3738 files changed, 331497 insertions, 159108 deletions

diff --git a/src/3rdparty/webkit/.gitattributes b/src/3rdparty/webkit/.gitattributes
deleted file mode 100644
index 5b43bd0..0000000
--- a/src/3rdparty/webkit/.gitattributes
+++ /dev/null
@@ -1,4 +0,0 @@
-# To enable automatic merging of ChangeLog files, use the following command:
-# git config merge.changelog.driver "resolve-ChangeLogs --merge-driver %O %A %B"
-ChangeLog* merge=changelog
-
diff --git a/src/3rdparty/webkit/.gitignore b/src/3rdparty/webkit/.gitignore
deleted file mode 100644
index b9595b3..0000000
--- a/src/3rdparty/webkit/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-*.mode*
-*.pbxuser
-*.perspective*
-*.pyc
-build/
-/WebKitBuild/
diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
new file mode 100644
index 0000000..fff71f4
--- /dev/null
+++ b/src/3rdparty/webkit/.tag
@@ -0,0 +1 @@
+6e15c3404d15a8ab72242152ec966e5e388161a2
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 57cb0de..f438655 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,392 @@
+2010-09-24  Romain Pokrzywka  <romain@kdab.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the Wince build.
+
+        * WebKit.pri: Apply msvc flags to wince, too.
+
+2010-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Laszlo Gombos.
+
+        [Qt][Symbian] Bumped up the maximum heap size to 96MB
+
+        * WebKit.pri:
+
+2010-06-17  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Upstream the WebKit QML integration plugin
+        https://bugs.webkit.org/show_bug.cgi?id=40050
+
+        Add to the build the QML WebKit integration plugin.
+
+        * WebKit.pro:
+
+2010-06-17  Mark Brand  <mabrand@mabrand.nl>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] use "win32-g++*" scope to match all MinGW makespecs
+
+        The scope "win32-g++" comes from the name of the makespec. However, it
+        is frequently used to check for MinGW. This works fine as long as
+        win32-g++ is the only makespec for MinGW. Now we need the wildcard
+        to cover "win32-g++-cross" as well.
+
+        * WebKit.pri:
+
+2010-05-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix for Symbian.
+
+        [Symbian] Symbian builds does not support shadow builds
+
+        Revision r54715 broke the Symbian build. For Symbian
+        the include directory is generated in the root of the source tree.
+        This patch sets the INCLUDEPATH accordingly for Symbian.
+
+        * WebKit.pri:
+
+2010-05-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Rename QtLauncher to QtTestBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=37665
+
+        * WebKit.pro:
+
+2010-05-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Detect debug mode consistently
+        https://bugs.webkit.org/show_bug.cgi?id=38863
+
+        * WebKit.pri:
+
+2010-04-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed crash fix.
+
+        Revert part of 57320 that would remove NDEBUG in release builds for
+        DRT, etc.
+
+        * WebKit.pri:
+
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crashes with package builds in release
+
+        * WebKit.pri: Don't randomly add NDEBUG to the defines.
+
+2010-04-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix trunk (non-standalone) builds for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=37136
+
+        Test for source files before building instead of relying on
+        standalone_package config.
+
+        * WebKit.pro:
+
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * WebKit.pro:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Update library version for 1.1.90 release.
+
+        * configure.ac:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version for 1.1.90 release.
+
+        * configure.ac:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add support for Fast Mobile Scrolling in the build system.
+
+        * configure.ac:
+
+2010-03-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Add WebKitTools/TestResultServer/index.yaml to gitattributes to ignore for crlf conversion.
+
+        * .gitattributes:
+
+2010-03-12  Scott Byer  <scottbyer@chromium.org>
+
+        Reviewed by David Levin.
+
+        Popup font size needs to be exposed to clients.
+        https://bugs.webkit.org/show_bug.cgi?id=35990
+
+        Add function to expose the popup menu font size, add a field to
+        WebPopupMenuInfo that receives that information to convey that to
+        the web view client's createPopupMenu() call.
+
+        * WebCore/platform/chromium/PopupMenuChromium.cpp:
+        * WebCore/platform/chromium/PopupMenuChromium.h:
+        * WebKit/chromium/public/WebPopupMenuInfo.h:
+        * WebKit/chromium/src/ChromeClientImpl.cpp:
+
+2010-03-11  Adam Roben  <aroben@apple.com>
+
+        Teach git about ObjC files
+
+        Fixes <http://webkit.org/b/36015>.
+
+        Reviewed by Tim Hatcher.
+
+        * .gitattributes: Set the diff attribute for .m and .mm files, and .h
+        files in Mac-specific directories. This can be used to generate
+        more-readable diffs of ObjC files.
+
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Versioning for 1.1.23.
+
+        * configure.ac:
+
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed distcheck fix.
+
+        * GNUmakefile.am:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+
+        * configure.ac:
+
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35726
+        Remove orphaned #ifdef WTF_USE_GLIB_ICU_UNICODE_HYBRID
+
+        Removing orphaned #if USE.
+
+        * GNUmakefile.am:
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+
+        * WebKit.pri:
+
+2010-03-03  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Xan Lopez.
+
+        Miscellaneous little fixes for the windows build of webkit-gtk
+        https://bugs.webkit.org/show_bug.cgi?id=35640
+
+        * GNUmakefile.am: On Windows with GCC, presence of
+        __declspec(dllexport) on some symbols disables the autoexport/autoimport
+        feature for all others. Using regex here assures that all symbols that 
+        need to be exported in the dll are actually exported.
+
+2010-03-02  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] implements ChromeClient::requestGeolocationPermissionForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=35210
+
+        * GNUmakefile.am:
+
+2010-03-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ignore compiled Java test cases in .gitignore.
+        https://bugs.webkit.org/show_bug.cgi?id=35559
+
+        * .gitignore:
+
+2010-02-26  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] ignore WebKit/gtk/docs/GNUmakefile.in in .gitignore
+        https://bugs.webkit.org/show_bug.cgi?id=35424
+
+        * .gitignore:
+
+2010-02-24  Sam Kerner  <skerner@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Expose WebFrame::setCanHaveScrollbars().  This allows a view
+        which is being resized to not need scroll bars to ensure that
+        they are not drawn.
+
+        Existing function setAllowsScrolling() was renamed
+        setCanHaveScrollbars(), to be consistant with change 37159:
+        http://trac.webkit.org/changeset/37159
+
+        https://bugs.webkit.org/show_bug.cgi?id=35257
+
+        * WebKit/chromium/public/WebFrame.h:
+        * WebKit/chromium/src/ChromeClientImpl.cpp:
+        * WebKit/chromium/src/WebFrameImpl.cpp:
+        * WebKit/chromium/src/WebFrameImpl.h:
+
+2010-02-19  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=35292
+
+        * WebKit.pro:
+
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Enable SharedWorkers by default, since that's been the default for
+        a long time in our build-webkit configuration.
+
+        * configure.ac:
+
+2010-02-23  James Choi  <jchoi42@pha.jhu.edu>
+
+        Add Solaris definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35214
+
+        * WebKit/chromium/src/WebViewImpl.cpp
+        * WebKit/chromium/src/WebFrameImpl.cpp
+
+2010-02-23  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk]: testwebview does not work when called with absolute path
+        https://bugs.webkit.org/show_bug.cgi?id=34940
+
+        When testwebview is called as absolute path, chdir to executable
+        directory before searching resource files.
+
+        * GNUmakefile.am:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Fixes references to GOwnPtr and GRefPtr so the GTK+ port builds
+        again.
+        http://webkit.org/b/35084
+
+        * GNUmakefile.am:
+
+2010-02-23  Diego Escalante Urrelo  <descalante@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [gtk] missing libsoup-2.4 package in gir generation
+        https://bugs.webkit.org/show_bug.cgi?id=35199
+
+        Include libsoup-2.4 package in gobject introspection .gir generation.
+
+        * GNUmakefile.am:
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+
+2010-02-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump library versioning for 1.1.22 release.
+
+        * configure.ac:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add support for layout tests on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31589
+
+        * WebKit.pro:
+
+2010-02-20  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] ENABLE_3D_RENDERING should be optional
+        https://bugs.webkit.org/show_bug.cgi?id=35100
+
+        * WebKit.pri: ENABLE_3D_RENDERING moved to a proper feature test
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * configure.ac:
+
 2010-02-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Eric Seidel.
@@ -6,6 +395,571 @@
 
         * .gitattributes: Added.
 
+2010-02-17  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] GraphicsLayer: support perspective and 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=34960
+
+        * WebKit.pri: added appropriate define: ENABLED_3D_RENDERING
+
+2010-02-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GStreamer] Should handle BUFFERING messages
+        https://bugs.webkit.org/show_bug.cgi?id=30004
+
+        * configure.ac: Bump gstreamer -core/-plugins-base requirements to
+        0.10.25 which is the minimum required version for on-disk buffering.
+
+2010-02-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version to 1.1.22 so we can depend on it in applications.
+
+        * configure.ac:
+
+2010-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Removed WMLInputElement.* from .gitattributes as the file is
+        now CRLF clean.
+
+        * .gitattributes:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
+
+        * WebKit.pri:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Manually add support for the install target on Symbian.
+
+        This is required to copy the headers over the ones in Qt.
+
+        * WebKit.pro:
+
+2010-02-11  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Detect properly different versions of libpng out there.
+
+        * configure.ac:
+
+2010-02-11  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix GTK+ build.
+
+        * configure.ac:
+
+2010-02-11  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Adjust gstreamer-plugins-base minimum version check (from 0.10 to 0.10.23).
+
+        * configure.ac:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * configure.ac:
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Bump version to 1.1.21, and adjust library versioning accordingly.
+
+        * configure.ac:
+
+2010-02-05  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        Add gstreamer-app-0.10 to configure.ac
+        https://bugs.webkit.org/show_bug.cgi?id=34317
+
+        * configure.ac:
+
+2010-02-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add .gitattributes file to tell git about files with Windows linefeeds
+        https://bugs.webkit.org/show_bug.cgi?id=34645
+
+        On Windows git defaults to "true" for core.autocrlf, meaning all text
+        files in the working directory are converted from CRLF to LF on checkin
+        time. Some files present in the repository have been checked in with
+        CRLF linefeeds and git should not try to convert them. The added
+        .gitattributes file tells git to not do any CRLF conversion.
+
+        * .gitattributes: Added.
+
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
+
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
+
+        These extra headers are installed alongside the normal headers.
+
+        * DerivedSources.pro: Include API-DerivedSources
+
+2010-02-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Make 'make -f Makefile.DerivedSources qmake' work
+
+        Previously this target ended up generating a file named
+        Makefile.DerivedSources.DerivedSources, and so on.
+
+        * DerivedSources.pro:
+
+2010-02-04  Christian Dywan  <christian@twotasts.de>
+
+        Reviewed by Xan Lopez.
+
+        Require either libsoup 2.28.2 or 2.29.90.
+
+        * configure.ac:
+
+2010-02-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump minimum libsoup requirement to 2.29.90
+
+        * configure.ac:
+
+2010-02-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Bump version, and adjust library versioning for 1.1.20.
+
+        * configure.ac:
+
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        A first step towards the Indexed Database API
+        https://bugs.webkit.org/show_bug.cgi?id=34342
+
+        Add Indexed Database API
+
+        * configure.ac:
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Don't build the tests in packages, only the launcher(s)
+
+        * WebKit.pro:
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add the "d" suffix to QtWebKit's dll on Windows.
+
+        * WebKit.pri:
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Unreviewed build fix
+
+        [Qt] Build fix for windows when QTDIR contains release libraries.
+
+        * WebKit.pri: Use the <name>.lib syntax for linking instead of qmake's -l<name> emulation
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * WebKit.pro:
+
+2010-01-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix the build on Maemo5.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34051
+
+        * WebKit.pri: Disable the use of uitools, just like it's done for Symbian.
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        * WebKit.pri: Addded compile flags to enable accelerated compositing
+        on versions higher than 4.5
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make DumpRenderTree build on Windows
+
+        * WebKit.pro:
+
+2010-01-20  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the recursive generated_files target to work with qmake -r -o
+
+        * DerivedSources.pro:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make it possible (on *nix at least) to recursively call "make generated_files"
+
+        * DerivedSources.pro:
+
+2010-01-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Shared library versioning update for 1.1.19.
+
+        * configure.ac:
+
+2010-01-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Bump version to 1.1.19.
+
+        * configure.ac:
+
+2010-01-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Defective dependencies caused build failing on QtBuildBot.
+        https://bugs.webkit.org/show_bug.cgi?id=33693
+
+        * WebKit.pri: CONFIG += depend_includepath added.
+
+2010-01-14  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Moves general includes before bindings includes in Android build system.
+        https://bugs.webkit.org/show_bug.cgi?id=33623
+
+        This avoids problems with collisions between WebCore/platform/text/StringBuilder.h
+        and the new JavaScriptCore/runtime/StringBuilder.h. This change puts
+        JavaScriptCore/runtime and other bindings includes after the WebCore and other
+        general includes, so that the WebCore StringBuilder.h is picked up when building
+        WebCore.
+
+        * Android.mk: Modified.
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * WebKit.pri:
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * configure.ac:
+
+2010-01-05  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Based on idea and original patch by Evan Martin.
+
+        Remove libWebCore intermediate library, to improve link time.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2010-01-05  Xan Lopez  <xlopez@igalia.com>
+
+        Bump for 1.1.18 release.
+
+        * configure.ac:
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Fix JSCore-1.0.gir path to fix make distcheck.
+
+        * GNUmakefile.am:
+
+2010-01-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix standalone package builds.
+
+        * WebKit.pri: Add logic for detecting standalone builds. Set OUTPUT_DIR to the top-level dir in that case.
+        * WebKit.pro: Don't build JSC and DRT for package builds.
+
+2010-01-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool should not require users to install mechanize
+        https://bugs.webkit.org/show_bug.cgi?id=32635
+
+        * .gitignore: Ignore autoinstall.cache.d directory created by autoinstall.py
+
+2009-12-28  Estêvão Samuel Procópio  <tevaum@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Bug 32940: [GTK] Changing the download throttle conditions.
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        The WebKitDownload progress notification was taking long to
+        update. This fix makes notification happens each 0.7 secs
+        or when the progress ups in 1%.
+
+        * WebKit/gtk/webkit/webkitdownload.cpp:
+
+2009-12-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Adjusted path to QtLauncher.
+
+        * WebKit.pro:
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a couple of WebKitGtk files to .gitignore.
+
+        * .gitignore:
+
+2009-12-18  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] RemoveDashboard support. It's useless.
+
+        * configure.ac:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * WebKit.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Content-Encoding support
+
+        https://bugs.webkit.org/show_bug.cgi?id=522772
+
+        * configure.ac: require libsoup 2.28.2 for SoupContentDecoder
+
+2009-12-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        string-base64 test does not compute a valid base64 string
+        http://bugs.webkit.org/show_bug.cgi?id=16806
+
+        * tests/string-base64.js: change str[i] to str.charCodeAt(i)
+
+2009-12-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Should provide an API to control the IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=32334
+
+        Add test to make sure favicon reporting works.
+
+        * GNUmakefile.am:
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified. Includes Makefiles for V8.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * configure.ac: Require only libSoup 2.27.91 but check for 2.29.3
+        and define HAVE_LIBSOUP_2_29_3 in that case.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Late post-release version bump.
+
+        * configure.ac:
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Removing hybrid configuration for --with-unicode-backend=glib
+        ICU not required anymore.
+
+        * autotools/webkit.m4:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Gtk.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * configure.ac:
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * configure.ac:
+
+2009-12-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Build the new API test.
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        * GNUmakefile.am:
+
+2009-12-05  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixes race for builds with introspection enabled, and parallel
+        make.
+
+        * GNUmakefile.am:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Bump libsoup required version to 2.29.3 for DNS prefetching.
+
+        * configure.ac:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Make sure we distribute and install GObject Introspection files.
+
+        * GNUmakefile.am:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix. Make sure JSCore-1.0.gir is added to the distributed
+        tarball.
+
+        * GNUmakefile.am:
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump versions for 1.1.17 release.
+
+        * configure.ac:
+
 2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -16,6 +970,110 @@
 
         * WebKit.pri:
 
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Add JavaScriptCore/wtf/gtk to 
+          the include path.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * configure.ac:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * LayoutTests/fast/js/regexp-in-and-foreach-handling.html: Added.
+        * LayoutTests/fast/js/script-tests/regexp-in-and-foreach-handling.js: Added.
+        * LayoutTests/fast/js/regexp-in-and-foreach-handling-expected.txt: Added.
+
+2009-11-24  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ignore Chromium's Xcode projects that are auto-generated from .gyp files.
+        https://bugs.webkit.org/show_bug.cgi?id=31847
+        
+        * .gitignore:  Add three .xcodeproj files.
+
+2009-11-09  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Gtk] Build from tarball fails with --enable-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=31261
+
+        We need to enable gobject-introspection during distcheck otherwise
+        some of the required files are missing in tarball.
+
+        * GNUmakefile.am:
+
+2009-11-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Build failure with --enable-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=31102
+
+        Add search and include paths for JSCore-1.0.gir required by
+        gobject-introspection tools.
+
+        * GNUmakefile.am:
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * configure.ac:
+
+2009-11-02  Estêvão Samuel Procópio  <tevaum@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Build] make install ignores --prefix option for gobject-introspection.
+        https://bugs.webkit.org/show_bug.cgi?id=31025
+
+        Make the build system use the --prefix path also when installing
+        gobject-introspection files.
+
+        * configure.ac: use --prefix path in GITDIR and GIRTYPELIBDIR
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version before release (or post-release, depending on your
+        point of view) so that we can make applications depending on
+        unreleased APIs in WebKit svn fail at configure time when the
+        requirements are not met.
+
+        * configure.ac:
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        * WebKit.pri: Turn on warnings for the GCC compiler
+
 2009-10-30  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Mark Rowe.
@@ -30,6 +1088,19 @@
 
         * .gitignore: Added.
 
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * configure.ac:
+
 2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Rubber-stamped by Darin Adler.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index b9167a8..ba00d02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -29,7 +29,6 @@
 #include "JSAPIValueWrapper.h"
 #include "JSGlobalObject.h"
 #include "JSValue.h"
-#include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
 
 namespace JSC {
@@ -51,16 +50,20 @@ typedef struct OpaqueJSValue* JSObjectRef;
 
 inline JSC::ExecState* toJS(JSContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(const_cast<OpaqueJSContext*>(c));
 }
 
 inline JSC::ExecState* toJS(JSGlobalContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
 #if USE(JSVALUE32_64)
     JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
     if (!jsCell)
@@ -73,6 +76,20 @@ inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
 #endif
 }
 
+inline JSC::JSValue toJSForGC(JSC::ExecState* exec, JSValueRef v)
+{
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    return jsCell;
+#else
+    return JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+}
+
 inline JSC::JSObject* toJS(JSObjectRef o)
 {
     return reinterpret_cast<JSC::JSObject*>(o);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h b/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h
new file mode 100644
index 0000000..9a6cacb
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef APIShims_h
+#define APIShims_h
+
+#include "CallFrame.h"
+#include "JSLock.h"
+
+namespace JSC {
+
+class APIEntryShimWithoutLock {
+protected:
+    APIEntryShimWithoutLock(JSGlobalData* globalData, bool registerThread)
+        : m_globalData(globalData)
+        , m_entryIdentifierTable(setCurrentIdentifierTable(globalData->identifierTable))
+    {
+        if (registerThread)
+            globalData->heap.registerThread();
+        m_globalData->timeoutChecker.start();
+    }
+
+    ~APIEntryShimWithoutLock()
+    {
+        m_globalData->timeoutChecker.stop();
+        setCurrentIdentifierTable(m_entryIdentifierTable);
+    }
+
+private:
+    JSGlobalData* m_globalData;
+    IdentifierTable* m_entryIdentifierTable;
+};
+
+class APIEntryShim : public APIEntryShimWithoutLock {
+public:
+    // Normal API entry
+    APIEntryShim(ExecState* exec, bool registerThread = true)
+        : APIEntryShimWithoutLock(&exec->globalData(), registerThread)
+        , m_lock(exec)
+    {
+    }
+
+    // JSPropertyNameAccumulator only has a globalData.
+    APIEntryShim(JSGlobalData* globalData, bool registerThread = true)
+        : APIEntryShimWithoutLock(globalData, registerThread)
+        , m_lock(globalData->isSharedInstance ? LockForReal : SilenceAssertionsOnly)
+    {
+    }
+
+private:
+    JSLock m_lock;
+};
+
+class APICallbackShim {
+public:
+    APICallbackShim(ExecState* exec)
+        : m_dropAllLocks(exec)
+        , m_globalData(&exec->globalData())
+    {
+        resetCurrentIdentifierTable();
+    }
+
+    ~APICallbackShim()
+    {
+        setCurrentIdentifierTable(m_globalData->identifierTable);
+    }
+
+private:
+    JSLock::DropAllLocks m_dropAllLocks;
+    JSGlobalData* m_globalData;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
index 4a32d35..ebfeafa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
@@ -28,6 +28,7 @@
 #include "JSBasePrivate.h"
 
 #include "APICast.h"
+#include "APIShims.h"
 #include "Completion.h"
 #include "OpaqueJSString.h"
 #include "SourceCode.h"
@@ -43,8 +44,7 @@ using namespace JSC;
 JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef thisObject, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsThisObject = toJS(thisObject);
 
@@ -69,8 +69,7 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     SourceCode source = makeSource(script->ustring(), sourceURL->ustring(), startingLineNumber);
     Completion completion = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source);
@@ -94,12 +93,11 @@ void JSGarbageCollect(JSContextRef ctx)
         return;
 
     ExecState* exec = toJS(ctx);
-    JSGlobalData& globalData = exec->globalData();
-
-    JSLock lock(globalData.isSharedInstance ? LockForReal : SilenceAssertionsOnly);
+    APIEntryShim entryShim(exec, false);
 
+    JSGlobalData& globalData = exec->globalData();
     if (!globalData.heap.isBusy())
-        globalData.heap.collect();
+        globalData.heap.collectAllGarbage();
 
     // FIXME: Perhaps we should trigger a second mark and sweep
     // once the garbage collector is done if this is called when
@@ -109,8 +107,6 @@ void JSGarbageCollect(JSContextRef ctx)
 void JSReportExtraMemoryCost(JSContextRef ctx, size_t size)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
-
+    APIEntryShim entryShim(exec);
     exec->globalData().heap.reportExtraMemoryCost(size);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
index d1ce9b3..2e16720 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
@@ -65,27 +65,15 @@ typedef struct OpaqueJSValue* JSObjectRef;
 /* JavaScript symbol exports */
 
 #undef JS_EXPORT
-#if defined(BUILDING_WX__)
+#if defined(JS_NO_EXPORT)
     #define JS_EXPORT
 #elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
     #define JS_EXPORT __attribute__((visibility("default")))
-#elif defined(_WIN32_WCE)
-    #if defined(JS_BUILDING_JS)
-        #define JS_EXPORT __declspec(dllexport)
-    #elif defined(JS_IMPORT_JS)
-        #define JS_EXPORT __declspec(dllimport)
-    #else
-        #define JS_EXPORT
-    #endif
-#elif defined(WIN32) || defined(_WIN32)
-    /*
-     * TODO: Export symbols with JS_EXPORT when using MSVC.
-     * See http://bugs.webkit.org/show_bug.cgi?id=16227
-     */
+#elif defined(WIN32) || defined(_WIN32) || defined(_WIN32_WCE)
     #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
-    #define JS_EXPORT __declspec(dllexport)
+        #define JS_EXPORT __declspec(dllexport)
     #else
-    #define JS_EXPORT __declspec(dllimport)
+        #define JS_EXPORT __declspec(dllimport)
     #endif
 #else
     #define JS_EXPORT
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
index 1c33962..9c5f6d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSCallbackConstructor.h"
 
+#include "APIShims.h"
 #include "APICast.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
@@ -66,7 +67,7 @@ static JSObject* constructJSCallback(ExecState* exec, JSObject* constructor, con
         JSValueRef exception = 0;
         JSObjectRef result;
         {
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
         }
         if (exception)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index c4bd7ad..e529947 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,7 +41,7 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
 
 protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
index b7dd768..63c8add 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -24,9 +24,9 @@
  */
 
 #include "config.h"
-#include <wtf/Platform.h>
 #include "JSCallbackFunction.h"
 
+#include "APIShims.h"
 #include "APICast.h"
 #include "CodeBlock.h"
 #include "JSFunction.h"
@@ -61,7 +61,7 @@ JSValue JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSVa
     JSValueRef exception = 0;
     JSValueRef result;
     {
-        JSLock::DropAllLocks dropAllLocks(exec);
+        APICallbackShim callbackShim(exec);
         result = static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
     }
     if (exception)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 0cf25c4..10dae6b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index d19890a..1cf7a02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -33,6 +33,84 @@
 
 namespace JSC {
 
+struct JSCallbackObjectData {
+    JSCallbackObjectData(void* privateData, JSClassRef jsClass)
+        : privateData(privateData)
+        , jsClass(jsClass)
+    {
+        JSClassRetain(jsClass);
+    }
+    
+    ~JSCallbackObjectData()
+    {
+        JSClassRelease(jsClass);
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        if (!m_privateProperties)
+            return JSValue();
+        return m_privateProperties->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    {
+        if (!m_privateProperties)
+            m_privateProperties.set(new JSPrivatePropertyMap);
+        m_privateProperties->setPrivateProperty(propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->deletePrivateProperty(propertyName);
+    }
+
+    void markChildren(MarkStack& markStack)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->markChildren(markStack);
+    }
+
+    void* privateData;
+    JSClassRef jsClass;
+    struct JSPrivatePropertyMap {
+        JSValue getPrivateProperty(const Identifier& propertyName) const
+        {
+            PrivatePropertyMap::const_iterator location = m_propertyMap.find(propertyName.ustring().rep());
+            if (location == m_propertyMap.end())
+                return JSValue();
+            return location->second;
+        }
+        
+        void setPrivateProperty(const Identifier& propertyName, JSValue value)
+        {
+            m_propertyMap.set(propertyName.ustring().rep(), value);
+        }
+        
+        void deletePrivateProperty(const Identifier& propertyName)
+        {
+            m_propertyMap.remove(propertyName.ustring().rep());
+        }
+
+        void markChildren(MarkStack& markStack)
+        {
+            for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) {
+                if (ptr->second)
+                    markStack.append(ptr->second);
+            }
+        }
+
+    private:
+        typedef HashMap<RefPtr<UString::Rep>, JSValue, IdentifierRepHash> PrivatePropertyMap;
+        PrivatePropertyMap m_propertyMap;
+    };
+    OwnPtr<JSPrivatePropertyMap> m_privateProperties;
+};
+
+    
 template <class Base>
 class JSCallbackObject : public Base {
 public:
@@ -50,7 +128,22 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount); 
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        return m_callbackObjectData->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    {
+        m_callbackObjectData->setPrivateProperty(propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        m_callbackObjectData->deletePrivateProperty(propertyName);
     }
 
 protected:
@@ -61,6 +154,7 @@ private:
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     
     virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
@@ -69,7 +163,7 @@ private:
 
     virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
-    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     virtual double toNumber(ExecState*) const;
     virtual UString toString(ExecState*) const;
@@ -78,6 +172,12 @@ private:
     virtual CallType getCallData(CallData&);
     virtual const ClassInfo* classInfo() const { return &info; }
 
+    virtual void markChildren(MarkStack& markStack)
+    {
+        Base::markChildren(markStack);
+        m_callbackObjectData->markChildren(markStack);
+    }
+
     void init(ExecState*);
  
     static JSCallbackObject* asCallbackObject(JSValue);
@@ -85,27 +185,10 @@ private:
     static JSValue JSC_HOST_CALL call(ExecState*, JSObject* functionObject, JSValue thisValue, const ArgList&);
     static JSObject* construct(ExecState*, JSObject* constructor, const ArgList&);
    
-    static JSValue staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
-
-    struct JSCallbackObjectData {
-        JSCallbackObjectData(void* privateData, JSClassRef jsClass)
-            : privateData(privateData)
-            , jsClass(jsClass)
-        {
-            JSClassRetain(jsClass);
-        }
-        
-        ~JSCallbackObjectData()
-        {
-            JSClassRelease(jsClass);
-        }
-        
-        void* privateData;
-        JSClassRef jsClass;
-    };
-    
+    static JSValue staticValueGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue staticFunctionGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue callbackGetter(ExecState*, JSValue, const Identifier&);
+
     OwnPtr<JSCallbackObjectData> m_callbackObjectData;
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 9b726e8..6c83eb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "APIShims.h"
 #include "APICast.h"
 #include "Error.h"
 #include "JSCallbackFunction.h"
@@ -79,7 +80,7 @@ void JSCallbackObject<Base>::init(ExecState* exec)
     
     // initialize from base to derived
     for (int i = static_cast<int>(initRoutines.size()) - 1; i >= 0; i--) {
-        JSLock::DropAllLocks dropAllLocks(exec);
+        APICallbackShim callbackShim(exec);
         JSObjectInitializeCallback initialize = initRoutines[i];
         initialize(toRef(exec), toRef(this));
     }
@@ -117,7 +118,7 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
         if (JSObjectHasPropertyCallback hasProperty = jsClass->hasProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             if (hasProperty(ctx, thisRef, propertyNameRef.get())) {
                 slot.setCustom(this, callbackGetter);
                 return true;
@@ -128,18 +129,18 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
-            if (value) {
-                slot.setValue(toJS(exec, value));
-                return true;
-            }
             if (exception) {
+                exec->setException(toJS(exec, exception));
                 slot.setValue(jsUndefined());
                 return true;
             }
+            if (value) {
+                slot.setValue(toJS(exec, value));
+                return true;
+            }
         }
         
         if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
@@ -167,6 +168,25 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, unsigned proper
 }
 
 template <class Base>
+bool JSCallbackObject<Base>::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    PropertySlot slot;
+    if (getOwnPropertySlot(exec, propertyName, slot)) {
+        // Ideally we should return an access descriptor, but returning a value descriptor is better than nothing.
+        JSValue value = slot.getValue(exec, propertyName);
+        if (!exec->hadException())
+            descriptor.setValue(value);
+        // We don't know whether the property is configurable, but assume it is.
+        descriptor.setConfigurable(true);
+        // We don't know whether the property is enumerable (we could call getOwnPropertyNames() to find out), but assume it isn't.
+        descriptor.setEnumerable(false);
+        return true;
+    }
+
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+template <class Base>
 void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSContextRef ctx = toRef(exec);
@@ -181,10 +201,11 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return;
         }
@@ -199,10 +220,11 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                     JSValueRef exception = 0;
                     bool result;
                     {
-                        JSLock::DropAllLocks dropAllLocks(exec);
+                        APICallbackShim callbackShim(exec);
                         result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception)
+                        exec->setException(toJS(exec, exception));
                     if (result || exception)
                         return;
                 } else
@@ -237,10 +259,11 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return true;
         }
@@ -298,10 +321,11 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
             JSValueRef exception = 0;
             JSObject* result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -322,10 +346,11 @@ bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = hasInstance(execRef, thisRef, valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -360,10 +385,11 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
             JSValueRef exception = 0;
             JSValue result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -373,14 +399,14 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
 }
 
 template <class Base>
-void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectGetPropertyNamesCallback getPropertyNames = jsClass->getPropertyNames) {
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             getPropertyNames(execRef, thisRef, toRef(&propertyNames));
         }
         
@@ -390,7 +416,7 @@ void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameAr
             for (iterator it = staticValues->begin(); it != end; ++it) {
                 UString::Rep* name = it->first.get();
                 StaticValueEntry* entry = it->second;
-                if (entry->getProperty && !(entry->attributes & kJSPropertyAttributeDontEnum))
+                if (entry->getProperty && (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties)))
                     propertyNames.add(Identifier(exec, name));
             }
         }
@@ -401,13 +427,13 @@ void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameAr
             for (iterator it = staticFunctions->begin(); it != end; ++it) {
                 UString::Rep* name = it->first.get();
                 StaticFunctionEntry* entry = it->second;
-                if (!(entry->attributes & kJSPropertyAttributeDontEnum))
+                if (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties))
                     propertyNames.add(Identifier(exec, name));
             }
         }
     }
     
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 template <class Base>
@@ -426,7 +452,7 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
             }
             if (exception) {
@@ -435,7 +461,8 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             }
 
             double dValue;
-            return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            if (value)
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
         }
             
     return Base::toNumber(exec);
@@ -452,14 +479,15 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = convertToType(ctx, thisRef, kJSTypeString, &exception);
             }
             if (exception) {
                 exec->setException(toJS(exec, exception));
                 return "";
             }
-            return toJS(exec, value).getString();
+            if (value)
+                return toJS(exec, value).getString(exec);
         }
             
     return Base::toString(exec);
@@ -488,9 +516,9 @@ bool JSCallbackObject<Base>::inherits(JSClassRef c) const
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     JSObjectRef thisRef = toRef(thisObj);
     RefPtr<OpaqueJSString> propertyNameRef;
@@ -504,23 +532,24 @@ JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identif
                     JSValueRef exception = 0;
                     JSValueRef value;
                     {
-                        JSLock::DropAllLocks dropAllLocks(exec);
+                        APICallbackShim callbackShim(exec);
                         value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception) {
+                        exec->setException(toJS(exec, exception));
+                        return jsUndefined();
+                    }
                     if (value)
                         return toJS(exec, value);
-                    if (exception)
-                        return jsUndefined();
                 }
-                    
+
     return throwError(exec, ReferenceError, "Static value property defined with NULL getProperty callback.");
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     // Check for cached or override property.
     PropertySlot slot2(thisObj);
@@ -543,9 +572,9 @@ JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Iden
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     JSObjectRef thisRef = toRef(thisObj);
     RefPtr<OpaqueJSString> propertyNameRef;
@@ -557,14 +586,15 @@ JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception) {
+                exec->setException(toJS(exec, exception));
+                return jsUndefined();
+            }
             if (value)
                 return toJS(exec, value);
-            if (exception)
-                return jsUndefined();
         }
             
     return throwError(exec, ReferenceError, "hasProperty callback returned true for a property that doesn't exist.");
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
index 3785bab..3c2133d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
@@ -33,11 +33,28 @@
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 #include <runtime/Identifier.h>
+#include <wtf/unicode/UTF8.h>
 
+using namespace std;
 using namespace JSC;
+using namespace WTF::Unicode;
 
 const JSClassDefinition kJSClassDefinitionEmpty = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 
+static inline UString tryCreateStringFromUTF8(const char* string)
+{
+    if (!string)
+        return UString::null();
+
+    size_t length = strlen(string);
+    Vector<UChar, 1024> buffer(length);
+    UChar* p = buffer.data();
+    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
+        return UString::null();
+
+    return UString(buffer.data(), p - buffer.data());
+}
+
 OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass* protoClass) 
     : parentClass(definition->parentClass)
     , prototypeClass(0)
@@ -52,7 +69,7 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     , callAsConstructor(definition->callAsConstructor)
     , hasInstance(definition->hasInstance)
     , convertToType(definition->convertToType)
-    , m_className(UString::Rep::createFromUTF8(definition->className))
+    , m_className(tryCreateStringFromUTF8(definition->className))
     , m_staticValues(0)
     , m_staticFunctions(0)
 {
@@ -61,8 +78,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticValue* staticValue = definition->staticValues) {
         m_staticValues = new OpaqueJSClassStaticValuesTable();
         while (staticValue->name) {
-            StaticValueEntry* e = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
-            m_staticValues->add(UString::Rep::createFromUTF8(staticValue->name), e);
+            UString valueName = tryCreateStringFromUTF8(staticValue->name);
+            if (!valueName.isNull()) {
+                // Use a local variable here to sidestep an RVCT compiler bug.
+                StaticValueEntry* entry = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
+                UStringImpl* impl = valueName.rep();
+                impl->ref();
+                m_staticValues->add(impl, entry);
+            }
             ++staticValue;
         }
     }
@@ -70,8 +93,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticFunction* staticFunction = definition->staticFunctions) {
         m_staticFunctions = new OpaqueJSClassStaticFunctionsTable();
         while (staticFunction->name) {
-            StaticFunctionEntry* e = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
-            m_staticFunctions->add(UString::Rep::createFromUTF8(staticFunction->name), e);
+            UString functionName = tryCreateStringFromUTF8(staticFunction->name);
+            if (!functionName.isNull()) {
+                // Use a local variable here to sidestep an RVCT compiler bug.
+                StaticFunctionEntry* entry = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
+                UStringImpl* impl = functionName.rep();
+                impl->ref();
+                m_staticFunctions->add(impl, entry);
+            }
             ++staticFunction;
         }
     }
@@ -82,12 +111,13 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
 
 OpaqueJSClass::~OpaqueJSClass()
 {
-    ASSERT(!m_className.rep()->identifierTable());
+    // The empty string is shared across threads & is an identifier, in all other cases we should have done a deep copy in className(), below. 
+    ASSERT(!m_className.size() || !m_className.rep()->isIdentifier());
 
     if (m_staticValues) {
         OpaqueJSClassStaticValuesTable::const_iterator end = m_staticValues->end();
         for (OpaqueJSClassStaticValuesTable::const_iterator it = m_staticValues->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
+            ASSERT(!it->first->isIdentifier());
             delete it->second;
         }
         delete m_staticValues;
@@ -96,7 +126,7 @@ OpaqueJSClass::~OpaqueJSClass()
     if (m_staticFunctions) {
         OpaqueJSClassStaticFunctionsTable::const_iterator end = m_staticFunctions->end();
         for (OpaqueJSClassStaticFunctionsTable::const_iterator it = m_staticFunctions->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
+            ASSERT(!it->first->isIdentifier());
             delete it->second;
         }
         delete m_staticFunctions;
@@ -115,56 +145,46 @@ static void clearReferenceToPrototype(JSObjectRef prototype)
 {
     OpaqueJSClassContextData* jsClassData = static_cast<OpaqueJSClassContextData*>(JSObjectGetPrivate(prototype));
     ASSERT(jsClassData);
-    jsClassData->cachedPrototype = 0;
+    jsClassData->cachedPrototype.clear(toJS(prototype));
 }
 
-PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* definition)
+PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* clientDefinition)
 {
-    if (const JSStaticFunction* staticFunctions = definition->staticFunctions) {
-        // copy functions into a prototype class
-        JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
-        protoDefinition.staticFunctions = staticFunctions;
-        protoDefinition.finalize = clearReferenceToPrototype;
-        
-        // We are supposed to use JSClassRetain/Release but since we know that we currently have
-        // the only reference to this class object we cheat and use a RefPtr instead.
-        RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
-
-        // remove functions from the original class
-        JSClassDefinition objectDefinition = *definition;
-        objectDefinition.staticFunctions = 0;
+    JSClassDefinition definition = *clientDefinition; // Avoid modifying client copy.
 
-        return adoptRef(new OpaqueJSClass(&objectDefinition, protoClass.get()));
-    }
-
-    return adoptRef(new OpaqueJSClass(definition, 0));
+    JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
+    protoDefinition.finalize = clearReferenceToPrototype;
+    swap(definition.staticFunctions, protoDefinition.staticFunctions); // Move static functions to the prototype.
+    
+    // We are supposed to use JSClassRetain/Release but since we know that we currently have
+    // the only reference to this class object we cheat and use a RefPtr instead.
+    RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
+    return adoptRef(new OpaqueJSClass(&definition, protoClass.get()));
 }
 
 OpaqueJSClassContextData::OpaqueJSClassContextData(OpaqueJSClass* jsClass)
     : m_class(jsClass)
-    , cachedPrototype(0)
 {
     if (jsClass->m_staticValues) {
         staticValues = new OpaqueJSClassStaticValuesTable;
         OpaqueJSClassStaticValuesTable::const_iterator end = jsClass->m_staticValues->end();
         for (OpaqueJSClassStaticValuesTable::const_iterator it = jsClass->m_staticValues->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
-            StaticValueEntry* e = new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes);
-            staticValues->add(UString::Rep::createCopying(it->first->data(), it->first->size()), e);
-
+            ASSERT(!it->first->isIdentifier());
+            // Use a local variable here to sidestep an RVCT compiler bug.
+            StaticValueEntry* entry = new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes);
+            staticValues->add(UString::Rep::create(it->first->characters(), it->first->length()), entry);
         }
-            
     } else
         staticValues = 0;
-        
 
     if (jsClass->m_staticFunctions) {
         staticFunctions = new OpaqueJSClassStaticFunctionsTable;
         OpaqueJSClassStaticFunctionsTable::const_iterator end = jsClass->m_staticFunctions->end();
         for (OpaqueJSClassStaticFunctionsTable::const_iterator it = jsClass->m_staticFunctions->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
-            StaticFunctionEntry* e = new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes);
-            staticFunctions->add(UString::Rep::createCopying(it->first->data(), it->first->size()), e);
+            ASSERT(!it->first->isIdentifier());
+            // Use a local variable here to sidestep an RVCT compiler bug.
+            StaticFunctionEntry* entry = new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes);
+            staticFunctions->add(UString::Rep::create(it->first->characters(), it->first->length()), entry);
         }
             
     } else
@@ -241,5 +261,5 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec)
                 jsClassData.cachedPrototype->setPrototype(prototype);
         }
     }
-    return jsClassData.cachedPrototype;
+    return jsClassData.cachedPrototype.get();
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
index c4777dd..ae60aad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
@@ -31,6 +31,7 @@
 #include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
+#include <runtime/WeakGCPtr.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
@@ -76,7 +77,7 @@ struct OpaqueJSClassContextData : Noncopyable {
 
     OpaqueJSClassStaticValuesTable* staticValues;
     OpaqueJSClassStaticFunctionsTable* staticFunctions;
-    JSC::JSObject* cachedPrototype;
+    JSC::WeakGCPtr<JSC::JSObject> cachedPrototype;
 };
 
 struct OpaqueJSClass : public ThreadSafeShared<OpaqueJSClass> {
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index e6626b7..9d4f38c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -33,9 +33,8 @@
 #include "JSClassRef.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
-#include <wtf/Platform.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include <mach-o/dyld.h>
 
 static const int32_t webkitFirstVersionWithConcurrentGlobalContexts = 0x2100500; // 528.5.0
@@ -46,7 +45,7 @@ using namespace JSC;
 JSContextGroupRef JSContextGroupCreate()
 {
     initializeThreading();
-    return toRef(JSGlobalData::create().releaseRef());
+    return toRef(JSGlobalData::createNonDefault().releaseRef());
 }
 
 JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group)
@@ -63,7 +62,7 @@ void JSContextGroupRelease(JSContextGroupRef group)
 JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 {
     initializeThreading();
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // When running on Tiger or Leopard, or if the application was linked before JSGlobalContextCreate was changed
     // to use a unique JSGlobalData, we use a shared one for compatibility.
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
@@ -74,7 +73,7 @@ JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
         JSLock lock(LockForReal);
         return JSGlobalContextCreateInGroup(toRef(&JSGlobalData::sharedInstance()), globalObjectClass);
     }
-#endif // PLATFORM(DARWIN)
+#endif // OS(DARWIN)
 
     return JSGlobalContextCreateInGroup(0, globalObjectClass);
 }
@@ -84,8 +83,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
     initializeThreading();
 
     JSLock lock(LockForReal);
+    RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::createNonDefault();
 
-    RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::create();
+    APIEntryShim entryShim(globalData.get(), false);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     globalData->makeUsableFromMultipleThreads();
@@ -108,12 +108,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 JSGlobalContextRef JSGlobalContextRetain(JSGlobalContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSGlobalData& globalData = exec->globalData();
-
-    globalData.heap.registerThread();
-
     gcProtect(exec->dynamicGlobalObject());
     globalData.ref();
     return ctx;
@@ -124,25 +121,39 @@ void JSGlobalContextRelease(JSGlobalContextRef ctx)
     ExecState* exec = toJS(ctx);
     JSLock lock(exec);
 
-    gcUnprotect(exec->dynamicGlobalObject());
-
     JSGlobalData& globalData = exec->globalData();
-    if (globalData.refCount() == 2) { // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
-        // The last reference was released, this is our last chance to collect.
-        ASSERT(!globalData.heap.protectedObjectCount());
-        ASSERT(!globalData.heap.isBusy());
+    JSGlobalObject* dgo = exec->dynamicGlobalObject();
+    IdentifierTable* savedIdentifierTable = setCurrentIdentifierTable(globalData.identifierTable);
+
+    // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
+    bool releasingContextGroup = globalData.refCount() == 2;
+    bool releasingGlobalObject = Heap::heap(dgo)->unprotect(dgo);
+    // If this is the last reference to a global data, it should also
+    // be the only remaining reference to the global object too!
+    ASSERT(!releasingContextGroup || releasingGlobalObject);
+
+    // An API 'JSGlobalContextRef' retains two things - a global object and a
+    // global data (or context group, in API terminology).
+    // * If this is the last reference to any contexts in the given context group,
+    //   call destroy on the heap (the global data is being  freed).
+    // * If this was the last reference to the global object, then unprotecting
+    //   it may  release a lot of GC memory - run the garbage collector now.
+    // * If there are more references remaining the the global object, then do nothing
+    //   (specifically that is more protects, which we assume come from other JSGlobalContextRefs).
+    if (releasingContextGroup)
         globalData.heap.destroy();
-    } else
-        globalData.heap.collect();
+    else if (releasingGlobalObject)
+        globalData.heap.collectAllGarbage();
 
     globalData.deref();
+
+    setCurrentIdentifierTable(savedIdentifierTable);
 }
 
 JSObjectRef JSContextGetGlobalObject(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     // It is necessary to call toThisObject to get the wrapper object when used with WebCore.
     return toRef(exec->lexicalGlobalObject()->toThisObject(exec));
@@ -157,8 +168,7 @@ JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
 JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
index 06ef578..8fdbdab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
@@ -26,6 +26,7 @@
 
 #include "config.h"
 #include "JSObjectRef.h"
+#include "JSObjectRefPrivate.h"
 
 #include "APICast.h"
 #include "CodeBlock.h"
@@ -48,7 +49,6 @@
 #include "ObjectPrototype.h"
 #include "PropertyNameArray.h"
 #include "RegExpConstructor.h"
-#include <wtf/Platform.h>
 
 using namespace JSC;
 
@@ -76,8 +76,7 @@ void JSClassRelease(JSClassRef jsClass)
 JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     if (!jsClass)
         return toRef(new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure())); // slightly more efficient
@@ -92,8 +91,7 @@ JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name, JSObjectCallAsFunctionCallback callAsFunction)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
@@ -103,8 +101,7 @@ JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name,
 JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
     if (!jsPrototype)
@@ -118,8 +115,7 @@ JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObje
 JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned parameterCount, const JSStringRef parameterNames[], JSStringRef body, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
@@ -141,8 +137,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
 JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* result;
     if (argumentCount) {
@@ -167,8 +162,7 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -188,8 +182,7 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
 JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -209,8 +202,7 @@ JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSVa
 JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -230,8 +222,7 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
 JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     return toRef(exec, jsObject->prototype());
@@ -240,8 +231,7 @@ JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
@@ -252,8 +242,7 @@ void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     
@@ -263,8 +252,7 @@ bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -280,8 +268,7 @@ JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef
 void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
@@ -304,8 +291,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -322,8 +308,7 @@ JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsi
 void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
@@ -339,8 +324,7 @@ void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned p
 bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -380,6 +364,55 @@ bool JSObjectSetPrivate(JSObjectRef object, void* data)
     return false;
 }
 
+JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue result;
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info))
+        result = static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
+    else if (jsObject->inherits(&JSCallbackObject<JSObject>::info))
+        result = static_cast<JSCallbackObject<JSObject>*>(jsObject)->getPrivateProperty(name);
+    return toRef(exec, result);
+}
+
+bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue jsValue = toJS(exec, value);
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        return true;
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObject>::info)) {
+        static_cast<JSCallbackObject<JSObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        return true;
+    }
+    return false;
+}
+
+bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObject>::info)) {
+        static_cast<JSCallbackObject<JSObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    return false;
+}
+
 bool JSObjectIsFunction(JSContextRef, JSObjectRef object)
 {
     CallData callData;
@@ -389,8 +422,7 @@ bool JSObjectIsFunction(JSContextRef, JSObjectRef object)
 JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSObject* jsThisObject = toJS(thisObject);
@@ -427,8 +459,7 @@ bool JSObjectIsConstructor(JSContextRef, JSObjectRef object)
 JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -466,8 +497,7 @@ JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef o
 {
     JSObject* jsObject = toJS(object);
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSGlobalData* globalData = &exec->globalData();
 
@@ -492,7 +522,7 @@ JSPropertyNameArrayRef JSPropertyNameArrayRetain(JSPropertyNameArrayRef array)
 void JSPropertyNameArrayRelease(JSPropertyNameArrayRef array)
 {
     if (--array->refCount == 0) {
-        JSLock lock(array->globalData->isSharedInstance ? LockForReal : SilenceAssertionsOnly);
+        APIEntryShim entryShim(array->globalData, false);
         delete array;
     }
 }
@@ -510,9 +540,6 @@ JSStringRef JSPropertyNameArrayGetNameAtIndex(JSPropertyNameArrayRef array, size
 void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef array, JSStringRef propertyName)
 {
     PropertyNameArray* propertyNames = toJS(array);
-
-    propertyNames->globalData()->heap.registerThread();
-    JSLock lock(propertyNames->globalData()->isSharedInstance ? LockForReal : SilenceAssertionsOnly);
-
+    APIEntryShim entryShim(propertyNames->globalData());
     propertyNames->add(propertyName->identifier(propertyNames->globalData()));
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h
new file mode 100644
index 0000000..32e80ab
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSObjectRefPrivate_h
+#define JSObjectRefPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ @function
+ @abstract Sets a private property on an object.  This private property cannot be accessed from within JavaScript.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to set.
+ @param propertyName A JSString containing the property's name.
+ @param value A JSValue to use as the property's value.  This may be NULL.
+ @result true if object can store private data, otherwise false.
+ @discussion This API allows you to store JS values directly an object in a way that will be ensure that they are kept alive without exposing them to JavaScript code and without introducing the reference cycles that may occur when using JSValueProtect.
+
+ The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private properties.
+ */
+JS_EXPORT bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value);
+
+/*!
+ @function
+ @abstract Gets a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to get.
+ @param propertyName A JSString containing the property's name.
+ @result The property's value if object has the property, otherwise NULL.
+ */
+JS_EXPORT JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+/*!
+ @function
+ @abstract Deletes a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to delete.
+ @param propertyName A JSString containing the property's name.
+ @result true if object can store private data, otherwise false.
+ @discussion The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private data.
+ */
+JS_EXPORT bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSObjectRefPrivate_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
index c58b958..92135b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
@@ -37,7 +37,8 @@
 extern "C" {
 #endif
 
-#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__)
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__) \
+    && !(defined(__CC_ARM) || defined(__ARMCC__)) /* RVCT */
 /*!
 @typedef JSChar
 @abstract A Unicode character.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
index 2207181..ced8203 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
@@ -26,12 +26,14 @@
 #include "config.h"
 #include "JSValueRef.h"
 
-#include <wtf/Platform.h>
 #include "APICast.h"
+#include "APIShims.h"
 #include "JSCallbackObject.h"
 
 #include <runtime/JSGlobalObject.h>
+#include <runtime/JSONObject.h>
 #include <runtime/JSString.h>
+#include <runtime/LiteralParser.h>
 #include <runtime/Operations.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -41,13 +43,14 @@
 
 #include <algorithm> // for std::min
 
-JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
+using namespace JSC;
+
+::JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
 {
-    JSC::ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSC::JSLock lock(exec);
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
 
-    JSC::JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJS(exec, value);
 
     if (jsValue.isUndefined())
         return kJSTypeUndefined;
@@ -63,13 +66,10 @@ JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
     return kJSTypeObject;
 }
 
-using namespace JSC; // placed here to avoid conflict between JSC::JSType and JSType, above.
-
 bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isUndefined();
@@ -78,8 +78,7 @@ bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isNull();
@@ -88,8 +87,7 @@ bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isBoolean();
@@ -98,8 +96,7 @@ bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isNumber();
@@ -108,8 +105,7 @@ bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isString();
@@ -118,8 +114,7 @@ bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isObject();
@@ -128,8 +123,7 @@ bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -145,8 +139,7 @@ bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsCla
 bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
@@ -163,20 +156,18 @@ bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* ex
 bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
 
-    return JSValue::strictEqual(jsA, jsB);
+    return JSValue::strictEqual(exec, jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
 
@@ -195,8 +186,7 @@ bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObject
 JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsUndefined());
 }
@@ -204,8 +194,7 @@ JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 JSValueRef JSValueMakeNull(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsNull());
 }
@@ -213,8 +202,7 @@ JSValueRef JSValueMakeNull(JSContextRef ctx)
 JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsBoolean(value));
 }
@@ -222,8 +210,7 @@ JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsNumber(exec, value));
 }
@@ -231,17 +218,40 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsString(exec, string->ustring()));
 }
 
+JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    LiteralParser parser(exec, string->ustring(), LiteralParser::StrictJSON);
+    return toRef(exec, parser.tryLiteralParse());
+}
+
+JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef apiValue, unsigned indent, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSValue value = toJS(exec, apiValue);
+    UString result = JSONStringify(exec, value, indent);
+    if (exception)
+        *exception = 0;
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return OpaqueJSString::create(result).releaseRef();
+}
+
 bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.toBoolean(exec);
@@ -250,8 +260,7 @@ bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
 
@@ -268,8 +277,7 @@ double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception
 JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -286,8 +294,7 @@ JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef*
 JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -304,19 +311,17 @@ JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exce
 void JSValueProtect(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcProtect(jsValue);
 }
 
 void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
index 7a7bf93..4186db8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
@@ -27,6 +27,7 @@
 #define JSValueRef_h
 
 #include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/WebKitAvailability.h>
 
 #ifndef __cplusplus
 #include <stdbool.h>
@@ -208,6 +209,28 @@ JS_EXPORT JSValueRef JSValueMakeNumber(JSContextRef ctx, double number);
 */
 JS_EXPORT JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string);
 
+/* Converting to and from JSON formatted strings */
+
+/*!
+ @function
+ @abstract       Creates a JavaScript value from a JSON formatted string.
+ @param ctx      The execution context to use.
+ @param string   The JSString containing the JSON string to be parsed.
+ @result         A JSValue containing the parsed value, or NULL if the input is invalid.
+ */
+JS_EXPORT JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string) AVAILABLE_AFTER_WEBKIT_VERSION_4_0;
+
+/*!
+ @function
+ @abstract       Creates a JavaScript string containing the JSON serialized representation of a JS value.
+ @param ctx      The execution context to use.
+ @param value    The value to serialize.
+ @param indent   The number of spaces to indent when nesting.  If 0, the resulting JSON will not contains newlines.  The size of the indent is clamped to 10 spaces.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result         A JSString with the result of serialization, or NULL if an exception is thrown.
+ */
+JS_EXPORT JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef value, unsigned indent, JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_4_0;
+
 /* Converting to primitive values */
 
 /*!
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp b/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
index 7c7b1af..f740abe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
@@ -42,7 +42,7 @@ PassRefPtr<OpaqueJSString> OpaqueJSString::create(const UString& ustring)
 UString OpaqueJSString::ustring() const
 {
     if (this && m_characters)
-        return UString(m_characters, m_length, true);
+        return UString(m_characters, m_length);
     return UString::null();
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
index 8402528..0e4f091 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,7 @@
 #define WEBKIT_VERSION_LATEST 0x9999
 
 #ifdef __APPLE__
-#import <AvailabilityMacros.h>
+#include <AvailabilityMacros.h>
 #else
 /*
  * For non-Mac platforms, require the newest version.
@@ -86,6 +86,9 @@
     #elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
         /* WebKit 3.0 is the version that shipped on Mac OS X 10.5. */
         #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_3_0
+    #elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_7
+        /* WebKit 4.0 is the version that shipped on Mac OS X 10.6. */
+        #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_4_0
     #else
         #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_LATEST
     #endif
@@ -645,9 +648,9 @@
  * 
  * Used on declarations introduced in WebKit 4.0
  */
-#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
-#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
+#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
 #else
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0
@@ -659,7 +662,7 @@
  * Used on declarations introduced in WebKit 4.0, 
  * and deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_IN_WEBKIT_VERSION_4_0
@@ -671,7 +674,7 @@
  * Used on declarations introduced in WebKit 1.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
@@ -683,7 +686,7 @@
  * Used on declarations introduced in WebKit 1.1, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
@@ -695,7 +698,7 @@
  * Used on declarations introduced in WebKit 1.2, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
@@ -707,7 +710,7 @@
  * Used on declarations introduced in WebKit 1.3, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
@@ -719,7 +722,7 @@
  * Used on declarations introduced in WebKit 2.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
@@ -731,7 +734,7 @@
  * Used on declarations introduced in WebKit 3.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
@@ -743,7 +746,7 @@
  * Used on declarations introduced in WebKit 3.1, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
@@ -754,11 +757,148 @@
  * 
  * Used on types deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define DEPRECATED_IN_WEBKIT_VERSION_4_0
 #endif
 
 
+
+
+
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
+#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
+#else
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED
+ * 
+ * Used on declarations introduced after WebKit 4.0, 
+ * and deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.1, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.2, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.3, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 2.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 3.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 3.1, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 4.0 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER
+#endif
+
+/*
+ * DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on types deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+
 #endif /* __WebKitAvailability__ */
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 8932b3b..c7e0fc2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,769 @@
+2010-06-18  Tucker Jay  <jay.tucker@nokia.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+        [Symbian] Lazy commit of memory required in JSC register file
+        https://bugs.webkit.org/show_bug.cgi?id=34349
+
+        * JavaScriptCore.pro: Added 1 new Symbian source file
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::):
+        (JSC::RegisterFile::start):
+        (JSC::RegisterFile::end):
+        (JSC::RegisterFile::size):
+        (JSC::RegisterFile::setNumGlobals):
+        (JSC::RegisterFile::numGlobals):
+        (JSC::RegisterFile::maxGlobals):
+        (JSC::RegisterFile::lastGlobal):
+        (JSC::RegisterFile::markGlobals):
+        (JSC::RegisterFile::markCallFrames):
+        (JSC::isPageAligned):
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        * wtf/symbian/RegisterFileAllocatorSymbian.cpp: Added.
+        (WTF::RegisterFileAllocator::RegisterFileAllocator):
+        Helper class to allocate memory required by RegisterFile
+        more efficiently.
+        (WTF::RegisterFileAllocator::~RegisterFileAllocator):
+        (WTF::RegisterFileAllocator::buffer):
+        (WTF::RegisterFileAllocator::grow):
+        (WTF::RegisterFileAllocator::shrink):
+        * wtf/symbian/RegisterFileAllocatorSymbian.h: Added.
+        * wtf/symbian/SymbianDefines.h: Added.
+
+2010-06-16  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+        Reindent the asm code I've moved to inside the function
+        (previous commit)
+
+        * jit/JITStubs.cpp:
+
+2010-06-16  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+        Fix the JIT compilation with the Intel 32-bit C++ compiler.
+
+        ICC doesn't understand the use of "asm" statements outside of
+        function bodies, so move the assembly code inside a dummy
+        function (and mark it so that the compiler doesn't remove it
+        altogether).
+
+        Also removed the ".text" entry that I had added because now
+        the assembly code is properly inside a code section (fixes
+        compilation with -ffunction-sections).
+
+        * jit/JITStubs.cpp:
+
+2010-06-16  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+        Don't use __attribute__((may_alias)) with the Intel compiler,
+        as it doesn't understand it.
+
+        * wtf/Vector.h:
+
+2010-06-16  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+        Fix compilation with the Intel C++ compiler (11.1.072).
+
+        Like RVCT, label pointers must be void*, not const void*.
+
+        * bytecode/Opcode.h:
+
+2010-06-16  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by NOBODY (OOPS!).
+
+        Add the WTF_COMPILER_INTEL for when the Intel compiler is used
+        for building. Usually, the Intel compiler masquerades as
+        another compiler in the system and gets away with it, but some
+        times specific fixes are required (such as when using language
+        extensions).
+
+        * wtf/Platform.h:
+
+2010-07-08  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Interpreter: Crash in op_load_varargs on 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=41795
+
+        Added missing cast of argCount to int32_t in op_load_varargs.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-07-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        The alternativeFrameLocation value is wrong in the emitDisjunction function in
+        case of PatternTerm::TypeParentheticalAssertion. This value needs to be
+        computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
+        memory corruption in some cases.
+        Layout test added for checking of TypeParentheticalAssertion case.
+        https://bugs.webkit.org/show_bug.cgi?id=41458
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-07-03  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make Arguments::MaxArguments clamping work for numbers >= 0x80000000 in
+        the interpreter as well as the JIT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        rdar://problem/8142141
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Fix signed integer overflow problem
+        in op_load_varargs handling. 0xFFFFFFFF was read as -1.
+
+2010-07-04  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r62456.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Be slightly more consistent in using uint32_t to prevent
+        warnings about comparisons between signed and unsigned types, and attempts to call an overload
+        of std::min that doesn't exist.
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clamp the number of arguments supported by function.apply
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        <rdar://problem/8142141>
+
+        Add clamping logic to function.apply similar to that
+        enforced by firefox.  We have a smaller clamp than
+        firefox as our calling convention means that stack
+        usage is proportional to argument count -- the firefox
+        limit is larger than you could actually call.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::):
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve reentrancy logic in polymorphic cache stubs
+        <https://bugs.webkit.org/show_bug.cgi?id=41482>
+        <rdar://problem/8094380>
+
+        Make the polymorphic cache stubs handle reentrancy
+        better.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
+
+        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
+        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
+        still giving a reasonable timeout (10 seconds) to prevent deadlock.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29381
+
+        * runtime/TimeoutChecker.h: Add getter for the timeout interval
+
+2010-05-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add an inlineCapacity template parameter to ListHashSet and use it to shrink the positioned object list hash set.
+        https://bugs.webkit.org/show_bug.cgi?id=39304
+        <rdar://problem/7998366>
+
+        Add an inlineCapacity template parameter to ListHashSet.
+
+        * wtf/ListHashSet.h:
+        (WTF::::ListHashSet):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::::~ListHashSet):
+        (WTF::::size):
+        (WTF::::capacity):
+        (WTF::::isEmpty):
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::find):
+        (WTF::::contains):
+        (WTF::::add):
+        (WTF::::insertBefore):
+        (WTF::::remove):
+        (WTF::::clear):
+        (WTF::::unlinkAndDelete):
+        (WTF::::appendNode):
+        (WTF::::insertNodeBefore):
+        (WTF::::deleteAllNodes):
+        (WTF::::makeIterator):
+        (WTF::::makeConstIterator):
+        (WTF::deleteAllValues):
+
+2010-06-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Work around a build problem with libjscore on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=40840
+
+        Sbsv2 sometimes have problems with debug/release configuration
+        determination causing QtWebKit in release to try linking with the debug
+        JavaScriptCore static library. This patch limit the jscore/jscored
+        r58306 fix necessary for mac builds only to the mac platform to prevent the
+        different name problem.
+
+        The real fix would be to fix qmake or the toolchain, this patch might
+        help meanwhile.
+
+        * JavaScriptCore.pri:
+
+2010-05-31  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement the simple text code path.
+        https://bugs.webkit.org/show_bug.cgi?id=40077
+
+        Remove the FONT_FAST_PATH macro and use the Qt's
+        fast text implementation instead of the one of WebKit.
+
+        The Qt::TextBypassShaping flag is used to tell Qt to
+        only use the glyph advances.
+
+        Qt 4.7 is needed to get this flag thus the complex path is always
+        used if QtWebKit is compiled against an earlier version.
+
+        Contrary to the WebKit's implementation, the complex code path
+        is taken if the text is RightToLeft, justified or is formatted
+        with non-zero letter or word spacing.
+
+        * wtf/Platform.h:
+
+2010-06-17  Mark Brand  <mabrand@mabrand.nl>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] use "win32-g++*" scope to match all MinGW makespecs
+
+        The scope "win32-g++" comes from the name of the makespec. However, it
+        is frequently used to check for MinGW. This works fine as long as
+        win32-g++ is the only makespec for MinGW. Now we need the wildcard
+        to cover "win32-g++-cross" as well.
+
+        * JavaScriptCore.pro:
+
+2010-06-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Crash when compiling on Snow Leopard and running on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=31403
+
+        Disable the use of pthread_setname_np and other symbols
+        when targetting Leopard.
+
+        Use the defines TARGETING_XX instead of BUILDING_ON_XX 
+        for features that cannot be used before Snow Leopard.
+
+        * wtf/Platform.h:
+
+2010-04-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed speculative buildfix for WinCE after r57882
+        https://bugs.webkit.org/show_bug.cgi?id=37701
+
+        * JavaScriptCore.pri: missing wince* case added.
+
+2010-04-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Target(WebCore,jsc,...) must depends on static library of JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=37701
+
+        * JavaScriptCore.pri: dependency added.
+
+2010-05-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a VS2010 assert in std::copy
+        https://bugs.webkit.org/show_bug.cgi?id=38630
+
+        The assert complains that the output iterator is null.
+
+        * wtf/Vector.h:
+        (WTF::::operator):
+
+2010-05-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Detect debug mode consistently
+        https://bugs.webkit.org/show_bug.cgi?id=38863
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+
+2010-05-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] Disable JIT support for mingw-w64
+        https://bugs.webkit.org/show_bug.cgi?id=38747
+
+        Disale JIT for mingw-w64 as it is reportedly
+        unstable.
+
+        Thanks for Vanboxem Rruben for the investigation.
+
+        * wtf/Platform.h:
+
+2010-05-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable YARR_JIT for X86 Mac for QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=38668
+
+        * wtf/Platform.h:
+
+2010-04-28  Simon Hausmann  <simon.hausmann@nokia.com>, Kent Hansen <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JSC's currentThreadStackBase is not reentrant on some platforms
+        https://bugs.webkit.org/show_bug.cgi?id=37195
+
+        This function needs to be reentrant to avoid memory corruption on platforms where
+        the implementation uses global variables.
+
+        This patch adds a mutex lock where necessary and makes the Symbian implementation
+        reentrant.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBaseMutex):
+        (JSC::currentThreadStackBase):
+
+2010-04-21  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compile fix for Visual Studio 2010
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        Patch by Prasanth Ullattil <prasanth.ullattil@nokia.com>
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::transitionTableAdd):
+        * wtf/MathExtras.h:
+        * wtf/Platform.h:
+
+2010-04-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename COMPILER(MSVC7) to COMPILER(MSVC7_OR_LOWER)
+
+        * config.h:
+        (JSC::Structure::transitionTableAdd):
+        * wtf/Assertions.h:
+        * wtf/Atomics.h:
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/Platform.h:
+        * wtf/StaticConstructors.h:
+        * wtf/StringExtras.h:
+        * wtf/Vector.h:
+        (WTF::::append):
+
+2010-04-15  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Mac build break.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+        - Make sure JavaScriptCore's debug_and_release config follows that
+          of WebCore.
+        - Use different name for JavaScriptCore target in debug and release
+          since they might be written in the same path at the same time on
+          parallel builds
+        - Consolidate the DESTDIR determination logic in JavaScriptCore.pri
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2010-04-21  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Make sure WebKit is not compiled using C++0x.
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        As the rest of Qt compiles in the C++0x mode, people might start
+        compiling it in this mode. WebKit don't support this yet.
+
+        Patch by Thiago Macieira <thiago.macieira@nokia.com>
+
+        * JavaScriptCore.pro:
+
+2010-04-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove dependency of JSC to QtGui
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        The patch also make sure that hal.h is in the include path on Symbian.
+        The dependency to QtGui took care of that before.
+
+        Patch by Thiago Macieira <thiago.macieira@nokia.com>
+             and Rohan McGovern <rohan.mcgovern@nokia.com>
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2010-04-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Corrects symbols visibility for JavaScriptCore.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        * JavaScriptCore.pro:
+
+2010-04-27  Thomas Zander <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the build on Symbian on Linux using the Makefile based mkspec
+
+        * JavaScriptCore.pri: It is necessary to specify the library search path
+        when linking against JavaScriptCore.
+
+2010-04-02  Ruben Van Boxem  <vanboxem.ruben@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Mingw-w64 fixes for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=35607
+
+        * runtime/Collector.cpp: use the msvc code for mingw-w64 (but not mingw-w32)
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::currentThreadStackBase):
+        * wtf/Platform.h: added COMPILER(MINGW64) check to differentiate between mingw.org and mingw-w64 functions
+
+2010-04-14  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Mac OS X: Use deployment target to determine whether memory tagging should be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34888
+
+        When building on (Snow) Leopard but targeting Tiger
+        (TARGETING_TIGER defined, BUILDING_ON_TIGER not defined),
+        WebKit would crash on Tiger because the tags passed to mmap
+        caused those function calls to fail.
+
+        Conversely, when building on Tiger but targeting Leopard
+        (BUILDING_ON_TIGER defined, TARGETING_LEOPARD defined), WebKit
+        would crash on Leopard because the tags passed to vm_map and
+        vm_allocate caused those function calls to fail.
+
+        Solution: Use TARGETING_TIGER rather than BUILDING_ON_TIGER to
+        govern the tag definitions. Use the same tags for vm_map and
+        vm_allocate regardless of target, since they work on
+        both. Fall back to the mmap tags that work on Tiger (that is,
+        "no tags") if targeting Tiger, since those tags also work on
+        Leopard.
+
+        * wtf/VMTags.h:
+
+2010-04-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix JavaScriptCore's include path for WinCE builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=36751
+
+        * JavaScriptCore.pri:
+
+2010-04-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build fix for WinCE.
+
+        Moved the include of the non-existing errno.h header file inside
+        platform guard macros.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2010-04-12  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Build fix for Mac when building with build-webkit --qt
+
+        Specifying no configuration on Mac builds WebCore both in debug
+        and release. JavaScriptCore has to follow this rule as well.
+
+        * JavaScriptCore.pro:
+
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crashes with package builds in release
+
+        Add NDEBUG to the defines for package build in JavaScriptCore.pri,
+        so that it's consistently used for JavaScriptCore, WebCore, jsc and all
+        other tools using wtf, etc. data structures directly. Mixing NDEBUG with
+        non-NDEBUG builds causes crashes due to differences in data structures when
+        assertions/checks are enabled.
+
+        * JavaScriptCore.pri:
+
+2010-03-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, fix after r56842.
+
+        Add UNUSED_PARAM a to silence warning.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-03-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, Symbian build fix.
+
+        Refactor JITStubs.cpp so that the list of STUB_FUNCTIONs
+        are not dependent on the JSVALUE32_64 guard.
+
+        * jit/JITStubs.cpp: Place the JSVALUE32_64 guard inside 
+        the body of cti_op_eq_strings.
+        * jit/JITStubs.h: Remove JSVALUE32_64 guard from 
+        cti_op_eq_strings stub.
+
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
+
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
+
+        PLATFORM(WIN) and OS(WIN) no longer needs to be undefined as
+        undefining WIN32 takes care of it.
+
+        * wtf/Platform.h:
+
+2010-03-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build break.
+
+        [Qt] Fix build break on Qt Mac.
+
+        DESTDIR path on Mac do not include the configuration path by default
+        like on Windows. Have to force it.
+
+        * JavaScriptCore.pro:
+
+2010-02-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
+
+        Add an enable flag for the Widgets (http://www.w3.org/TR/widgets-reqs/)
+        and turn it on for Qt only.
+
+        * wtf/Platform.h:
+
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use the -l syntax for linking against JavaScriptCore on Windows.
+        This allow qmake to extract dependencies correctly when generating VS
+        solutions.
+
+        * JavaScriptCore.pri:
+
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36742
+
+        gcc for Symbian doesn't support gcc extensions like atomicity.h - disable
+
+        * wtf/Threading.h: also detect os symbian
+
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
+  
+        * JavaScriptCore.pro: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
+
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+
+2010-03-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Build fix on MSVC. Reverts r55633 for stdint.h
+
+        This file gets included in generated moc files which don't
+        include the prefix header.
+
+        * os-win32/stdint.h:
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix part II).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36519 - JSGlobalContextRelease is unnecessarily slow
+
+        Since [ http://trac.webkit.org/changeset/35917 ], calling
+        JSGlobalContextRelease always triggers a GC heap collection
+        (if not a full destroy). As per 35917's changelog "This is
+        only really necessary when the (JSGlobalObject's) last
+        reference is released, but there is no way to determine that,
+        and no harm in collecting slightly more often."
+        
+        Well, we now know of cases of API clients who are harmed by
+        the performance penalty of collecting too often, so it's time
+        to add a way to determine whether a call to JSGlobalContextRelease
+        is removing the last protect from it's global object.  If further
+        protects are retaining the global object (likely from other
+        JSGlobalContextRefs), then don't trigger a GC collection.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::unprotect): return a boolean indicating that the value is now unprotected.
+        * runtime/Collector.h:
+        * wtf/HashCountedSet.h:
+        (WTF::::remove): return a boolean indicating whether the value was removed from the set.
+
+2010-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Some versions of GCC emit a warning about the implicit 64- to 32-bit truncation
+        that takes place here. An explicit cast is sufficient to silence it.
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): Fixed a typo - length doesn't
+        need to be converted with toInteger().
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36511
+        <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+        Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
+        the start offset, and iterated over (almost) all integers. Note that this can be fixed
+        without using doubles, but the code would be much more complicated, and there is no important
+        reason to stick to integers here.
+
+2010-03-23  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix compilation on Itanium in 32-bit mode
+        https://bugs.webkit.org/show_bug.cgi?id=36494
+
+        * wtf/Platform.h: Introduce CPU(IA64_32). Don't define
+          WTF_USE_JSVALUE64 if the CPU is in 32-bit mode.
+
+2010-03-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Interpreter fix for <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Only take the fast negate path if
+        a bit other than bit 31 is set. If none of bits 0-30 are set, then the
+        value we're negating can only be 0 or -2147483648, and neither can be
+        negated in int space.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate): Updated the JIT implementation to match
+        the interpreter, since it's slightly simpler.
+
 2010-03-22  Siddharth Mathur  <siddharth.mathur@nokia.com>
 
         Reviewed by Laszlo Gombos.
@@ -26,6 +792,3142 @@
         (WTF::AlignedBlockAllocator::~AlignedBlockAllocator):
         * wtf/symbian/BlockAllocatorSymbian.h: Added.
 
+2010-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+        
+        Two ways to fix the same bug:
+        
+        1. Check for overflow when negating, since negating the largest negative
+        int causes overflow.
+        
+        2. Constant-fold even when negating a negative, since, like they say in
+        high school, "math works."
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchNeg32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchNeg32): Added a branching version
+        of the negate operator.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate): Use the branching version of the negate 
+        operator to check for overflow.
+
+        (JSC::JIT::emitSlow_op_negate): Link the check for overflow to a slow case.
+        (We could emit inline code for this, since we know what the result would
+        be, but that's probably just a waste of generated code.)
+
+        * parser/Grammar.y: Constant fold even when negating a negative.
+
+2010-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/36431> Clean up 'int' use in UString.cpp after r54789
+
+        Reviewed by Darin Adler.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+        (JSC::UString::find): Changed static_cast<int>() to
+        static_cast<unsigned>() now that this method returns unsigned.
+        (JSC::UString::rfind): Ditto.
+        * runtime/UString.h:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+
+2010-03-22  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for syntax checking in the QtScript API.
+
+        New class was created; the QScriptSyntaxCheckResult which main
+        responsibility is to provide results of the ECMA Script code
+        syntax check. The class is not fully functional as the JSC C API
+        doesn't expose an error column number, but it is a good start point
+        for a future development.
+
+        [Qt] QtScript functionality should be extended by syntax checking.
+        https://bugs.webkit.org/show_bug.cgi?id=36123
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::checkSyntax):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::checkSyntax):
+        * qt/api/qscriptengine_p.h:
+        * qt/api/qscriptsyntaxcheckresult.cpp: Added.
+        (QScriptSyntaxCheckResult::QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::~QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::operator=):
+        (QScriptSyntaxCheckResult::state):
+        (QScriptSyntaxCheckResult::errorLineNumber):
+        (QScriptSyntaxCheckResult::errorColumnNumber):
+        (QScriptSyntaxCheckResult::errorMessage):
+        * qt/api/qscriptsyntaxcheckresult.h: Added.
+        * qt/api/qscriptsyntaxcheckresult_p.cpp: Added.
+        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+        * qt/api/qscriptsyntaxcheckresult_p.h: Added.
+        (QScriptSyntaxCheckResultPrivate::get):
+        (QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::state):
+        (QScriptSyntaxCheckResultPrivate::errorColumnNumber):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+
+2010-03-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New class; QScriptProgram.
+
+        The class should be used to evaluate the same script multiple times
+        more efficiently.
+
+        [Qt] QtScript should have QScriptProgram class
+        https://bugs.webkit.org/show_bug.cgi?id=36008
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::evaluate):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptprogram.cpp: Added.
+        (QScriptProgram::QScriptProgram):
+        (QScriptProgram::~QScriptProgram):
+        (QScriptProgram::operator=):
+        (QScriptProgram::isNull):
+        (QScriptProgram::sourceCode):
+        (QScriptProgram::fileName):
+        (QScriptProgram::firstLineNumber):
+        (QScriptProgram::operator==):
+        (QScriptProgram::operator!=):
+        * qt/api/qscriptprogram.h: Added.
+        * qt/api/qscriptprogram_p.h: Added.
+        (QScriptProgramPrivate::get):
+        (QScriptProgramPrivate::QScriptProgramPrivate):
+        (QScriptProgramPrivate::~QScriptProgramPrivate):
+        (QScriptProgramPrivate::isNull):
+        (QScriptProgramPrivate::sourceCode):
+        (QScriptProgramPrivate::fileName):
+        (QScriptProgramPrivate::firstLineNumber):
+        (QScriptProgramPrivate::operator==):
+        (QScriptProgramPrivate::operator!=):
+        (QScriptProgramPrivate::program):
+        (QScriptProgramPrivate::file):
+        (QScriptProgramPrivate::line):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::evaluateProgram):
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt #2 to fix the Windows build after r56314
+
+        * API/tests/testapi.c: Include JSObjectRefPrivate.h for the new
+        methods instead of declaring them locally (and non-extern).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Backed out previous change.
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt to fix the Windows build after r56314
+
+        Try to fix the following errors on the Windows buildbot:
+
+            Linking...
+            testapi.obj : error LNK2001: unresolved external symbol "bool __cdecl JSObjectSetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *,struct OpaqueJSValue const *)" (?JSObjectSetPrivateProperty@@YA_NPBUOpaqueJSContext@@PAUOpaqueJSValue@@PAUOpaqueJSString@@PBU2@@Z)
+            testapi.obj : error LNK2001: unresolved external symbol "struct OpaqueJSValue const * __cdecl JSObjectGetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *)" (?JSObjectGetPrivateProperty@@YAPBUOpaqueJSValue@@PBUOpaqueJSContext@@PAU1@PAUOpaqueJSString@@@Z)
+            C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\bin\testapi.exe : fatal error LNK1120: 2 unresolved externals
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        missing symbols to be exported.
+
+2010-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Documentation fix for previous patch.
+
+        * API/JSObjectRefPrivate.h:
+
+2010-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC needs an API to allow custom objects to have aprivate GC-accessible properties
+        https://bugs.webkit.org/show_bug.cgi?id=36420
+
+        Add new API methods to support "private" properties on custom
+        objects.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::~JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::getPrivateProperty):
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::markChildren):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::getPrivateProperty):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        (JSC::JSCallbackObject::deletePrivateProperty):
+        (JSC::JSCallbackObject::markChildren):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSObjectRefPrivate.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes after introduction of Brew files.
+
+        * wscript:
+
+2010-03-18  Tom Callaway  <tcallawa@redhat.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 35429: Fix compile on SPARC64
+        https://bugs.webkit.org/show_bug.cgi?id=35429
+
+        * wtf/Platform.h: Set WTF_USE_JSVALUE64 for SPARC64
+
+2010-03-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add API to directly expose JSON parsing
+        https://bugs.webkit.org/show_bug.cgi?id=34887
+
+        Add API to expose JSON parsing directly, and add tests to testapi
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        (JSValueCreateJSONString):
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+
+2010-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler and Mark Rowe.
+
+        Update WebKit availability macros for release after 4.0.
+
+        * API/WebKitAvailability.h:
+
+2010-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        undefined, NaN, and Infinity should be ReadOnly
+        https://bugs.webkit.org/show_bug.cgi?id=36263
+
+        Simply add the ReadOnly flag to these properties.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2010-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up Math.round a little by removing unneeded special case
+        https://bugs.webkit.org/show_bug.cgi?id=36107
+
+        Test: fast/js/math.html
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): This function had a special case for numbers
+        between -0.5 and -0.0 to return -0.0. But the algorithm in the function
+        already yields -0.0 for those cases, so the extra checking and branching
+        is unneeded.
+
+2010-03-17  Mike Homey  <glandium@debian.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for SPARC. Fix missing macro value.
+
+        * wtf/Platform.h:
+
+2010-03-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt, Darin Adler.
+
+        Bug 36083 - REGRESSION (r55772-r55834): Crash in JavaScriptCore RegExp code on PowerPC
+
+        The problem is a bug in our port of PCRE - that a read may take place from the first character in an
+        empty string.  For the time being, revert to using a valid pointer in the data segment rather than
+        an invalid non-null pointer into the zero-page for the empty string's data pointer.  A better fix for
+        this will be to remove PCRE.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+
+2010-03-16  Darin Adler  <darin@apple.com>
+
+        Rolled out r56081 since it broke the Windows build.
+
+2010-03-16  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove extra <new> include and add guards to operator new/delete definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35967
+
+        Remove extra <new> header include from FastAlloc.cpp since it is included in 
+        FastAlloc.h. Add ENABLE(GLOBAL_FASTMALLOC_NEW) macro guard to operator
+        new/delete/new []/delete [] definitions.
+
+        * wtf/FastMalloc.cpp:
+
+2010-03-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add a function to create a BREW instance without local variable declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=34705
+
+        Add a template function to create a BREW instance in one line.
+
+        * wtf/brew/ShellBrew.h: Added.
+        (WTF::createInstance):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Removed a now-incorrect comment I forgot to remove in my last check-in.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+
+        Every few seconds, release a percentage of the minimum unused page count
+        during that time period.
+
+        SunSpider reports no change, command-line or in-browser, Mac or Windows.
+        
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Renamed shouldContinueScavenging
+        to shouldScavenge, since scavenging is no longer something that we interrupt.
+
+        (WTF::TCMalloc_PageHeap::scavenge): The new scavenging algorithm. Fixes
+        a bug where the old code would release only one item from each size class
+        per scavenge, potentially leaving large numbers of large-sized objects
+        unreleased for a long time.
+
+        (WTF::TCMalloc_PageHeap::shouldScavenge):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        (WTF::TCMalloc_PageHeap::periodicScavenge): Updated to track the minimum
+        value of free_committed_pages_ during a given scavenge period.
+
+2010-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35843
+        Re-land reverted fix to JSString::getIndex()
+
+        Calling getIndex() on a JSString in rope form may result in a JSException being thrown
+        if there is insuficient memory so value(exec) returns UString() with length zero,
+        which will be passed to jsSingleCharacterSubstring.
+        Add a slow case function to trap the error & return a safe null value, until the
+        exception is handled.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::getIndexSlowCase):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+
+2010-03-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a long long version of abs() for MSVC.
+
+        * wtf/MathExtras.h:
+        (abs):
+
+2010-03-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Combine ctiTrampolines on ARM and Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=36014
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass): Classname may be null/empty, and these are an identifer.  This is okay, since the null/empty strings are shared across all threads.
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): No need to explicitly hash null reps, this is done in the ststic UStringImpl constructor.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() handled & checkCurrentIdentifierTable now called in the header.
+        (JSC::Identifier::checkCurrentIdentifierTable): Replaces checkSameIdentifierTable (this no longer checked the rep since the identifierTable pointer was removed from UString::Rep long ago).
+        * runtime/Identifier.h:
+        (JSC::Identifier::add): Replace call to checkSameIdentifierTable with call to checkCurrentIdentifierTable at head of function.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Remove call to checkConsistency - this function no longer checks anything interesting.
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl): Set s_refCountFlagIsIdentifier in static constructor.
+        (JSC::UStringImpl::UStringImpl): remove calls to checkConsistency (see above), add new ASSERT to substring constructor.
+        (JSC::UStringImpl::setHash): ASSERT not static (static strings set the hash in their constructor, should not reach this code path).
+        (JSC::UStringImpl::create): Add missing ASSERT.
+        (JSC::UStringImpl::setIsIdentifier): ASSERT !isStatic() (static strings hash set in constructor).
+
+2010-03-12  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Two functions tryConsumeCharacter() and tryConsumeCharacterClass() are
+        removed from yarr/RegexInterpreter.cpp because they are never called.
+
+        * yarr/RegexInterpreter.cpp:
+
+2010-03-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        The JSNative state was renamed to JSPrimitive. The new name better
+        coresponds to the ECMAScript standard.
+
+        Enum QScriptValuePrivate::States was renamed to State to obey Qt
+        coding style rules ("States" name suggests that a state could
+        mixed together with an other state using bitwise logic operators.
+
+        [Qt] QScriptValuePrivate::States has naming issues
+        https://bugs.webkit.org/show_bug.cgi?id=35968
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Remove nonsense comments used in development & commited in error.
+
+        * runtime/UStringImpl.h:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Remove export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
+
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Only call bufferOwnership() once, add missing ASSERTs.
+        (JSC::UStringImpl::createUninitialized): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::create): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::sharedBuffer): Rewritten to more closely match WebCore implementation, remove need for separate baseSharedBuffer() method.
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::UStringImpl): Automatically hash static strings, ASSERT m_data & m_length are non-null/non-zero in non-static strings.
+        (JSC::UStringImpl::setHash): Add missing ASSERT.
+        (JSC::UStringImpl::create): Moved to .cpp / added missing check for empty string creation.
+        (JSC::UStringImpl::adopt): Vector.size() returns size_t, not unsigned.
+        (JSC::UStringImpl::cost): Renamed m_bufferSubstring -> m_substringBuffer
+        (JSC::UStringImpl::hash): Reordered in file.
+        (JSC::UStringImpl::existingHash): Reordered in file.
+        (JSC::UStringImpl::computeHash): Reordered in file, renamed parameter.
+        (JSC::UStringImpl::checkConsistency): rewrote ASSERT.
+        (JSC::UStringImpl::bufferOwnership): Return type should be BufferOwnership.
+        (JSC::UStringImpl::): Moved friends to head of class.
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
+
+        * Configurations/Base.xcconfig:
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
+
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
+
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
+
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file .
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Buildfix for Thumb-2 after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::ldrb):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::setTest8):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+        
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::data):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::characters):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::setHash):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
+
+        Change JSC::UStringImpl's implementation of empty() match to match StringImpl's new implementation
+        (use a static defined within the empty() method), and change the interface to match too (return
+        a pointer not a reference). 
+
+        ~0% performance impact (possible minor progression from moving empty() from .h to .cpp).
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fixing Snow Leopard build.
+
+        * wtf/mac/MainThreadMac.mm: Forgot 'static' for a new local function.
+        (WTF::postTimer):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
+
+        The patch uses CFRunLoopTimer to schedule execution of tasks instead of performSelectorOnMainThread which apparently can starve other event sources.
+        The timer is used when the schedule request is coming on the main thread itself. This happens when the task is posted on the main thread or
+        when too many tasks are posted and the queue does 'stop and re-schedule' to make sure run loop has a chance to execute other events.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::timerFired):
+        (WTF::postTimer):
+        (WTF::scheduleDispatchFunctionsOnMainThread): Use timer posted to the current RunLoop if scheduling the task execution while on the main thread.
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed old symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov, Darin Adler, and Sam Weinig.
+
+        Refactored fastCheckConsistency to match some review comments:
+            - renamed fastCheckConsistency to fastMallocSize, and changed ValueCheck
+              to ASSERT that a pointer's fastMallocSize is not 0.
+            - implemented a version of fastMallocSize for tcmalloc.
+            
+        Also moved some pre-existing code around to avoid a problem related to
+        mismatched #define/#undef of malloc/free in this source file.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize): Renamed. Fixed indentation.
+
+        (WTF::TCMalloc_PageHeap::scavenge): Removed an incorrect ASSERT that
+        got in the way of testing the tcmalloc implementation. (More information
+        on why this ASSERT is incorrect is in <rdar://problem/7165917>.)
+
+        (WTF::TCMallocStats::fastMallocSize): Implemented for tcmalloc.
+
+        * wtf/FastMalloc.h: Updated for rename.
+
+        * wtf/ValueCheck.h:
+        (WTF::): Moved the ASSERT that used to be in fastCheckConsistency here.
+
+2010-03-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Make global new/delete operators configurable for all ports and disable it
+        for the wx port for now.
+
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+
+2010-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting r54510).
+
+        This caused a performance regression, by breaking the code
+        generator's logic to calculate the skip level for resolving
+        variables (traced by rdar:7683350)  Reverting for now.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed FastMalloc statistics reporting to be a bit clearer. We now
+        report:
+            - Reserved VM Bytes: the VM that has been mapped into the process.
+            - Committed VM Bytes: the subset of Reserved VM Bytes actually in use.
+            - Free List Bytes: the subset of Committed VM Bytes in a free list.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocStatistics):
+        (WTF::TCMallocStats::fastMallocStatistics): Updated to report the statistics
+        above. Standardized use of "ifdef WTF_CHANGES". Added a SpinLockHolder
+        around all statistics gathering, since it reads from the page heap.
+
+        * wtf/FastMalloc.h: Updated to report the statistics above. 
+
+2010-03-09  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Buildfix for ARM after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branchTest8):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: 'P' is not a type. Luckily, 'void' is.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switching malloc implementations requires a world rebuild
+        https://bugs.webkit.org/show_bug.cgi?id=35899
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+        (WTF::TCMallocStats::fastCheckConsistency):
+        * wtf/FastMalloc.h:
+        * wtf/ValueCheck.h:
+        (WTF::): Moved pointer checking into a helper function in FastMalloc.cpp,
+        so you can switch malloc implementations without rebuilding the world.
+
+2010-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        TypeInfo is unnecessarily large
+        https://bugs.webkit.org/show_bug.cgi?id=35850
+
+        Reduce the size of the type and flags members to a single
+        byte each, reducing the size of Structure by 8 bytes.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+          Add single byte branches, and correct setTest8 to do a
+          single byte read from memory, and actually store the result
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::type):
+
+2010-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting regression).
+
+        Reverting 55035, this caused a regression.
+        (https://bugs.webkit.org/show_bug.cgi?id=35843)
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added a new USE definition for secure text mode on the Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=31265
+
+        * wtf/Platform.h:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+        Also fix a problem that JSValue.toInteger is not exposed on Windows.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-07  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small performance fix in the QScriptConverter::toString().
+
+        The QByteArray was replaced by the QVarLengthArray which doesn't
+        have to allocate any memory on heap.
+
+        [Qt] QScriptConverter::toString() should use QVarLengthArray instead of QByteArray
+        https://bugs.webkit.org/show_bug.cgi?id=35577
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+
+2010-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
+
+        * API/APICast.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/CodeLocation.h:
+        * assembler/LinkBuffer.h:
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/RepatchBuffer.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITStubs.h:
+        * os-win32/stdint.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSImmediate.h:
+        * wtf/ASCIICType.h:
+        * wtf/StdLibExtras.h:
+        * wtf/VMTags.h:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.h:
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-03-06  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Share OwnPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=35776
+
+        Share OwnPtr implementation with BREW MP and remove OwnPtrBrew.
+
+        * wtf/OwnPtrBrew.cpp: Added.
+        (WTF::deleteOwnedPtr):
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp: Removed.
+        * wtf/brew/OwnPtrBrew.h: Removed.
+
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Implemented JIT_OPTIMIZE_NATIVE_CALL for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33426
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add enw exports to windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSC should cache int to Identifier conversion as it does for ordinary strings
+        https://bugs.webkit.org/show_bug.cgi?id=35814
+
+        Make the NumericStrings cache cache unsigned ints in addition to signed.
+        We keep them separate from the int cache as it both simplifies code, and
+        also because the unsigned path is exclusive to property access and therefore
+        seems to have different usage patterns.
+
+        The primary trigger for the unsigned to Identifier propertyName conversion
+        is the construction of array-like objects out of normal objects.  Given these
+        tend to be relative small numbers, and the array-like behaviour lends itself
+        to sequential values this patch also adds a non-colliding cache for all small
+        numbers.
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::from):
+        * runtime/Identifier.h:
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup):
+        (JSC::NumericStrings::lookupSmallString):
+
+2010-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
+
+        Add new opcodes for handling cached lookup of static value getters.
+        More or less the same as with JS getters, all that changes is that
+        instead of calling through a JSFunction we always know that we have
+        a C function to call.
+
+        For the patching routines in the JIT we now need to pass a few
+        new parameters to allow us to pass enough information to the stub
+        function to allow us to call the C function correctly.  Logically
+        this shouldn't actually be necessary as all of these functions ignore
+        the identifier, but removing the ident parameter would require
+        somewhat involved changes to the way we implement getOwnPropertySlot,
+        etc.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::):
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::cachedPropertyType):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::customGetter):
+
+2010-03-04  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. Remove a non-ASCII character introduced in the following bug.
+
+        put_by_id does will incorrectly cache writes where a specific value exists, where at the point of caching the same value is being written.
+        https://bugs.webkit.org/show_bug.cgi?id=35537
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+        * qt/tests/qscriptengine/qscriptengine.pro:
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/tests.pri:
+
+2010-03-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QScriptValue::isObject fix.
+
+        Fix broken internal state evaluation from JSValue to JSNative / JSObject.
+        New function was introduced which should take care about promoting
+        JSValue state inside QScriptValuePrivate. It should be used instead of a
+        direct JSC C API call.
+
+        The bug exposed a weakness in autotest suite, as the QScriptValuePrivate
+        is based on state machine with lazy state evaluation, there is a possibility
+        that serial sequencial calls to the same public const function could return
+        different results. The patch fix the issue.
+
+        [Qt] Sometimes QScriptValue::isObject returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=35387
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::refineJSValue):
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-03-03  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MIPS JIT Supports
+        https://bugs.webkit.org/show_bug.cgi?id=30144
+
+        The following changes enable MIPS YARR and YARR_JIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MIPSAssembler.h: Added.
+        (JSC::MIPSRegisters::):
+        (JSC::MIPSAssembler::MIPSAssembler):
+        (JSC::MIPSAssembler::):
+        (JSC::MIPSAssembler::JmpSrc::JmpSrc):
+        (JSC::MIPSAssembler::JmpDst::JmpDst):
+        (JSC::MIPSAssembler::JmpDst::isUsed):
+        (JSC::MIPSAssembler::JmpDst::used):
+        (JSC::MIPSAssembler::emitInst):
+        (JSC::MIPSAssembler::nop):
+        (JSC::MIPSAssembler::loadDelayNop):
+        (JSC::MIPSAssembler::copDelayNop):
+        (JSC::MIPSAssembler::move):
+        (JSC::MIPSAssembler::li):
+        (JSC::MIPSAssembler::lui):
+        (JSC::MIPSAssembler::addiu):
+        (JSC::MIPSAssembler::addu):
+        (JSC::MIPSAssembler::subu):
+        (JSC::MIPSAssembler::mult):
+        (JSC::MIPSAssembler::mfhi):
+        (JSC::MIPSAssembler::mflo):
+        (JSC::MIPSAssembler::mul):
+        (JSC::MIPSAssembler::andInsn):
+        (JSC::MIPSAssembler::andi):
+        (JSC::MIPSAssembler::nor):
+        (JSC::MIPSAssembler::orInsn):
+        (JSC::MIPSAssembler::ori):
+        (JSC::MIPSAssembler::xorInsn):
+        (JSC::MIPSAssembler::xori):
+        (JSC::MIPSAssembler::slt):
+        (JSC::MIPSAssembler::sltu):
+        (JSC::MIPSAssembler::sltiu):
+        (JSC::MIPSAssembler::sll):
+        (JSC::MIPSAssembler::sllv):
+        (JSC::MIPSAssembler::sra):
+        (JSC::MIPSAssembler::srav):
+        (JSC::MIPSAssembler::lw):
+        (JSC::MIPSAssembler::lwl):
+        (JSC::MIPSAssembler::lwr):
+        (JSC::MIPSAssembler::lhu):
+        (JSC::MIPSAssembler::sw):
+        (JSC::MIPSAssembler::jr):
+        (JSC::MIPSAssembler::jalr):
+        (JSC::MIPSAssembler::jal):
+        (JSC::MIPSAssembler::bkpt):
+        (JSC::MIPSAssembler::bgez):
+        (JSC::MIPSAssembler::bltz):
+        (JSC::MIPSAssembler::beq):
+        (JSC::MIPSAssembler::bne):
+        (JSC::MIPSAssembler::bc1t):
+        (JSC::MIPSAssembler::bc1f):
+        (JSC::MIPSAssembler::newJmpSrc):
+        (JSC::MIPSAssembler::appendJump):
+        (JSC::MIPSAssembler::addd):
+        (JSC::MIPSAssembler::subd):
+        (JSC::MIPSAssembler::muld):
+        (JSC::MIPSAssembler::lwc1):
+        (JSC::MIPSAssembler::ldc1):
+        (JSC::MIPSAssembler::swc1):
+        (JSC::MIPSAssembler::sdc1):
+        (JSC::MIPSAssembler::mtc1):
+        (JSC::MIPSAssembler::mfc1):
+        (JSC::MIPSAssembler::truncwd):
+        (JSC::MIPSAssembler::cvtdw):
+        (JSC::MIPSAssembler::ceqd):
+        (JSC::MIPSAssembler::cngtd):
+        (JSC::MIPSAssembler::cnged):
+        (JSC::MIPSAssembler::cltd):
+        (JSC::MIPSAssembler::cled):
+        (JSC::MIPSAssembler::cueqd):
+        (JSC::MIPSAssembler::coled):
+        (JSC::MIPSAssembler::coltd):
+        (JSC::MIPSAssembler::culed):
+        (JSC::MIPSAssembler::cultd):
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::align):
+        (JSC::MIPSAssembler::getRelocatedAddress):
+        (JSC::MIPSAssembler::getDifferenceBetweenLabels):
+        (JSC::MIPSAssembler::size):
+        (JSC::MIPSAssembler::executableCopy):
+        (JSC::MIPSAssembler::getCallReturnOffset):
+        (JSC::MIPSAssembler::linkJump):
+        (JSC::MIPSAssembler::linkCall):
+        (JSC::MIPSAssembler::linkPointer):
+        (JSC::MIPSAssembler::relinkJump):
+        (JSC::MIPSAssembler::relinkCall):
+        (JSC::MIPSAssembler::repatchInt32):
+        (JSC::MIPSAssembler::repatchPointer):
+        (JSC::MIPSAssembler::repatchLoadPtrToLEA):
+        (JSC::MIPSAssembler::relocateJumps):
+        (JSC::MIPSAssembler::linkWithOffset):
+        (JSC::MIPSAssembler::linkCallInternal):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerMIPS.h: Added.
+        (JSC::MacroAssemblerMIPS::MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::):
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::not32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::loadPtrWithPatchToLEA):
+        (JSC::MacroAssemblerMIPS::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::load16):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::pop):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::swap):
+        (JSC::MacroAssemblerMIPS::signExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::jump):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::breakpoint):
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::ret):
+        (JSC::MacroAssemblerMIPS::set32):
+        (JSC::MacroAssemblerMIPS::setTest32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::makeTailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::addDouble):
+        (JSC::MacroAssemblerMIPS::subDouble):
+        (JSC::MacroAssemblerMIPS::mulDouble):
+        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
+        (JSC::MacroAssemblerMIPS::insertRelaxationWords):
+        (JSC::MacroAssemblerMIPS::branchTrue):
+        (JSC::MacroAssemblerMIPS::branchFalse):
+        (JSC::MacroAssemblerMIPS::branchEqual):
+        (JSC::MacroAssemblerMIPS::branchNotEqual):
+        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2010-03-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap): Use the VM tag.
+        * wtf/VMTags.h: Make use of VM_MEMORY_TCMALLOC and VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS.
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Adam Roben.
+
+        Fix bogus xcopy that was polluting source tree at build time.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Oliver Hunt.
+
+        Allow building smoothly on win32 and win64 using GCC
+        https://bugs.webkit.org/show_bug.cgi?id=35607
+
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
+
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toString().
+
+        More ECMA Script compliance, especially for values as NaN, Inifinite
+        and really big/small numbers.
+
+        [Qt] QScriptValue::toString() returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34850
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toString):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toString_initData):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce a new class; QScriptString.
+
+        The QScriptString class should act as a handle to "interned"
+        strings in a QScriptEngine.
+
+        [Qt] QtScript should provide QScriptString
+        https://bugs.webkit.org/show_bug.cgi?id=34843
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::toStringHandle):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::toStringHandle):
+        * qt/api/qscriptstring.cpp: Added.
+        (QScriptString::QScriptString):
+        (QScriptString::~QScriptString):
+        (QScriptString::operator=):
+        (QScriptString::isValid):
+        (QScriptString::operator==):
+        (QScriptString::operator!=):
+        (QScriptString::toArrayIndex):
+        (QScriptString::toString):
+        (QScriptString::operator QString):
+        (qHash):
+        * qt/api/qscriptstring.h: Added.
+        * qt/api/qscriptstring_p.h: Added.
+        (QScriptStringPrivate::QScriptStringPrivate):
+        (QScriptStringPrivate::~QScriptStringPrivate):
+        (QScriptStringPrivate::get):
+        (QScriptStringPrivate::isValid):
+        (QScriptStringPrivate::operator==):
+        (QScriptStringPrivate::operator!=):
+        (QScriptStringPrivate::toArrayIndex):
+        (QScriptStringPrivate::toString):
+        (QScriptStringPrivate::id):
+        * qt/tests/qscriptstring/qscriptstring.pro: Added.
+        * qt/tests/qscriptstring/tst_qscriptstring.cpp: Added.
+        (tst_QScriptString::tst_QScriptString):
+        (tst_QScriptString::~tst_QScriptString):
+        (tst_QScriptString::test):
+        (tst_QScriptString::hash):
+        (tst_QScriptString::toArrayIndex_data):
+        (tst_QScriptString::toArrayIndex):
+        * qt/tests/tests.pro:
+
+2010-03-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Export function on windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
+
+        This removes the PropertySlot argument from getter functions, and makes them directly
+        pass the slot base.  This makes the semantics for the functions match that of the
+        indexing getters.
+
+        On the down side, this means that we can no longer simply use a proxy function for
+        JS getters, so we now add another marker value to indicate that a getter is present
+        and branch accordingly.
+
+        Against all rationality sunspider reports this as a perf win, but i suspect it's just noise.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * JavaScriptCore.exp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        * runtime/JSFunction.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
+
+        Fix this by defining a separate property getter function for index getters.  This allows
+        us to pass an unsigned number without the conversion to an Identifier.  We then update
+        setCustomIndex to take this new getter type.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+
+2010-03-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 35537 - put_by_id does will incorrectly cache writes where a specific value exists,
+                    where at the point of caching the same value is being written.
+
+        When performing a put_by_id that is replacing a property already present on the object,
+        there are three interesting cases regarding the state of the specific value:
+
+        (1) No specific value set - nothing to do, leave the structure in it's current state,
+            can cache.
+        (2) A specific value was set, the new put is not of a specified value (i.e. function),
+            or is of a different specific value - in these cases we need to perform a despecifying
+            transition to clear the specific value in the structure, but having done so this is a
+            normal property so as such we can again cache normally.
+        (3) A specific value was set, and we are overwriting with the same value - in these cases
+            leave the structure unchanged, but since a specific value is set we cannot cache this
+            put (we would need the JIT to dynamically check the value being written matched).
+
+        Unfortunately, the current behaviour does not match this.  the checks for a specific value
+        being present & the value matching are combined in such a way that in case (2), above we
+        will unnecessarily prevent the transition being cached, but in case (3) we will incorrectly
+        fail to prevent caching.
+
+        The bug exposes itself if multiple puts of the same specific value are performed to a
+        property, and erroneously the put is allowed to be cached by the JIT.  Method checks may be
+        generated caching calls of this structure.  Subsequent puts performed from JIT code may
+        write different values without triggering a despecify transition, and as such cached method
+        checks will continue to pass, despite the value having changed.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
+
+        * JavaScriptCore.pri: Add missing implementation file to resolve JSC symbols
+
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Remove wrec.  All builds should have switched to yarr by now.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec: Removed.
+        * wrec/CharacterClass.cpp: Removed.
+        * wrec/CharacterClass.h: Removed.
+        * wrec/CharacterClassConstructor.cpp: Removed.
+        * wrec/CharacterClassConstructor.h: Removed.
+        * wrec/Escapes.h: Removed.
+        * wrec/Quantifier.h: Removed.
+        * wrec/WREC.cpp: Removed.
+        * wrec/WREC.h: Removed.
+        * wrec/WRECFunctors.cpp: Removed.
+        * wrec/WRECFunctors.h: Removed.
+        * wrec/WRECGenerator.cpp: Removed.
+        * wrec/WRECGenerator.h: Removed.
+        * wrec/WRECParser.cpp: Removed.
+        * wrec/WRECParser.h: Removed.
+        * wscript:
+
+2010-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
+
+        * create_hash_table:
+
+2010-02-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian specific getCPUTime implemetation
+        https://bugs.webkit.org/show_bug.cgi?id=34742
+
+        Default implementation doesn't work on Symbian devices.
+        This change adds a proper implementation by
+        asking thread execution time from the current thread.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
+
+        Renamed lazyCreationData to subclassData. This is extra data that can be used by JSArray
+        subclasses (you can't add new data members, because it wouldn't fit in JSCell otherwise).
+
+        * JavaScriptCore.exp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        * runtime/JSArray.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::~RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSC crashes like crazy in the JSPropertyNameIterator destructor
+
+        Add back null check of m_cachedStructure.  Curse last minute changes.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Race condition in JSPropertyNameIterator and Structure destruction
+        https://bugs.webkit.org/show_bug.cgi?id=35398
+
+        JSPropertyNameIterator and Structure have a cyclic dependency that they
+        manage by clearing the appropriate reference in each other during their
+        destruction.  However if the Structure is destroyed while the 
+        JSPropertyNameIterator is dead but not yet finalized the Structures
+        WeakGCPtr will return null, and so prevent Structure from clearing
+        the m_cachedStructure pointer of the iterator.  When the iterator is
+        then finalised the m_cachedStructure is invalid, and the attempt to
+        clear the structures back reference fails.
+
+        To fix this we simply make JSPropertyNameIterator keep the Structure
+        alive, using the weak pointer to break the ref cycle.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+          The iterator now keeps m_cachedStructure alive itself, so no longer needs
+          to check for it being cleared
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+          Add an assertion to ensure correct usage
+        (JSC::JSPropertyNameIterator::cachedStructure):
+          Add .get()
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+          Add an assertion that our iterator isn't already dead, and remove
+          the now unnecessary attempt to clear the ref in the iterator
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::hasDeadObject):
+          An assert-only function to allow us to assert correct behaviour
+          in the Structure destructor
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+ 
+        Reviewed by Jeremy Orlow.
+ 
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        When a database is opened, right now you
+        don't have any context from where it is opened. The problem is that
+        the actual calls that open a database go through the sqlite3 vfs
+        layer, so there's no easy way to pass this function down to to
+        platform/sql/chromium/SQLFileSystemChromium*.cpp
+
+        This patch will allow you to get from anywhere within webkit a pointer
+        to the Thread object that actually created the thread you're currently
+        on (in case of the database, this can be either a thread forked of
+        from the main thread or from a worker thread), and query the object
+        for context information.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reverting to re-submit with better change log.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=35335
+
+        compileGetDirectOffset modifies the contents of the object register
+        when the object is not using the inline storage array.  As the object
+        register contains our 'this' pointer we can't allow it to be clobbered.
+        The fix is simply to copy the register into a separate scratch register
+        when we're loading off an object that doesn't use inline storage.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Speed up getter performance in the jit
+        https://bugs.webkit.org/show_bug.cgi?id=35332
+
+        Implement getter lookup caching in the interpreter.
+        The getter stubs are generated through basically the
+        same code paths as the normal get_by_id caching.
+        Instead of simply loading a property and returning,
+        we load the getter slot, and pass the getter, base value
+        and return address to a shared stub used for getter
+        dispatch.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/GetterSetter.h:
+
+2010-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Web Inspector: Regression: r55027+: Inspector broken
+        https://bugs.webkit.org/show_bug.cgi?id=35253
+
+        op_get_by_id_getter_chain was not passing the correct this parameter.
+        The bug was caused by incorrect use of baseCell instead of baseValue,
+        baseValue contains the original object for the lookup (and hence the
+        correct this object), baseCell is clobbered as part of walking the
+        prototype chain.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-02-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adding the EFL implementation of JavaScriptCore.
+        See https://bugs.webkit.org/show_bug.cgi?id=35084 for details.
+
+        * GNUmakefile.am: Updated to reflect the new location of GOwnPtr and
+                          GRefPtr.
+        * wtf/efl/MainThreadEfl.cpp: Added.
+        * wtf/gobject/GOwnPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GOwnPtr.h: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.h: Moved from wtf/gtk.
+
+2010-02-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove auto_ptr usage in JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35221
+
+        * parser/Nodes.h: Removed now unneeded adopt method.
+        * parser/Parser.cpp: Removed <memory> include as it is not required anymore.
+        * wtf/OwnPtr.h: Removed the constructor from auto_ptr.
+        * wtf/VectorTraits.h: Removed a template specialization for auto_ptr.
+        * wtf/unicode/Collator.h: Made userDefault return a PassOwnPtr.
+        * wtf/unicode/CollatorDefault.cpp:
+        (WTF::Collator::userDefault): Changed the method to match the next signature.
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Ditto.
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+        * wtf/Platform.h:
+
+2010-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSStringBuilder should not CRASH if allocation fails, it should throw a JSException.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::JSStringBuilder):
+        (JSC::JSStringBuilder::append):
+        (JSC::JSStringBuilder::build):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::tryAllocateBuffer):
+        (WTF::):
+        (WTF::VectorBuffer::tryAllocateBuffer):
+        (WTF::::tryExpandCapacity):
+        (WTF::::tryReserveCapacity):
+        (WTF::::tryAppend):
+
+2010-02-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Map FastMalloc to BREW memory allocator
+        https://bugs.webkit.org/show_bug.cgi?id=33570
+
+        Use MALLOC macro instead of the standard malloc function.
+        Although RVCT provides malloc, we can't use it in BREW
+        because the loader does not initialize the base address properly.
+
+        * wtf/FastMalloc.cpp:
+        * wtf/brew/SystemMallocBrew.h: Added.
+        (mallocBrew):
+        (callocBrew):
+        (freeBrew):
+        (reallocBrew):
+
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix for RVCT.
+
+        Fix after r55024. The "-i" option is for perl not for the
+        script.
+
+        * DerivedSources.pro:
+
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make UString::m_data be const, and make the UChar owned/ref-counted by CrossThreadRefCounted be const too.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::UStringImpl):
+        * wtf/OwnFastMallocPtr.h:
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+
+2010-02-21  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HashMapTranslatorAdapter::translate() needs to set the mapped value.
+
+        HTTPHeaderMap::add(const char*, const String&) does not work
+        https://bugs.webkit.org/show_bug.cgi?id=35227
+
+        * wtf/HashMap.h:
+        (WTF::HashMapTranslatorAdapter::translate):
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSString::getIndex() calls value() to resolve the string value (is a rope)
+        to a UString, then passes the result to jsSingleCharacterSubstring without
+        checking for an exception.  In case of out-of-memory the returned UString
+        is null(), which may result in an out-of-buounds substring being created.
+        This is bad.
+
+        Simple fix is to be able to get an index from a rope without resolving to
+        UString.  This may be a useful optimization in some test cases.
+
+        The same bug exists in some other methods is JSString, these can be fixed
+        by changing them to call getIndex().
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        (JSC::singleCharacterSubstring):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::singleCharacterSubstring):
+
+2010-02-19  Oliver Hunt  <oliver@apple.com>
+
+        RS = Gavin Barraclough.
+
+        Split the 32/64 version of JITPropertyAccess into a separate file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp: Added.
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+
+2010-02-19  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the regularexpression prefix.
+        Renamed it because it now works for other platforms too.
+        https://bugs.webkit.org/show_bug.cgi?id=34951
+
+        * DerivedSources.pro:
+        * create_jit_stubs: Copied from JavaScriptCore/create_rvct_stubs.
+        * create_rvct_stubs: Removed.
+
+2010-02-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve interpreter getter performance
+        https://bugs.webkit.org/show_bug.cgi?id=35138
+
+        Improve the performance of getter dispatch by making it possible
+        for the interpreter to cache the GetterSetter object lookup.
+
+        To do this we simply need to make PropertySlot aware of getters
+        as a potentially cacheable property, and record the base and this
+        objects for a getter access.  This allows us to use more-or-less
+        identical code to that used by the normal get_by_id caching, with
+        the dispatch being the only actual difference.
+
+        I'm holding off of implementing this in the JIT until I do some
+        cleanup to try and making coding in the JIT not be as horrible
+        as it is currently.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isGetter):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::thisValue):
+
+2010-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+        
+        This patch fixes a surprisingly common edge case in which the page heap
+        would have only one free span, but that span would be larger than the
+        minimum free size, so we would decide not to free it, even though it
+        could be as large as 100MB or more!
+        
+        SunSpider reports no change on Mac or Windows.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge): Call shouldContinueScavenging() instead
+        of doing the math ourselves. Don't keep a local value for pagesDecommitted
+        because that lets free_committed_pages_ be wrong temporarily. Instead,
+        update free_committed_pages_ as we go. ASSERT that we aren't releasing
+        a span that has already been released, because we think this is impossible.
+        Finally, don't be afraid to release all free memory in the page heap when
+        scavenging. We only scavenge after 5 seconds of the application's working
+        set not growing, and we keep both thread caches and a central cache on
+        top of the page heap, so the extra free pages in the page heap were just
+        overkill.
+
+2010-02-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35070
+        Addition of 2 strings of length 2^31 may result in a string of length 0.
+
+        Check for overflow when creating a new JSString as a result of an addition
+        or concatenation, throw an out of memory exception.
+
+        * runtime/JSString.h:
+        (JSC::):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
+
+        Add support for GFile to GOwnPtr.
+
+        Based on original work by Gustavo Noronha.
+
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GFile):
+        * wtf/gtk/GOwnPtr.h:
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a handful of other leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Delegate through to the subclass version of deref to ensure that
+        the correct cleanup takes place.  This function previously featured some code that attempted to
+        skip deletion of static UStringImpl's.  Closer inspection revealed that it was in fact equivalent
+        to "if (false)", meaning that UStringImpl's which had their final deref performed via this function
+        were leaked.
+
+2010-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a handful of leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Call URopeImpl::destructNonRecursive rather than delete
+        to ensure that the rope's fibers are also destroyed.
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
+
+        A rope is a recursive data structure where each node in the rope holds a set of
+        pointers, each of which may reference either a string (in UStringImpl form) or
+        another rope node.  A low bit in each pointer is used to distinguish between
+        rope & string elements, in a fashion similar to the recently-removed
+        PtrAndFlags class (see https://bugs.webkit.org/show_bug.cgi?id=33731 ).  Again,
+        this causes a problem for Leaks - refactor to remove the magic pointer
+        mangling.
+
+        Move Rope out from JSString.h and rename to URopeImpl, to match UStringImpl.
+        Give UStringImpl and URopeImpl a common parent class, UStringOrRopeImpl.
+        Repurpose an otherwise invalid permutation to flags (static & should report
+        memory cost) to identify ropes.
+
+        This allows us to change the rope's fibers to interrogate the object rather
+        than storing a bool within the low bits of the pointer (or in some cases the
+        use of a common parent class removes the need to determine the type at all -
+        there is a common interface to ref or get the length of either ropes or strings).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::JSStringFinalizerStruct):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::size):
+        * runtime/UStringImpl.cpp:
+        (JSC::URopeImpl::derefFibersNonRecursive):
+        (JSC::URopeImpl::destructNonRecursive):
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::isRope):
+        (JSC::UStringOrRopeImpl::length):
+        (JSC::UStringOrRopeImpl::ref):
+        (JSC::UStringOrRopeImpl::):
+        (JSC::UStringOrRopeImpl::operator new):
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl):
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::):
+        (JSC::URopeImpl::tryCreateUninitialized):
+        (JSC::URopeImpl::initializeFiber):
+        (JSC::URopeImpl::fiberCount):
+        (JSC::URopeImpl::fibers):
+        (JSC::URopeImpl::deref):
+        (JSC::URopeImpl::URopeImpl):
+        (JSC::URopeImpl::hasOneRef):
+        (JSC::UStringOrRopeImpl::deref):
+
+2010-02-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the SP at ctiOpThrowNotCaught on Thumb2 (JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=34939
+
+        * jit/JITStubs.cpp:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix!).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some general Rope related refactoring.
+
+        Rename Rope::m_ropeLength to m_fiberCount, to be more descriptive.
+        Rename Rope::m_stringLength to simply m_length (since this is the
+        more conventional name for the length of a string).  Move append
+        behaviour out into a new RopeBuilder class, so that Rope no longer
+        needs any knowledge of the JSString or UString implementation.
+
+        Make Rope no longer be nested within JSString.
+        (Rope now no-longer need reside within JSString.h, but leaving
+        the change of moving this out to a different header as a separate
+        change from these renames).
+
+        * JavaScriptCore.exp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * runtime/JSString.cpp:
+        (JSC::Rope::destructNonRecursive):
+        (JSC::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::Rope::Fiber::Fiber):
+        (JSC::Rope::Fiber::deref):
+        (JSC::Rope::Fiber::ref):
+        (JSC::Rope::Fiber::refAndGetLength):
+        (JSC::Rope::Fiber::isRope):
+        (JSC::Rope::Fiber::rope):
+        (JSC::Rope::Fiber::isString):
+        (JSC::Rope::Fiber::string):
+        (JSC::Rope::Fiber::nonFiber):
+        (JSC::Rope::tryCreateUninitialized):
+        (JSC::Rope::append):
+        (JSC::Rope::fiberCount):
+        (JSC::Rope::length):
+        (JSC::Rope::fibers):
+        (JSC::Rope::Rope):
+        (JSC::Rope::operator new):
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::length):
+        (JSC::RopeBuilder::canGetIndex):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::isRope):
+        (JSC::RopeBuilder::fiberCount):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add missing cast for !YARR (PPC) builds.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        StructureTransitionTable was effectively a smart pointer type,
+        one machine word in size and wholly contained as a member of
+        of Structure.  It either pointed to an actual table, or could
+        be used to describe a single transtion entry without use of a
+        table.
+
+        This, however, worked by using a PtrAndFlags, which is not
+        compatible with the leaks tool.  Since there is no clear way to
+        obtain another bit for 'free' here, and since there are bits
+        available up in Structure, merge this functionality back up into
+        Structure.  Having this in a separate class was quite clean
+        from an enacapsulation perspective, but this solution doesn't
+        seem to bad - all table access is now intermediated through the
+        Structure::structureTransitionTableFoo methods, keeping the
+        optimization fairly well contained.
+
+        This was the last use of PtrAndFlags, so removing the file too.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::):
+        (JSC::Structure::structureTransitionTableContains):
+        (JSC::Structure::structureTransitionTableGet):
+        (JSC::Structure::structureTransitionTableHasTransition):
+        (JSC::Structure::structureTransitionTableRemove):
+        (JSC::Structure::structureTransitionTableAdd):
+        (JSC::Structure::structureTransitionTable):
+        (JSC::Structure::setStructureTransitionTable):
+        (JSC::Structure::singleTransition):
+        (JSC::Structure::setSingleTransition):
+        * runtime/StructureTransitionTable.h:
+        * wtf/PtrAndFlags.h: Removed.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        Ooops! - "bool overflow" argument should have been "bool& overflow".
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 2!)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 1?)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some mistaken code added in http://trac.webkit.org/changeset/53860.
+
+        * API/APIShims.h:
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim): No need to start/stop the
+        timeout checker when calling out from the API to the client; we want to
+        monitor the VM for timeouts, not the client. This mistake was harmless /
+        undetectable, since it's totally redundant with the APIEntryShim, which
+        also starts / stops the timeout checker.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
+
+        * JavaScriptCore.exp:
+        * bytecode/EvalCodeCache.h:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEscape):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::indent):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSplit):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::getCString):
+        (JSC::UString::ascii):
+        (JSC::UString::operator[]):
+        (JSC::UString::toStrictUInt32):
+        (JSC::UString::find):
+        (JSC::UString::rfind):
+        (JSC::UString::substr):
+        (JSC::operator<):
+        (JSC::operator>):
+        (JSC::compare):
+        (JSC::equal):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::size):
+        (JSC::operator==):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::UStringImpl):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        The sum of the length of substrings could overflow.
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7628524> Crash beneath JSGlobalContextRelease when
+        typing in Google search field with GuardMalloc/full page heap enabled
+
+        * API/JSContextRef.cpp: Don't use APIEntryShim, since that requires
+        a JSGlobalData, which this function destroys. Do use setCurrentIdentifierTable
+        and JSLock instead, since those are the two features of APIEntryShim we
+        require.
+
+2010-02-15  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the offset of thunkReturnAddress.
+        https://bugs.webkit.org/show_bug.cgi?id=34657
+
+        * create_rvct_stubs:
+        * jit/JITStubs.cpp:
+
+2010-02-15  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toIntXX methods.
+
+        More ECMA Script compliance.
+
+        [Qt] QScriptValue::toIntXX returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34847
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toInteger_initData):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_initData):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_initData):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_initData):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-02-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        Implement NEVER_INLINE and NO_RETURN for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=34740
+
+        * wtf/AlwaysInline.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        Remove UntypedPtrAndBitfield (similar to PtrAndFlags) in UStringImpl,
+        and steal bits from the refCount instead.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        (JSC::UStringImpl::):
+
+2010-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed an unnecessary data dependency from my last patch.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Since isAnyStringMarked being false
+        is a condition of entering the loop, we can just use '=' instead of '|='.
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Don't import the cmath functions from std:: for WINSCW.
+
+        * wtf/MathExtras.h:
+
+2010-02-12  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Typedef both JSChar and UChar to wchar_t in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=34560
+
+        Define both JSChar and UChar to wchar_t as the size
+        of wchar_t is 2 bytes in RVCT.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+
+        The rest of the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        Don't unconditionally hang onto small strings. Instead, hang onto all
+        small strings as long as any small string is still referenced.
+        
+        SunSpider reports no change.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots): Mark the small strings cache last, so it can
+        check if anything else has kept any strings alive.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren): Only keep our strings alive if some
+        other reference to at least one of them exists, too.
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Some progress toward fixing
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        SunSpider reports no change.
+        
+        Keep weak references, rather than protected references, to cached for-in
+        property name enumerators.
+        
+        One problem with protected references is that a chain like 
+            [ gc object 1 ] => [ non-gc object ] => [ gc object 2 ]
+        takes two GC passes to break, since the first pass collects [ gc object 1 ],
+        releasing [ non-gc object ] and unprotecting [ gc object 2 ], and only
+        then can a second pass collect [ gc object 2 ].
+        
+        Another problem with protected references is that they can keep a bunch
+        of strings alive long after they're useful. In SunSpider and a few popular
+        websites, the size-speed tradeoff seems to favor weak references.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Moved this constructor
+        into the .cpp file, since it's not used elsewhere.
+
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator): Added a destructor
+        to support our weak reference.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::enumerationCache): Added a function for clearing a
+        Structure's enumeration cache, used by our new destructor. Also fixed
+        indentation to match the rest of the file.
+
+        * runtime/Structure.h: Changed from protected pointer to weak pointer.
+
+2010-02-11  Chris Rogers  <crogers@google.com>
+
+        Reviewed by David Levin.
+
+        audio engine: add Complex number class
+        https://bugs.webkit.org/show_bug.cgi?id=34538
+
+        * wtf/Complex.h: Added.
+        (WebCore::complexFromMagnitudePhase):
+
+2010-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added an SPI for asking about all the different live objects on the heap.
+        Useful for memory debugging.
+
+        * JavaScriptCore.exp: Export the new SPI.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Use a little capitalization. Don't crash in the case of
+        a non-object cell, since it might just be an uninitialized cell.
+
+        (JSC::Heap::objectTypeCounts): The new SPI.
+
+        * runtime/Collector.h:
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::operator++): Made 2 tweaks to these iterators:
+        (1) Skip the last cell in the block, since it's a dummy sentinel, and
+        we don't want it to confuse the object count; (2) Fixed a logic error
+        in LiveObjectIterator that could cause it to iterate dead objects if
+        m_block were equal to m_heap.nextBlock and m_cell were less than
+        m_heap.nextCell. No test for this since I can't think of a way that this
+        could make WebKit behave badly.
+
+2010-02-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Guard cmath using declarations in MathExtras.h on Android
+        https://bugs.webkit.org/show_bug.cgi?id=34840
+
+        Android does not provide these functions.
+
+        * wtf/MathExtras.h:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34759
+
+        * wscript:
+
+2010-02-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Addressing issues found by style bot.
+
+        * wtf/ValueCheck.h: Renamed header guard to match final file name.
+
+        * wtf/Vector.h: (WTF::::checkConsistency): Remove braces around a one-line clause.
+
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added ValueCheck.h.
+
+        * wtf/ValueCheck.h: Added. Moved code out of HashTraits, since it would be awkward to
+        include that from Vector.h.
+        (WTF::ValueCheck::checkConsistency): Allow null pointers, those are pretty consistent.
+
+        * wtf/HashTraits.h: Moved value checking code out of here.
+
+        * wtf/HashTable.h: (WTF::::checkTableConsistencyExceptSize): Updated for the above changes.
+
+        * wtf/Vector.h:
+        (WTF::::checkConsistency): Check all vector elements.
+        (WTF::ValueCheck): Support checking a Vector as an element in other containers. Currently
+        unused.
+
+2010-02-10  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toBool.
+
+        Fix ECMA compliance in the QScriptValue for values like 0, NaN and
+        empty strings.
+
+        [Qt] QScriptValue::toBool problem
+        https://bugs.webkit.org/show_bug.cgi?id=34793
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toBool):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toBool_initData):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_initData):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use derefIfNotNull() to work around WINSCW compiler forward declaration bug
+
+        The compiler bug is reported at
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+
+        The change should be reverted when the above bug is fixed in WINSCW compiler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Get rid of WINSCW hack for UnSpecifiedBoolType
+
+        Add parenthesis around (RefPtr::*UnspecifiedBoolType) to make the WINSCW
+        compiler work with the default UnSpecifiedBoolType() operator.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/RefPtr.h:
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New functions nullValue() and undefinedValue().
+
+        [Qt] QScriptEngine should contain nullValue and undefinedValue methods
+        https://bugs.webkit.org/show_bug.cgi?id=34749
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::nullValue):
+        (QScriptEngine::undefinedValue):
+        * qt/api/qscriptengine.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixes for QScriptValue::toNumber().
+
+        Fix ECMA compliance in QScriptValue for values unbound
+        to a QScriptEngine.
+
+        [Qt] QScriptValue::toNumber() is broken
+        https://bugs.webkit.org/show_bug.cgi?id=34592
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toNumber_initData):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::isNumber().
+
+        The isNumber() should return 'true' if the value is in the CNumber
+        state.
+
+        [Qt] QScriptValue::isNumber() returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=34575
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::isNumber_initData):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+
+2010-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Small refactoring to the small strings cache to allow it to be cleared
+        dynamically.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::clear):
+        * runtime/SmallStrings.h: Moved initialization code into a shared function,
+        and changed the constructor to call it.
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+
+2010-02-09  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=34772
+        Overzealous new assertion in URStringImpl::adopt()
+
+        Reviewed by Adam Barth.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        Only assert that vector.data() is non-zero if vector.size() is non-zero.
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix build problem on SnowLeopard slaves to bring them back.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8): Mark method as 'static inline' to suppress "warning: no previous prototype for ..."
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Three small string fixes:
+        (1) StringBuilder::release should CRASH if the buffer allocation failed.
+        (2) Remove weird, dead code from JSString::tryGetValue, replace with an ASSERT.
+        (3) Move UString::createFromUTF8 out to the API, as tryCreateStringFromUTF8.
+            This is only used from the API, and (now) unlike other UString::create
+            methods may return UString::null() to indicate failure cases.  Better
+            handle these in the API.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/JSString.h:
+        (JSC::Fiber::tryGetValue):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::find):
+        * runtime/UString.h:
+
 2010-02-09  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Laszlo Gombos.
@@ -39,35 +3941,3695 @@
         * runtime/JSValue.cpp:
         (JSC::nonInlineNaN):
 
-2010-01-07  Norbert Leser  <norbert.leser@nokia.com>
+2010-02-09  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Gavin Barraclough.
+
+        Add a soft modulo operation to ARM JIT using a trampoline function.
+        The performance progression is about ~1.8% on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        Developed in cooperation with Gabor Loki.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiSoftModulo):
+        * wtf/Platform.h:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (SL/win build fixes).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/StringPrototype.cpp:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Make String.replace throw an exception on out-of-memory, rather than
+        returning a null (err, empty-ish) string.  Move String::replaceRange
+        and String::spliceSubstringsWithSeparators out to StringPrototype -
+        these were fairly specific use anyway, and we can better integrate
+        throwing the JS expcetion this way.
+
+        Also removes redundant assignment operator from UString.
+
+        * JavaScriptCore.exp:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringRange::StringRange):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::jsReplaceRange):
+        (JSC::stringProtoFuncReplace):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Undefine WTF_OS_WINDOWS and WTF_PLATFORM_WIN
+        https://bugs.webkit.org/show_bug.cgi?id=34561
+
+        As the binary for simulator is built with MSVC 2005,
+        WTF_OS_WINDOWS and WTF_PLATFORM_WIN are defined.
+        Undefine them as we don't target Windows.
+
+        * wtf/Platform.h:
+
+2010-02-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Darin Adler.
+
+        audio engine: add Vector3 class
+        https://bugs.webkit.org/show_bug.cgi?id=34548
+
+        * wtf/Vector3.h: Added.
+        (WebCore::Vector3::Vector3):
+        (WebCore::Vector3::abs):
+        (WebCore::Vector3::isZero):
+        (WebCore::Vector3::normalize):
+        (WebCore::Vector3::x):
+        (WebCore::Vector3::y):
+        (WebCore::Vector3::z):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        (WebCore::dot):
+        (WebCore::cross):
+        (WebCore::distance):
+
+2010-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix warning in clang++
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make makeString CRASH if we fail to allocate a string.
+
+        (tryMakeString or jsMakeNontrivialString can be used where we
+        expect allocation may fail and want to handle the error).
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/UString.h:
+        (JSC::tryMakeString):
+        (JSC::makeString):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a couple of unnecesary C-style casts spotted by Darin.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Switch some more StringBuilder/jsNontrivialString code to use
+        JSStringBuilder/jsMakeNontrivialString - these methods will
+        throw an exception if we hit out-of-memory, rather than just
+        CRASHing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use an empty identifier instead of a null identifier for parse
+        tokens without an identifier.
+
+        This helps encapsulate the null UStringImpl within UString.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed RVCT build fix.
+
+        Similar to r54391, don't import the cmath functions from std:: for RVCT.
+
+        * wtf/MathExtras.h:
+
+2010-02-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Change UStringImpl::create to CRASH if the string cannot be allocated,
+        rather than returning a null string (which will behave like a zero-length
+        string if used).
+
+        Also move createRep function from UString to become new overloaded
+        UStringImpl::create methods.  In doing so, bring their behaviour closer to
+        being in line with WebCore::StringImpl, in removing the behaviour that they
+        can be used to produce null UStrings (ASSERT the char* provided is non-null).
+        This behaviour of converting null C-strings to null UStrings is inefficient
+        (cmompared to just using UString::null()), incompatible with WebCore::StringImpl's
+        behaviour, and may generate unexpected behaviour, since in many cases a null
+        UString can be used like an empty string.
+
+        With these changes UStringImpl need not have a concept of null impls, we can
+        start transitioning this to become an implementation detail of UString, that
+        internally it chooses to use a null-object rather than an actually zero impl
+        pointer.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::stopProfiling):
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        (JSC::throwError):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::rep):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define SYSTEM_MALLOC 1
+        https://bugs.webkit.org/show_bug.cgi?id=34640
+
+        Make BREWMP use system malloc because FastMalloc is not ported.
+
+        * wtf/Platform.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't call CRASH() in fastMalloc and fastCalloc when the requested memory size is 0
+        https://bugs.webkit.org/show_bug.cgi?id=34569
+
+        With USE_SYSTEM_MALLOC=1, fastMalloc and fastCalloc call CRASH()
+        if the return value of malloc and calloc is 0.
+        
+        However, these functions can return 0 when the request size is 0.
+        Libc manual says, "If size is 0, then malloc() returns either NULL,
+        or a unique pointer value that can later be successfully passed to free()."
+        Though malloc returns a unique pointer in most systems,
+        0 can be returned in some systems. For instance, BREW's MALLOC returns 0
+        when size is 0.
+
+        If malloc or calloc returns 0 due to allocation size, increase the size
+        to 1 and try again.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+
+2010-02-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Accommodate rename of script.
+
+2010-02-04  Daniel Bates  <dbates@webkit.org>
+
+        [Qt] Unreviewed, build fix for Qt bot.
+
+        * runtime/JSStringBuilder.h: Changed #include <X.h> notation #include "X.h".
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Clearing a WeakGCPtr is weird
+        https://bugs.webkit.org/show_bug.cgi?id=34627
+
+        Added a WeakGCPtr::clear interface.
+        
+        As discussed in https://bugs.webkit.org/show_bug.cgi?id=33383, the old
+        interface made it pretty weird for a client to conditionally clear a
+        WeakGCPtr, which is exactly what clients want to do when objects are
+        finalized.
+
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype): Use the new WeakGCPtr::clear() interface. 
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::clear): Added an interface for clearing a WeakGCPtr,
+        iff its current value is the value passed in. It's cumbersome for the
+        client to do this test, since WeakGCPtr sometimes pretends to be null.
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add a JSStringBuilder class (similar-to, and derived-from StringBuilder) to
+        construct JSStrings, throwing a JS exception should we run out of memory whilst
+        allocating storage for the string.
+
+        Similarly, add jsMakeNontrivialString methods to use in cases where previously
+        we were calling makeString & passing the result to jsNontrivialString.  Again,
+        these new methods throw if we hit an out of memory condition.
+
+        Move throwOutOfMemoryError into ExceptionHelpers, to make it more widely available.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSStringBuilder.h: Added.
+        (JSC::JSStringBuilder::releaseJSString):
+        (JSC::jsMakeNontrivialString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        * runtime/Operations.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+
+2010-02-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * wtf/MathExtras.h:
+
+2010-02-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Make MathExtras.h compatible with <cmath>
+        https://bugs.webkit.org/show_bug.cgi?id=34618
+
+        * wtf/MathExtras.h: Include <cmath> instead of <math.h>.
+        Use "using" as we do elsewhere in WTF for the four functions from <cmath>
+        we want to use without the prefix. Later we could consider making the std
+        explicit at call sites instead.
+
+2010-02-04  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use an easily appendable structure for trampolines instead of pointer parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+
+2010-02-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Increase test coverage for the QScriptValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34533
+
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::dataHelper):
+        (tst_QScriptValue::newRow):
+        (tst_QScriptValue::testHelper):
+        (tst_QScriptValue::ctor):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp: Added.
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_initData):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_initData):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_initData):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isFunction_initData):
+        (tst_QScriptValue::isFunction_makeData):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_initData):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_initData):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_initData):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_initData):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP_SIMULATOR when AEE_SIMULATOR is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34514
+
+        PLATFORM(BREWMP_SIMULATOR) guard is needed to make distinction between BREWMP
+        and BREWMP simulator.
+
+        * wtf/Platform.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Remove COMPILE_ASSERT conflict with the underlying PLATFORM
+        https://bugs.webkit.org/show_bug.cgi?id=34190
+
+        COMPILE_ASSERT conflicts with the underlying PLATFORM because it is defined
+        both in WTF's Assertions.h and BREWMP's AEEClassIDs.h. Include AEEClassIDs.h
+        in Assertions.h and undef COMPILE_ASSERT to avoid redefining COMPILE_ASSERT.
+
+        * wtf/Assertions.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Implement OwnPtrBrew to make sure BREW instances are freed.
+        https://bugs.webkit.org/show_bug.cgi?id=34518
+
+        Add OwnPtrBrew to release IFile, IFileMgr and IBitmap instances.
+
+        * wtf/brew/OwnPtrBrew.cpp: Added.
+        (WTF::IFileMgr):
+        (WTF::IFile):
+        (WTF::IBitmap):
+        (WTF::freeOwnedPtrBrew):
+        * wtf/brew/OwnPtrBrew.h: Added.
+        (WTF::OwnPtrBrew::OwnPtrBrew):
+        (WTF::OwnPtrBrew::~OwnPtrBrew):
+        (WTF::OwnPtrBrew::get):
+        (WTF::OwnPtrBrew::release):
+        (WTF::OwnPtrBrew::outPtr):
+        (WTF::OwnPtrBrew::set):
+        (WTF::OwnPtrBrew::clear):
+        (WTF::OwnPtrBrew::operator*):
+        (WTF::OwnPtrBrew::operator->):
+        (WTF::OwnPtrBrew::operator!):
+        (WTF::OwnPtrBrew::operator UnspecifiedBoolType):
+        (WTF::OwnPtrBrew::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Export WTF::fastStrDup symbol
+        https://bugs.webkit.org/show_bug.cgi?id=34526
+
+        * JavaScriptCore.exp:
+
+2010-02-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Enable JIT compilation for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34536
+
+        * wtf/Platform.h:
+
+2010-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash in CollectorBitmap::get at nbcolympics.com
+        https://bugs.webkit.org/show_bug.cgi?id=34504
+
+        This was caused by the use of m_offset to determine the offset of
+        a new property into the property storage.  This patch corrects
+        the effected cases by incorporating the anonymous slot count. It
+        also removes the duplicate copy of anonymous slot count from the
+        property table as keeping this up to date merely increased the
+        chance of a mismatch.  Finally I've added a large number of
+        assertions in an attempt to prevent such a bug from happening
+        again.
+
+        With the new assertions in place the existing anonymous slot tests
+        all fail without the m_offset fixes.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add dummy main thread functions
+        https://bugs.webkit.org/show_bug.cgi?id=33569
+
+        Add dummy initializeMainThreadPlatform and
+        scheduleDispatchFunctionsOnMainThread.
+
+        * wtf/brew/MainThreadBrew.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Add using WTF::getLocalTime to CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=34493
+
+        * wtf/CurrentTime.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add HAVE_XXX definitions
+        https://bugs.webkit.org/show_bug.cgi?id=34414
+
+        Add HAVE_ERRNO_H=1
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't define HAVE_TM_GMTOFF, HAVE_TM_ZONE and HAVE_TIMEGM
+        https://bugs.webkit.org/show_bug.cgi?id=34388
+
+        BREWMP does not have these features.
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP=1 when BUILDING_BREWMP is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34386
+
+        Define WTF_PLATFORM_BREWMP=1 so that PLATFORM(BREWMP) guard can be used.
+
+        * wtf/Platform.h:
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Date.UTC() should apply TimeClip operation.
+        https://bugs.webkit.org/show_bug.cgi?id=34461
+
+        ECMAScript 5 15.9.4.3:
+        > 9 Return TimeClip(MakeDate(MakeDay(yr, m, dt), MakeTime(h, min, s, milli))).
+
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Calls WTF::timeClip().
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that Math.round() retunrs incorrect results for huge integers
+        https://bugs.webkit.org/show_bug.cgi?id=34462
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): Avoid "arg + 0.5".
+
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's currentTime
+        https://bugs.webkit.org/show_bug.cgi?id=33567
+
+        Combine GETUTCSECONDS and GETTIMEMS to calculate the number
+        of milliseconds since 1970/01/01 00:00:00 UTC.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2010-02-01  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] WinCE buildfix after r52729 and fix for Q_BIG_ENDIAN typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34378
+
+        * wtf/Platform.h:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Structure not accounting for anonymous slots when computing property storage size
+        https://bugs.webkit.org/show_bug.cgi?id=34441
+
+        Previously any Structure with anonymous storage would have a property map, so we
+        were only including anonymous slot size if there was a property map.  Given this
+        is no longer the case we should always include the anonymous slot count in the
+        property storage size.
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file (again)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC is failing to propagate anonymous slot count on some transitions
+        https://bugs.webkit.org/show_bug.cgi?id=34321
+
+        Remove secondary Structure constructor, and make Structure store a copy
+        of the number of anonymous slots directly so saving an immediate allocation
+        of a property map for all structures with anonymous storage, which also
+        avoids the leaked property map on new property transition in the original
+        version of this patch.
+
+        We need to propagate the the anonymous slot count otherwise we can end up
+        with a structure recording incorrect information about the available and
+        needed space for property storage, or alternatively incorrectly reusing
+        some slots.
+
+        * JavaScriptCore.exp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::hasAnonymousSlots):
+        (JSC::Structure::anonymousSlotCount):
+
+2010-01-31  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix for WinCE + style fixes (TLS_OUT_OF_INDEXES is not defined).
+        https://bugs.webkit.org/show_bug.cgi?id=34380
+
+        * wtf/ThreadSpecific.h:
+
+2010-01-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [Windows] Fix a bug of round() with huge integral numbers
+        https://bugs.webkit.org/show_bug.cgi?id=34297
+
+        Fix a bug that round() for huge integral numbers returns incorrect
+        results. For example, round(8639999913600001) returns
+        8639999913600002 without this change though the double type can
+        represent 8639999913600001 precisely.
+
+        Math.round() of JavaScript has a similar problem. But this change
+        doesn't fix it because Math.round() doesn't use round() of
+        MathExtra.h.
+
+        * wtf/MathExtras.h:
+        (round): Avoid to do "num + 0.5" or "num - 0.5".
+        (roundf): Fixed similarly.
+        (llround): Calls round().
+        (llroundf): Calls roundf().
+        (lround): Calls round().
+        (lroundf): Calls roundf().
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Sort Xcode projects.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Fix the ARM build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure): Call the right Structure::create overload.
+
+2010-01-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for MSW, use ThreadingWin.cpp as the Windows pthreads implementation
+        implements pthread_t in a way that makes it impossible to check its validity,
+        which is needed by ThreadingPthreads.cpp.
+
+        * wscript:
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make getAnonymousValue const-friendly
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getAnonymousValue):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        A class must now specify the number of slots it needs at construction time
+        rather than later on with a transition.  This makes many things simpler,
+        we no longer need to need an additional transition on object creation to
+        add the anonymous slots, and we remove the need for a number of transition
+        type checks. 
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::Fiber::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::anonymousSlotCount):
+        * runtime/StructureTransitionTable.h:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Add logic to allow us to create an Object, Array, or Date instance
+        so we can create them in the context of a specific global object,
+        rather than just using the current lexical global object.
+
+        * JavaScriptCore.exp:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        (JSC::constructEmptyArray):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove trailing \ from inline function code
+        https://bugs.webkit.org/show_bug.cgi?id=34223
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=33566
+
+        Use GETRAND to generate 4 byte random byte sequence to implement
+        weakRandomNumber. Create a secure random number generator with
+        AEECLSID_RANDOM to implement randomNumber.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port getCPUTime
+        https://bugs.webkit.org/show_bug.cgi?id=33572
+
+        Use GETUPTIMEMS which returns a continuously and
+        linearly increasing millisecond timer from the time the device
+        was powered on. This function is enough to implement getCPUTime.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Oliver Hunt.
+
+        [BREWMP] Add MarkStack fastMalloc implementation for platforms without VirtualAlloc or mmap.
+        https://bugs.webkit.org/show_bug.cgi?id=33582
+
+        Use fastMalloc and fastFree to implement MarkStack::allocateStack and
+        MarkStack::releaseStack for platforms without page level allocation.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackNone.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't use time function
+        https://bugs.webkit.org/show_bug.cgi?id=33577
+
+        Calling time(0) in BREW devices causes a crash because time
+        is not properly ported in most devices. Cast currentTime() to
+        time_t to get the same result as time(0).
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * wtf/HashMap.h:
+        (WTF::::remove):
+        * wtf/HashSet.h:
+        (WTF::::remove):
+        * wtf/HashTable.h:
+        (WTF::::add):
+        (WTF::::addPassingHashCode):
+        (WTF::::removeAndInvalidate):
+        (WTF::::remove):
+        (WTF::::rehash):
+        (WTF::::checkTableConsistency):
+        (WTF::::checkTableConsistencyExceptSize):
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::emptyValue):
+        (WTF::):
+        * wtf/RefPtrHashMap.h:
+        (WTF::::remove):
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fixing.
+
+        * wtf/HashTraits.h: _msize takes void*, remove const qualifier from type.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * wtf/HashTraits.h: Include malloc.h for _msize().
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * wtf/HashTable.h: (WTF::HashTable::checkTableConsistencyExceptSize): Remove const from a
+        static (empty) version of this function.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-26  Lyon Chen  <liachen@rim.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Opcode.h use const void* for Opcode cause error #1211 for RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=33902
+
+        * bytecode/Opcode.h:
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2010-01-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Using JavaScriptCore API with a webkit vended context can result in slow script dialog
+        https://bugs.webkit.org/show_bug.cgi?id=34172
+
+        Make the APIShim correctly increment and decrement the timeout
+        entry counter.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix compilation of QtScript with non-gcc compilers
+
+        Variable length stack arrays are a gcc extension. Use QVarLengthArray
+        as a more portable solution that still tries to allocate on the stack
+        first.
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::call):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on platforms without JIT support.
+
+        The JIT support should be determined at compile-time via wtf/Platform.h
+
+        * qt/api/QtScript.pro:
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * qt/api/QtScript.pro: Added.
+        * qt/api/qscriptconverter_p.h: Added.
+        (QScriptConverter::toString):
+        * qt/api/qscriptengine.cpp: Added.
+        (QScriptEngine::QScriptEngine):
+        (QScriptEngine::~QScriptEngine):
+        (QScriptEngine::evaluate):
+        (QScriptEngine::collectGarbage):
+        * qt/api/qscriptengine.h: Added.
+        * qt/api/qscriptengine_p.cpp: Added.
+        (QScriptEnginePrivate::QScriptEnginePrivate):
+        (QScriptEnginePrivate::~QScriptEnginePrivate):
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h: Added.
+        (QScriptEnginePrivate::get):
+        (QScriptEnginePrivate::collectGarbage):
+        (QScriptEnginePrivate::makeJSValue):
+        (QScriptEnginePrivate::context):
+        * qt/api/qscriptvalue.cpp: Added.
+        (QScriptValue::QScriptValue):
+        (QScriptValue::~QScriptValue):
+        (QScriptValue::isValid):
+        (QScriptValue::isBool):
+        (QScriptValue::isBoolean):
+        (QScriptValue::isNumber):
+        (QScriptValue::isNull):
+        (QScriptValue::isString):
+        (QScriptValue::isUndefined):
+        (QScriptValue::isError):
+        (QScriptValue::isObject):
+        (QScriptValue::isFunction):
+        (QScriptValue::toString):
+        (QScriptValue::toNumber):
+        (QScriptValue::toBool):
+        (QScriptValue::toBoolean):
+        (QScriptValue::toInteger):
+        (QScriptValue::toInt32):
+        (QScriptValue::toUInt32):
+        (QScriptValue::toUInt16):
+        (QScriptValue::call):
+        (QScriptValue::engine):
+        (QScriptValue::operator=):
+        (QScriptValue::equals):
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue.h: Added.
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h: Added.
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::get):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isValid):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::engine):
+        (QScriptValuePrivate::context):
+        (QScriptValuePrivate::value):
+        (QScriptValuePrivate::object):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::isJSBased):
+        (QScriptValuePrivate::isNumberBased):
+        (QScriptValuePrivate::isStringBased):
+        * qt/api/qtscriptglobal.h: Added.
+        * qt/tests/qscriptengine/qscriptengine.pro: Added.
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::tst_QScriptEngine):
+        (tst_QScriptEngine::~tst_QScriptEngine):
+        (tst_QScriptEngine::init):
+        (tst_QScriptEngine::cleanup):
+        (tst_QScriptEngine::collectGarbage):
+        (tst_QScriptEngine::evaluate):
+        * qt/tests/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::init):
+        (tst_QScriptValue::cleanup):
+        (tst_QScriptValue::ctor):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::copyConstructor_data):
+        (tst_QScriptValue::copyConstructor):
+        (tst_QScriptValue::assignOperator_data):
+        (tst_QScriptValue::assignOperator):
+        (tst_QScriptValue::dataSharing):
+        (tst_QScriptValue::constructors_data):
+        (tst_QScriptValue::constructors):
+        (tst_QScriptValue::call):
+        * qt/tests/tests.pri: Added.
+        * qt/tests/tests.pro: Added.
+
+2010-01-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Linux tests: the pthread functions on Linux produce segfault if they receive 0 thread handle.
+        After r53714, we can have 0 thread handles passed to pthread_join and pthread_detach if corresponding threads
+        were already terminated and their threadMap entries cleared.
+        Add a 0 check.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2010-01-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor JITStubs.cpp so that DEFINE_STUB_FUNCTION is only used once for each function
+        https://bugs.webkit.org/show_bug.cgi?id=33866
+
+        Place the guard USE(JSVALUE32_64) inside the body of the DEFINE_STUB_FUNCTION
+        macro for those functions that are always present.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempted Snow Leopard build fix.
+
+        * wtf/ThreadingPthreads.cpp: Add a forward declaration of a function which is not 'static'.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the leak of ThreadIdentifiers in threadMap across threads.
+        https://bugs.webkit.org/show_bug.cgi?id=32689
+
+        Test is added to DumpRenderTree.mm.
+
+        * Android.mk: Added file ThreadIdentifierDataPthreads.(h|cpp) to build.
+        * Android.v8.wtf.mk: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp: Added. Contains custom implementation of thread-specific data that uses custom destructor.
+        (WTF::ThreadIdentifierData::~ThreadIdentifierData): Removes the ThreadIdentifier from the threadMap.
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::destruct): Custom thread-specific destructor. Resets the value for the key again to cause second invoke.
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce): Need to use pthread_once since initialization may come on any thread(s).
+        * wtf/ThreadIdentifierDataPthreads.h: Added.
+        (WTF::ThreadIdentifierData::ThreadIdentifierData):
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Move initializeCurrentThreadInternal to after the lock to make
+                                 sure it is invoked when ThreadIdentifier is already established.
+
+        * wtf/Threading.h: Rename setThreadNameInternal -> initializeCurrentThreadInternal since it does more then only set the name now.
+        * wtf/ThreadingNone.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        (WTF::initializeThreading): Ditto.
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::clearPthreadHandleForIdentifier): Make it not 'static' so the ~ThreadIdentifierData() in another file can call it.
+        (WTF::initializeCurrentThreadInternal): Set the thread-specific data. The ThreadIdentifier is already established by creating thread.
+        (WTF::waitForThreadCompletion): Remove call to clearPthreadHandleForIdentifier(threadID) since it is now done in ~ThreadIdentifierData().
+        (WTF::detachThread): Ditto.
+        (WTF::currentThread): Use the thread-specific data to get the ThreadIdentifier. It's many times faster then Mutex-protected iteration through the map.
+                              Also, set the thread-specific data if called first time on the thread.
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ThreadSpecific for ENABLE(SINGLE_THREADED)
+        https://bugs.webkit.org/show_bug.cgi?id=33878
+
+        Implement ThreadSpecific with a simple getter/setter
+        when ENABLE(SINGLE_THREADED) is true.
+
+        Due to the change in https://bugs.webkit.org/show_bug.cgi?id=33236,
+        an implementation of ThreadSpecific must be available to build WebKit.
+        This causes a build failure for platforms without a proper
+        ThreadSpecific implementation.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add fastStrDup to FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=33937
+
+        The new string returned by fastStrDup is obtained with fastMalloc,
+        and can be freed with fastFree. This makes the memory management 
+        more consistent because we don't need to keep strdup allocated pointers
+        and free them with free(). Instead we can use fastFree everywhere.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastStrDup):
+        * wtf/FastMalloc.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        * wtf/Platform.h: Add a "HISTORY_ALWAYS_ASYNC" enable and turn it on for Chromium.
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Always create a prototype for automatically managed classes.
+        
+        This fixes some errors where prototype chains were not correctly hooked
+        up, and also ensures that API classes work correctly with features like
+        instanceof.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create): Cleaned up some of this code. Also changed it
+        to always create a prototype class.
+
+        * API/tests/testapi.c:
+        (Derived2_class):
+        (main): Fixed a null value crash in the exception checking code.
+        * API/tests/testapi.js: Added some tests for the case where a prototype
+        chain would not be hooked up correctly.
+
+2010-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Force JSC to create a prototype chain for API classes with a
+        parent class but no static functions.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+
+2010-01-21  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Object.getOwnPropertyDescriptor always returns undefined for JS API objects
+        https://bugs.webkit.org/show_bug.cgi?id=33946
+
+        Ideally the getOwnPropertyDescriptor() reimplementation should return an
+        access descriptor that wraps the property getter and setter callbacks, but
+        that approach is much more involved than returning a value descriptor.
+        Keep it simple for now.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * API/tests/testapi.js:
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Remove unnecessary function call.
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use the inline i386 assembly for x86_64 as well rather than falling back to using pthread mutexes.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7215063> Use GCD instead of an extra thread for FastMalloc scavenging on platforms where it is supported
+
+        Abstract the background scavenging slightly so that an alternate implementation that uses GCD can be used on platforms
+        where it is supported.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        * wtf/Platform.h:
+
+2010-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
+        all destructors
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks): Instead of fully marking protected objects,
+        just set their mark bits. This prevents protected objects from keeping
+        unprotected objects alive. Destructor order is not guaranteed, so it's
+        OK to destroy objects pointed to by protected objects before destroying
+        protected objects.
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        * wtf/TypeTraits.cpp: Added tests for the new type traits.
+        * wtf/TypeTraits.h:
+        (WTF::IsSubclass): Determines if a class is a derived from another class.
+        (WTF::IsSubclassOfTemplate): Determines if a class is a derived from a
+        template class (with one parameter that is unknown).
+        (WTF::RemoveTemplate): Reveals the type for a template parameter.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * DerivedSources.pro:
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        When JavaScriptCore calls Debugger::Exception, have it pass a
+        hasHandler variable that represents if exception is being handled
+        in the same function (not in a parent on the call stack).
+        
+        This just adds a new parameter, no behavior is changed.
+
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+        
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * runtime/WeakGCMap.h:
+        (JSC::::get): inline
+
+2010-01-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix for JIT with RVCT.
+
+        Remove IMPORT statement; cti_vm_throw is already defined in JITStubs.h.
+        Remove extra ')'.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiVMThrowTrampoline):
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrinkBlocks):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53454, since it causes much sadness in this world.
+
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Expose the following functions to be used by WebCore:
+         - WTF::msToyear()
+         - WTF::dayInYear()
+         - WTF::monthFromDayInYear()
+         - WTF::dayInMonthFromDayInYear()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::msToYear): Remove "static inline".
+        (WTF::dayInYear): Remove "static inline".
+        (WTF::monthFromDayInYear): Remove "static inline".
+        (WTF::dayInMonthFromDayInYear): Remove "static inline".
+        * wtf/DateMath.h: Declare the above functions.
+
+2010-01-18  Darin Adler  <darin@apple.com>
+
+        Fix build by reverting the previous change.
+
+        * runtime/UString.h: Rolled out the FastAllocBase base class.
+        It was making UString larger, and therefore JSString larger,
+        and too big for a garbage collection cell.
+
+        This raises the unpleasant possibility that many classes became
+        larger because we added the FastAllocBase base class. I am
+        worried about this, and it needs to be investigated.
+
+2010-01-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for UString class
+        https://bugs.webkit.org/show_bug.cgi?id=27831
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name     - instantiated at:
+        classs UString - JavaScriptCore/runtime/UString.cpp:160
+
+        * runtime/UString.h:
+
+2010-01-18  Evan Cheng  <evan.cheng@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add some ALWAYS_INLINE for key functions not inlined by some versions of GCC.
+        rdar://problem/7553780
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot): ALWAYS_INLINE both overloads.
+        * runtime/JSString.h:
+        (JSC::JSString::JSString): ALWAYS_INLINE the version that takes a UString.
+        * runtime/UString.h:
+        (JSC::operator==): ALWAYS_INLINE the version that compares two UString objects.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Delete dftables-xxxxxxxx.in files automatically.
+        https://bugs.webkit.org/show_bug.cgi?id=33796
+
+        * pcre/dftables: unlink unnecessary temporary file.
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Rolling out r53391 and r53392 because of random crashes on buildbots.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UString.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the build with strict gcc and RVCT versions: It's not legal to cast a
+        pointer to a function to a void* without an intermediate cast to a non-pointer
+        type. A cast to a ptrdiff_t inbetween fixes it.
+
+        * runtime/JSString.h:
+        (JSC::Fiber::JSString):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithFinalizer): Added new mechanism for a string to have an optional
+        finalizer callback, for the benefit of weak-referencing caches.
+        (JSC::):
+        (JSC::Fiber::JSString):
+        (JSC::Fiber::~JSString):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Clear fibers so this doesn't look like a string with a finalizer.
+        * runtime/WeakGCMap.h: Include "Collector.h" to make this header includable by itself.
+
+2010-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for <rdar://problem/7548432>
+        Add ALWAYS_INLINE to jsLess for a 1% speedup on llvm-gcc.
+
+        * runtime/Operations.h:
+        (JSC::jsLess):
+
+2010-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESISON: Google maps buttons not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=31871
+
+        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
+        getting directions for a second time
+        https://bugs.webkit.org/show_bug.cgi?id=33446
+        
+        SunSpider and v8 report no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case
+        flattening the dictionary changed any of its offsets.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): ditto
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33705
+        UStringImpl::create() should use internal storage
+
+        When creating a UStringImpl copying of a UChar*, we can use an internal buffer,
+        by calling UStringImpl::tryCreateUninitialized().
+
+        Also, remove duplicate of copyChars from JSString, call UStringImpl's version.
+
+        Small (max 0.5%) progression on Sunspidey.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        UString::create() creates a copy of the UChar* passed, but UStringImpl::create() assumes
+        that it should assume ownership of the provided buffer (with UString::createNonCopying()
+        and UStringImpl::createCopying() providing the alternate behaviours).  Unify on create()
+        taking a copy of the provided buffer.  For non-copying cases, use the name 'adopt', and
+        make this method take a Vector<UChar>&.  For cases where non-copying construction was being
+        used, other than from a Vector<UChar>, change the code to allocate the storage along with
+        the UStringImpl using UStringImpl::createUninitialized().  (The adopt() method also more
+        closely matches that of WebCore::StringImpl).
+
+        Also, UString::createUninitialized() and UStringImpl::createUninitialized() have incompatible
+        behaviours, in that the UString form sets the provided UChar* to a null or non-null value to
+        indicate success or failure, but UStringImpl uses the returned PassRefPtr<UStringImpl> to
+        indicate when allocation has failed (potentially leaving the output Char* uninitialized).
+        This is also incompatible with WebCore::StringImpl's behaviour, in that
+        StringImpl::createUninitialized() will CRASH() if unable to allocate.  Some uses of
+        createUninitialized() in JSC are unsafe, since they do not test the result for null.
+        UStringImpl's indication is preferable, since we may want a successful call to set the result
+        buffer to 0 (specifically, StringImpl returns 0 for the buffer where createUninitialized()
+        returns the empty string, which seems reasonable to catch bugs early).  UString's method
+        cannot support UStringImpl's behaviour directly, since it returns an object rather than a
+        pointer.
+            - remove UString::createUninitialized(), replace with calls to UStringImpl::createUninitialized()
+            - create a UStringImpl::tryCreateUninitialized() form UStringImpl::createUninitialized(),
+              with current behaviour, make createUninitialized() crash on failure to allocate.
+            - make cases in JSC that do not check the result call createUninitialized(), and cases that do
+              check call tryCreateUninitialized().
+
+        Rename computedHash() to existingHash(), to bring this in line wih WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHash::hash):
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::IdentifierRepHash::hash):
+        (JSC::makeString):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::existingHash):
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSON.stringify and JSON.parse needlessly process properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33053
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+        Test: fast/js/end-in-string-escape.html
+
+        * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+        assertion a chance to fire.
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig & Darin Adler.
+
+        Three quick fixes to UStringImpl.
+            - The destroy() method can be switched back to a normal destructor; since we've switched
+              the way we protect static strings to be using an odd ref-count the destroy() won't abort.
+            - The cost() calculation logic was wrong.  If you have multiple JSStrings wrapping substrings
+              of a base string, they would each report the full cost of the base string to the heap.
+              Instead we should only be reporting once for the base string.
+            - Remove the overloaded new operator calling fastMalloc, replace this with a 'using' to pick
+              up the implementation from the parent class.
+
+        * JavaScriptCore.exp:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * JavaScriptCore.pri: Moved source generation to DerivedSources.pro
+        * pcre/pcre.pri: Moved source generation to DerivedSources.pro
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add an extra argument to getPropertyNames() and getOwnPropertyNames()
+        (and all reimplementations thereof) that indicates whether non-enumerable
+        properties should be added.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyNames):
+        * runtime/Arguments.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp: Rename getEnumerablePropertyNames() to getPropertyNames(), which takes an extra argument.
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::):
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Identifier.cpp: (JSC::Identifier::checkSameIdentifierTable):
+        * wtf/FastMalloc.cpp:
+        * wtf/HashTable.h: (WTF::HashTableConstIterator::checkValidity):
+        * yarr/RegexCompiler.cpp: (JSC::Yarr::compileRegex):
+
+2009-11-23  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Make GIF decoder support down-sampling
+        https://bugs.webkit.org/show_bug.cgi?id=31806
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::upperBoundScaledY):
+        (WebCore::ImageDecoder::lowerBoundScaledY):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::scaledRect):
+        (WebCore::RGBA32Buffer::setScaledRect):
+        (WebCore::ImageDecoder::scaledSize):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::copyOnePixel):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+
+2010-01-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ecma/Date/15.9.5.12-1.js fails every night at midnight
+        https://bugs.webkit.org/show_bug.cgi?id=28041
+
+        Change the test to use a concrete time instead of "now".
+
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js:
+        * tests/mozilla/ecma/Date/15.9.5.12-1.js:
+
+2010-01-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Enable JIT and YARR_JIT if (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100)
+
+        * wtf/Platform.h:
+
+2010-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33481
+        Uninitialized data members in ArrayStorage
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize missing data members in the two cases
+        where we don't use fastZeroedMalloc, so it doesn't happen automatically.
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33480
+        
+        Improve debugging reliability for WTF on Windows.
+        Store WTF static library's PDB file into a better location.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Remove extraneous entries from def file causing build warning.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+        (AddRegExpCases):
+        * tests/mozilla/js1_2/regexp/toString.js:
+        Update relevant Mozilla tests (Mozilla has had this behavior since November 2003).
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/ecma/Array/15.4.1.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.1.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.1-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.13.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.16.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.18.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.5.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.7.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/TypeConversion/9.5-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/LexicalConventions/keywords-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/RegExp/exec-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/match-004.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/replace-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/split-002.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/Date/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_3/Exceptions/regress-181654.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-209067.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-85721.js: Added property allow-tabs.
+        * tests/mozilla/importList.html: Added property allow-tabs.
+        * tests/mozilla/js1_1/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Objects/toString-001.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/charCodeAt.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/concat.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/String/match.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Function_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Number.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/String.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/nesting.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-2-n.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/jsref.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/equality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/strictEquality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_dollar_number.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastIndex.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/alphanumeric.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/asterisk.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backslash.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backspace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/beginLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/character_class.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/compile.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/control_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/digit.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/dot.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/endLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/everything.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/exec.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/flags.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/global.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/hexadecimal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/ignoreCase.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/interval.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/octal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/parentheses.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/plus.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/question_mark.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/simple_form.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/source.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/special_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_replace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_search.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_split.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/test.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/toString.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/vertical_bar.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/whitespace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/word_boundary.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/break.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/continue.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/do_while.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch2.js: Added property allow-tabs.
+        * tests/mozilla/js1_3/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_4/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-111557.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-216320.js: Added property allow-tabs.
+        * tests/mozilla/menuhead.html: Added property allow-tabs.
+        * tests/mozilla/mklistpage.pl: Added property allow-tabs.
+        * tests/mozilla/runtests.pl: Added property allow-tabs.
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+        Moreover, fixes all "Weird number of spaces at line-start. Are you using a 4-space indent?"
+        errors reported by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * wtf/Platform.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Memory use grows grows possibly unbounded in this JavaScript Array test case
+        https://bugs.webkit.org/show_bug.cgi?id=31675
+
+        This fixes one observed bug in this test case, which is that
+        arrays don't report extra cost for the sparse value maps.
+
+        SunSpider reports a small speedup.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Report extra memory cost for
+        the sparse value map.
+        * runtime/JSArray.h: 
+
+2010-01-08  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary #include from FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33393
+
+        * wtf/FastMalloc.cpp:
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52983.
+        http://trac.webkit.org/changeset/52983
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        Broke 59 JavaScriptCore tests.  I don't think Kent knew about
+        run-javascriptcore-tests.  Sadly neither does the commit-bot,
+        yet.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        (JSC::RegExp::flags):
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52981.
+        http://trac.webkit.org/changeset/52981
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        Caused two JS tests to start failing:
+        ecma_2/RegExp/properties-001.js and js1_2/regexp/toString.js
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
 
         RVCT compiler with "-Otime -O3" optimization tries to optimize out 
         inline new'ed pointers that are passed as arguments.
         Proposed patch assigns new'ed pointer explicitly outside function call.
 
+        https://bugs.webkit.org/show_bug.cgi?id=33084
+
         * API/JSClassRef.cpp:
         (OpaqueJSClass::OpaqueJSClass):
         (OpaqueJSClassContextData::OpaqueJSClassContextData):
 
-2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+2010-01-08  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove an unnecessary cacheFlush from ARM_TRADITIONAL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=33203
+
+        * assembler/ARMAssembler.cpp: Remove obsolete linkBranch function.
+        (JSC::ARMAssembler::executableCopy): Inline a clean linkBranch code.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::getLdrImmAddress): Use inline function.
+        (JSC::ARMAssembler::getLdrImmAddressOnPool): Ditto.
+        (JSC::ARMAssembler::patchPointerInternal): Remove an unnecessary cacheFlush.
+        (JSC::ARMAssembler::linkJump): Use patchPointerInternal instead of linkBranch.
+        (JSC::ARMAssembler::linkCall): Ditto.
+        (JSC::ARMAssembler::relinkCall): Ditto.
+
+2010-01-07  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix for JSVALUE32 when ENABLE_JIT_OPTIMIZE* are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=33311
+
+        Move compileGetDirectOffset function to common part of JSVALUE32
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Allow call sites to determine if ASSERT_* and LOG_* macros are operational
+        https://bugs.webkit.org/show_bug.cgi?id=33020
+
+        * wtf/Assertions.h: Set ASSERT_MSG_DISABLED, FATAL_DISABLED,
+        ERROR_DISABLED, LOG_DISABLED to 1 if the compiler does not support
+        variadic macros. Refactor for better readibility.
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Symbian] Port ARM traditional JIT Trampolines to RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=30552
+
+        Take the GCC implementation and mechanically convert
+        it to RVCT syntax.
+
+        Use 'bx rX' instead of 'mov pc, rX' when it is available.
+
+        Developed in cooperation with Iain Campbell and Gabor Loki.
+
+        * JavaScriptCore.pri: Extra step to generate RVCT stubs. The 
+        script generation intentionally executed all the time not just
+        for RVCT targets.
+
+        * create_rvct_stubs: Added. Perl script to expand precompiler macros
+        for RVCT assembler - the template is defined in JITStubs.cpp.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Disable specific function tracking here,
+        instead of in WebCore, to ensure that the disabling happens before a
+        specific function can be registered.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Mac build fix.
+
+        * JavaScriptCore.exp: Export new JSGlobalData static data members.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        Test: fast/js/webcore-string-comparison.html
+
+        In r49365, some code was moved from JSString.cpp to JSString.h, and as a result, WebCore
+        got a way to directly instantiate JSStrings over DLL borders. Since vftable for JSString was
+        not exported, objects created from WebCore got a different vptr, and JavaScriptCore
+        optimizations that relied on vptr of all JSString objects being equal failed.
+
+        * config.h: Added a JS_EXPORTCLASS macro for exporting classes. It's currently the same as
+        JS_EXPORTDATA, but it clearly needed a new name.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        Store vptrs just once, no need to repeatedly pick and copy them. This makes it possible to
+        assert vptr correctness in object destructors (which don't have access to JSGlobalData,
+        and even Heap::heap(this) will fail for fake objects created from storeVPtrs()).
+
+        * runtime/JSArray.cpp: (JSC::JSArray::~JSArray): Assert that vptr is what we expect it to be.
+        It's important to assert in destructor, because MSVC changes the vptr after constructor
+        is invoked.
+        * runtime/JSByteArray.cpp: (JSC::JSByteArray::~JSByteArray): Ditto.
+        * runtime/JSByteArray.h: Ditto.
+        * runtime/JSFunction.h: Ditto.
+        * runtime/JSFunction.cpp: (JSC::JSFunction::~JSFunction): Ditto.
+
+        * runtime/JSCell.h: (JSC::JSCell::setVPtr): Added a method to substitute vptr for another
+        one.
+
+        * runtime/JSString.h: Export JSString class together with its vftable, and tell other
+        libraries tp import it. This is needed on platforms that have a separate JavaScriptCore
+        dynamic library - and on Mac, we already did the export via JavaScriptCore.exp.
+        (JSC::JSString::~JSString): Assert tha vptr is what we expect it to be.
+        (JSC::fixupVPtr): Store a previously saved primary vftable pointer (do nothing if building
+        JavaScriptCore itself).
+        (JSC::jsSingleCharacterString): Call fixupVPtr in case this is call across DLL boundary.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new static
+        JSGlobalData members that are used in WebCore via inline functions.
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        The memory use was caused by the global object creating too many structures
+        as it thrashed between different specific functions.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::despecifyAllFunctions):
+        * runtime/Structure.h:
+        (JSC::Structure::disableSpecificFunctionTracking): Track a thrash count
+        for specific functions. Disable specific function tracking once the
+        thrash count has been hit.
+
+2010-01-07  Csaba Osztrogonác  <ossy@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        Build fix for 32-bit Sparc machines: these machines are big-endian.
+        [Qt] Enable JIT in debug mode on win32 after r51141 fixed the crashes.
+
+        * JavaScriptCore.pri:
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Mac] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Using of operator += cause compile error on Mac, so it is changed to
+        "= static_cast<AllocAlignmentInteger*>(old_ptr) + 1".
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Remove pByte (committed in r42344 from #20422), because pByte doesn't
+        exist and it is unnecessary.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        QT build fix.
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecific):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part I.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecificCallback):
+
+2010-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33236
+        Remove m_identifierTable pointer from UString
+
+        Currently every string holds a pointer so that during destruction,
+        if a string has been used as an identifier, it can remove itself
+        from the table.  By instead accessing the identifierTable via a
+        thread specific tracking the table associated with the current
+        globaldata, we can save the memory cost of this pointer.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+            - change the API shims to track the identifierTable of the current JSGlobalData.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+
+            - update creation of JSGlobalData for API usage to use new create method.
+            - fix shim instanciation bug in JSGlobalContextCreateInGroup.
+
+        * JavaScriptCore.exp:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+
+            - add asserts to check the identifierTable is being tracked correctly.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkSameIdentifierTable):
+        (JSC::createIdentifierTableSpecificCallback):
+        (JSC::createIdentifierTableSpecific):
+        (JSC::createDefaultDataSpecific):
+
+            - Use currentIdentifierTable() instead of UStringImpl::m_identifierTable.
+            - Define methods to access the thread specific identifier tables.
+
+        * runtime/Identifier.h:
+        (JSC::ThreadIdentifierTableData::ThreadIdentifierTableData):
+        (JSC::defaultIdentifierTable):
+        (JSC::setDefaultIdentifierTable):
+        (JSC::currentIdentifierTable):
+        (JSC::setCurrentIdentifierTable):
+        (JSC::resetCurrentIdentifierTable):
+
+            - Declare methods to access the thread specific identifier tables.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+
+            - creation of JSGlobalData objects, other than for API usage, associate themselves with the current thread.
+
+        * runtime/JSGlobalData.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::destroy):
+
+            - destroy() method should be using isIdentifier().
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+
+            - replace m_identifierTable with a single m_isIdentifier bit.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+            - change string hash result from 32-bit to 31-bit, to free a bit in UStringImpl for m_isIdentifier.
+
+2009-12-25 Patrick Gansterer <paroga@paroga.com>
+ 
+        Reviewed by Eric Seidel.
+
+        Buildfix for WinCE + style fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=32939
+
+        * jsc.cpp:
+        (functionPrint):
+        (functionQuit):
+        (parseArguments):
+        (fillBufferWithContentsOfFile):
+ 
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix after r52791 (renamed PLATFORM(WINCE) to OS(WINCE)).
+        https://bugs.webkit.org/show_bug.cgi?id=33205
+
+        * jit/ExecutableAllocator.h:
+
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Added compiler error for unsupported platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=33112
+
+        * jit/JITStubs.cpp:
+
+2010-01-05  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow r52729 in ARMAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=33208
+
+        Use WTF_ARM_ARCH_AT_LEAST instead of ARM_ARCH_VERSION
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::encodeComplexImm): Move tmp declaration to ARMv7
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::bkpt):
+
+2010-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix for Gtk+
+
+        Don't use // comments in Platform.h, at least some of them seem to make the version of GCC
+        used on the Gtk buildbot unhappy.
 
         * wtf/Platform.h:
 
-2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        * wtf/Platform.h: Rename, reorganize and document OS() macros.
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * API/JSContextRef.cpp:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerX86Common.h:
+        * bytecode/SamplingTool.cpp:
+        * config.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        (main):
+        * parser/Grammar.y:
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * runtime/Collector.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp:
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/DateMath.cpp:
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::InitModule):
+        (WTF::TCMallocStats::):
+        * wtf/FastMalloc.h:
+        * wtf/MathExtras.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/StringExtras.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/ThreadSpecific.h:
+        (WTF::::destroy):
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::createThreadInternal):
+        * wtf/VMTags.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Add missing files to the build system - make distcheck build fix.
+
+        * GNUmakefile.am:
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig, additional coding by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Add string hashing functions to WTF.
+        Use WTF's string hashing functions from UStringImpl.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::computeHash):
+        * wtf/HashFunctions.h:
+        * wtf/StringHashFunctions.h: Added.
+        (WTF::stringHash):
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix ARM bulid.
+
+        * wtf/Platform.h:
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Add an 'isIdentifier' to UStringImpl, use this where appropriate
+        (where previously 'identifierTable' was being tested).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Shimmey Shimmey" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33158
+        Refactor JSC API entry/exit to use RAII instead of copy/pasting code.
+        Make it easier to change set of actions taken when passing across the API boundary.
+
+        * API/APIShims.h: Added.
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-01-04  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r52741.
+        http://trac.webkit.org/changeset/52741
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
 
         Reviewed by Darin Adler.
 
-        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
-        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
-        and Colin Watson <cjwatson@ubuntu.com>.
+        Add cacheFlush support for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33110
 
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        Implement NO_RETURN for COMPILER(MSVC).
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * runtime/JSCell.cpp:
+        (JSC::):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Document CPU() macros in comments.
+        https://bugs.webkit.org/show_bug.cgi?id=33147
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+        ExecutableAllocatorSymbian appears to have buggy ARM version check
+        https://bugs.webkit.org/show_bug.cgi?id=33138
+        
         * wtf/Platform.h:
+        Rename all macros related to detection of particular CPUs or
+        classes of CPUs to CPU(), reorganize and document them.
+
+        All remaining changes are adapting to the renames, plus fixing the
+        second bug cited above.
+        
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Registers::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCount):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/Threading.h:
+        * wtf/dtoa.cpp:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        * yarr/RegexJIT.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Clean up COMPILER macros and remove unused ones.
+        https://bugs.webkit.org/show_bug.cgi?id=33132
+        
+        Removed values are COMPILER(BORLAND) and COMPILER(CYGWIN) - they were
+        not used anywhere.
+
+        * wtf/Platform.h:
+
+2010-01-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Update wtf/Platform.h to document the new system for porting macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33130
+
+        * wtf/Platform.h:
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        PLATFORM(CAIRO) should be defined by WIN_CAIRO define
+        https://bugs.webkit.org/show_bug.cgi?id=22250
+
+        * wtf/Platform.h: Define WTF_PLATFORM_CAIRO for GTK port only
+        For the WinCairo port WTF_PLATFORM_CAIRO is already defined in config.h
+
+2009-12-28  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Delete ThreadPrivate instance after it is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=32614
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadMonitor::instance):
+        (WTF::ThreadMonitor::threadFinished):
+        (WTF::createThreadInternal):
+        (WTF::detachThread):
+
+2009-12-28  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleanup of #define JS_EXPORT.
+
+        * API/JSBase.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfix (HWND_MESSAGE isn't supported there)
+
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        Added a file with WinMain function to link agains in WinCE.
+
+        * os-win32/WinMain.cpp: Added.
+        (convertToUtf8):
+        (WinMain):
+
+2009-12-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed; revert of r52550.
+
+        The change regressed the following LayoutTests for QtWebKit.
+
+        fast/workers/worker-call.html -> crashed
+        fast/workers/worker-close.html -> crashed
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-24  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix memory leak by deleting instance of ThreadPrivate
+        in function waitForThreadCompletion(), synchronously, or in
+        detachThread(), asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=32614 
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Include stddef.h for ptrdiff_t
+        https://bugs.webkit.org/show_bug.cgi?id=32891
+
+        ptrdiff_t is typedef-ed in stddef.h.
+        Include stddef.h in jit/ExecutableAllocator.h.
+
+        * jit/ExecutableAllocator.h:
+
+2009-12-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r47092.
+
+        * wtf/wince/MemoryManager.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        Expose dateToDaysFrom1970().
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970):
+        * wtf/DateMath.h:
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+
+2009-12-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Updates Android's scheduleDispatchFunctionsOnMainThread() to use new
+        AndroidThreading class, rather than using JavaSharedClient directly.
+        This fixes the current layering violation.
+        https://bugs.webkit.org/show_bug.cgi?id=32651
+
+        The pattern is copied from Chromium, which uses the ChromiumThreading
+        class. This patch also fixes the style in ChromiumThreading.h.
+
+        * wtf/android/AndroidThreading.h: Added. Declares AndroidThreading.
+        * wtf/android/MainThreadAndroid.cpp: Modified
+        (WTF::scheduleDispatchFunctionsOnMainThread): Uses AndroidThreading.
+        * wtf/chromium/ChromiumThreading.h: Modified. Fixes style.
+
+2009-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a couple of problems with UntypedPtrAndBitfield.
+
+        Add a m_leaksPtr to reduce false positives from leaks in debug builds
+        (this isn't perfect because we'd like a solution for release builds,
+        but this is now at least as good as a PtrAndFlags would be).
+
+        Switch SmallStringsto use a regular string for the base, rather than
+        a static one.  UntypedPtrAndBitfield assumes all strings are at least
+        8 byte aligned; this migt not be true of static strings.  Shared buffers
+        are heap allocated, as are all UStringImpls other than static strings.
+        Static strings cannot end up being the owner string of substrings,
+        since the only static strings are length 0.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UStringImpl::UStringImpl):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT (__ARMCC_VERSION < 400000) does not provide strcasecmp and strncasecmp
+        https://bugs.webkit.org/show_bug.cgi?id=32857
+
+        Add implementation of strcasecmp and strncasecmp for RVCT < 4.0
+        because earlier versions of RVCT 4.0 does not provide these functions.
+
+        * wtf/StringExtras.cpp: Added.
+        (strcasecmp):
+        (strncasecmp):
+        * wtf/StringExtras.h:
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Define ALWAYS_INLINE and WTF_PRIVATE_INLINE to __forceinline for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=32853
+
+        Use __forceinline forces RVCT to compile a C or C++ function
+        inline. The compiler attempts to inline the function, regardless of
+        the characteristics of the function.
+
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.h:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective GTK build fix: Add UStringImpl.cpp/h to the build.
+
+        * GNUmakefile.am:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add UStringImpl.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix part 5.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Fix breakage of world introduced in build fix to r52463.
+
+        * runtime/UStringImpl.h:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+            * Remove redundant overcapacity mechanisms.
+            * Reduce memory cost of Rep's.
+            * Add an inline storage mechanism akin to that in WebCore's StringImpl.
+
+        ~1% Sunspider progression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::createRep):
+        (JSC::UString::createFromUTF8):
+        (JSC::UString::createUninitialized):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::ascii):
+        (JSC::UString::operator=):
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+        (JSC::makeString):
+        * runtime/UStringImpl.cpp: Added.
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::destroy):
+        (JSC::UStringImpl::computeHash):
+        * runtime/UStringImpl.h: Added.
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createCopying):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::computedHash):
+        (JSC::UStringImpl::setHash):
+        (JSC::UStringImpl::identifierTable):
+        (JSC::UStringImpl::setIdentifierTable):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::allocChars):
+        (JSC::UStringImpl::copyChars):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::null):
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::operator new):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+
+2009-12-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move some build decisions from Qt build system into source files
+        https://bugs.webkit.org/show_bug.cgi?id=31956
+
+        * JavaScriptCore.pri: Compile files unconditionally
+        * jit/ExecutableAllocatorPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * jit/ExecutableAllocatorWin.cpp: Guard with PLATFORM(WIN_OS)
+        * runtime/MarkStackPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * runtime/MarkStackSymbian.cpp: Guard with PLATFORM(SYMBIAN)
+        * runtime/MarkStackWin.cpp: Guard with PLATFORM(WIN_OS)
+        * wtf/Platform.h: Guard ENABLE_JSC_MULTIPLE_THREADS with ENABLE_SINGLE_THREADED for the Qt port
+        * wtf/ThreadingNone.cpp: Guard with ENABLE(SINGLE_THREADED)
+        * wtf/qt/ThreadingQt.cpp: Guard with !ENABLE(SINGLE_THREADED)
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add createNonCopying method to UString to make replace constructor passed bool,
+        to make behaviour more explicit.  Add createFromUTF8 to UString (wrapping method
+        on UString::Rep), since other cases of transliteration (e.g.  from ascii) are
+        performed in UString constructors.  Add/use setHash & size() accessors on Rep,
+        rather than accessing _hash/len directly.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::createNonCopying):
+        (JSC::UString::createFromUTF8):
+        * runtime/UString.h:
+        (JSC::UString::Rep::setHash):
+        (JSC::UString::~UString):
+        (JSC::makeString):
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Gavin Barraclough.
+        
+        Changed Register constructors to assignment operators, to streamline
+        moving values into registers. (In theory, there's no difference between
+        the two, since the constructor should just inline away, but there seems
+        to be a big difference in the addled mind of the GCC optimizer.)
+
+        In the interpreter, this is a 3.5% SunSpider speedup and a 1K-2K
+        reduction in stack usage per privateExecute stack frame.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScopeChain):
+        (JSC::ExecState::init):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock): Added a little bit of casting so these
+        functions could use the new Register assignment operators.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::Register):
+        (JSC::Register::operator=): Swapped in assignment operators for constructors.
 
 2009-12-18  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
@@ -81,6 +7643,1656 @@
 
         * wtf/Assertions.h:
 
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixed intermittent failure seen on Windows buildbot, and in other JSC
+        API clients.
+        
+        Added a WeakGCPtr class and changed OpaqueJSClass::cachedPrototype to
+        use it, to avoid vending a stale object as a prototype.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h: Use WeakGCPtr.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/WeakGCPtr.h: Added.
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::operator*):
+        (JSC::WeakGCPtr::operator->):
+        (JSC::WeakGCPtr::operator!):
+        (JSC::WeakGCPtr::operator bool):
+        (JSC::WeakGCPtr::operator UnspecifiedBoolType):
+        (JSC::WeakGCPtr::assign):
+        (JSC::::operator):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::static_pointer_cast):
+        (JSC::const_pointer_cast):
+        (JSC::getPtr): Added WeakGCPtr to the project.
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+
+        * JavaScriptCore.exp:
+            - Remove exports for UString::append
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Make StringBuilder a private header (was project).
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GRefPtr does not take a reference when assigned a raw pointer
+        https://bugs.webkit.org/show_bug.cgi?id=32709
+
+        Ensure that when assigning a raw pointer to a GRefPtr, the reference
+        count is incremented. Also remove the GRefPtr conversion overload as
+        GRefPtr types have necessarily incompatible reference counting.
+
+        * wtf/gtk/GRefPtr.h:
+        (WTF::GRefPtr::operator=):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * pcre/pcre.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Compile warning from line 29 of GRefPtr.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32703
+
+        Fix memory leak and compiler warning in GRefPtr GHashTable template
+        specialization.
+
+        * wtf/gtk/GRefPtr.cpp:
+        (WTF::refGPtr):
+
+2009-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add BUILDING_ON_SNOW_LEOPARD and TARGETING_SNOW_LEOPARD #defines.
+
+        * wtf/Platform.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Sync JavaScriptCore.vcproj with JavaScriptCore.xcodeproj and the
+        source tree
+
+        Fixes <http://webkit.org/b/32665>.
+
+        Reviewed by Ada Chan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Moved
+        around files and filters so that the structure matches
+        JavaScriptCore.xcodeproj and the source tree. A few headers that were
+        previously omitted have been added, as well as JSZombie.{cpp,h}.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Remove HeavyProfile and TreeProfile completely
+
+        These were mostly removed in r42808, but the empty files were left in
+        place.
+
+        Fixes <http://webkit.org/b/32664>.
+
+        Reviewed by John Sullivan.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        Removed HeavyProfile/TreeProfile source files.
+
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Implement GRefPtr, a smart pointer for reference counted GObject types.
+
+        * GNUmakefile.am:
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GDir):
+        * wtf/gtk/GRefPtr.h: Added.
+        (WTF::):
+        (WTF::GRefPtr::GRefPtr):
+        (WTF::GRefPtr::~GRefPtr):
+        (WTF::GRefPtr::clear):
+        (WTF::GRefPtr::get):
+        (WTF::GRefPtr::operator*):
+        (WTF::GRefPtr::operator->):
+        (WTF::GRefPtr::operator!):
+        (WTF::GRefPtr::operator UnspecifiedBoolType):
+        (WTF::GRefPtr::hashTableDeletedValue):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+        (WTF::adoptGRef):
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7355025> Interpreter::privateExecute macro generates
+        bloated code
+        
+        This patch cuts Interpreter stack use by about a third.
+
+        * bytecode/Opcode.h: Changed Opcode to const void* to work with the
+        const static initiliazation we want to do in Interpreter::privateExecute.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter): Moved hashtable initialization here to
+        avoid polluting Interpreter::privateExecute's stack, and changed it from a
+        series of add() calls to one add() call in a loop, to cut down on code size.
+
+        (JSC::Interpreter::privateExecute): Changed a series of label computations
+        to a copy of a compile-time constant array to cut down on code size.
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "r=me" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32498
+        <rdar://problem/7471495>
+        REGRESSION(r51978-r52039): AJAX "Mark This Forum Read" function no longer
+        works
+        
+        Fixed a tyop.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd): Use the '&&' operator, not the ',' operator.
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build: don't export this inlined function.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Inlined JSCell's operator new.
+        
+        3.7% speedup on bench-allocate-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the number heap, replacing it with a one-item free list for
+        numbers, taking advantage of the fact that two number cells fit inside
+        the space for one regular cell, and number cells don't require destruction.
+        
+        SunSpider says 1.6% faster in JSVALUE32 mode (the only mode that
+        heap-allocates numbers).
+        
+        SunSpider says 1.1% faster in JSVALUE32_64 mode. v8 says 0.8% faster
+        in JSVALUE32_64 mode. 10% speedup on bench-alloc-nonretained.js. 6%
+        speedup on bench-alloc-retained.js.
+        
+        There's a lot of formulaic change in this patch, but not much substance.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        (JSC::Heap::sweep):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Collector.h:
+        (JSC::): Removed all code pertaining to the number heap, and changed all
+        heap template functions and classes to non-template functions and classes.
+
+        (JSC::Heap::allocateNumber): A new optimization to replace the number
+        heap: allocate half-sized number cells in pairs, returning the first
+        cell and caching the second cell for the next allocation.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++):
+        * runtime/JSCell.h:
+        (JSC::JSCell::isNumber): Removed all code pertaining to the number heap,
+        and changed all heap template functions and classes to non-template functions
+        and classes.
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WeakGCMap class
+        https://bugs.webkit.org/show_bug.cgi?id=32547
+
+        Inherits WeakGCMap from FastAllocBase because it is instantiated by
+        'new' at: WebCore/dom/Document.cpp:512.
+
+        * runtime/WeakGCMap.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for dtoa's P5Node struct
+        https://bugs.webkit.org/show_bug.cgi?id=32544
+
+        Inherits P5Node struct from Noncopyable because it is instantiated by
+        'new' at wtf/dtoa.cpp:588 and don't need to be copyable.
+
+        * wtf/dtoa.cpp:
+
+2009-12-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32524
+        REGRESSION(52084): fast/dom/prototypes.html failing two CSS tests
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): The original patch put the parentheses in the wrong
+        place, completely changing the calculation and making it almost always
+        wrong. Moved the parentheses around the '+' operation, like the original
+        compiler warning suggested.
+
+2009-12-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix.
+
+        Fix crosses initialization of usedPrimaryBlocks for JSValue32
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+
+2009-12-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        GCC 4.3.x warning fixed. Suggested parantheses added.
+        warning: ../../../JavaScriptCore/wtf/StdLibExtras.h:77: warning: suggest parentheses around + or - in operand of &
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+        
+        Added WeakGCMap to keep WebCore blissfully ignorant about objects that
+        have become garbage but haven't run their destructors yet.
+        
+        1% SunSpider speedup.
+        7.6% v8 speedup (37% splay speedup).
+        17% speedup on bench-alloc-nonretained.js.
+        18% speedup on bench-alloc-retained.js.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated for renames and new
+        files.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use the Collector
+        iterator abstraction.
+
+        * jsc.cpp:
+        (functionGC): Updated for rename.
+
+        * runtime/Collector.cpp: Slightly reduced the number of allocations per
+        collection, so that small workloads only allocate on collector block,
+        rather than two.
+
+        (JSC::Heap::Heap): Updated to use the new allocateBlock function.
+
+        (JSC::Heap::destroy): Updated to use the new freeBlocks function.
+
+        (JSC::Heap::allocateBlock): New function to initialize a block when
+        allocating it.
+
+        (JSC::Heap::freeBlock): Consolidated the responsibility for running
+        destructors into this function.
+
+        (JSC::Heap::freeBlocks): Updated to use freeBlock.
+
+        (JSC::Heap::recordExtraCost): Sweep the heap in this reporting function,
+        so that allocation, which is more common, doesn't have to check extraCost.
+
+        (JSC::Heap::heapAllocate): Run destructors right before recycling a
+        garbage cell. This has better cache utilization than a separate sweep phase.
+
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks): New set of functions for managing the size of
+        the heap, now that the heap doesn't maintain any information about its
+        size.
+
+        (JSC::isPointerAligned):
+        (JSC::isHalfCellAligned):
+        (JSC::isPossibleCell):
+        (JSC::isCellAligned):
+        (JSC::Heap::markConservatively): Cleaned up this code a bit.
+
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells): Some helper functions for examining the the mark
+        bitmap.
+
+        (JSC::Heap::sweep): Simplified this function by using a DeadObjectIterator.
+
+        (JSC::Heap::markRoots): Reordered some operations for clarity.
+
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics): Rewrote these functions to calculate an object
+        count on demand, since the heap doesn't maintain this information by 
+        itself.
+
+        (JSC::Heap::reset): New function for resetting the heap once we've
+        exhausted heap space.
+
+        (JSC::Heap::collectAllGarbage): This function matches the old collect()
+        behavior, but it's now an uncommon function used only by API.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::count):
+        (JSC::CollectorBitmap::isEmpty): Added some helper functions for managing
+        the collector mark bitmap.
+
+        (JSC::Heap::reportExtraMemoryCost): Changed reporting from cell equivalents
+        to bytes, so it's easier to understand.
+        
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::CollectorHeapIterator):
+        (JSC::CollectorHeapIterator::operator!=):
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::::LiveObjectIterator):
+        (JSC::::operator):
+        (JSC::::DeadObjectIterator):
+        (JSC::::ObjectIterator): New iterators for encapsulating details about
+        heap layout, and what's live and dead on the heap.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength): Delay reporting extra cost until
+        we're fully constructed, so the heap mark phase won't visit us in an
+        invalid state.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSCell::JSCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Added a dummy cell to simplify allocation logic.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring): Don't report extra cost for substrings, since they
+        share a buffer that's already reported extra cost.
+
+        * runtime/Tracing.d:
+        * runtime/Tracing.h: Changed these dtrace hooks not to report object
+        counts, since they're no longer cheap to compute.
+
+        * runtime/UString.h: Updated for renames.
+
+        * runtime/WeakGCMap.h: Added.
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedBegin):
+        (JSC::WeakGCMap::uncheckedEnd):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove): Mentioned above.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): Added a bit population count function, so the heap can
+        count live objects to fulfill statistics questions.
+
+The very last cell in the block is not allocated -- should not be marked.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Export some new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some old exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Use unsigned instead of uint32_t to avoid dependencies.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative Windows build fix).
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32496
+        Switch remaining cases of string construction to use StringBuilder.
+        Builds strings using a vector rather than using string append / addition.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::indent):
+        * runtime/JSString.h:
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncConcat):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT and USE_ATSUI on Chrome/Mac.
+
+2009-12-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Unify codegen for forward and backward variants of branches
+        https://bugs.webkit.org/show_bug.cgi?id=32463
+
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop): Implemented in terms of forward variant.
+        (JSC::JIT::emit_op_loop_if_true): ditto
+        (JSC::JIT::emitSlow_op_loop_if_true): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        (JSC::JIT::emit_op_loop_if_less): ditto
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        * jit/JITOpcodes.cpp:
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Allow WTFs concept of the main thread to differ from pthreads when necessary.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32454
+        Refactor construction of simple strings to avoid string concatenation.
+
+        Building strings through concatenation has a memory and performance cost -
+        a memory cost since we must over-allocate the buffer to leave space to append
+        into, and performance in that the string may still require reallocation (and
+        thus copying during construction).  Instead move the full construction to
+        within a single function call (makeString), so that the arguments' lengths
+        can be calculated and an appropriate sized buffer allocated before copying
+        any characters.
+
+        ~No performance change (~2% progression on date tests).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDate):
+        (JSC::formatDateUTCVariant):
+        (JSC::formatTime):
+        (JSC::formatTimeUTC):
+        * runtime/DateConversion.h:
+        (JSC::):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        * runtime/UString.h:
+        (JSC::):
+        (JSC::makeString):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        Re-landing r51975 - added toPrimitiveString method,
+        performs toPrimitive then subsequent toString operations.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added
+        $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCorePresent.h to include/private
+
+        This fixes other projects that use wtf/Platform.h
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS do its thang.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Write
+        QuartzCorePresent.h to $(WebKitOutputDir)/include/private.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        Added $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Fix clean builds and everything rebuilding on every build
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Don't
+        write out QuartzCorePresent.h if it exists but is older than
+        QuartzCore.h. Also, create the directory we write QuartzCorePresent.h
+        into first.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix for systems with spaces in their paths
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Quote some paths.
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add check for presence of QuartzCore headers
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        The script now checks for the presence of QuartzCore.h. If present
+        it will turn on ACCELERATED_COMPOSITING and 3D_RENDERING to enable
+        HW compositing on Windows. The script writes QuartzCorePresent.h to
+        the build directory which has a define telling whether QuartzCore is 
+        present.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * wtf/Platform.h:
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a problem that JSC::gregorianDateTimeToMS() returns a negative
+        value for a huge year value.
+        https://bugs.webkit.org/show_bug.cgi?id=32304
+
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970): Renamed from dateToDayInYear, and changed the return type to double.
+        (WTF::calculateDSTOffset): Follow the dateToDaysFrom1970() change.
+        (WTF::timeClip): Use maxECMAScriptTime.
+        (JSC::gregorianDateTimeToMS): Follow the dateToDaysFrom1970() change.
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r51975.
+        http://trac.webkit.org/changeset/51975
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect caching of prototype lookup with dictionary base
+        https://bugs.webkit.org/show_bug.cgi?id=32402
+
+        Make sure we don't add cached prototype lookup to the proto_list
+        lookup chain if the top level object is a dictionary.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSObject::getPropertyAttributes() and all usage of it.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        getOwnPropertyDescriptor() should be used instead.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32367
+        Add support for short Ropes (up to 3 entries) inline within JSString.
+        (rather than externally allocating an object to hold the rope).
+        Switch jsAdd of (JSString* + JSString*) to now make use of Ropes.
+
+        ~1% progression on Sunspidey.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::deref):
+        (JSC::JSString::Rope::Fiber::ref):
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        (JSC::JSString::JSString):
+        (JSC::JSString::~JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::length):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::appendStringInConstruct):
+        (JSC::JSString::appendValueInConstructAndIncrementLength):
+        (JSC::JSString::isRope):
+        (JSC::JSString::string):
+        (JSC::JSString::ropeLength):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+        (JSC::resolveBase):
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix three more things found by compiling with clang++.
+        
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        Add the 'std' qualifier to the call to make_pair.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+        Incrementing a bool is deprecated according to the C++ specification.
+        
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        Name lookup should not be done in dependent bases, so explicitly qualify the call to set.
+
+2009-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Google reader gets stuck in the "Loading..." state and does not complete
+        https://bugs.webkit.org/show_bug.cgi?id=32256
+        <rdar://problem/7456388>
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless): Fix some backward branches.
+
+2009-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32228
+        Make destruction of ropes non-recursive to prevent stack exhaustion.
+        Also, pass a UString& into initializeFiber rather than a Ustring::Rep*,
+        since the Rep is not being ref counted this could result in usage of a
+        Rep with refcount zero (where the Rep comes from a temporary UString
+        returned from a function).
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::destructNonRecursive):
+        (JSC::JSString::Rope::~Rope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::initializeFiber):
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+
+2009-12-09  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Update to r51457. ASSERTs changed to COMPILE_ASSERTs.
+        The speedup is 25%.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updates Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified.
+        * Android.v8.wtf.mk: Modified.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a bug found while trying to compile JavaScriptCore with clang++.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm): Don't self assign here.  Use false instead.
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Attempt to fix the Windows build.
+        
+        * wtf/FastMalloc.h:
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix some things found while trying to compile JavaScriptCore with clang++.
+
+        * wtf/FastMalloc.h:
+        Add correct exception specifications for the allocation/deallocation operators.
+        
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        Fix a bunch of struct/class mismatches.
+
+2009-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        move code generation portions of Nodes.cpp to bytecompiler directory
+        https://bugs.webkit.org/show_bug.cgi?id=32284
+
+        * bytecompiler/NodesCodegen.cpp: Copied from parser/Nodes.cpp. Removed parts that
+        are not about codegen.
+        * parser/Nodes.cpp: Removed everything that is about codegen.
+
+        Update build systems:
+        
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
+        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
+        and Colin Watson <cjwatson@ubuntu.com>.
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Disable thread verification on this class since it uses addressOfCount().
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Add ASSERT.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::derefBase): Ditto.
+        (WTF::RefCountedBase::disableThreadVerification): delegate to ThreadVerifier method.
+        * wtf/ThreadVerifier.h: Added.
+        (WTF::ThreadVerifier::ThreadVerifier): New Debug-only class to verify that ref/deref of RefCounted is done on the same thread.
+        (WTF::ThreadVerifier::activate): Activates checks. Called when ref count becomes above 2.
+        (WTF::ThreadVerifier::deactivate): Deactivates checks. Called when ref count drops below 2.
+        (WTF::ThreadVerifier::disableThreadVerification): used on objects that should not be checked (StringImpl etc)
+        (WTF::ThreadVerifier::verifyThread):
+        * GNUmakefile.am: Add ThreadVerifier.h to the build file.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+        * Android.v8.wtf.mk: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fixage part I).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toString):
+        * API/JSValueRef.cpp:
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/Profiler.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getString):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::createOrNull):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSValue::toString):
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/Operations.cpp:
+        (JSC::JSValue::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo):
+        * runtime/PropertyDescriptor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        op_loop_if_less JIT codegen is broken for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=32221
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false): Fix codegen in this version - test was backwards.
+
+2009-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Actually tested 64-bit *and* 32-bit build this time.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really really fix 64-bit build for prior patch (actually tested this time).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+        (JSC::JIT::emitSlow_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really fix 64-bit build for prior patch.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix 64-bit build for prior patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        conway benchmark spends half it's time in op_less (jump fusion fails)
+        https://bugs.webkit.org/show_bug.cgi?id=32190
+
+        <1% speedup on SunSpider and V8
+        2x speedup on "conway" benchmark
+        
+        Two optimizations:
+        1) Improve codegen for logical operators &&, || and ! in a condition context
+        
+        When generating code for combinations of &&, || and !, in a
+        condition context (i.e. in an if statement or loop condition), we
+        used to produce a value, and then separately jump based on its
+        truthiness. Now we pass the false and true targets in, and let the
+        logical operators generate jumps directly. This helps in four
+        ways:
+
+        a) Individual clauses of a short-circuit logical operator can now
+        jump directly to the then or else clause of an if statement (or to
+        the top or exit of a loop) instead of jumping to a jump.
+        
+        b) It used to be that jump fusion with the condition of the first
+        clause of a logical operator was inhibited, because the register
+        was ref'd to be used later, in the actual condition jump; this no
+        longer happens since a jump straight to the final target is
+        generated directly.
+
+        c) It used to be that jump fusion with the condition of the second
+        clause of a logical operator was inhibited, because there was a
+        jump target right after the second clause and before the actual
+        condition jump. But now it's no longer necessary for the first
+        clause to jump there so jump fusion is not blocked.
+
+        d) We avoid generating excess mov statements in some cases.
+        
+        As a concrete example this source:
+        
+        if (!((x < q && y < q) || (t < q && z < q))) {
+            // ...
+        }
+        
+        Used to generate this bytecode:
+        
+        [  34] less              r1, r-15, r-19
+        [  38] jfalse            r1, 7(->45)
+        [  41] less              r1, r-16, r-19
+        [  45] jtrue             r1, 14(->59)
+        [  48] less              r1, r-17, r-19
+        [  52] jfalse            r1, 7(->59)
+        [  55] less              r1, r-18, r-19
+        [  59] jtrue             r1, 17(->76)
+        
+        And now generates this bytecode (also taking advantage of the second optimization below):
+        
+        [  34] jnless            r-15, r-19, 8(->42)
+        [  38] jless             r-16, r-19, 26(->64)
+        [  42] jnless            r-17, r-19, 8(->50)
+        [  46] jless             r-18, r-19, 18(->64)
+        
+        Note the jump fusion and the fact that there's less jump
+        indirection - three of the four jumps go straight to the target
+        clause instead of indirecting through another jump.
+        
+        2) Implement jless opcode to take advantage of the above, since we'll now often generate
+        a less followed by a jtrue where fusion is not forbidden.
+       
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::hasConditionContextCodegen): Helper function to determine
+        whether a node supports special conditional codegen. Return false as this is the default.
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): Assert not reached - only really
+        defined for nodes that do have conditional codegen.
+        (JSC::UnaryOpNode::expr): Add const version.
+        (JSC::LogicalNotNode::hasConditionContextCodegen): Returne true only if subexpression
+        supports it.
+        (JSC::LogicalOpNode::hasConditionContextCodegen): Return true.
+        * parser/Nodes.cpp:
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext): Implemented - just swap
+        the true and false targets for the child node.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Implemented - handle jumps
+        directly, improving codegen quality. Also handles further nested conditional codegen.
+        (JSC::ConditionalNode::emitBytecode): Use condition context codegen when available.
+        (JSC::IfNode::emitBytecode): ditto
+        (JSC::IfElseNode::emitBytecode): ditto
+        (JSC::DoWhileNode::emitBytecode): ditto
+        (JSC::WhileNode::emitBytecode): ditto
+        (JSC::ForNode::emitBytecode): ditto
+
+        * bytecode/Opcode.h: 
+        - Added loop_if_false opcode - needed now that falsey jumps can be backwards.
+        - Added jless opcode to take advantage of new fusion opportunities.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Handle above.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue): Add peephole for less + jtrue ==> jless.
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add handling of backwrds falsey jumps.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext): Wrapper to handle tracking of
+        overly deep expressions etc.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Implement the two new opcodes (loop_if_false, jless).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Implement JIT support for the two new opcodes.
+        (JSC::JIT::privateCompileSlowCases): ditto
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless): ditto
+        (JSC::JIT::emitBinaryDoubleOp): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScript delete operator should return false for string properties
+        https://bugs.webkit.org/show_bug.cgi?id=32012
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolled back r51633 because it causes a perf regression in Chromium.
+
+        * wtf/Platform.h:
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Export a symbol that should be exported.
+
+2009-12-03  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Mac build.
+
+        * JavaScriptCore.exp:  Export a symbol that should be exported.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
+        https://bugs.webkit.org/show_bug.cgi?id=32133
+
+        Work around odd GCC-ism and correct the scopechain for use by
+        calls made while a cachedcall is active on the callstack.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Brraaaaiiiinnnnnzzzzzzzz" Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32136
+        Add a rope representation to JSString.  Presently JSString always holds its data in UString form.
+        Instead, allow the result of a string concatenation to be represented in a tree form - with a
+        variable sized, reference-counted rope node retaining a set of UString::Reps (or other rope nopes).
+
+        Strings must still currently be resolved down to a flat UString representation before being used,
+        but by holding the string in a rope representation during construction we can avoid copying data
+        until we know the final size of the string.
+
+        ~2% progression on SunSpider (~25% on date-format-xparb, ~20% on string-validate-input).
+
+        * JavaScriptCore.exp:
+
+            - Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            - Switch the string length trampoline to read the length directly from JSString::m_length,
+              rather than from the JSString's UString::Rep's 'len' property.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            - Modify op_add such that addition of two strings, where either or both strings are already
+              in rope representation, produces a rope as a result.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::copyChars):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::Fiber):
+        (JSC::JSString::Rope::Fiber::destroy):
+        (JSC::JSString::Rope::Fiber::isRope):
+        (JSC::JSString::Rope::Fiber::rope):
+        (JSC::JSString::Rope::Fiber::string):
+        (JSC::JSString::Rope::create):
+        (JSC::JSString::Rope::initializeFiber):
+        (JSC::JSString::Rope::ropeLength):
+        (JSC::JSString::Rope::stringLength):
+        (JSC::JSString::Rope::fibers):
+        (JSC::JSString::Rope::Rope):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::length):
+        (JSC::JSString::isRope):
+        (JSC::JSString::rope):
+        (JSC::JSString::string):
+        (JSC::JSString::canGetIndex):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSubstring):
+        (JSC::JSString::getStringPropertySlot):
+
+            - Add rope form.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+
+            - Update string concatenation, and addition of ropes, to produce ropes.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT for Chrome/Mac.
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add files missed in prior patch.
+
+        * runtime/JSZombie.cpp:
+        (JSC::):
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h: Added.
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::isZombie):
+        (JSC::JSZombie::classInfo):
+        (JSC::JSZombie::isGetterSetter):
+        (JSC::JSZombie::isAPIValueWrapper):
+        (JSC::JSZombie::isPropertyNameIterator):
+        (JSC::JSZombie::getCallData):
+        (JSC::JSZombie::getConstructData):
+        (JSC::JSZombie::getUInt32):
+        (JSC::JSZombie::toPrimitive):
+        (JSC::JSZombie::getPrimitiveNumber):
+        (JSC::JSZombie::toBoolean):
+        (JSC::JSZombie::toNumber):
+        (JSC::JSZombie::toString):
+        (JSC::JSZombie::toObject):
+        (JSC::JSZombie::markChildren):
+        (JSC::JSZombie::put):
+        (JSC::JSZombie::deleteProperty):
+        (JSC::JSZombie::toThisObject):
+        (JSC::JSZombie::toThisString):
+        (JSC::JSZombie::toThisJSString):
+        (JSC::JSZombie::getJSNumber):
+        (JSC::JSZombie::getOwnPropertySlot):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add zombies to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=32103
+
+        Add a compile time flag to make the JSC collector replace "unreachable"
+        objects with zombie objects.  The zombie object is a JSCell subclass that
+        ASSERTs on any attempt to use the JSCell methods.  In addition there are
+        a number of additional assertions in bottleneck code to catch zombie usage
+        as quickly as possible.
+
+        Grrr. Argh. Brains.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isZombie):
+        (JSC::JSValue::isZombie):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        * wtf/Platform.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added variants of find/contains/add that allow a foreign key type to be used.
+        This will allow AtomicString-keyed maps to be queried by C string without
+        having to create a temporary AtomicString (see HTTPHeaderMap.)
+        The code for this is adapted from the equivalent in HashSet.h.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::find):
+        (WTF::HashMap::contains):
+        (WTF::HashMap::add):
+        * wtf/HashSet.h: Changed "method" to "function member" in a comment.
+
+2009-12-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Revert 51551 because it broke GTK+.
+
+        * wtf/Platform.h:
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix.  Reviewed by NOBODY.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+        
+        Remove the temporary duct tape of willExecute/didExecute virtual hooks on the JSGlobalData::ClientData - these are no longer necessary.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete PLATFORM(KDE) code
+        https://bugs.webkit.org/show_bug.cgi?id=31958
+
+        KDE is now using unpatched QtWebKit.
+
+        * parser/Lexer.cpp: Remove obsolete KDE_USE_FINAL guard
+        * wtf/Platform.h: Remove PLATFORM(KDE) definition and code 
+        section that is guarded with it.
+
 2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -97,6 +9309,15 @@
 
         * wtf/TypeTraits.h:
 
+2009-11-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Mac build has JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=31828
+
+        * wtf/Platform.h: Enable JIT for Qt Mac builds
+
 2009-11-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
@@ -107,15 +9328,219 @@
         * runtime/MarkStack.h:
         (JSC::MarkStack::MarkStackArray::shrinkAllocation):
 
-2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+2009-11-28  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Reviewed by Darin Adler.
+        Reviewed by Gavin Barraclough.
 
-        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
-        https://bugs.webkit.org/show_bug.cgi?id=31631
+        https://bugs.webkit.org/show_bug.cgi?id=31930
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
+        Seems a typo. We don't need ~270k memory to determine the vptrs.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. 
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        Build fix for chromium after r51423.
+        Exclude gtk directory from chromium build.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect behaviour of jneq_null in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=31901
+
+        Correct the logic of jneq_null.  This is already covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Change the path for GOwnPtr.*.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Remove
+          GOwnPtr.cpp from the exclude list.
+        * JavaScriptCore.gypi: Change the path for GOwnPtr.*.
+        * wscript: Remove GOwnPtr.cpp from the exclude list.
+        * wtf/GOwnPtr.cpp: Removed.
+        * wtf/GOwnPtr.h: Removed.
+        * wtf/Threading.h: Change the path for GOwnPtr.h.
+        * wtf/gtk/GOwnPtr.cpp: Copied from JavaScriptCore/wtf/GOwnPtr.cpp.
+        * wtf/gtk/GOwnPtr.h: Copied from JavaScriptCore/wtf/GOwnPtr.h.
+        * wtf/unicode/glib/UnicodeGLib.h: Change the path for GOwnPtr.h.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ability to enable ACCELERATED_COMPOSITING on Windows (currently disabled)
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+
+        * wtf/Platform.h:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * JavaScriptCore/runtime/RegExpConstructor.cpp: ensure that undefined
+        values are added to the returned RegExpMatchesArray
+
+2009-11-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON.stringify performance on undefined is very poor
+        https://bugs.webkit.org/show_bug.cgi?id=31839
+
+        Switch from a UString to a Vector<UChar> when building
+        the JSON string, allowing us to safely remove the substr-copy
+        we otherwise did when unwinding an undefined property.
+
+        Also turns out to be a ~5% speedup on stringification.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::StringBuilder::append):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * wtf/unicode/UTF8.cpp:
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        * wtf/unicode/wince/UnicodeWince.cpp:
+
+2009-11-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Streamlined some Math functions where we expect or know the result not
+        to be representable as an int.
+        
+        SunSpider says 0.6% faster.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::jsDoubleNumber):
+        (JSC::JSValue::JSValue): Added a function for making a numeric JSValue
+        and skipping the "can I encode this as an int?" check, avoiding the
+        overhead of int <-> double roundtripping and double <-> double comparison
+        and branching.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan): For these functions, which we expect or know
+        to produce results not representable as ints, call jsDoubleNumber instead
+        of jsNumber.
+
+2009-11-23  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed. Unbreak the regression tests after r51329.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Null-check clientData before dereferencing it.
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction): Ditto.
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 1/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Since the API is in JSC but worlds only exist in WebCore, add callbacks on the JSGlobalData::ClientData
+        to allow it to update the current world on entry/exit via the JSC API.  This is temporary duck
+        tape, and should be removed once the current world no longer needs to be explicitly tracked.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::ClientData::beginningExecution):
+        (JSC::JSGlobalData::ClientData::completedExecution):
+        * runtime/JSGlobalData.h:
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adds MainThreadAndroid.cpp with Android-specific WTF threading functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31807
+
+        * wtf/android: Added.
+        * wtf/android/MainThreadAndroid.cpp: Added.
+        (WTF::timeoutFired):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * JavaScriptCore.exp: Export callOnMainThreadAndWait.
 
 2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
@@ -134,6 +9559,213 @@
         (JSC::stringProtoFuncLastIndexOf):Add an extra test 
         to check for NaN for Symbian.
 
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android port lacks implementation of atomicIncrement and atomicDecrement.
+        https://bugs.webkit.org/show_bug.cgi?id=31715
+
+        * wtf/Threading.h: Modified.
+        (WTF::atomicIncrement): Added Android implementation.
+        (WTF::atomicDecrement): Added Android implementation.
+
+2009-11-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Sort source lists and remove obsolete comments 
+        from the build system.
+
+        * JavaScriptCore.pri:
+
+2009-11-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt][Mac] Turn on multiple JavaScript threads for QtWebkit on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31753
+
+        * wtf/Platform.h:
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        * wtf/Platform.h: Modified. Added Android-specific configuration.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext):
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::callOnMainThreadAndWait):
+        * wtf/MainThread.h:
+        Re-add callOnMainThreadAndWait(), which was removed in bug 23926.
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        isMainThread() on Chromium (Mac and Linux) is so slow it timeouts LayoutTests..
+        https://bugs.webkit.org/show_bug.cgi?id=31693
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): grab and use the pthread_t of the main thread instead of ThreadIdentifier.
+        (WTF::isMainThread): Ditto.
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(STRING_H) guard from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=31668
+
+        * config.h:
+        * runtime/UString.cpp:
+
+2009-11-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Fixing a bug in MessageQueue::removeIf() that leads to an
+        assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31657
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::removeIf):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        JavaScriptCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        * runtime/DatePrototype.cpp: Remove include directive 
+        for float.h as it is included in MathExtras.h already.
+        * runtime/Operations.cpp: Ditto.
+        * runtime/UString.cpp: Ditto.
+        * wtf/dtoa.cpp: Ditto.
+        * wtf/MathExtras.h: Remove HAVE(FLOAT_H) guard.
+        * wtf/Platform.h: Ditto.
+
+2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix for 32-bit Sparc machines: these machines are big-endian.
+
+        * wtf/Platform.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move UString::from(double) implementation to new
+        WTF::doubleToStringInJavaScriptFormat(), and expose it because WebCore
+        code will use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31330
+
+        - Introduce new function createRep(const char*, unsigned) and
+          UString::UString(const char*, unsigned) to reduce 2 calls to strlen().
+        - Fix a bug that dtoa() doesn't update *rve if the input value is NaN
+          or Infinity.
+
+        No new tests because this doesn't change the behavior.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::from): Move the code to doubleToStringInJavaScriptFormat().
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Fix a bug about rve.
+        (WTF::append): A helper for doubleToStringInJavaScriptFormat().
+        (WTF::doubleToStringInJavaScriptFormat): Move the code from UString::from(double).
+        * wtf/dtoa.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        * JavaScriptCore.pro:
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium's unnecessary dependency on wtf's tcmalloc files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-18  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] Implement symbol hiding for JSC's JIT functions.
+
+        These functions are implemented directly in assembly, so they need the
+        proper directives to enable/disable visibility. On ELF systems, it's
+        .hidden, whereas on Mach-O systems (Mac) it's .private_extern. On
+        Windows, it's not necessary since you have to explicitly export. I
+        also implemented the AIX idiom, though it's unlikely anyone will
+        implement AIX/POWER JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=30864
+
+        * jit/JITStubs.cpp:
+
+2009-11-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Interpreter may do an out of range access when throwing an exception in the profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=31635
+
+        Add bounds check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=31631
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
 2009-11-18  Harald Fernengel  <harald.fernengel@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -146,6 +9778,91 @@
 
         * JavaScriptCore.pri:
 
+2009-11-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add JSContextRefPrivate.h to list of copied files.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Style cleanup for GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=31506
+
+        Remove forward declaration in GOwnPtr and do some style cleanup.
+
+        * wtf/GOwnPtr.cpp:
+        * wtf/GOwnPtr.h:
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        (WTF::freeOwnedGPtr):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Add assertions to the 'toJS' functions to catch mistakes like
+        this early.  Restructure existing code which blindly passed potentially
+        null values to toJS when forwarding exceptions so that a null check is
+        performed first.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/tests/testapi.c: Fix errors in the API tester.
+        (MyObject_getProperty):
+        (MyObject_convertToType):
+        (EvilExceptionObject_convertToType):
+
+2009-11-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Minor fixes for JSVALUE32_64: branchConvertDoubleToInt32
+        failed on a CortexA8 CPU, but not on a simulator; and
+        JITCall.cpp modifications was somehow not committed to mainline.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fmrs_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
 2009-11-16  Joerg Bornemann  <joerg.bornemann@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -155,18 +9872,102 @@
         * JavaScriptCore.pri: Add missing include path.
         * wtf/Platform.h: Include ce_time.h for Windows CE 6.
 
-2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+2009-11-13  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Reviewed by Gavin Barraclough.
 
-        [Qt] Fix linking on Linux 32-bit.
+        https://bugs.webkit.org/show_bug.cgi?id=31050
 
-        It was missing the ".text" directive at the top of the file,
-        indicating that code would follow. Without it, the assembler created
-        "NOTYPE" symbols, which would result in linker errors.
-        https://bugs.webkit.org/show_bug.cgi?id=30863
+        Adding optimization support for mode JSVALUE32_64
+        on ARM systems.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
 
+2009-11-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding JSVALUE32_64 support for ARM (but not turning it
+        on by default). All optimizations must be disabled, since
+        this patch is only the first of a series of patches.
+
+        During the work, a lot of x86 specific code revealed and
+        made platform independent.
+        See revisions: 50531 50541 50593 50594 50595
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fdivd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::set8):
+        (JSC::MacroAssemblerARM::setTest8):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::zeroDouble):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
         * jit/JITStubs.cpp:
+        * wtf/StdLibExtras.h:
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Adding isAlphanumeric abstraction, required
+        by TextBoundaries.cpp.
+
+        * wtf/unicode/glib/UnicodeGLib.h:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isAlphanumeric):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * JavaScriptCore.pri:
+
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
 
 2009-11-13  İsmail Dönmez  <ismail@namtrac.org>
 
@@ -176,6 +9977,63 @@
 
         * JavaScriptCore.pri:
 
+2009-11-12  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Calculate the time offset only if we were able to parse
+        the date string. This saves an IPC in Chromium for
+        invalid date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=31416
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r50896 until i can work out why it causes failures.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Remove LIBRARY directive from def file to fix Debug_All target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Holger Freyther.
+
+        Revert r50204, since it makes DRT crash on 32 bits release builds
+        for GTK+.
+
+        * wtf/FastMalloc.h:
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Start unifying entry logic for function and eval code.
+
+        Eval now uses a ret instruction to end execution, and sets up
+        a callframe more in line with what we do for function entry.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
 2009-11-12  Richard Moe Gustavsen  <richard.gustavsen@nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
@@ -188,6 +10046,654 @@
 
         * wtf/Platform.h:
 
+2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix linking on Linux 32-bit.
+
+        It was missing the ".text" directive at the top of the file,
+        indicating that code would follow. Without it, the assembler created
+        "NOTYPE" symbols, which would result in linker errors.
+        https://bugs.webkit.org/show_bug.cgi?id=30863
+
+        * jit/JITStubs.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Refactor multiple JavaScriptCore threads
+        https://bugs.webkit.org/show_bug.cgi?id=31328
+
+        Remove the id field from the PlatformThread structure 
+        as it is not used.
+
+        * runtime/Collector.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: Added an #include for UINT_MAX.
+
+        * runtime/WeakRandom.h:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptGlue build fix: Marked a file 'private' instead of 'project'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "avGni arBalroguch" Barraclough.
+
+        Faster Math.random, based on GameRand.
+        
+        SunSpider says 1.4% faster.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the header to the project.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Use an object to track random number generation
+        state, initialized to the current time.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom): Use the new hotness.
+
+        * runtime/WeakRandom.h: Added.
+        (JSC::WeakRandom::WeakRandom):
+        (JSC::WeakRandom::get):
+        (JSC::WeakRandom::advance): The new hotness.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Imported the v8 DST cache.
+        
+        SunSpider says 1.5% faster.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Reset the DST cache when resetting
+        other date data.
+
+        * runtime/JSGlobalData.h:
+        (JSC::DSTOffsetCache::DSTOffsetCache):
+        (JSC::DSTOffsetCache::reset): Added a struct for the DST cache.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+        (WTF::calculateDSTOffset):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getDSTOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: The imported code for probing and updating the cache.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed an edge case that could cause the engine not to notice a timezone
+        change.
+        
+        No test because this case would require manual intervention to change
+        the timezone during the test.
+        
+        SunSpider reports no change.
+
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::reset): Added a helper function for resetting
+        this cache. Also, shrank the cache, since we'll be resetting it often.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Include resetting the DateInstanceCache
+        in resetting Date data. (Otherwise, a cache hit could bypass a necessary
+        timezone update check.)
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some manual inlining and constant propogation in Date code.
+        
+        SunSpider reports a 0.4% speedup on date-*, no overall speedup. Shark
+        says some previously evident stalls are now gone.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+        (JSC::formatTimeUTC): Split formatTime into UTC and non-UTC variants.
+
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::gregorianDateTime):
+        (JSC::DateInstance::gregorianDateTimeUTC): Split gregorianDateTime into
+        a UTC and non-UTC variant, and split each variant into a fast inline
+        case and a slow out-of-line case.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Updated for the gregorianDateTime change above.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a new symbol.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "Home Wrecker" Weinig.
+
+        Added a tiny cache for Date parsing.
+        
+        SunSpider says 1.2% faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate): Try to reuse the last parsed Date, if present.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalData.h: Added storage for last parsed Date. Refactored
+        this code to make resetting the date cache easier.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        refactoring.
+
+        * wtf/DateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: Changed ExecState to be first parameter, as is the JSC custom.
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Can cache prototype lookups on uncacheable dictionaries.
+        https://bugs.webkit.org/show_bug.cgi?id=31198
+
+        Replace fromDictionaryTransition with flattenDictionaryObject and
+        flattenDictionaryStructure.  This change is necessary as we need to
+        guarantee that our attempt to convert away from a dictionary structure
+        will definitely succeed, and in some cases this requires mutating the
+        object storage itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::comparePropertyMapEntryIndices):
+        * runtime/Structure.h:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Remove extra character from r50701.
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Revert r50695 because it broke QtWebKit (clean builds).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Prepended $$PWD to GENERATED_SOURCES_DIR to avoid potential ambiguities when included from WebCore.pro.
+        Some preprocessors consider this GENERATED_SOURCES_DIR relative to current invoking dir (e.g., ./WebCore),
+        and not the working dir of JavaCriptCore.pri (i.e., ../JavaScriptCore/).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative snow leopard and windows build fixes).
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+        
+        Hopefully, the last build fix.
+
+        Create better separation in DateMath about the JSC
+        and non-JSC portions. Also, only expose the non-JSC
+        version in the exports.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getUTCOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::gmtoffset):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        For the change in DateMath.
+
+        * config.h:
+        * wtf/DateMath.cpp:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export some symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated export file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        If the VM calculates the local timezone offset from UTC, it caches the
+        result until the end of the current VM invocation. (We don't want to cache
+        forever, because the user's timezone may change over time.)
+        
+        This removes notify_* overhead on Mac, and, more significantly, removes
+        OS time and date call overhead on non-Mac platforms.
+
+        ~8% speedup on Date microbenchmark on Mac. SunSpider reports maybe a tiny
+        speedup on Mac. (Speedup on non-Mac platforms should be even more noticeable.)
+
+        * JavaScriptCore.exp:
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Made the 
+        DynamicGlobalObjectScope constructor responsible for checking whether a
+        dynamicGlobalObject has already been set. This eliminated some duplicate
+        client code, and allowed me to avoid adding even more duplicate client
+        code. Made DynamicGlobalObjectScope responsible for resetting the
+        local timezone cache upon first entry to the VM.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/DateMath.cpp:
+        (WTF::getCurrentUTCTime):
+        (WTF::getCurrentUTCTimeWithMicroseconds):
+        (WTF::getLocalTime):
+        (JSC::getUTCOffset): Use the new cache. Also, see below.
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::initializeDates):
+        (JSC::parseDateFromNullTerminatedCharacters): Simplified the way this function
+        accounts for the local timezone offset, to accomodate our new caching API,
+        and a (possibly misguided) caller in WebCore. Also, see below.
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): Moved most of the code in
+        DateMath.* into the JSC namespace. The code needed to move so it could
+        naturally interact with ExecState and JSGlobalData to support caching.
+        Logically, it seemed right to move it, too, since this code is not really
+        as low-level as the WTF namespace might imply -- it implements a set of
+        date parsing and conversion quirks that are finely tuned to the JavaScript
+        language. Also removed the Mac OS X notify_* infrastructure.
+        
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime): Moved the rest of the DateMath code here, and renamed
+        it to make it consistent with WTF's currentTime function.
+
+2009-11-06  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix after r50595.
+
+        Rename the remaining rshiftPtr calls to rshift32
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithImmToInt):
+
+2009-11-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tidy up the shift methods on the macro-assembler interface.
+
+        Currently behaviour of shifts of a magnitude > 0x1f is undefined.
+        Instead defined that all shifts are masked to this range.  This makes a lot of
+        practical sense, both since having undefined behaviour is not particularly
+        desirable, and because this behaviour is commonly required (particularly since
+        it is required bt ECMA-262 for shifts).
+
+        Update the ARM assemblers to provide this behaviour.  Remove (now) redundant
+        masks from JITArithmetic, and remove rshiftPtr (this was used in case that
+        could be rewritten in a simpler form using rshift32, only optimized JSVALUE32
+        on x86-64, which uses JSVALUE64!)
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::rshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+
+2009-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a magic number (1) from the JIT, instead compute the value with OBJECT_OFFSET.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument):
+        * jit/JITStubs.h:
+
+2009-11-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31159
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The x86 branchDouble behaviour is reworked, and all JIT
+        ports should follow the x86 port. See bug 31104 and 31151
+
+        This patch contains a fix for the traditional ARM port
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fmrs_r):
+        (JSC::ARMAssembler::ftosid_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+        
+        * wtf/wince/FastMallocWince.h:
+
+2009-11-05  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ARMv7 specific encoding for immediate constants on ARMv7 target
+        https://bugs.webkit.org/show_bug.cgi?id=31060
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::getOp2): Use INVALID_IMM
+        (JSC::ARMAssembler::getImm): Use encodeComplexImm for complex immediate
+        (JSC::ARMAssembler::moveImm): Ditto.
+        (JSC::ARMAssembler::encodeComplexImm): Encode a constant by one or two
+        instructions or a PC relative load.
+        * assembler/ARMAssembler.h: Use INVALID_IMM if a constant cannot be
+        encoded as an immediate constant.
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::movw_r): 16-bit immediate load
+        (JSC::ARMAssembler::movt_r): High halfword 16-bit immediate load
+        (JSC::ARMAssembler::getImm16Op2): Encode immediate constant for
+        movw_r and mowt_r
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Provide TARGETING_TIGER and TARGETING_LEOPARD as analogues to
+        BUILDING_ON_TIGER and BUILDING_ON_LEOPARD.  The TARGETING_ macros
+        consider the deployment target; the BUILDING_ON_ macros consider the
+        headers being built against.
+
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31151
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The ARMv7 JIT is currently using ARMv7Assembler::ConditionEQ to branch
+        for DoubleEqualOrUnordered, however this is incorrect - ConditionEQ won't
+        branch on unordered operands.  Similarly, DoubleLessThanOrUnordered &
+        DoubleLessThanOrEqualOrUnordered use ARMv7Assembler::ConditionLO &
+        ARMv7Assembler::ConditionLS, whereas they should be using
+        ARMv7Assembler::ConditionLT & ARMv7Assembler::ConditionLE.
+
+        Fix these, and fill out the missing DoubleConditions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Enable native call optimizations on ARMv7.  (Existing ARM_TRADITIONAL
+        implementation was generic, worked perfectly, just needed turning on).
+
+        * jit/JITOpcodes.cpp:
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe, Oliver Hunt, and Sam Weinig.
+
+        Add a missing assert to the ARMv7 JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::ARMThumbImmediate):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus op_ prefix on dumped version of three opcodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix dumping of constants in bytecode so that they aren't printed as large positive register numbers.
+
+        We do this by having the registerName function return information about the constant if the register
+        number corresponds to a constant.  This requires that registerName, and several functions that call it,
+        be converted to member functions of CodeBlock so that the constant value can be retrieved.  The
+        ExecState also needs to be threaded down through these functions so that it can be passed on to
+        constantName when needed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+
+2009-11-04  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30647
+        Solaris build failure due to strnstr.
+
+        * wtf/StringExtras.h: Enable strnstr on Solaris, too.
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31104
+        Refactor x86-specific behaviour out of the JIT.
+
+        - Add explicit double branch conditions for ordered and unordered comparisons (presently the brehaviour is a mix).
+        - Refactor double to int conversion out into the MacroAssembler.
+        - Remove broken double to int conversion for !JSVALUE32_64 builds - this code was broken and slowing us down, fixing it showed it not to be an improvement.
+        - Remove exclusion of double to int conversion from (1 % X) cases in JSVALUE32_64 builds - if this was of benefit this is no longer the case; simplify.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove BUILDING_ON_LEOPARD from JavaScriptCore.gyp.  This is supposed
+        to be set as needed only in wtf/Platform.h.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
 2009-11-02  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
@@ -205,19 +10711,161 @@
         * jit/JITStubs.cpp:
         (JSC::JITThunks::tryCacheGetByID):
 
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Darin Adler.
 
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
 
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
+        * wtf/Platform.h: Turn on CF support if both QT and DARWIN
+        platforms are defined.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29381
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
 
-        * runtime/TimeoutChecker.h: Add getter for the timeout interval
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::~MessageQueue):
+        (WTF::MessageQueue::append):
+        (WTF::MessageQueue::appendAndCheckEmpty):
+        (WTF::MessageQueue::prepend):
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+        (WTF::MessageQueue::tryGetMessage):
+        (WTF::MessageQueue::removeIf):
+        The MessageQueue is changed to act as a queue of OwnPtr<DataType>. It takes ownership
+        of posted tasks and passes it to the new owner (in another thread) when the task is fetched.
+        All methods have arguments of type PassOwnPtr<DataType> and return the same type.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread):
+        Superficial change to trigger rebuild of JSC project on Windows,
+        workaround for https://bugs.webkit.org/show_bug.cgi?id=30890
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed failing layout test: restore a special case I accidentally deleted.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromDateArgs): In the case of applying a change to a date
+        that is NaN, reset the date to 0 *and* then apply the change; don't just
+        reset the date to 0.
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update for object-to-pointer change.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30942
+        Use pointers instead of copies to pass GregorianDateTime objects around.
+        
+        SunSpider reports a shocking 4.5% speedup on date-format-xparb, and 1.3%
+        speedup on date-format-tofte.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Renamed getGregorianDateTime to gregorianDateTime,
+        since it no longer has an out parameter. Uses 0 to indicate invalid dates.
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=30853
+
+        Inherits ListHashSet class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/rendering/RenderBlock.cpp:1813.
+
+        * wtf/ListHashSet.h:
+
+2009-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+ 
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r50218-r50262): E*TRADE accounts page is missing content
+        https://bugs.webkit.org/show_bug.cgi?id=30947
+        <rdar://problem/7348833>
+
+        The logic for flagging that a structure has non-enumerable properties
+        was in addPropertyWithoutTransition, rather than in the core Structure::put
+        method.  Despite this I was unable to produce a testcase that caused
+        the failure that etrade was experiencing, but the new assertion in
+        getEnumerablePropertyNames triggers on numerous layout tests without
+        the fix, so in effecti all for..in enumeration in any test ends up
+        doing the required consistency check.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::put):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::checkConsistency):
 
 2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
deleted file mode 100644
index 9eaccab..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
+++ /dev/null
@@ -1,76 +0,0 @@
-# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-#
-# 1.  Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer. 
-# 2.  Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution. 
-# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-#     its contributors may be used to endorse or promote products derived
-#     from this software without specific prior written permission. 
-#
-# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
-# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
-# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-VPATH = \
-    $(JavaScriptCore) \
-    $(JavaScriptCore)/parser \
-    $(JavaScriptCore)/pcre \
-    $(JavaScriptCore)/docs \
-    $(JavaScriptCore)/runtime \
-    $(JavaScriptCore)/interpreter \
-    $(JavaScriptCore)/jit \
-#
-
-.PHONY : all
-all : \
-    ArrayPrototype.lut.h \
-    chartables.c \
-    DatePrototype.lut.h \
-    Grammar.cpp \
-    JSONObject.lut.h \
-    Lexer.lut.h \
-    MathObject.lut.h \
-    NumberConstructor.lut.h \
-    RegExpConstructor.lut.h \
-    RegExpObject.lut.h \
-    StringPrototype.lut.h \
-    docs/bytecode.html \
-#
-
-# lookup tables for classes
-
-%.lut.h: create_hash_table %.cpp
-	$^ -i > $@
-Lexer.lut.h: create_hash_table Keywords.table
-	$^ > $@
-
-# JavaScript language grammar
-
-Grammar.cpp: Grammar.y
-	bison -d -p jscyy $< -o $@ > bison_out.txt 2>&1
-	perl -p -e 'END { if ($$conflict) { unlink "Grammar.cpp"; die; } } $$conflict ||= /conflict/' < bison_out.txt
-	touch Grammar.cpp.h
-	touch Grammar.hpp
-	cat Grammar.cpp.h Grammar.hpp > Grammar.h
-	rm -f Grammar.cpp.h Grammar.hpp bison_out.txt
-
-# character tables for PCRE
-
-chartables.c : dftables
-	$^ $@
-
-docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
-	perl $^ $@
diff --git a/src/3rdparty/webkit/JavaScriptCore/Info.plist b/src/3rdparty/webkit/JavaScriptCore/Info.plist
index 17949b0..77c9eb8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/Info.plist
+++ b/src/3rdparty/webkit/JavaScriptCore/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2010 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 03c23c3..e5f3408 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -64,6 +64,7 @@
             'bytecode/StructureStubInfo.h',
             'bytecompiler/BytecodeGenerator.cpp',
             'bytecompiler/BytecodeGenerator.h',
+            'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/Label.h',
             'bytecompiler/LabelScope.h',
             'bytecompiler/RegisterID.h',
@@ -119,6 +120,7 @@
             'jit/JITInlineMethods.h',
             'jit/JITOpcodes.cpp',
             'jit/JITPropertyAccess.cpp',
+            'jit/JITPropertyAccess32_64.cpp',
             'jit/JITStubCall.h',
             'jit/JITStubs.cpp',
             'jit/JITStubs.h',
@@ -148,8 +150,6 @@
             'pcre/ucpinternal.h',
             'pcre/ucptable.cpp',
             'profiler/CallIdentifier.h',
-            'profiler/HeavyProfile.cpp',
-            'profiler/HeavyProfile.h',
             'profiler/Profile.cpp',
             'profiler/Profile.h',
             'profiler/ProfileGenerator.cpp',
@@ -159,8 +159,6 @@
             'profiler/Profiler.cpp',
             'profiler/Profiler.h',
             'profiler/ProfilerServer.h',
-            'profiler/TreeProfile.cpp',
-            'profiler/TreeProfile.h',
             'runtime/ArgList.cpp',
             'runtime/ArgList.h',
             'runtime/Arguments.cpp',
@@ -332,20 +330,7 @@
             'runtime/Tracing.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
-            'wrec/CharacterClass.cpp',
-            'wrec/CharacterClass.h',
-            'wrec/CharacterClassConstructor.cpp',
-            'wrec/CharacterClassConstructor.h',
-            'wrec/Escapes.h',
-            'wrec/Quantifier.h',
-            'wrec/WREC.cpp',
-            'wrec/WREC.h',
-            'wrec/WRECFunctors.cpp',
-            'wrec/WRECFunctors.h',
-            'wrec/WRECGenerator.cpp',
-            'wrec/WRECGenerator.h',
-            'wrec/WRECParser.cpp',
-            'wrec/WRECParser.h',
+            'runtime/WeakRandom.h',
             'wtf/AlwaysInline.h',
             'wtf/ASCIICType.h',
             'wtf/Assertions.cpp',
@@ -369,8 +354,8 @@
             'wtf/FastMalloc.h',
             'wtf/Forward.h',
             'wtf/GetPtr.h',
-            'wtf/GOwnPtr.cpp',
-            'wtf/GOwnPtr.h',
+            'wtf/gobject/GOwnPtr.cpp',
+            'wtf/gobject/GOwnPtr.h',
             'wtf/gtk/MainThreadGtk.cpp',
             'wtf/gtk/ThreadingGtk.cpp',
             'wtf/HashCountedSet.h',
@@ -400,8 +385,6 @@
             'wtf/PassRefPtr.h',
             'wtf/Platform.h',
             'wtf/PtrAndFlags.h',
-            'wtf/qt/MainThreadQt.cpp',
-            'wtf/qt/ThreadingQt.cpp',
             'wtf/RandomNumber.cpp',
             'wtf/RandomNumber.h',
             'wtf/RandomNumberSeed.h',
@@ -414,11 +397,16 @@
             'wtf/SegmentedVector.h',
             'wtf/StdLibExtras.h',
             'wtf/StringExtras.h',
+            'wtf/StringHashFunctions.h',
             'wtf/TCPackedCache.h',
+            'wtf/qt/MainThreadQt.cpp',
+            'wtf/qt/ThreadingQt.cpp',
             'wtf/TCPageMap.h',
             'wtf/TCSpinLock.h',
             'wtf/TCSystemAlloc.cpp',
             'wtf/TCSystemAlloc.h',
+            'wtf/ThreadIdentifierDataPthreads.cpp',
+            'wtf/ThreadIdentifierDataPthreads.h',
             'wtf/Threading.cpp',
             'wtf/Threading.h',
             'wtf/ThreadingNone.cpp',
@@ -440,6 +428,7 @@
             'wtf/unicode/UTF8.cpp',
             'wtf/unicode/UTF8.h',
             'wtf/UnusedParam.h',
+            'wtf/ValueCheck.h',
             'wtf/Vector.h',
             'wtf/VectorTraits.h',
             'wtf/VMTags.h',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
index 3ae3ec6..d6f6caa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
@@ -1625,7 +1625,6 @@ __ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10Registe
 __ZN3JSCL27compareByStringPairForQSortEPKvS1_
 __Z22jsc_pcre_ucp_othercasej
 __ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
-__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
 __ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
 __ZN3JSC12RegisterFile21releaseExcessCapacityEv
@@ -1841,7 +1840,6 @@ __ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
 __ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3JSC9ExecState22regExpConstructorTableEPS0_
 __ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index a0f9f8e..fe9e8cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -1,16 +1,28 @@
 # JavaScriptCore - Qt4 build info
 VPATH += $$PWD
 
-CONFIG(debug, debug|release) {
-    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
-    OBJECTS_DIR = obj/release
+# Use a config-specific target to prevent parallel builds file clashes on Mac
+mac: CONFIG(debug, debug|release): JAVASCRIPTCORE_TARGET = jscored
+else: JAVASCRIPTCORE_TARGET = jscore
+
+# Output in JavaScriptCore/<config>
+CONFIG(debug, debug|release) : JAVASCRIPTCORE_DESTDIR = debug
+else: JAVASCRIPTCORE_DESTDIR = release
+
+CONFIG(standalone_package) {
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = $$PWD/generated
+} else {
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = generated
 }
 
-symbian {
+CONFIG(standalone_package): DEFINES *= NDEBUG
+
+symbian: {
+    # Need to guarantee this comes before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE ../JavaScriptCore/profiler"
     LIBS += -lhal
+    # For hal.h
+    INCLUDEPATH *= $$MW_LAYER_SYSTEMINCLUDE
 }
 
 INCLUDEPATH = \
@@ -23,24 +35,22 @@ INCLUDEPATH = \
     $$PWD/interpreter \
     $$PWD/jit \
     $$PWD/parser \
+    $$PWD/pcre \
     $$PWD/profiler \
     $$PWD/runtime \
-    $$PWD/wrec \
     $$PWD/wtf \
     $$PWD/wtf/symbian \
     $$PWD/wtf/unicode \
     $$PWD/yarr \
     $$PWD/API \
     $$PWD/ForwardingHeaders \
-    $$GENERATED_SOURCES_DIR \
+    $$JSC_GENERATED_SOURCES_DIR \
     $$INCLUDEPATH
 
+win32-*: DEFINES += _HAS_TR1=0
+
 DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
 
-GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-win32-* {
-    LIBS += -lwinmm
-}
 contains(JAVASCRIPTCORE_JIT,yes) {
     DEFINES+=ENABLE_JIT=1
     DEFINES+=ENABLE_YARR_JIT=1
@@ -52,236 +62,50 @@ contains(JAVASCRIPTCORE_JIT,no) {
     DEFINES+=ENABLE_YARR=0
 }
 
-# In debug mode JIT disabled until crash fixed
-win32-* {
-    CONFIG(debug):!contains(DEFINES, ENABLE_JIT=1): DEFINES+=ENABLE_JIT=0
-}
-
-# Rules when JIT enabled (not disabled)
-!contains(DEFINES, ENABLE_JIT=0) {
-    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
-        QMAKE_CXXFLAGS += -fno-stack-protector
-        QMAKE_CFLAGS += -fno-stack-protector
-    }
-}
-
 wince* {
     INCLUDEPATH += $$QT_SOURCE_TREE/src/3rdparty/ce-compat
-    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
     DEFINES += WINCEBASIC
-}
-
-include(pcre/pcre.pri)
 
-LUT_FILES += \
-    runtime/DatePrototype.cpp \
-    runtime/JSONObject.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/ArrayPrototype.cpp \
-    runtime/MathObject.cpp \
-    runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp
-
-KEYWORDLUT_FILES += \
-    parser/Keywords.table
-
-JSCBISON += \
-    parser/Grammar.y
+    INCLUDEPATH += $$PWD/../JavaScriptCore/os-wince
+    INCLUDEPATH += $$PWD/../JavaScriptCore/os-win32
+}
 
-SOURCES += \
-    wtf/Assertions.cpp \
-    wtf/ByteArray.cpp \
-    wtf/HashTable.cpp \
-    wtf/MainThread.cpp \
-    wtf/RandomNumber.cpp \
-    wtf/RefCountedLeakCounter.cpp \
-    wtf/TypeTraits.cpp \
-    wtf/unicode/CollatorDefault.cpp \
-    wtf/unicode/icu/CollatorICU.cpp \
-    wtf/unicode/UTF8.cpp \
-    API/JSBase.cpp \
-    API/JSCallbackConstructor.cpp \
-    API/JSCallbackFunction.cpp \
-    API/JSCallbackObject.cpp \
-    API/JSClassRef.cpp \
-    API/JSContextRef.cpp \
-    API/JSObjectRef.cpp \
-    API/JSStringRef.cpp \
-    API/JSValueRef.cpp \
-    API/OpaqueJSString.cpp \
-    runtime/InitializeThreading.cpp \
-    runtime/JSGlobalData.cpp \
-    runtime/JSGlobalObject.cpp \
-    runtime/JSStaticScopeObject.cpp \
-    runtime/JSVariableObject.cpp \
-    runtime/JSActivation.cpp \
-    runtime/JSNotAnObject.cpp \
-    runtime/JSONObject.cpp \
-    runtime/LiteralParser.cpp \
-    runtime/MarkStack.cpp \
-    runtime/TimeoutChecker.cpp \
-    bytecode/CodeBlock.cpp \
-    bytecode/StructureStubInfo.cpp \
-    bytecode/JumpTable.cpp \
-    assembler/ARMAssembler.cpp \
-    assembler/MacroAssemblerARM.cpp \
-    jit/JIT.cpp \
-    jit/JITCall.cpp \
-    jit/JITArithmetic.cpp \
-    jit/JITOpcodes.cpp \
-    jit/JITPropertyAccess.cpp \
-    jit/ExecutableAllocator.cpp \
-    jit/JITStubs.cpp \
-    bytecompiler/BytecodeGenerator.cpp \
-    runtime/ExceptionHelpers.cpp \
-    runtime/JSPropertyNameIterator.cpp \
-    interpreter/Interpreter.cpp \
-    bytecode/Opcode.cpp \
-    bytecode/SamplingTool.cpp \
-    yarr/RegexCompiler.cpp \
-    yarr/RegexInterpreter.cpp \
-    yarr/RegexJIT.cpp \
-    interpreter/RegisterFile.cpp
 
-symbian {
-    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
-              runtime/MarkStackSymbian.cpp
-} else {
-    win32-*|wince* {
-        SOURCES += jit/ExecutableAllocatorWin.cpp \
-                  runtime/MarkStackWin.cpp
+defineTest(addJavaScriptCoreLib) {
+    # Argument is the relative path to JavaScriptCore.pro's qmake output
+    pathToJavaScriptCoreOutput = $$ARGS/$$JAVASCRIPTCORE_DESTDIR
+
+    win32-msvc*|wince* {
+        LIBS += -L$$pathToJavaScriptCoreOutput
+        LIBS += -l$$JAVASCRIPTCORE_TARGET
+        POST_TARGETDEPS += $${pathToJavaScriptCoreOutput}$${QMAKE_DIR_SEP}$${JAVASCRIPTCORE_TARGET}.lib
+    } else:symbian {
+        LIBS += -l$${JAVASCRIPTCORE_TARGET}.lib
+        # The default symbian build system does not use library paths at all. However when building with
+        # qmake's symbian makespec that uses Makefiles
+        QMAKE_LIBDIR += $$pathToJavaScriptCoreOutput
+        POST_TARGETDEPS += $${pathToJavaScriptCoreOutput}$${QMAKE_DIR_SEP}$${JAVASCRIPTCORE_TARGET}.lib
     } else {
-        SOURCES += jit/ExecutableAllocatorPosix.cpp \
-                  runtime/MarkStackPosix.cpp
+        # Make sure jscore will be early in the list of libraries to workaround a bug in MinGW
+        # that can't resolve symbols from QtCore if libjscore comes after.
+        QMAKE_LIBDIR = $$pathToJavaScriptCoreOutput $$QMAKE_LIBDIR
+        LIBS += -l$$JAVASCRIPTCORE_TARGET
+        POST_TARGETDEPS += $${pathToJavaScriptCoreOutput}$${QMAKE_DIR_SEP}lib$${JAVASCRIPTCORE_TARGET}.a
     }
-}
-
-!contains(DEFINES, USE_SYSTEM_MALLOC) {
-    SOURCES += wtf/TCSystemAlloc.cpp
-}
 
-# AllInOneFile.cpp helps gcc analize and optimize code
-# Other compilers may be able to do this at link time
-SOURCES += \
-    runtime/ArgList.cpp \
-    runtime/Arguments.cpp \
-    runtime/ArrayConstructor.cpp \
-    runtime/ArrayPrototype.cpp \
-    runtime/BooleanConstructor.cpp \
-    runtime/BooleanObject.cpp \
-    runtime/BooleanPrototype.cpp \
-    runtime/CallData.cpp \
-    runtime/Collector.cpp \
-    runtime/CommonIdentifiers.cpp \
-    runtime/ConstructData.cpp \
-    wtf/CurrentTime.cpp \
-    runtime/DateConstructor.cpp \
-    runtime/DateConversion.cpp \
-    runtime/DateInstance.cpp \
-    runtime/DatePrototype.cpp \
-    debugger/Debugger.cpp \
-    debugger/DebuggerCallFrame.cpp \
-    debugger/DebuggerActivation.cpp \
-    wtf/dtoa.cpp \
-    runtime/Error.cpp \
-    runtime/ErrorConstructor.cpp \
-    runtime/ErrorInstance.cpp \
-    runtime/ErrorPrototype.cpp \
-    interpreter/CallFrame.cpp \
-    runtime/Executable.cpp \
-    runtime/FunctionConstructor.cpp \
-    runtime/FunctionPrototype.cpp \
-    runtime/GetterSetter.cpp \
-    runtime/GlobalEvalFunction.cpp \
-    runtime/Identifier.cpp \
-    runtime/InternalFunction.cpp \
-    runtime/Completion.cpp \
-    runtime/JSArray.cpp \
-    runtime/JSAPIValueWrapper.cpp \
-    runtime/JSByteArray.cpp \
-    runtime/JSCell.cpp \
-    runtime/JSFunction.cpp \
-    runtime/JSGlobalObjectFunctions.cpp \
-    runtime/JSImmediate.cpp \
-    runtime/JSLock.cpp \
-    runtime/JSNumberCell.cpp \
-    runtime/JSObject.cpp \
-    runtime/JSString.cpp \
-    runtime/JSValue.cpp \
-    runtime/JSWrapperObject.cpp \
-    parser/Lexer.cpp \
-    runtime/Lookup.cpp \
-    runtime/MathObject.cpp \
-    runtime/NativeErrorConstructor.cpp \
-    runtime/NativeErrorPrototype.cpp \
-    parser/Nodes.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/NumberObject.cpp \
-    runtime/NumberPrototype.cpp \
-    runtime/ObjectConstructor.cpp \
-    runtime/ObjectPrototype.cpp \
-    runtime/Operations.cpp \
-    parser/Parser.cpp \
-    parser/ParserArena.cpp \
-    runtime/PropertyDescriptor.cpp \
-    runtime/PropertyNameArray.cpp \
-    runtime/PropertySlot.cpp \
-    runtime/PrototypeFunction.cpp \
-    runtime/RegExp.cpp \
-    runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp \
-    runtime/RegExpPrototype.cpp \
-    runtime/ScopeChain.cpp \
-    runtime/SmallStrings.cpp \
-    runtime/StringConstructor.cpp \
-    runtime/StringObject.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/Structure.cpp \
-    runtime/StructureChain.cpp \
-    runtime/UString.cpp \
-    profiler/HeavyProfile.cpp \
-    profiler/Profile.cpp \
-    profiler/ProfileGenerator.cpp \
-    profiler/ProfileNode.cpp \
-    profiler/Profiler.cpp \
-    profiler/TreeProfile.cpp \
-    wtf/DateMath.cpp \
-    wtf/FastMalloc.cpp \
-    wtf/symbian/BlockAllocatorSymbian.cpp \
-    wtf/Threading.cpp \
-    wtf/qt/MainThreadQt.cpp
-
-!contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    SOURCES += wtf/qt/ThreadingQt.cpp
-} else {
-    DEFINES += ENABLE_JSC_MULTIPLE_THREADS=0
-    SOURCES += wtf/ThreadingNone.cpp
-}
-
-# GENERATOR 1-A: LUT creator
-lut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-lut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
-lut.depend = ${QMAKE_FILE_NAME}
-lut.input = LUT_FILES
-lut.CONFIG += no_link
-addExtraCompiler(lut)
+    win32-* {
+        LIBS += -lwinmm
+    }
 
-# GENERATOR 1-B: particular LUT creator (for 1 file only)
-keywordlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Lexer.lut.h
-keywordlut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
-keywordlut.depend = ${QMAKE_FILE_NAME}
-keywordlut.input = KEYWORDLUT_FILES
-keywordlut.CONFIG += no_link
-addExtraCompiler(keywordlut)
+    # The following line is to prevent qmake from adding jscore to libQtWebKit's prl dependencies.
+    # The compromise we have to accept by disabling explicitlib is to drop support to link QtWebKit and QtScript
+    # statically in applications (which isn't used often because, among other things, of licensing obstacles).
+    CONFIG -= explicitlib
 
-# GENERATOR 2: bison grammar
-jscbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-jscbison.depend = ${QMAKE_FILE_NAME}
-jscbison.input = JSCBISON
-jscbison.variable_out = GENERATED_SOURCES
-jscbison.dependency_type = TYPE_C
-jscbison.CONFIG = target_predeps
-addExtraCompilerWithHeader(jscbison)
+    export(QMAKE_LIBDIR)
+    export(LIBS)
+    export(POST_TARGETDEPS)
+    export(CONFIG)
 
+    return(true)
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index a1affd4..a805170 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -1,68 +1,232 @@
 # JavaScriptCore - qmake build info
 CONFIG += building-libs
 include($$PWD/../WebKit.pri)
+include(JavaScriptCore.pri)
 
 TEMPLATE = lib
 CONFIG += staticlib
-TARGET = JavaScriptCore
+# Don't use JavaScriptCore as the target name. qmake would create a JavaScriptCore.vcproj for msvc
+# which already exists as a directory
+TARGET = $$JAVASCRIPTCORE_TARGET
+DESTDIR = $$JAVASCRIPTCORE_DESTDIR
+QT += core
+QT -= gui
 
 CONFIG += depend_includepath
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
 CONFIG(QTDIR_build) {
-    GENERATED_SOURCES_DIR = $$PWD/generated
-    OLDDESTDIR = $$DESTDIR
-    include($$QT_SOURCE_TREE/src/qbase.pri)
-    INSTALLS =
-    DESTDIR = $$OLDDESTDIR
-    DEFINES *= NDEBUG
-}
-
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-
-INCLUDEPATH += $$GENERATED_SOURCES_DIR
-
-!CONFIG(QTDIR_build) {
-    CONFIG(debug, debug|release) {
+    # Make sure we compile both debug and release on mac when inside Qt.
+    # This line was extracted from qbase.pri instead of including the whole file
+    win32|mac:!macx-xcode:CONFIG += debug_and_release
+} else {
+    !CONFIG(release, debug|release) {
         OBJECTS_DIR = obj/debug
     } else { # Release
         OBJECTS_DIR = obj/release
     }
+    # Make sure that build_all follows the build_all config in WebCore
+    mac:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework):!build_pass:CONFIG += build_all
 }
 
-CONFIG(release):!CONFIG(QTDIR_build) {
-    contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
-    unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
-}
-
-linux-*: DEFINES += HAVE_STDINT_H
-freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
-
-DEFINES += BUILD_WEBKIT
+# WebCore adds these config only when in a standalone build.
+# qbase.pri takes care of that when in a QTDIR_build
+# Here we add the config for both cases since we don't include qbase.pri
+contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
+unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
 
-win32-*: DEFINES += _HAS_TR1=0
+CONFIG(QTDIR_build) {
+    # Remove the following 2 lines if you want debug information in JavaScriptCore
+    CONFIG -= separate_debug_info
+    CONFIG += no_debug_info
+}
 
 # Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
-win32-g++ {
+win32-g++* {
     TMPPATH            = $$quote($$(INCLUDE))
     QMAKE_INCDIR_POST += $$split(TMPPATH,";")
     TMPPATH            = $$quote($$(LIB))
     QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1
-
-DEFINES += WTF_CHANGES=1
+*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
+*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
 
-include(JavaScriptCore.pri)
+# Rules when JIT enabled (not disabled)
+!contains(DEFINES, ENABLE_JIT=0) {
+    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+        QMAKE_CXXFLAGS += -fno-stack-protector
+        QMAKE_CFLAGS += -fno-stack-protector
+    }
+}
 
-QMAKE_EXTRA_TARGETS += generated_files
+wince* {
+    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
+}
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
+include(pcre/pcre.pri)
+
+SOURCES += \
+    API/JSBase.cpp \
+    API/JSCallbackConstructor.cpp \
+    API/JSCallbackFunction.cpp \
+    API/JSCallbackObject.cpp \
+    API/JSClassRef.cpp \
+    API/JSContextRef.cpp \
+    API/JSObjectRef.cpp \
+    API/JSStringRef.cpp \
+    API/JSValueRef.cpp \
+    API/OpaqueJSString.cpp \
+    assembler/ARMAssembler.cpp \
+    assembler/MacroAssemblerARM.cpp \
+    bytecode/CodeBlock.cpp \
+    bytecode/JumpTable.cpp \
+    bytecode/Opcode.cpp \
+    bytecode/SamplingTool.cpp \
+    bytecode/StructureStubInfo.cpp \
+    bytecompiler/BytecodeGenerator.cpp \
+    bytecompiler/NodesCodegen.cpp \
+    debugger/DebuggerActivation.cpp \
+    debugger/DebuggerCallFrame.cpp \
+    debugger/Debugger.cpp \
+    interpreter/CallFrame.cpp \
+    interpreter/Interpreter.cpp \
+    interpreter/RegisterFile.cpp \
+    jit/ExecutableAllocatorFixedVMPool.cpp \
+    jit/ExecutableAllocatorPosix.cpp \
+    jit/ExecutableAllocatorSymbian.cpp \
+    jit/ExecutableAllocatorWin.cpp \
+    jit/ExecutableAllocator.cpp \
+    jit/JITArithmetic.cpp \
+    jit/JITCall.cpp \
+    jit/JIT.cpp \
+    jit/JITOpcodes.cpp \
+    jit/JITPropertyAccess.cpp \
+    jit/JITPropertyAccess32_64.cpp \
+    jit/JITStubs.cpp \
+    parser/Lexer.cpp \
+    parser/Nodes.cpp \
+    parser/ParserArena.cpp \
+    parser/Parser.cpp \
+    profiler/Profile.cpp \
+    profiler/ProfileGenerator.cpp \
+    profiler/ProfileNode.cpp \
+    profiler/Profiler.cpp \
+    runtime/ArgList.cpp \
+    runtime/Arguments.cpp \
+    runtime/ArrayConstructor.cpp \
+    runtime/ArrayPrototype.cpp \
+    runtime/BooleanConstructor.cpp \
+    runtime/BooleanObject.cpp \
+    runtime/BooleanPrototype.cpp \
+    runtime/CallData.cpp \
+    runtime/Collector.cpp \
+    runtime/CommonIdentifiers.cpp \
+    runtime/Completion.cpp \
+    runtime/ConstructData.cpp \
+    runtime/DateConstructor.cpp \
+    runtime/DateConversion.cpp \
+    runtime/DateInstance.cpp \
+    runtime/DatePrototype.cpp \
+    runtime/ErrorConstructor.cpp \
+    runtime/Error.cpp \
+    runtime/ErrorInstance.cpp \
+    runtime/ErrorPrototype.cpp \
+    runtime/ExceptionHelpers.cpp \
+    runtime/Executable.cpp \
+    runtime/FunctionConstructor.cpp \
+    runtime/FunctionPrototype.cpp \
+    runtime/GetterSetter.cpp \
+    runtime/GlobalEvalFunction.cpp \
+    runtime/Identifier.cpp \
+    runtime/InitializeThreading.cpp \
+    runtime/InternalFunction.cpp \
+    runtime/JSActivation.cpp \
+    runtime/JSAPIValueWrapper.cpp \
+    runtime/JSArray.cpp \
+    runtime/JSByteArray.cpp \
+    runtime/JSCell.cpp \
+    runtime/JSFunction.cpp \
+    runtime/JSGlobalData.cpp \
+    runtime/JSGlobalObject.cpp \
+    runtime/JSGlobalObjectFunctions.cpp \
+    runtime/JSImmediate.cpp \
+    runtime/JSLock.cpp \
+    runtime/JSNotAnObject.cpp \
+    runtime/JSNumberCell.cpp \
+    runtime/JSObject.cpp \
+    runtime/JSONObject.cpp \
+    runtime/JSPropertyNameIterator.cpp \
+    runtime/JSStaticScopeObject.cpp \
+    runtime/JSString.cpp \
+    runtime/JSValue.cpp \
+    runtime/JSVariableObject.cpp \
+    runtime/JSWrapperObject.cpp \
+    runtime/LiteralParser.cpp \
+    runtime/Lookup.cpp \
+    runtime/MarkStackPosix.cpp \
+    runtime/MarkStackSymbian.cpp \
+    runtime/MarkStackWin.cpp \
+    runtime/MarkStack.cpp \
+    runtime/MathObject.cpp \
+    runtime/NativeErrorConstructor.cpp \
+    runtime/NativeErrorPrototype.cpp \
+    runtime/NumberConstructor.cpp \
+    runtime/NumberObject.cpp \
+    runtime/NumberPrototype.cpp \
+    runtime/ObjectConstructor.cpp \
+    runtime/ObjectPrototype.cpp \
+    runtime/Operations.cpp \
+    runtime/PropertyDescriptor.cpp \
+    runtime/PropertyNameArray.cpp \
+    runtime/PropertySlot.cpp \
+    runtime/PrototypeFunction.cpp \
+    runtime/RegExpConstructor.cpp \
+    runtime/RegExp.cpp \
+    runtime/RegExpObject.cpp \
+    runtime/RegExpPrototype.cpp \
+    runtime/ScopeChain.cpp \
+    runtime/SmallStrings.cpp \
+    runtime/StringConstructor.cpp \
+    runtime/StringObject.cpp \
+    runtime/StringPrototype.cpp \
+    runtime/StructureChain.cpp \
+    runtime/Structure.cpp \
+    runtime/TimeoutChecker.cpp \
+    runtime/UString.cpp \
+    runtime/UStringImpl.cpp \
+    wtf/Assertions.cpp \
+    wtf/ByteArray.cpp \
+    wtf/CurrentTime.cpp \
+    wtf/DateMath.cpp \
+    wtf/dtoa.cpp \
+    wtf/FastMalloc.cpp \
+    wtf/HashTable.cpp \
+    wtf/MainThread.cpp \
+    wtf/qt/MainThreadQt.cpp \
+    wtf/qt/ThreadingQt.cpp \
+    wtf/RandomNumber.cpp \
+    wtf/RefCountedLeakCounter.cpp \
+    wtf/symbian/RegisterFileAllocatorSymbian.cpp \
+    wtf/symbian/BlockAllocatorSymbian.cpp \
+    wtf/ThreadingNone.cpp \
+    wtf/Threading.cpp \
+    wtf/TypeTraits.cpp \
+    wtf/unicode/CollatorDefault.cpp \
+    wtf/unicode/icu/CollatorICU.cpp \
+    wtf/unicode/UTF8.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp
+
+# Generated files, simply list them for JavaScriptCore
+SOURCES += \
+    $${JSC_GENERATED_SOURCES_DIR}/Grammar.cpp
+
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
 }
 
-*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
-*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
+# Disable C++0x mode in JSC for those who enabled it in their Qt's mkspec
+*-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
index 1324586..7393aa1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 
@@ -34,39 +34,6 @@ namespace JSC {
 
 // Patching helpers
 
-ARMWord* ARMAssembler::getLdrImmAddress(ARMWord* insn, uint32_t* constPool)
-{
-    // Must be an ldr ..., [pc +/- imm]
-    ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
-
-    if (constPool && (*insn & 0x1))
-        return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
-
-    ARMWord addr = reinterpret_cast<ARMWord>(insn) + 2 * sizeof(ARMWord);
-    if (*insn & DT_UP)
-        return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
-    else
-        return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
-}
-
-void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to, int useConstantPool)
-{
-    ARMWord* insn = reinterpret_cast<ARMWord*>(code) + (from.m_offset / sizeof(ARMWord));
-
-    if (!useConstantPool) {
-        int diff = reinterpret_cast<ARMWord*>(to) - reinterpret_cast<ARMWord*>(insn + 2);
-
-        if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
-            *insn = B | getConditionalField(*insn) | (diff & BRANCH_MASK);
-            ExecutableAllocator::cacheFlush(insn, sizeof(ARMWord));
-            return;
-        }
-    }
-    ARMWord* addr = getLdrImmAddress(insn);
-    *addr = reinterpret_cast<ARMWord>(to);
-    ExecutableAllocator::cacheFlush(addr, sizeof(ARMWord));
-}
-
 void ARMAssembler::patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
 {
     ARMWord *ldr = reinterpret_cast<ARMWord*>(loadAddr);
@@ -118,7 +85,7 @@ ARMWord ARMAssembler::getOp2(ARMWord imm)
     if ((imm & 0x00ffffff) == 0)
         return OP2_IMM | (imm >> 24) | (rol << 8);
 
-    return 0;
+    return INVALID_IMM;
 }
 
 int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
@@ -236,25 +203,18 @@ ARMWord ARMAssembler::getImm(ARMWord imm, int tmpReg, bool invert)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp)
+    if (tmp != INVALID_IMM)
         return tmp;
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         if (invert)
             return tmp | OP2_INV_IMM;
         mvn_r(tmpReg, tmp);
         return tmpReg;
     }
 
-    // Do it by 2 instruction
-    if (genInt(tmpReg, imm, true))
-        return tmpReg;
-    if (genInt(tmpReg, ~imm, false))
-        return tmpReg;
-
-    ldr_imm(tmpReg, imm);
-    return tmpReg;
+    return encodeComplexImm(imm, tmpReg);
 }
 
 void ARMAssembler::moveImm(ARMWord imm, int dest)
@@ -263,50 +223,68 @@ void ARMAssembler::moveImm(ARMWord imm, int dest)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mov_r(dest, tmp);
         return;
     }
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mvn_r(dest, tmp);
         return;
     }
 
+    encodeComplexImm(imm, dest);
+}
+
+ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
+{
+#if WTF_ARM_ARCH_AT_LEAST(7)
+    ARMWord tmp = getImm16Op2(imm);
+    if (tmp != INVALID_IMM) {
+        movw_r(dest, tmp);
+        return dest;
+    }
+    movw_r(dest, getImm16Op2(imm & 0xffff));
+    movt_r(dest, getImm16Op2(imm >> 16));
+    return dest;
+#else
     // Do it by 2 instruction
     if (genInt(dest, imm, true))
-        return;
+        return dest;
     if (genInt(dest, ~imm, false))
-        return;
+        return dest;
 
     ldr_imm(dest, imm);
+    return dest;
+#endif
 }
 
 // Memory load/store helpers
 
-void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset)
+void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes)
 {
+    ARMWord transferFlag = bytes ? DT_BYTE : 0;
     if (offset >= 0) {
         if (offset <= 0xfff)
-            dtr_u(isLoad, srcDst, base, offset);
+            dtr_u(isLoad, srcDst, base, offset | transferFlag);
         else if (offset <= 0xfffff) {
             add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
+            dtr_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
         } else {
             ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_ur(isLoad, srcDst, base, reg);
+            dtr_ur(isLoad, srcDst, base, reg | transferFlag);
         }
     } else {
         offset = -offset;
         if (offset <= 0xfff)
-            dtr_d(isLoad, srcDst, base, offset);
+            dtr_d(isLoad, srcDst, base, offset | transferFlag);
         else if (offset <= 0xfffff) {
             sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
         } else {
             ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_dr(isLoad, srcDst, base, reg);
+            dtr_dr(isLoad, srcDst, base, reg | transferFlag);
         }
     }
 }
@@ -378,10 +356,17 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
         // The last bit is set if the constant must be placed on constant pool.
         int pos = (*iter) & (~0x1);
         ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + pos);
-        ARMWord offset = *getLdrImmAddress(ldrAddr);
-        if (offset != 0xffffffff) {
-            JmpSrc jmpSrc(pos);
-            linkBranch(data, jmpSrc, data + offset, ((*iter) & 1));
+        ARMWord* addr = getLdrImmAddress(ldrAddr);
+        if (*addr != 0xffffffff) {
+            if (!(*iter & 1)) {
+                int diff = reinterpret_cast<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetching);
+
+                if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
+                    *ldrAddr = B | getConditionalField(*ldrAddr) | (diff & BRANCH_MASK);
+                    continue;
+                }
+            }
+            *addr = reinterpret_cast<ARMWord>(data + *addr);
         }
     }
 
@@ -390,4 +375,4 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
index 9f9a450..f93db68 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
@@ -27,9 +27,7 @@
 #ifndef ARMAssembler_h
 #define ARMAssembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "AssemblerBufferWithConstantPool.h"
 #include <wtf/Assertions.h>
@@ -121,6 +119,7 @@ namespace JSC {
             MUL = 0x00000090,
             MULL = 0x00c00090,
             FADDD = 0x0e300b00,
+            FDIVD = 0x0e800b00,
             FSUBD = 0x0e300b40,
             FMULD = 0x0e200b00,
             FCMPD = 0x0eb40b40,
@@ -133,12 +132,18 @@ namespace JSC {
             B = 0x0a000000,
             BL = 0x0b000000,
             FMSR = 0x0e000a10,
+            FMRS = 0x0e100a10,
             FSITOD = 0x0eb80bc0,
+            FTOSID = 0x0ebd0b40,
             FMSTAT = 0x0ef1fa10,
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
             CLZ = 0x016f0f10,
             BKPT = 0xe120070,
 #endif
+#if WTF_ARM_ARCH_AT_LEAST(7)
+            MOVW = 0x03000000,
+            MOVT = 0x03400000,
+#endif
         };
 
         enum {
@@ -148,6 +153,7 @@ namespace JSC {
             SET_CC = (1 << 20),
             OP2_OFSREG = (1 << 25),
             DT_UP = (1 << 23),
+            DT_BYTE = (1 << 22),
             DT_WB = (1 << 21),
             // This flag is inlcuded in LDR and STR
             DT_PRE = (1 << 24),
@@ -175,6 +181,9 @@ namespace JSC {
             padForAlign32 = 0xee120070,
         };
 
+        static const ARMWord INVALID_IMM = 0xf0000000;
+        static const int DefaultPrefetching = 2;
+
         class JmpSrc {
             friend class ARMAssembler;
         public:
@@ -333,6 +342,20 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        void movw_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVW | RD(rd) | op2);
+        }
+
+        void movt_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVT | RD(rd) | op2);
+        }
+#endif
+
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
@@ -378,6 +401,11 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
         }
 
+        void fdivd_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FDIVD, dd, dn, dm);
+        }
+
         void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
@@ -482,17 +510,27 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
         }
 
+        void fmrs_r(int rd, int dn, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FMRS, rd, dn, 0);
+        }
+
         void fsitod_r(int dd, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
         }
 
+        void ftosid_r(int fd, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FTOSID, fd, 0, dm);
+        }
+
         void fmstat(Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | FMSTAT);
         }
 
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
         void clz_r(int rd, int rm, Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | CLZ | RD(rd) | RM(rm));
@@ -501,7 +539,7 @@ namespace JSC {
 
         void bkpt(ARMWord value)
         {
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
 #else
             // Cannot access to Zero memory address
@@ -594,15 +632,32 @@ namespace JSC {
 
         // Patching helpers
 
-        static ARMWord* getLdrImmAddress(ARMWord* insn, uint32_t* constPool = 0);
-        static void linkBranch(void* code, JmpSrc from, void* to, int useConstantPool = 0);
+        static ARMWord* getLdrImmAddress(ARMWord* insn)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+
+            ARMWord addr = reinterpret_cast<ARMWord>(insn) + DefaultPrefetching * sizeof(ARMWord);
+            if (*insn & DT_UP)
+                return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
+            return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
+        }
+
+        static ARMWord* getLdrImmAddressOnPool(ARMWord* insn, uint32_t* constPool)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+
+            if (*insn & 0x1)
+                return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
+            return getLdrImmAddress(insn);
+        }
 
         static void patchPointerInternal(intptr_t from, void* to)
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(from);
             ARMWord* addr = getLdrImmAddress(insn);
             *addr = reinterpret_cast<ARMWord>(to);
-            ExecutableAllocator::cacheFlush(addr, sizeof(ARMWord));
         }
 
         static ARMWord patchConstantPoolLoad(ARMWord load, ARMWord value)
@@ -647,12 +702,13 @@ namespace JSC {
         void linkJump(JmpSrc from, JmpDst to)
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(m_buffer.data()) + (from.m_offset / sizeof(ARMWord));
-            *getLdrImmAddress(insn, m_buffer.poolAddress()) = static_cast<ARMWord>(to.m_offset);
+            ARMWord* addr = getLdrImmAddressOnPool(insn, m_buffer.poolAddress());
+            *addr = static_cast<ARMWord>(to.m_offset);
         }
 
         static void linkJump(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to);
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void relinkJump(void* from, void* to)
@@ -662,12 +718,12 @@ namespace JSC {
 
         static void linkCall(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to, true);
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void relinkCall(void* from, void* to)
         {
-            relinkJump(from, to);
+            patchPointerInternal(reinterpret_cast<intptr_t>(from) - sizeof(ARMWord), to);
         }
 
         // Address operations
@@ -708,12 +764,22 @@ namespace JSC {
         }
 
         static ARMWord getOp2(ARMWord imm);
+
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        static ARMWord getImm16Op2(ARMWord imm)
+        {
+            if (imm <= 0xffff)
+                return (imm & 0xf000) << 4 | (imm & 0xfff);
+            return INVALID_IMM;
+        }
+#endif
         ARMWord getImm(ARMWord imm, int tmpReg, bool invert = false);
         void moveImm(ARMWord imm, int dest);
+        ARMWord encodeComplexImm(ARMWord imm, int dest);
 
         // Memory load/store helpers
 
-        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset);
+        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes = false);
         void baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
         void doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset);
 
@@ -764,6 +830,6 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
index 02ce2e9..21279f5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,9 +27,7 @@
 #ifndef ARMAssembler_h
 #define ARMAssembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
+#if ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
 #include "AssemblerBuffer.h"
 #include <wtf/Assertions.h>
@@ -201,10 +200,10 @@ class ARMThumbImmediate {
 
     ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
     {
-        if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
-            value >>= N;         /* if any were set, lose the bottom N */ \
-        else                     /* if none of the top N bits are set, */ \
-            zeros += N;          /* then we have identified N leading zeros */
+        if (value & ~((1 << N) - 1)) /* check for any of the top N bits (of 2N bits) are set */
+            value >>= N;             /* if any were set, lose the bottom N */
+        else                         /* if none of the top N bits are set, */
+            zeros += N;              /* then we have identified N leading zeros */
     }
 
     static int32_t countLeadingZeros(uint32_t value)
@@ -236,6 +235,11 @@ class ARMThumbImmediate {
     ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
         : m_type(TypeUInt16)
     {
+        // Make sure this constructor is only reached with type TypeUInt16;
+        // this extra parameter makes the code a little clearer by making it
+        // explicit at call sites which type is being constructed
+        ASSERT_UNUSED(type, type == TypeUInt16);
+
         m_value.asInt = value;
     }
 
@@ -577,11 +581,13 @@ private:
         OP_MOV_reg_T1       = 0x4600,
         OP_BLX              = 0x4700,
         OP_BX               = 0x4700,
-        OP_LDRH_reg_T1      = 0x5A00,
         OP_STR_reg_T1       = 0x5000,
         OP_LDR_reg_T1       = 0x5800,
+        OP_LDRH_reg_T1      = 0x5A00,
+        OP_LDRB_reg_T1      = 0x5C00,
         OP_STR_imm_T1       = 0x6000,
         OP_LDR_imm_T1       = 0x6800,
+        OP_LDRB_imm_T1      = 0x7800,
         OP_LDRH_imm_T1      = 0x8800,
         OP_STR_imm_T2       = 0x9000,
         OP_LDR_imm_T2       = 0x9800,
@@ -626,12 +632,15 @@ private:
         OP_SUB_imm_T4   = 0xF2A0,
         OP_MOVT         = 0xF2C0,
         OP_NOP_T2a      = 0xF3AF,
+        OP_LDRB_imm_T3  = 0xF810,
+        OP_LDRB_reg_T2  = 0xF810,
         OP_LDRH_reg_T2  = 0xF830,
         OP_LDRH_imm_T3  = 0xF830,
         OP_STR_imm_T4   = 0xF840,
         OP_STR_reg_T2   = 0xF840,
         OP_LDR_imm_T4   = 0xF850,
         OP_LDR_reg_T2   = 0xF850,
+        OP_LDRB_imm_T2  = 0xF890,
         OP_LDRH_imm_T2  = 0xF8B0,
         OP_STR_imm_T3   = 0xF8C0,
         OP_LDR_imm_T3   = 0xF8D0,
@@ -1075,6 +1084,52 @@ public:
             m_formatter.twoWordOp12Reg4FourFours(OP_LDRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
     }
 
+    void ldrb(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt5())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRB_imm_T1, imm.getUInt5(), rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+
+        ASSERT(!(offset & ~0xff));
+
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T3, rn, rt, offset);
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRB_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRB_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
     void lsl(RegisterID rd, RegisterID rm, int32_t shiftAmount)
     {
         ASSERT(!BadReg(rd));
@@ -1827,6 +1882,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 525fe98..aad70e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -26,8 +26,6 @@
 #ifndef AbstractMacroAssembler_h
 #define AbstractMacroAssembler_h
 
-#include <wtf/Platform.h>
-
 #include <MacroAssemblerCodeRef.h>
 #include <CodeLocation.h>
 #include <wtf/Noncopyable.h>
@@ -173,16 +171,16 @@ public:
     struct Imm32 {
         explicit Imm32(int32_t value)
             : m_value(value)
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
             , m_isPointer(false)
 #endif
         {
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         explicit Imm32(ImmPtr ptr)
             : m_value(ptr.asIntptr())
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
             , m_isPointer(true)
 #endif
         {
@@ -190,13 +188,14 @@ public:
 #endif
 
         int32_t m_value;
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
         // We rely on being able to regenerate code to recover exception handling
         // information.  Since ARMv7 supports 16-bit immediates there is a danger
         // that if pointer values change the layout of the generated code will change.
         // To avoid this problem, always generate pointers (and thus Imm32s constructed
         // from ImmPtrs) with a code sequence that is able  to represent  any pointer
         // value - don't use a more compact form in these cases.
+        // Same for MIPS.
         bool m_isPointer;
 #endif
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
index 073906a..e2fb8a1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -26,8 +26,6 @@
 #ifndef AssemblerBuffer_h
 #define AssemblerBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "stdint.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index af3c3be..b1c537e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -27,8 +27,6 @@
 #ifndef AssemblerBufferWithConstantPool_h
 #define AssemblerBufferWithConstantPool_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "AssemblerBuffer.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
index b910b6f..cab28cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
@@ -26,7 +26,6 @@
 #ifndef CodeLocation_h
 #define CodeLocation_h
 
-#include <wtf/Platform.h>
 
 #include <MacroAssemblerCodeRef.h>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
index 6d08117..47cac5a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
@@ -26,8 +26,6 @@
 #ifndef LinkBuffer_h
 #define LinkBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include <MacroAssembler.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h
new file mode 100644
index 0000000..0ab929d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h
@@ -0,0 +1,935 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MIPSAssembler_h
+#define MIPSAssembler_h
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AssemblerBuffer.h"
+#include <wtf/Assertions.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+typedef uint32_t MIPSWord;
+
+namespace MIPSRegisters {
+typedef enum {
+    r0 = 0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14,
+    r15,
+    r16,
+    r17,
+    r18,
+    r19,
+    r20,
+    r21,
+    r22,
+    r23,
+    r24,
+    r25,
+    r26,
+    r27,
+    r28,
+    r29,
+    r30,
+    r31,
+    zero = r0,
+    at = r1,
+    v0 = r2,
+    v1 = r3,
+    a0 = r4,
+    a1 = r5,
+    a2 = r6,
+    a3 = r7,
+    t0 = r8,
+    t1 = r9,
+    t2 = r10,
+    t3 = r11,
+    t4 = r12,
+    t5 = r13,
+    t6 = r14,
+    t7 = r15,
+    s0 = r16,
+    s1 = r17,
+    s2 = r18,
+    s3 = r19,
+    s4 = r20,
+    s5 = r21,
+    s6 = r22,
+    s7 = r23,
+    t8 = r24,
+    t9 = r25,
+    k0 = r26,
+    k1 = r27,
+    gp = r28,
+    sp = r29,
+    fp = r30,
+    ra = r31
+} RegisterID;
+
+typedef enum {
+    f0,
+    f1,
+    f2,
+    f3,
+    f4,
+    f5,
+    f6,
+    f7,
+    f8,
+    f9,
+    f10,
+    f11,
+    f12,
+    f13,
+    f14,
+    f15,
+    f16,
+    f17,
+    f18,
+    f19,
+    f20,
+    f21,
+    f22,
+    f23,
+    f24,
+    f25,
+    f26,
+    f27,
+    f28,
+    f29,
+    f30,
+    f31
+} FPRegisterID;
+
+} // namespace MIPSRegisters
+
+class MIPSAssembler {
+public:
+    typedef MIPSRegisters::RegisterID RegisterID;
+    typedef MIPSRegisters::FPRegisterID FPRegisterID;
+    typedef SegmentedVector<int, 64> Jumps;
+
+    MIPSAssembler()
+    {
+    }
+
+    // MIPS instruction opcode field position
+    enum {
+        OP_SH_RD = 11,
+        OP_SH_RT = 16,
+        OP_SH_RS = 21,
+        OP_SH_SHAMT = 6,
+        OP_SH_CODE = 16,
+        OP_SH_FD = 6,
+        OP_SH_FS = 11,
+        OP_SH_FT = 16
+    };
+
+    class JmpSrc {
+        friend class MIPSAssembler;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+
+    class JmpDst {
+        friend class MIPSAssembler;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+    void emitInst(MIPSWord op)
+    {
+        void* oldBase = m_buffer.data();
+
+        m_buffer.putInt(op);
+
+        void* newBase = m_buffer.data();
+        if (oldBase != newBase)
+            relocateJumps(oldBase, newBase);
+    }
+
+    void nop()
+    {
+        emitInst(0x00000000);
+    }
+
+    /* Need to insert one load data delay nop for mips1.  */
+    void loadDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    /* Need to insert one coprocessor access delay nop for mips1.  */
+    void copDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    void move(RegisterID rd, RegisterID rs)
+    {
+        /* addu */
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS));
+    }
+
+    /* Set an immediate value to a register.  This may generate 1 or 2
+       instructions.  */
+    void li(RegisterID dest, int imm)
+    {
+        if (imm >= -32768 && imm <= 32767)
+            addiu(dest, MIPSRegisters::zero, imm);
+        else if (imm >= 0 && imm < 65536)
+            ori(dest, MIPSRegisters::zero, imm);
+        else {
+            lui(dest, imm >> 16);
+            if (imm & 0xffff)
+                ori(dest, dest, imm);
+        }
+    }
+
+    void lui(RegisterID rt, int imm)
+    {
+        emitInst(0x3c000000 | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void addiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x24000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void addu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void subu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000023 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void mult(RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000018 | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void mfhi(RegisterID rd)
+    {
+        emitInst(0x00000010 | (rd << OP_SH_RD));
+    }
+
+    void mflo(RegisterID rd)
+    {
+        emitInst(0x00000012 | (rd << OP_SH_RD));
+    }
+
+    void mul(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+#if WTF_MIPS_ISA_AT_LEAST(32) 
+        emitInst(0x70000002 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+#else
+        mult(rs, rt);
+        mflo(rd);
+#endif
+    }
+
+    void andInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000024 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void andi(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x30000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void nor(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000027 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void orInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000025 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void ori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x34000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void xorInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000026 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void xori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x38000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void slt(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002a | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void sltu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002b | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void sltiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x2c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void sll(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000000 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void sllv(RegisterID rd, RegisterID rt, int rs)
+    {
+        emitInst(0x00000004 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | (rs << OP_SH_RS));
+    }
+
+    void sra(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000003 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void srav(RegisterID rd, RegisterID rt, RegisterID rs)
+    {
+        emitInst(0x00000007 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | (rs << OP_SH_RS));
+    }
+
+    void lw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x8c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwl(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x88000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwr(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x98000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lhu(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x94000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void sw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0xac000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void jr(RegisterID rs)
+    {
+        emitInst(0x00000008 | (rs << OP_SH_RS));
+    }
+
+    void jalr(RegisterID rs)
+    {
+        emitInst(0x0000f809 | (rs << OP_SH_RS));
+    }
+
+    void jal()
+    {
+        emitInst(0x0c000000);
+    }
+
+    void bkpt()
+    {
+        int value = 512; /* BRK_BUG */
+        emitInst(0x0000000d | ((value & 0x3ff) << OP_SH_CODE));
+    }
+
+    void bgez(RegisterID rs, int imm)
+    {
+        emitInst(0x04010000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void bltz(RegisterID rs, int imm)
+    {
+        emitInst(0x04000000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void beq(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x10000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bne(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x14000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bc1t()
+    {
+        emitInst(0x45010000);
+    }
+
+    void bc1f()
+    {
+        emitInst(0x45000000);
+    }
+
+    JmpSrc newJmpSrc()
+    {
+        return JmpSrc(m_buffer.size());
+    }
+
+    void appendJump()
+    {
+        m_jumps.append(m_buffer.size());
+    }
+
+    void addd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200000 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void subd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200001 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void muld(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200002 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void lwc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xc4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        copDelayNop();
+    }
+
+    void ldc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xd4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void swc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xe4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void sdc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xf4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void mtc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44800000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void mfc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44000000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void truncwd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x4620000d | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtdw(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46800021 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void ceqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200032 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cngtd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003f | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cnged(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003d | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003c | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003e | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cueqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200033 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200036 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200034 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void culed(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200037 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cultd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200035 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    // General helpers
+
+    JmpDst label()
+    {
+        return JmpDst(m_buffer.size());
+    }
+
+    JmpDst align(int alignment)
+    {
+        while (!m_buffer.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        ASSERT(jump.m_offset != -1);
+        void* b = reinterpret_cast<void*>((reinterpret_cast<intptr_t>(code)) + jump.m_offset);
+        return b;
+    }
+
+    static void* getRelocatedAddress(void* code, JmpDst label)
+    {
+        void* b = reinterpret_cast<void*>((reinterpret_cast<intptr_t>(code)) + label.m_offset);
+        return b;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst from, JmpDst to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst from, JmpSrc to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpSrc from, JmpDst to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    // Assembler admin methods:
+
+    size_t size() const
+    {
+        return m_buffer.size();
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void *result = m_buffer.executableCopy(allocator);
+        if (!result)
+            return 0;
+
+        relocateJumps(m_buffer.data(), result);
+        return result;
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        // The return address is after a call and a delay slot instruction
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + from.m_offset);
+        MIPSWord* toPos = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + to.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, toPos);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, to);
+    }
+
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        linkCallInternal(insn, to);
+    }
+
+    static void linkPointer(void* code, JmpDst from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 5)));
+        insn = insn - 6;
+        int flushSize = linkWithOffset(insn, to);
+
+        ExecutableAllocator::cacheFlush(insn, flushSize);
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        void* start;
+        int size = linkCallInternal(from, to);
+        if (size == sizeof(MIPSWord))
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 2 * sizeof(MIPSWord));
+        else
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 4 * sizeof(MIPSWord));
+
+        ExecutableAllocator::cacheFlush(start, size);
+    }
+
+    static void repatchInt32(void* from, int32_t to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((to >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (to & 0xffff);
+        insn--;
+        ExecutableAllocator::cacheFlush(insn, 2 * sizeof(MIPSWord));
+    }
+
+    static void repatchPointer(void* from, void* to)
+    {
+        repatchInt32(from, reinterpret_cast<int32_t>(to));
+    }
+
+    static void repatchLoadPtrToLEA(void* from)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn + 3;
+        ASSERT((*insn & 0xfc000000) == 0x8c000000); // lw
+        /* lw -> addiu */
+        *insn = 0x24000000 | (*insn & 0x03ffffff);
+
+        ExecutableAllocator::cacheFlush(insn, sizeof(MIPSWord));
+    }
+
+private:
+
+    /* Update each jump in the buffer of newBase.  */
+    void relocateJumps(void* oldBase, void* newBase)
+    {
+        // Check each jump
+        for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
+            int pos = *iter;
+            MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(newBase) + pos);
+            insn = insn + 2;
+            // Need to make sure we have 5 valid instructions after pos
+            if ((unsigned int)pos >= m_buffer.size() - 5 * sizeof(MIPSWord))
+                continue;
+
+            if ((*insn & 0xfc000000) == 0x08000000) { // j
+                int offset = *insn & 0x03ffffff;
+                int oldInsnAddress = (int)insn - (int)newBase + (int)oldBase;
+                int topFourBits = (oldInsnAddress + 4) >> 28;
+                int oldTargetAddress = (topFourBits << 28) | (offset << 2);
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                int newInsnAddress = (int)insn;
+                if (((newInsnAddress + 4) >> 28) == (newTargetAddress >> 28))
+                    *insn = 0x08000000 | ((newTargetAddress >> 2) & 0x3ffffff);
+                else {
+                    /* lui */
+                    *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                    /* ori */
+                    *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+                    /* jr */
+                    *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+                }
+            } else if ((*insn & 0xffe00000) == 0x3c000000) { // lui
+                int high = (*insn & 0xffff) << 16;
+                int low = *(insn + 1) & 0xffff;
+                int oldTargetAddress = high | low;
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                /* lui */
+                *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                /* ori */
+                *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            }
+        }
+    }
+
+    static int linkWithOffset(MIPSWord* insn, void* to)
+    {
+        ASSERT((*insn & 0xfc000000) == 0x10000000 // beq
+               || (*insn & 0xfc000000) == 0x14000000 // bne
+               || (*insn & 0xffff0000) == 0x45010000 // bc1t
+               || (*insn & 0xffff0000) == 0x45000000); // bc1f
+        intptr_t diff = (reinterpret_cast<intptr_t>(to)
+                         - reinterpret_cast<intptr_t>(insn) - 4) >> 2;
+
+        if (diff < -32768 || diff > 32767 || *(insn + 2) != 0x10000003) {
+            /*
+                Convert the sequence:
+                  beq $2, $3, target
+                  nop
+                  b 1f
+                  nop
+                  nop
+                  nop
+                1:
+
+                to the new sequence if possible:
+                  bne $2, $3, 1f
+                  nop
+                  j    target
+                  nop
+                  nop
+                  nop
+                1:
+
+                OR to the new sequence:
+                  bne $2, $3, 1f
+                  nop
+                  lui $25, target >> 16
+                  ori $25, $25, target & 0xffff
+                  jr $25
+                  nop
+                1:
+
+                Note: beq/bne/bc1t are converted to bne/beq/bc1f.
+            */
+
+            if (*(insn + 2) == 0x10000003) {
+                if ((*insn & 0xfc000000) == 0x10000000) // beq
+                    *insn = (*insn & 0x03ff0000) | 0x14000005; // bne
+                else if ((*insn & 0xfc000000) == 0x14000000) // bne
+                    *insn = (*insn & 0x03ff0000) | 0x10000005; // beq
+                else if ((*insn & 0xffff0000) == 0x45010000) // bc1t
+                    *insn = 0x45000005; // bc1f
+                else
+                    ASSERT(0);
+            }
+
+            insn = insn + 2;
+            if ((reinterpret_cast<intptr_t>(insn) + 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *insn = 0x08000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                *(insn + 1) = 0;
+                return 4 * sizeof(MIPSWord);
+            }
+
+            intptr_t newTargetAddress = reinterpret_cast<intptr_t>(to);
+            /* lui */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+            /* ori */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            /* jr */
+            *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 5 * sizeof(MIPSWord);
+        }
+
+        *insn = (*insn & 0xffff0000) | (diff & 0xffff);
+        return sizeof(MIPSWord);
+    }
+
+    static int linkCallInternal(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn - 4;
+
+        if ((*(insn + 2) & 0xfc000000) == 0x0c000000) { // jal
+            if ((reinterpret_cast<intptr_t>(from) - 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *(insn + 2) = 0x0c000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                return sizeof(MIPSWord);
+            }
+
+            /* lui $25, (to >> 16) & 0xffff */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+            /* ori $25, $25, to & 0xffff */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+            /* jalr $25 */
+            *(insn + 2) = 0x0000f809 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 3 * sizeof(MIPSWord);
+        }
+
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        ASSERT((*(insn + 1) & 0xfc000000) == 0x34000000); // ori
+
+        /* lui */
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        /* ori */
+        *(insn + 1) = (*(insn + 1) & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+        return 2 * sizeof(MIPSWord);
+    }
+
+    AssemblerBuffer m_buffer;
+    Jumps m_jumps;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#endif // MIPSAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
index 2743ab4..e6f698f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
@@ -26,23 +26,27 @@
 #ifndef MacroAssembler_h
 #define MacroAssembler_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 #include "MacroAssemblerARMv7.h"
 namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
 #include "MacroAssemblerARM.h"
 namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; };
 
-#elif PLATFORM(X86)
+#elif CPU(MIPS)
+#include "MacroAssemblerMIPS.h"
+namespace JSC {
+typedef MacroAssemblerMIPS MacroAssemblerBase;
+};
+
+#elif CPU(X86)
 #include "MacroAssemblerX86.h"
 namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
 #include "MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
@@ -60,7 +64,7 @@ public:
     using MacroAssemblerBase::jump;
     using MacroAssemblerBase::branch32;
     using MacroAssemblerBase::branch16;
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     using MacroAssemblerBase::branchPtr;
     using MacroAssemblerBase::branchTestPtr;
 #endif
@@ -133,7 +137,8 @@ public:
 
     // Ptr methods
     // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
-#if !PLATFORM(X86_64)
+    // FIXME: should this use a test for 32-bitness instead of this specific exception?
+#if !CPU(X86_64)
     void addPtr(RegisterID src, RegisterID dest)
     {
         add32(src, dest);
@@ -179,16 +184,6 @@ public:
         or32(imm, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        rshift32(shift_amount, dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        rshift32(imm, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         sub32(src, dest);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index d726ecd..b5b20fa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -26,11 +26,11 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "MacroAssemblerARM.h"
 
-#if PLATFORM(LINUX)
+#if OS(LINUX)
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -43,7 +43,7 @@ namespace JSC {
 
 static bool isVFPPresent()
 {
-#if PLATFORM(LINUX)
+#if OS(LINUX)
     int fd = open("/proc/self/auxv", O_RDONLY);
     if (fd > 0) {
         Elf32_auxv_t aux;
@@ -62,7 +62,8 @@ static bool isVFPPresent()
 
 const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
 
-#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+#if CPU(ARMV5_OR_LOWER)
+/* On ARMv5 and below, natural alignment is required. */
 void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
 {
     ARMWord op2;
@@ -91,4 +92,4 @@ void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, Register
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index 7a72b06..52c4fa2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -28,9 +28,7 @@
 #ifndef MacroAssemblerARM_h
 #define MacroAssemblerARM_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 #include "AbstractMacroAssembler.h"
@@ -38,6 +36,9 @@
 namespace JSC {
 
 class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler> {
+    static const int DoubleConditionMask = 0x0f;
+    static const int DoubleConditionBitSpecial = 0x10;
+    COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
 public:
     enum Condition {
         Equal = ARMAssembler::EQ,
@@ -57,11 +58,20 @@ public:
     };
 
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMAssembler::EQ,
+        DoubleNotEqual = ARMAssembler::NE | DoubleConditionBitSpecial,
         DoubleGreaterThan = ARMAssembler::GT,
         DoubleGreaterThanOrEqual = ARMAssembler::GE,
-        DoubleLessThan = ARMAssembler::LT,
-        DoubleLessThanOrEqual = ARMAssembler::LE,
+        DoubleLessThan = ARMAssembler::CC,
+        DoubleLessThanOrEqual = ARMAssembler::LS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMAssembler::EQ | DoubleConditionBitSpecial,
+        DoubleNotEqualOrUnordered = ARMAssembler::NE,
+        DoubleGreaterThanOrUnordered = ARMAssembler::HI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMAssembler::CS,
+        DoubleLessThanOrUnordered = ARMAssembler::LT,
+        DoubleLessThanOrEqualOrUnordered = ARMAssembler::LE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -106,14 +116,18 @@ public:
             m_assembler.ands_r(dest, dest, w);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, shift_amount));
+        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -131,6 +145,11 @@ public:
         m_assembler.muls_r(dest, src, ARMRegisters::S0);
     }
 
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2(0));
+    }
+
     void not32(RegisterID dest)
     {
         m_assembler.mvns_r(dest, dest);
@@ -148,7 +167,11 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.asr_r(dest, shift_amount));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
@@ -189,6 +212,11 @@ public:
         m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer32(true, dest, address.base, address.offset, true);
+    }
+
     void load32(ImplicitAddress address, RegisterID dest)
     {
         m_assembler.dataTransfer32(true, dest, address.base, address.offset);
@@ -199,7 +227,7 @@ public:
         m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
-#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+#if CPU(ARMV5_OR_LOWER)
     void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest);
 #else
     void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
@@ -334,6 +362,12 @@ public:
             move(src, dest);
     }
 
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        load8(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
     Jump branch32(Condition cond, RegisterID left, RegisterID right, int useConstantPool = 0)
     {
         m_assembler.cmp_r(left, right);
@@ -397,6 +431,12 @@ public:
         return m_assembler.jmp(ARMCondition(cond));
     }
 
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        load8(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
+    }
+
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
@@ -505,6 +545,20 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        or32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     void breakpoint()
     {
         m_assembler.bkpt(0);
@@ -548,6 +602,25 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void set8(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
+    void set8(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        load32(left, ARMRegisters::S1);
+        set32(cond, ARMRegisters::S1, right, dest);
+    }
+
+    void set8(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         load32(address, ARMRegisters::S1);
@@ -559,6 +632,12 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        setTest32(cond, address, mask, dest);
+    }
+
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
@@ -666,6 +745,12 @@ public:
         m_assembler.doubleTransfer(true, dest, address.base, address.offset);
     }
 
+    void loadDouble(void* address, FPRegisterID dest)
+    {
+        m_assembler.ldr_un_imm(ARMRegisters::S0, (ARMWord)address);
+        m_assembler.fdtr_u(true, dest, ARMRegisters::S0, 0);
+    }
+
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
         m_assembler.doubleTransfer(false, src, address.base, address.offset);
@@ -682,6 +767,18 @@ public:
         addDouble(ARMRegisters::SD0, dest);
     }
 
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fdivd_r(dest, dest, src);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        loadDouble(src, ARMRegisters::SD0);
+        divDouble(ARMRegisters::SD0, dest);
+    }
+
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.fsubd_r(dest, dest, src);
@@ -710,11 +807,30 @@ public:
         m_assembler.fsitod_r(dest, dest);
     }
 
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        load32(src, ARMRegisters::S1);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        m_assembler.ldr_un_imm(ARMRegisters::S1, (ARMWord)src.m_ptr);
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         m_assembler.fcmpd_r(left, right);
         m_assembler.fmstat();
-        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond)));
+        if (cond & DoubleConditionBitSpecial)
+            m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::VS);
+        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond & ~DoubleConditionMask)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -729,6 +845,29 @@ public:
         return jump();
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        m_assembler.ftosid_r(ARMRegisters::SD0, src);
+        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.fsitod_r(ARMRegisters::SD0, ARMRegisters::SD0);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
+
+        // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0
+        failureCases.append(branchTest32(Zero, dest));
+    }
+
+    void zeroDouble(FPRegisterID srcDest)
+    {
+        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2(0));
+        convertInt32ToDouble(ARMRegisters::S0, srcDest);
+    }
+
 protected:
     ARMAssembler::Condition ARMCondition(Condition cond)
     {
@@ -811,6 +950,6 @@ private:
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // MacroAssemblerARM_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index c479517..3d08f0e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +27,6 @@
 #ifndef MacroAssemblerARMv7_h
 #define MacroAssemblerARMv7_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "ARMv7Assembler.h"
@@ -93,13 +92,21 @@ public:
         Zero = ARMv7Assembler::ConditionEQ,
         NonZero = ARMv7Assembler::ConditionNE
     };
-
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleNotEqual = ARMv7Assembler::ConditionVC, // Not the right flag! check for this & handle differently.
         DoubleGreaterThan = ARMv7Assembler::ConditionGT,
         DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
         DoubleLessThan = ARMv7Assembler::ConditionLO,
         DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMv7Assembler::ConditionVS, // Not the right flag! check for this & handle differently.
+        DoubleNotEqualOrUnordered = ARMv7Assembler::ConditionNE,
+        DoubleGreaterThanOrUnordered = ARMv7Assembler::ConditionHI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMv7Assembler::ConditionHS,
+        DoubleLessThanOrUnordered = ARMv7Assembler::ConditionLT,
+        DoubleLessThanOrEqualOrUnordered = ARMv7Assembler::ConditionLE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -189,14 +196,19 @@ public:
         }
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, imm.m_value);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.lsl(dest, dest, dataTempRegister);
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, shift_amount);
+        m_assembler.lsl(dest, dest, imm.m_value & 0x1f);
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -233,12 +245,17 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, shift_amount);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.asr(dest, dest, dataTempRegister);
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, imm.m_value);
+        m_assembler.asr(dest, dest, imm.m_value & 0x1f);
     }
 
     void sub32(RegisterID src, RegisterID dest)
@@ -350,6 +367,20 @@ private:
         }
     }
 
+    void load8(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrb(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrb(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrb(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
     void store32(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -386,6 +417,11 @@ public:
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(setupArmAddress(address), dest);
+    }
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
@@ -531,6 +567,23 @@ public:
     {
         m_assembler.vcmp_F64(left, right);
         m_assembler.vmrs_APSR_nzcv_FPSCR();
+
+        if (cond == DoubleNotEqual) {
+            // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump result = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            return result;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump notEqual = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            // We get here if either unordered, or equal.
+            Jump result = makeJump();
+            notEqual.link(this);
+            return result;
+        }
         return makeBranch(cond);
     }
 
@@ -758,6 +811,19 @@ public:
         return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
     }
 
+    Jump branch8(Condition cond, RegisterID left, Imm32 right)
+    {
+        compare32(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch8 we call uses dataTempRegister. :-/
+        load8(left, addressTempRegister);
+        return branch8(cond, addressTempRegister, right);
+    }
+
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
@@ -788,6 +854,21 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
+    Jump branchTest8(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        test32(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
+        load8(address, addressTempRegister);
+        return branchTest8(cond, addressTempRegister, mask);
+    }
+
     Jump jump()
     {
         return Jump(makeJump());
@@ -938,6 +1019,14 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        load8(address, dataTempRegister);
+        test32(dataTempRegister, mask);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
 
     DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 3681af8..543b0fa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -26,8 +26,6 @@
 #ifndef MacroAssemblerCodeRef_h
 #define MacroAssemblerCodeRef_h
 
-#include <wtf/Platform.h>
-
 #include "ExecutableAllocator.h"
 #include "PassRefPtr.h"
 #include "RefPtr.h"
@@ -37,7 +35,7 @@
 
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 // ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
 // into the processor are decorated with the bottom bit set, indicating that this is
 // thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
@@ -130,7 +128,7 @@ public:
     }
 
     explicit MacroAssemblerCodePtr(void* value)
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
         // Decorate the pointer as a thumb code pointer.
         : m_value(reinterpret_cast<char*>(value) + 1)
 #else
@@ -147,7 +145,7 @@ public:
     }
 
     void* executableAddress() const { return m_value; }
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
     // To use this pointer as a data address remove the decoration.
     void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h
new file mode 100644
index 0000000..27e30fc
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -0,0 +1,1658 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MacroAssemblerMIPS_h
+#define MacroAssemblerMIPS_h
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AbstractMacroAssembler.h"
+#include "MIPSAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerMIPS : public AbstractMacroAssembler<MIPSAssembler> {
+public:
+
+    MacroAssemblerMIPS()
+        : m_fixedWidth(false)
+    {
+    }
+
+    static const Scale ScalePtr = TimesFour;
+
+    // For storing immediate number
+    static const RegisterID immTempRegister = MIPSRegisters::t0;
+    // For storing data loaded from the memory
+    static const RegisterID dataTempRegister = MIPSRegisters::t1;
+    // For storing address base
+    static const RegisterID addrTempRegister = MIPSRegisters::t2;
+    // For storing compare result
+    static const RegisterID cmpTempRegister = MIPSRegisters::t3;
+
+    // FP temp register
+    static const FPRegisterID fpTempRegister = MIPSRegisters::f16;
+
+    enum Condition {
+        Equal,
+        NotEqual,
+        Above,
+        AboveOrEqual,
+        Below,
+        BelowOrEqual,
+        GreaterThan,
+        GreaterThanOrEqual,
+        LessThan,
+        LessThanOrEqual,
+        Overflow,
+        Signed,
+        Zero,
+        NonZero
+    };
+
+    enum DoubleCondition {
+        DoubleEqual,
+        DoubleNotEqual,
+        DoubleGreaterThan,
+        DoubleGreaterThanOrEqual,
+        DoubleLessThan,
+        DoubleLessThanOrEqual,
+        DoubleEqualOrUnordered,
+        DoubleNotEqualOrUnordered,
+        DoubleGreaterThanOrUnordered,
+        DoubleGreaterThanOrEqualOrUnordered,
+        DoubleLessThanOrUnordered,
+        DoubleLessThanOrEqualOrUnordered
+    };
+
+    static const RegisterID stackPointerRegister = MIPSRegisters::sp;
+    static const RegisterID returnAddressRegister = MIPSRegisters::ra;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addu(dest, dest, src);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, src, imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              addu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.addu(dest, src, immTempRegister);
+        }
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (!imm.m_isPointer
+                && imm.m_value >= -32768 && imm.m_value <= 32767
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(RegisterID src, Address dest)
+    {
+        if (dest.offset >= -32768 && dest.offset <= 32767 && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, dest.base, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, dest.base, dest.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (dest.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, dest.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, addrTempRegister, dest.offset);
+        }
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           addu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(ImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+        if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth)
+            m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value);
+        else {
+            move(imm, immTempRegister);
+            m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andInsn(dest, dest, src);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (!imm.m_isPointer && imm.m_value > 0 && imm.m_value < 65535
+                 && !m_fixedWidth)
+            m_assembler.andi(dest, dest, imm.m_value);
+        else {
+            /*
+              li        immTemp, imm
+              and       dest, dest, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.andInsn(dest, dest, immTempRegister);
+        }
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sll(dest, dest, imm.m_value);
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.sllv(dest, dest, shiftAmount);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mul(dest, dest, src);
+    }
+
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (!imm.m_isPointer && imm.m_value == 1 && !m_fixedWidth)
+            move(src, dest);
+        else {
+            /*
+                li      dataTemp, imm
+                mul     dest, src, dataTemp
+            */
+            move(imm, dataTempRegister);
+            m_assembler.mul(dest, src, dataTempRegister);
+        }
+    }
+
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.nor(srcDest, srcDest, MIPSRegisters::zero);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orInsn(dest, dest, src);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            return;
+
+        if (!imm.m_isPointer && imm.m_value > 0 && imm.m_value < 65535
+            && !m_fixedWidth) {
+            m_assembler.ori(dest, dest, imm.m_value);
+            return;
+        }
+
+        /*
+            li      dataTemp, imm
+            or      dest, dest, dataTemp
+        */
+        move(imm, dataTempRegister);
+        m_assembler.orInsn(dest, dest, dataTempRegister);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srav(dest, dest, shiftAmount);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sra(dest, dest, imm.m_value);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subu(dest, dest, src);
+    }
+
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, dest, -imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              subu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.subu(dest, dest, immTempRegister);
+        }
+    }
+
+    void sub32(Imm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (!imm.m_isPointer
+                && imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (!imm.m_isPointer
+                && imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           subu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(ImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            m_assembler.addiu(dataTempRegister, dataTempRegister,
+                              -imm.m_value);
+        } else {
+            move(imm, immTempRegister);
+            m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorInsn(dest, dest, src);
+    }
+
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        /*
+            li  immTemp, imm
+            xor dest, dest, immTemp
+        */
+        move(imm, immTempRegister);
+        m_assembler.xorInsn(dest, dest, immTempRegister);
+    }
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.lw(dest, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                lw      dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lw      dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lw      dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32764
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                (Big-Endian)
+                lwl     dest, address.offset(addrTemp)
+                lwr     dest, address.offset+3(addrTemp)
+                (Little-Endian)
+                lwl     dest, address.offset+3(addrTemp)
+                lwr     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, address.offset);
+            m_assembler.lwr(dest, addrTempRegister, address.offset + 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, address.offset + 3);
+            m_assembler.lwr(dest, addrTempRegister, address.offset);
+
+#endif
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, address.offset >> 16
+                ori     immTemp, immTemp, address.offset & 0xffff
+                addu    addrTemp, addrTemp, immTemp
+                (Big-Endian)
+                lw      dest, 0(at)
+                lw      dest, 3(at)
+                (Little-Endian)
+                lw      dest, 3(at)
+                lw      dest, 0(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, address.offset >> 16);
+            m_assembler.ori(immTempRegister, immTempRegister, address.offset);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, 0);
+            m_assembler.lwr(dest, addrTempRegister, 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, 3);
+            m_assembler.lwr(dest, addrTempRegister, 0);
+#endif
+        }
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        /*
+            li  addrTemp, address
+            lw  dest, 0(addrTemp)
+        */
+        move(ImmPtr(address), addrTempRegister);
+        m_assembler.lw(dest, addrTempRegister, 0);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw  dest, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui         addrTemp, address.offset >> 16
+            ori         addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw          dest, 0(addrTemp)
+        */
+        Label label(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Label loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return loadPtrWithPatchToLEA(address, dest);
+    }
+
+    /* Need to use zero-extened load half-word for load16.  */
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lhu     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lhu     dest, (address.offset & 0xffff)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            sw  src, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.sw(src, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sw(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sw      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sw      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            if (!imm.m_isPointer && !imm.m_value)
+                m_assembler.sw(MIPSRegisters::zero, address.base,
+                               address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, address.base, address.offset);
+            }
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      immTemp, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+                m_assembler.sw(MIPSRegisters::zero, addrTempRegister,
+                               address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, addrTempRegister,
+                               address.offset);
+            }
+        }
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        /*
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        move(ImmPtr(address), addrTempRegister);
+        m_assembler.sw(src, addrTempRegister, 0);
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        /*
+            li  immTemp, imm
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth) {
+            move(ImmPtr(address), addrTempRegister);
+            m_assembler.sw(MIPSRegisters::zero, addrTempRegister, 0);
+        } else {
+            move(imm, immTempRegister);
+            move(ImmPtr(address), addrTempRegister);
+            m_assembler.sw(immTempRegister, addrTempRegister, 0);
+        }
+    }
+
+    // Floating-point operations:
+
+    bool supportsFloatingPoint() const
+    {
+#if WTF_MIPS_DOUBLE_FLOAT
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    bool supportsFloatingPointTruncate() const
+    {
+#if WTF_MIPS_DOUBLE_FLOAT && WTF_MIPS_ISA_AT_LEAST(2)
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.lw(dest, MIPSRegisters::sp, 0);
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, 4);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, -4);
+        m_assembler.sw(src, MIPSRegisters::sp, 0);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(Imm32 imm)
+    {
+        move(imm, immTempRegister);
+        push(immTempRegister);
+    }
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (imm.m_isPointer || m_fixedWidth) {
+            m_assembler.lui(dest, imm.m_value >> 16);
+            m_assembler.ori(dest, dest, imm.m_value);
+        } else
+            m_assembler.li(dest, imm.m_value);
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            m_assembler.move(dest, src);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, immTempRegister);
+        move(reg2, reg1);
+        move(immTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        if (cond == Equal || cond == Zero)
+            return branchEqual(left, right);
+        if (cond == NotEqual || cond == NonZero)
+            return branchNotEqual(left, right);
+        if (cond == Above) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == AboveOrEqual) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Below) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == BelowOrEqual) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThan) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThan) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Overflow) {
+            /*
+                xor     cmpTemp, left, right
+                bgez    No_overflow, cmpTemp    # same sign bit -> no overflow
+                nop
+                subu    cmpTemp, left, right
+                xor     cmpTemp, cmpTemp, left
+                bgez    No_overflow, cmpTemp    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+              No_overflow:
+            */
+            m_assembler.xorInsn(cmpTempRegister, left, right);
+            m_assembler.bgez(cmpTempRegister, 11);
+            m_assembler.nop();
+            m_assembler.subu(cmpTempRegister, left, right);
+            m_assembler.xorInsn(cmpTempRegister, cmpTempRegister, left);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            m_assembler.subu(cmpTempRegister, left, right);
+            // Check if the result is negative.
+            m_assembler.slt(cmpTempRegister, cmpTempRegister,
+                            MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        move(right, immTempRegister);
+        return branch32(cond, left, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        load32(left, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32(left, dataTempRegister);
+        // Be careful that the previous load32() uses immTempRegister.
+        // So, we need to put move() after load32().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32WithUnalignedHalfWords(left, dataTempRegister);
+        // Be careful that the previous load32WithUnalignedHalfWords()
+        // uses immTempRegister.
+        // So, we need to put move() after load32WithUnalignedHalfWords().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        load16(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        ASSERT(!(right.m_value & 0xFFFF0000));
+        load16(left, dataTempRegister);
+        // Be careful that the previous load16() uses immTempRegister.
+        // So, we need to put move() after load16().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.andInsn(cmpTempRegister, reg, mask);
+        if (cond == Zero)
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                return branchEqual(reg, MIPSRegisters::zero);
+            return branchNotEqual(reg, MIPSRegisters::zero);
+        }
+        move(mask, immTempRegister);
+        return branchTest32(cond, reg, immTempRegister);
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump jump()
+    {
+        return branchEqual(MIPSRegisters::zero, MIPSRegisters::zero);
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jr(target);
+        m_assembler.nop();
+    }
+
+    void jump(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+    }
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bltz    cmpTemp, No_overflow    # diff sign bit -> no overflow
+                addu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign big -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bltz(cmpTempRegister, 10);
+            m_assembler.addu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            add32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            add32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            add32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                mult    src, dest
+                mfhi    dataTemp
+                mflo    dest
+                sra     addrTemp, dest, 31
+                beq     dataTemp, addrTemp, No_overflow # all sign bits (bit 63 to bit 31) are the same -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            m_assembler.mult(src, dest);
+            m_assembler.mfhi(dataTempRegister);
+            m_assembler.mflo(dest);
+            m_assembler.sra(addrTempRegister, dest, 31);
+            m_assembler.beq(dataTempRegister, addrTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            mul32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            mul32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            mul32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        move(src, dest);
+        return branchMul32(cond, immTempRegister, dest);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                subu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bgez(cmpTempRegister, 10);
+            m_assembler.subu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            sub32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            sub32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            sub32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchSub32(cond, immTempRegister, dest);
+    }
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+    }
+
+    Call nearCall()
+    {
+        /* We need two words for relaxation.  */
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.jal();
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::LinkableNear);
+    }
+
+    Call call()
+    {
+        m_assembler.lui(MIPSRegisters::t9, 0);
+        m_assembler.ori(MIPSRegisters::t9, MIPSRegisters::t9, 0);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::Linkable);
+    }
+
+    Call call(RegisterID target)
+    {
+        m_assembler.jalr(target);
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::None);
+    }
+
+    Call call(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.newJmpSrc(), Call::None);
+    }
+
+    void ret()
+    {
+        m_assembler.jr(MIPSRegisters::ra);
+        m_assembler.nop();
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        if (cond == Equal || cond == Zero) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltiu(dest, dest, 1);
+        } else if (cond == NotEqual || cond == NonZero) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltu(dest, MIPSRegisters::zero, dest);
+        } else if (cond == Above)
+            m_assembler.sltu(dest, right, left);
+        else if (cond == AboveOrEqual) {
+            m_assembler.sltu(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Below)
+            m_assembler.sltu(dest, left, right);
+        else if (cond == BelowOrEqual) {
+            m_assembler.sltu(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == GreaterThan)
+            m_assembler.slt(dest, right, left);
+        else if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == LessThan)
+            m_assembler.slt(dest, left, right);
+        else if (cond == LessThanOrEqual) {
+            m_assembler.slt(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Overflow) {
+            /*
+                xor     cmpTemp, left, right
+                bgez    Done, cmpTemp   # same sign bit -> no overflow
+                move    dest, 0
+                subu    cmpTemp, left, right
+                xor     cmpTemp, cmpTemp, left # diff sign bit -> overflow
+                slt     dest, cmpTemp, 0
+              Done:
+            */
+            m_assembler.xorInsn(cmpTempRegister, left, right);
+            m_assembler.bgez(cmpTempRegister, 4);
+            m_assembler.move(dest, MIPSRegisters::zero);
+            m_assembler.subu(cmpTempRegister, left, right);
+            m_assembler.xorInsn(cmpTempRegister, cmpTempRegister, left);
+            m_assembler.slt(dest, cmpTempRegister, MIPSRegisters::zero);
+        } else if (cond == Signed) {
+            m_assembler.subu(dest, left, right);
+            // Check if the result is negative.
+            m_assembler.slt(dest, dest, MIPSRegisters::zero);
+        }
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        move(right, immTempRegister);
+        set32(cond, left, immTempRegister, dest);
+    }
+
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        load32(address, dataTempRegister);
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                m_assembler.sltiu(dest, dataTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister);
+        } else {
+            move(mask, immTempRegister);
+            m_assembler.andInsn(cmpTempRegister, dataTempRegister,
+                                 immTempRegister);
+            if (cond == Zero)
+                m_assembler.sltiu(dest, cmpTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, cmpTempRegister);
+        }
+    }
+
+    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabel32 label(this);
+        move(imm, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr label(this);
+        move(initialValue, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_fixedWidth = true;
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, left, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_fixedWidth = true;
+        load32(left, dataTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, dataTempRegister, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address)
+    {
+        return storePtrWithPatch(ImmPtr(0), address);
+    }
+
+    Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't update the returned address register
+        m_fixedWidth = true;
+        move(Imm32(0), MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.newJmpSrc(), Call::Linkable);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            lwc1        dest, 0(addrTemp)
+            lwc1        dest+1, 4(addrTemp)
+         */
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lwc1(dest, addrTempRegister, 0);
+        m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            m_assembler.ldc1(dest, address.base, address.offset);
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                ldc1    dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.ldc1(dest, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            swc1        dest, 0(addrTemp)
+            swc1        dest+1, 4(addrTemp)
+         */
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.swc1(src, addrTempRegister, 0);
+        m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sdc1(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sdc1    src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sdc1(src, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.addd(dest, dest, src);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.addd(dest, dest, fpTempRegister);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.subd(dest, dest, src);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.subd(dest, dest, fpTempRegister);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.muld(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.muld(dest, dest, fpTempRegister);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.mtc1(src, fpTempRegister);
+        m_assembler.cvtdw(dest, fpTempRegister);
+    }
+
+    void insertRelaxationWords()
+    {
+        /* We need four words for relaxation. */
+        m_assembler.beq(MIPSRegisters::zero, MIPSRegisters::zero, 3); // Jump over nops;
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.nop();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1t();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1f();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.appendJump();
+        m_assembler.beq(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchNotEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.appendJump();
+        m_assembler.bne(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.ceqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleNotEqual) {
+            m_assembler.ceqd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThan) {
+            m_assembler.cngtd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqual) {
+            m_assembler.cnged(right, left);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThan) {
+            m_assembler.cltd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqual) {
+            m_assembler.cled(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            m_assembler.cueqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleGreaterThanOrUnordered) {
+            m_assembler.coled(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            m_assembler.coltd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThanOrUnordered) {
+            m_assembler.cultd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            m_assembler.culed(left, right);
+            return branchTrue();
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MAX 0x7fffffff).
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+        return branch32(Equal, dest, Imm32(0x7fffffff));
+    }
+
+private:
+    // If m_fixedWidth is true, we will generate a fixed number of instructions.
+    // Otherwise, we can emit any number of instructions.
+    bool m_fixedWidth;
+
+    friend class LinkBuffer;
+    friend class RepatchBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        MIPSAssembler::linkCall(code, call.m_jmp, function.value());
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+};
+
+}
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#endif // MacroAssemblerMIPS_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
index 6e96240..0366541 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -26,9 +26,7 @@
 #ifndef MacroAssemblerX86_h
 #define MacroAssemblerX86_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(X86)
+#if ENABLE(ASSEMBLER) && CPU(X86)
 
 #include "MacroAssemblerX86Common.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 5ebefa7..073f563 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -26,8 +26,6 @@
 #ifndef MacroAssemblerX86Common_h
 #define MacroAssemblerX86Common_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "X86Assembler.h"
@@ -36,6 +34,10 @@
 namespace JSC {
 
 class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+    static const int DoubleConditionBitInvert = 0x10;
+    static const int DoubleConditionBitSpecial = 0x20;
+    static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
+
 public:
 
     enum Condition {
@@ -56,13 +58,24 @@ public:
     };
 
     enum DoubleCondition {
-        DoubleEqual = X86Assembler::ConditionE,
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = X86Assembler::ConditionE | DoubleConditionBitSpecial,
         DoubleNotEqual = X86Assembler::ConditionNE,
         DoubleGreaterThan = X86Assembler::ConditionA,
         DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
-        DoubleLessThan = X86Assembler::ConditionB,
-        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+        DoubleLessThan = X86Assembler::ConditionA | DoubleConditionBitInvert,
+        DoubleLessThanOrEqual = X86Assembler::ConditionAE | DoubleConditionBitInvert,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = X86Assembler::ConditionE,
+        DoubleNotEqualOrUnordered = X86Assembler::ConditionNE | DoubleConditionBitSpecial,
+        DoubleGreaterThanOrUnordered = X86Assembler::ConditionB | DoubleConditionBitInvert,
+        DoubleGreaterThanOrEqualOrUnordered = X86Assembler::ConditionBE | DoubleConditionBitInvert,
+        DoubleLessThanOrUnordered = X86Assembler::ConditionB,
+        DoubleLessThanOrEqualOrUnordered = X86Assembler::ConditionBE,
     };
+    COMPILE_ASSERT(
+        !((X86Assembler::ConditionE | X86Assembler::ConditionNE | X86Assembler::ConditionA | X86Assembler::ConditionAE | X86Assembler::ConditionB | X86Assembler::ConditionBE) & DoubleConditionBits),
+        DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);
 
     static const RegisterID stackPointerRegister = X86Registers::esp;
 
@@ -416,20 +429,35 @@ public:
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
     {
+        ASSERT(isSSE2Present());
         m_assembler.cvtsi2sd_mr(src.offset, src.base, dest);
     }
 
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         ASSERT(isSSE2Present());
-        m_assembler.ucomisd_rr(right, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
-    }
 
-    Jump branchDouble(DoubleCondition cond, FPRegisterID left, Address right)
-    {
-        m_assembler.ucomisd_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+
+        if (cond == DoubleEqual) {
+            Jump isUnordered(m_assembler.jp());
+            Jump result = Jump(m_assembler.je());
+            isUnordered.link(this);
+            return result;
+        } else if (cond == DoubleNotEqualOrUnordered) {
+            Jump isUnordered(m_assembler.jp());
+            Jump isEqual(m_assembler.je());
+            isUnordered.link(this);
+            Jump result = jump();
+            isEqual.link(this);
+            return result;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        return Jump(m_assembler.jCC(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -443,6 +471,25 @@ public:
         return branch32(Equal, dest, Imm32(0x80000000));
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        failureCases.append(branchTest32(Zero, dest));
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        convertInt32ToDouble(dest, fpTemp);
+        m_assembler.ucomisd_rr(fpTemp, src);
+        failureCases.append(m_assembler.jp());
+        failureCases.append(m_assembler.jne());
+    }
+
     void zeroDouble(FPRegisterID srcDest)
     {
         ASSERT(isSSE2Present());
@@ -493,7 +540,7 @@ public:
             m_assembler.movl_i32r(imm.m_value, dest);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void move(RegisterID src, RegisterID dest)
     {
         // Note: on 64-bit this is is a full register move; perhaps it would be
@@ -509,7 +556,8 @@ public:
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.xchgq_rr(reg1, reg2);
+        if (reg1 != reg2)
+            m_assembler.xchgq_rr(reg1, reg2);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
@@ -570,6 +618,12 @@ public:
     // an optional second operand of a mask under which to perform the test.
 
 public:
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        m_assembler.cmpb_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branch32(Condition cond, RegisterID left, RegisterID right)
     {
         m_assembler.cmpl_rr(right, left);
@@ -667,6 +721,16 @@ public:
             m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
+    
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpb_im(0, address.offset, address.base);
+        else
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
 
     Jump jump()
     {
@@ -786,6 +850,13 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -867,10 +938,11 @@ public:
     void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base);
+            m_assembler.cmpb_im(0, address.offset, address.base);
         else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
         m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
     }
 
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
@@ -889,18 +961,13 @@ protected:
         return static_cast<X86Assembler::Condition>(cond);
     }
 
-    X86Assembler::Condition x86Condition(DoubleCondition cond)
-    {
-        return static_cast<X86Assembler::Condition>(cond);
-    }
-
 private:
     // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
     // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
     friend class MacroAssemblerX86;
 
-#if PLATFORM(X86)
-#if PLATFORM(MAC)
+#if CPU(X86)
+#if OS(MAC_OS_X)
 
     // All X86 Macs are guaranteed to support at least SSE2,
     static bool isSSE2Present()
@@ -908,7 +975,7 @@ private:
         return true;
     }
 
-#else // PLATFORM(MAC)
+#else // OS(MAC_OS_X)
 
     enum SSE2CheckState {
         NotCheckedSSE2,
@@ -951,8 +1018,8 @@ private:
     
     static SSE2CheckState s_sse2CheckState;
 
-#endif // PLATFORM(MAC)
-#elif !defined(NDEBUG) // PLATFORM(X86)
+#endif // OS(MAC_OS_X)
+#elif !defined(NDEBUG) // CPU(X86)
 
     // On x86-64 we should never be checking for SSE2 in a non-debug build,
     // but non debug add this method to keep the asserts above happy.
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 0f95fe6..b36c323 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -26,9 +26,7 @@
 #ifndef MacroAssemblerX86_64_h
 #define MacroAssemblerX86_64_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(X86_64)
+#if ENABLE(ASSEMBLER) && CPU(X86_64)
 
 #include "MacroAssemblerX86Common.h"
 
@@ -192,33 +190,6 @@ public:
         m_assembler.orq_ir(imm.m_value, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.sarq_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarq_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
-            m_assembler.sarq_CLr(dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.sarq_i8r(imm.m_value, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.subq_rr(src, dest);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
index 89cbf06..72cf6b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
@@ -26,8 +26,6 @@
 #ifndef RepatchBuffer_h
 #define RepatchBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include <MacroAssembler.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
index cbbaaa5..57b811c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
@@ -26,9 +26,7 @@
 #ifndef X86Assembler_h
 #define X86Assembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && (PLATFORM(X86) || PLATFORM(X86_64))
+#if ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
 
 #include "AssemblerBuffer.h"
 #include <stdint.h>
@@ -50,7 +48,7 @@ namespace X86Registers {
         esi,
         edi,
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         r8,
         r9,
         r10,
@@ -118,18 +116,19 @@ private:
         OP_XOR_GvEv                     = 0x33,
         OP_CMP_EvGv                     = 0x39,
         OP_CMP_GvEv                     = 0x3B,
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         PRE_REX                         = 0x40,
 #endif
         OP_PUSH_EAX                     = 0x50,
         OP_POP_EAX                      = 0x58,
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         OP_MOVSXD_GvEv                  = 0x63,
 #endif
         PRE_OPERAND_SIZE                = 0x66,
         PRE_SSE_66                      = 0x66,
         OP_PUSH_Iz                      = 0x68,
         OP_IMUL_GvEvIz                  = 0x69,
+        OP_GROUP1_EbIb                  = 0x80,
         OP_GROUP1_EvIz                  = 0x81,
         OP_GROUP1_EvIb                  = 0x83,
         OP_TEST_EvGv                    = 0x85,
@@ -296,7 +295,7 @@ public:
 
     // Arithmetic operations:
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void adcl_im(int imm, void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -346,7 +345,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void addq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_ADD_EvGv, src, dst);
@@ -423,7 +422,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void andq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_AND_EvGv, src, dst);
@@ -509,7 +508,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void orq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_OR_EvGv, src, dst);
@@ -575,7 +574,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void subq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst);
@@ -641,7 +640,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void xorq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_XOR_EvGv, src, dst);
@@ -689,7 +688,7 @@ public:
         m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_SHL, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void sarq_CLr(RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_SAR, dst);
@@ -760,7 +759,7 @@ public:
         m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
         m_formatter.immediate32(imm);
     }
-
+    
     void cmpl_im(int imm, int offset, RegisterID base)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -771,6 +770,12 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+    
+    void cmpb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EbIb, GROUP1_OP_CMP, base, offset);
+        m_formatter.immediate8(imm);
+    }
 
     void cmpl_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
@@ -789,7 +794,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void cmpq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_CMP_EvGv, src, dst);
@@ -890,6 +895,12 @@ public:
         m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
         m_formatter.immediate32(imm);
     }
+    
+    void testb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
+        m_formatter.immediate8(imm);
+    }
 
     void testl_i32m(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
@@ -897,7 +908,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void testq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_TEST_EvGv, src, dst);
@@ -971,7 +982,7 @@ public:
         m_formatter.oneByteOp(OP_XCHG_EvGv, src, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void xchgq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_XCHG_EvGv, src, dst);
@@ -1001,7 +1012,7 @@ public:
     void movl_mEAX(void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_EAXOv);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
 #else
         m_formatter.immediate32(reinterpret_cast<int>(addr));
@@ -1038,14 +1049,14 @@ public:
     void movl_EAXm(void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_OvEAX);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
 #else
         m_formatter.immediate32(reinterpret_cast<int>(addr));
 #endif
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void movq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_EvGv, src, dst);
@@ -1157,7 +1168,7 @@ public:
     {
         m_formatter.oneByteOp(OP_LEA, dst, base, offset);
     }
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void leaq_mr(int offset, RegisterID base, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
@@ -1323,7 +1334,7 @@ public:
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
     }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void cvtsi2sd_mr(void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1343,7 +1354,7 @@ public:
         m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void movq_rr(XMMRegisterID src, RegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_66);
@@ -1369,7 +1380,7 @@ public:
         m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void movsd_mr(void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1535,7 +1546,7 @@ public:
 
     static void repatchLoadPtrToLEA(void* where)
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
         // Skip over the prefix byte.
         where = reinterpret_cast<char*>(where) + 1;
@@ -1679,7 +1690,7 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
@@ -1722,7 +1733,7 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void twoByteOp(TwoByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
@@ -1732,7 +1743,7 @@ private:
         }
 #endif
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // Quad-word-sized operands:
         //
         // Used to format 64-bit operantions, planting a REX.w prefix.
@@ -1891,7 +1902,7 @@ private:
         static const RegisterID noBase = X86Registers::ebp;
         static const RegisterID hasSib = X86Registers::esp;
         static const RegisterID noIndex = X86Registers::esp;
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         static const RegisterID noBase2 = X86Registers::r13;
         static const RegisterID hasSib2 = X86Registers::r12;
 
@@ -1967,7 +1978,7 @@ private:
         void memoryModRM(int reg, RegisterID base, int offset)
         {
             // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if ((base == hasSib) || (base == hasSib2)) {
 #else
             if (base == hasSib) {
@@ -1982,7 +1993,7 @@ private:
                     m_buffer.putIntUnchecked(offset);
                 }
             } else {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
                 if (!offset && (base != noBase) && (base != noBase2))
 #else
                 if (!offset && (base != noBase))
@@ -2001,7 +2012,7 @@ private:
         void memoryModRM_disp32(int reg, RegisterID base, int offset)
         {
             // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if ((base == hasSib) || (base == hasSib2)) {
 #else
             if (base == hasSib) {
@@ -2018,7 +2029,7 @@ private:
         {
             ASSERT(index != noIndex);
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if (!offset && (base != noBase) && (base != noBase2))
 #else
             if (!offset && (base != noBase))
@@ -2033,7 +2044,7 @@ private:
             }
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void memoryModRM(int reg, void* address)
         {
             // noBase + ModRmMemoryNoDisp means noBase + ModRmMemoryDisp32!
@@ -2048,6 +2059,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(X86)
+#endif // ENABLE(ASSEMBLER) && CPU(X86)
 
 #endif // X86Assembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index c915934..1f090a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -49,9 +49,9 @@ namespace JSC {
 static UString escapeQuotes(const UString& str)
 {
     UString result = str;
-    int pos = 0;
-    while ((pos = result.find('\"', pos)) >= 0) {
-        result = result.substr(0, pos) + "\"\\\"\"" + result.substr(pos + 1);
+    unsigned pos = 0;
+    while ((pos = result.find('\"', pos)) != UString::NotFound) {
+        result = makeString(result.substr(0, pos), "\"\\\"\"", result.substr(pos + 1));
         pos += 4;
     }
     return result;
@@ -62,49 +62,50 @@ static UString valueToSourceString(ExecState* exec, JSValue val)
     if (!val)
         return "0";
 
-    if (val.isString()) {
-        UString result("\"");
-        result += escapeQuotes(val.toString(exec)) + "\"";
-        return result;
-    } 
+    if (val.isString())
+        return makeString("\"", escapeQuotes(val.toString(exec)), "\"");
 
     return val.toString(exec);
 }
 
-static CString registerName(int r)
+static CString constantName(ExecState* exec, int k, JSValue value)
 {
-    if (r == missingThisObjectMarker())
-        return "<null>";
-
-    return (UString("r") + UString::from(r)).UTF8String();
+    return makeString(valueToSourceString(exec, value), "(@k", UString::from(k - FirstConstantRegisterIndex), ")").UTF8String();
 }
 
-static CString constantName(ExecState* exec, int k, JSValue value)
+static CString idName(int id0, const Identifier& ident)
 {
-    return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
+    return makeString(ident.ustring(), "(@id", UString::from(id0), ")").UTF8String();
 }
 
-static CString idName(int id0, const Identifier& ident)
+CString CodeBlock::registerName(ExecState* exec, int r) const
 {
-    return (ident.ustring() + "(@id" + UString::from(id0) +")").UTF8String();
+    if (r == missingThisObjectMarker())
+        return "<null>";
+
+    if (isConstantRegisterIndex(r))
+        return constantName(exec, r, getConstant(r));
+
+    return makeString("r", UString::from(r)).UTF8String();
 }
 
 static UString regexpToSourceString(RegExp* regExp)
 {
-    UString pattern = UString("/") + regExp->pattern() + "/";
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
     if (regExp->global())
-        pattern += "g";
+        postfix[index++] = 'g';
     if (regExp->ignoreCase())
-        pattern += "i";
+        postfix[index++] = 'i';
     if (regExp->multiline())
-        pattern += "m";
+        postfix[index] = 'm';
 
-    return pattern;
+    return makeString("/", regExp->pattern(), postfix);
 }
 
 static CString regexpName(int re, RegExp* regexp)
 {
-    return (regexpToSourceString(regexp) + "(@re" + UString::from(re) + ")").UTF8String();
+    return makeString(regexpToSourceString(regexp), "(@re", UString::from(re), ")").UTF8String();
 }
 
 static UString pointerToSourceString(void* p)
@@ -135,44 +136,44 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printUnaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
 
-    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
 }
 
-static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int r2 = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
+void CodeBlock::printConditionalJump(ExecState* exec, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).c_str(), offset, location + offset);
 }
 
-static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
     it += 4;
 }
 
-static void printPutByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printPutByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
     it += 4;
 }
 
@@ -357,7 +358,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
+            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -481,7 +482,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_enter_with_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] enter_with_activation %s\n", location, registerName(r0).c_str());
+            printf("[%4d] enter_with_activation %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_create_arguments: {
@@ -494,148 +495,148 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
+            printf("[%4d] convert_this %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_object: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] new_object\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] new_object\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_array: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(dst).c_str(), registerName(argv).c_str(), argc);
+            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, argv).c_str(), argc);
             break;
         }
         case op_new_regexp: {
             int r0 = (++it)->u.operand;
             int re0 = (++it)->u.operand;
-            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(r0).c_str(), regexpName(re0, regexp(re0)).c_str());
+            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(exec, r0).c_str(), regexpName(re0, regexp(re0)).c_str());
             break;
         }
         case op_mov: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] mov\t\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_not: {
-            printUnaryOp(location, it, "not");
+            printUnaryOp(exec, location, it, "not");
             break;
         }
         case op_eq: {
-            printBinaryOp(location, it, "eq");
+            printBinaryOp(exec, location, it, "eq");
             break;
         }
         case op_eq_null: {
-            printUnaryOp(location, it, "eq_null");
+            printUnaryOp(exec, location, it, "eq_null");
             break;
         }
         case op_neq: {
-            printBinaryOp(location, it, "neq");
+            printBinaryOp(exec, location, it, "neq");
             break;
         }
         case op_neq_null: {
-            printUnaryOp(location, it, "neq_null");
+            printUnaryOp(exec, location, it, "neq_null");
             break;
         }
         case op_stricteq: {
-            printBinaryOp(location, it, "stricteq");
+            printBinaryOp(exec, location, it, "stricteq");
             break;
         }
         case op_nstricteq: {
-            printBinaryOp(location, it, "nstricteq");
+            printBinaryOp(exec, location, it, "nstricteq");
             break;
         }
         case op_less: {
-            printBinaryOp(location, it, "less");
+            printBinaryOp(exec, location, it, "less");
             break;
         }
         case op_lesseq: {
-            printBinaryOp(location, it, "lesseq");
+            printBinaryOp(exec, location, it, "lesseq");
             break;
         }
         case op_pre_inc: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_inc\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pre_dec: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_dec\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_post_inc: {
-            printUnaryOp(location, it, "post_inc");
+            printUnaryOp(exec, location, it, "post_inc");
             break;
         }
         case op_post_dec: {
-            printUnaryOp(location, it, "post_dec");
+            printUnaryOp(exec, location, it, "post_dec");
             break;
         }
         case op_to_jsnumber: {
-            printUnaryOp(location, it, "to_jsnumber");
+            printUnaryOp(exec, location, it, "to_jsnumber");
             break;
         }
         case op_negate: {
-            printUnaryOp(location, it, "negate");
+            printUnaryOp(exec, location, it, "negate");
             break;
         }
         case op_add: {
-            printBinaryOp(location, it, "add");
+            printBinaryOp(exec, location, it, "add");
             ++it;
             break;
         }
         case op_mul: {
-            printBinaryOp(location, it, "mul");
+            printBinaryOp(exec, location, it, "mul");
             ++it;
             break;
         }
         case op_div: {
-            printBinaryOp(location, it, "div");
+            printBinaryOp(exec, location, it, "div");
             ++it;
             break;
         }
         case op_mod: {
-            printBinaryOp(location, it, "mod");
+            printBinaryOp(exec, location, it, "mod");
             break;
         }
         case op_sub: {
-            printBinaryOp(location, it, "sub");
+            printBinaryOp(exec, location, it, "sub");
             ++it;
             break;
         }
         case op_lshift: {
-            printBinaryOp(location, it, "lshift");
+            printBinaryOp(exec, location, it, "lshift");
             break;            
         }
         case op_rshift: {
-            printBinaryOp(location, it, "rshift");
+            printBinaryOp(exec, location, it, "rshift");
             break;
         }
         case op_urshift: {
-            printBinaryOp(location, it, "urshift");
+            printBinaryOp(exec, location, it, "urshift");
             break;
         }
         case op_bitand: {
-            printBinaryOp(location, it, "bitand");
+            printBinaryOp(exec, location, it, "bitand");
             ++it;
             break;
         }
         case op_bitxor: {
-            printBinaryOp(location, it, "bitxor");
+            printBinaryOp(exec, location, it, "bitxor");
             ++it;
             break;
         }
         case op_bitor: {
-            printBinaryOp(location, it, "bitor");
+            printBinaryOp(exec, location, it, "bitor");
             ++it;
             break;
         }
         case op_bitnot: {
-            printUnaryOp(location, it, "bitnot");
+            printUnaryOp(exec, location, it, "bitnot");
             break;
         }
         case op_instanceof: {
@@ -643,59 +644,59 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
             int r3 = (++it)->u.operand;
-            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str());
+            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str());
             break;
         }
         case op_typeof: {
-            printUnaryOp(location, it, "typeof");
+            printUnaryOp(exec, location, it, "typeof");
             break;
         }
         case op_is_undefined: {
-            printUnaryOp(location, it, "is_undefined");
+            printUnaryOp(exec, location, it, "is_undefined");
             break;
         }
         case op_is_boolean: {
-            printUnaryOp(location, it, "is_boolean");
+            printUnaryOp(exec, location, it, "is_boolean");
             break;
         }
         case op_is_number: {
-            printUnaryOp(location, it, "is_number");
+            printUnaryOp(exec, location, it, "is_number");
             break;
         }
         case op_is_string: {
-            printUnaryOp(location, it, "is_string");
+            printUnaryOp(exec, location, it, "is_string");
             break;
         }
         case op_is_object: {
-            printUnaryOp(location, it, "is_object");
+            printUnaryOp(exec, location, it, "is_object");
             break;
         }
         case op_is_function: {
-            printUnaryOp(location, it, "is_function");
+            printUnaryOp(exec, location, it, "is_function");
             break;
         }
         case op_in: {
-            printBinaryOp(location, it, "in");
+            printBinaryOp(exec, location, it, "in");
             break;
         }
         case op_resolve: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_skip: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
+            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
             break;
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
             break;
         }
@@ -703,125 +704,165 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(r0).c_str(), index, skipLevels);
+            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).c_str(), index, skipLevels);
             break;
         }
         case op_put_scoped_var: {
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(r0).c_str());
+            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).c_str());
             break;
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
-            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
+            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
             break;
         }
         case op_put_global_var: {
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
+            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(exec, r0).c_str());
             break;
         }
         case op_resolve_base: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_with_base: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_id: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id");
+            printGetByIdOp(exec, location, it, "get_by_id");
             break;
         }
         case op_get_by_id_self: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self");
+            printGetByIdOp(exec, location, it, "get_by_id_self");
             break;
         }
         case op_get_by_id_self_list: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self_list");
+            printGetByIdOp(exec, location, it, "get_by_id_self_list");
             break;
         }
         case op_get_by_id_proto: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_proto");
+            printGetByIdOp(exec, location, it, "get_by_id_proto");
             break;
         }
         case op_get_by_id_proto_list: {
-            printGetByIdOp(location, it, m_identifiers, "op_get_by_id_proto_list");
+            printGetByIdOp(exec, location, it, "op_get_by_id_proto_list");
             break;
         }
         case op_get_by_id_chain: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_chain");
+            printGetByIdOp(exec, location, it, "get_by_id_chain");
+            break;
+        }
+        case op_get_by_id_getter_self: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_self");
+            break;
+        }
+        case op_get_by_id_getter_self_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_self_list");
+            break;
+        }
+        case op_get_by_id_getter_proto: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_proto");
+            break;
+        }
+        case op_get_by_id_getter_proto_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_proto_list");
+            break;
+        }
+        case op_get_by_id_getter_chain: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_chain");
+            break;
+        }
+        case op_get_by_id_custom_self: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_self");
+            break;
+        }
+        case op_get_by_id_custom_self_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_self_list");
+            break;
+        }
+        case op_get_by_id_custom_proto: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_proto");
+            break;
+        }
+        case op_get_by_id_custom_proto_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_proto_list");
+            break;
+        }
+        case op_get_by_id_custom_chain: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_chain");
             break;
         }
         case op_get_by_id_generic: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_generic");
+            printGetByIdOp(exec, location, it, "get_by_id_generic");
             break;
         }
         case op_get_array_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_array_length");
+            printGetByIdOp(exec, location, it, "get_array_length");
             break;
         }
         case op_get_string_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_string_length");
+            printGetByIdOp(exec, location, it, "get_string_length");
             break;
         }
         case op_put_by_id: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id");
+            printPutByIdOp(exec, location, it, "put_by_id");
             break;
         }
         case op_put_by_id_replace: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_replace");
+            printPutByIdOp(exec, location, it, "put_by_id_replace");
             break;
         }
         case op_put_by_id_transition: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_transition");
+            printPutByIdOp(exec, location, it, "put_by_id_transition");
             break;
         }
         case op_put_by_id_generic: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_generic");
+            printPutByIdOp(exec, location, it, "put_by_id_generic");
             break;
         }
         case op_put_getter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_put_setter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_method_check: {
-            printf("[%4d] op_method_check\n", location);
+            printf("[%4d] method_check\n", location);
             break;
         }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_get_by_pname: {
@@ -831,28 +872,28 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r3 = (++it)->u.operand;
             int r4 = (++it)->u.operand;
             int r5 = (++it)->u.operand;
-            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), registerName(r4).c_str(), registerName(r5).c_str());
+            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), registerName(exec, r4).c_str(), registerName(exec, r5).c_str());
             break;
         }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_del_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_put_by_index: {
             int r0 = (++it)->u.operand;
             unsigned n0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(r0).c_str(), n0, registerName(r1).c_str());
+            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).c_str(), n0, registerName(exec, r1).c_str());
             break;
         }
         case op_jmp: {
@@ -866,91 +907,102 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_jtrue: {
-            printConditionalJump(begin, it, location, "jtrue");
+            printConditionalJump(exec, begin, it, location, "jtrue");
             break;
         }
         case op_loop_if_true: {
-            printConditionalJump(begin, it, location, "loop_if_true");
+            printConditionalJump(exec, begin, it, location, "loop_if_true");
+            break;
+        }
+        case op_loop_if_false: {
+            printConditionalJump(exec, begin, it, location, "loop_if_false");
             break;
         }
         case op_jfalse: {
-            printConditionalJump(begin, it, location, "jfalse");
+            printConditionalJump(exec, begin, it, location, "jfalse");
             break;
         }
         case op_jeq_null: {
-            printConditionalJump(begin, it, location, "jeq_null");
+            printConditionalJump(exec, begin, it, location, "jeq_null");
             break;
         }
         case op_jneq_null: {
-            printConditionalJump(begin, it, location, "jneq_null");
+            printConditionalJump(exec, begin, it, location, "jneq_null");
             break;
         }
         case op_jneq_ptr: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
+            break;
+        }
+        case op_jless: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_new_func_exp: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_call: {
@@ -958,7 +1010,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_eval: {
@@ -966,7 +1018,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_varargs: {
@@ -974,16 +1026,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), registerName(exec, argCount).c_str(), registerOffset);
             break;
         }
         case op_load_varargs: {
-            printUnaryOp(location, it, "load_varargs");
+            printUnaryOp(exec, location, it, "load_varargs");
             break;
         }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] tear_off_activation\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_tear_off_arguments: {
@@ -992,7 +1044,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_ret: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] ret\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] ret\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_construct: {
@@ -1002,26 +1054,26 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int registerOffset = (++it)->u.operand;
             int proto = (++it)->u.operand;
             int thisRegister = (++it)->u.operand;
-            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset, registerName(proto).c_str(), registerName(thisRegister).c_str());
+            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset, registerName(exec, proto).c_str(), registerName(exec, thisRegister).c_str());
             break;
         }
         case op_construct_verify: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_strcat: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int count = (++it)->u.operand;
-            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            printf("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), count);
             break;
         }
         case op_to_primitive: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_get_pnames: {
@@ -1030,7 +1082,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r2 = it[3].u.operand;
             int r3 = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), offset, location + offset);
+            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
@@ -1038,13 +1090,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int dest = it[1].u.operand;
             int iter = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(exec, dest).c_str(), registerName(exec, iter).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] push_scope\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] push_scope\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pop_scope: {
@@ -1055,7 +1107,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_jmp_scopes: {
@@ -1066,30 +1118,30 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_catch: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] catch\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] catch\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_throw: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] throw\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] throw\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_error: {
             int r0 = (++it)->u.operand;
             int errorType = (++it)->u.operand;
             int k0 = (++it)->u.operand;
-            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
+            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(exec, r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
             break;
         }
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(exec, retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
             int retAddrSrc = (++it)->u.operand;
-            printf("[%4d] sret\t\t %s\n", location, registerName(retAddrSrc).c_str());
+            printf("[%4d] sret\t\t %s\n", location, registerName(exec, retAddrSrc).c_str());
             break;
         }
         case op_debug: {
@@ -1101,17 +1153,17 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_profile_will_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_will_call %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_will_call %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_profile_did_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_did_call\t %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_end: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] end\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] end\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
     }
@@ -1343,16 +1395,16 @@ void CodeBlock::derefStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         vPC[4].u.structure->deref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structure->deref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structureChain->deref();
         return;
@@ -1373,7 +1425,9 @@ void CodeBlock::derefStructures(Instruction* vPC) const
         return;
     }
     if ((vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto_list))
-        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self_list))) {
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self_list))
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto_list))
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self_list))) {
         PolymorphicAccessStructureList* polymorphicStructures = vPC[4].u.polymorphicStructures;
         polymorphicStructures->derefStructures(vPC[5].u.operand);
         delete polymorphicStructures;
@@ -1388,16 +1442,16 @@ void CodeBlock::refStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         vPC[4].u.structure->ref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structure->ref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structureChain->ref();
         return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 4ba58d7..d92dc9d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -36,7 +36,6 @@
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "Nodes.h"
-#include "PtrAndFlags.h"
 #include "RegExp.h"
 #include "UString.h"
 #include <wtf/FastAllocBase.h>
@@ -110,44 +109,54 @@ namespace JSC {
         CodeLocationNearCall callReturnLocation;
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
-        PtrAndFlags<CodeBlock, HasSeenShouldRepatch> ownerCodeBlock;
+        CodeBlock* ownerCodeBlock;
         CodeBlock* callee;
-        unsigned position;
+        unsigned position : 31;
+        unsigned hasSeenShouldRepatch : 1;
         
         void setUnlinked() { callee = 0; }
         bool isLinked() { return callee; }
 
         bool seenOnce()
         {
-            return ownerCodeBlock.isFlagSet(hasSeenShouldRepatch);
+            return hasSeenShouldRepatch;
         }
 
         void setSeen()
         {
-            ownerCodeBlock.setFlag(hasSeenShouldRepatch);
+            hasSeenShouldRepatch = true;
         }
     };
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
             : cachedStructure(0)
+            , cachedPrototypeStructure(0)
         {
         }
 
         bool seenOnce()
         {
-            return cachedPrototypeStructure.isFlagSet(hasSeenShouldRepatch);
+            ASSERT(!cachedStructure);
+            return cachedPrototypeStructure;
         }
 
         void setSeen()
         {
-            cachedPrototypeStructure.setFlag(hasSeenShouldRepatch);
+            ASSERT(!cachedStructure && !cachedPrototypeStructure);
+            // We use the values of cachedStructure & cachedPrototypeStructure to indicate the
+            // current state.
+            //     - In the initial state, both are null.
+            //     - Once this transition has been taken once, cachedStructure is
+            //       null and cachedPrototypeStructure is set to a nun-null value.
+            //     - Once the call is linked both structures are set to non-null values.
+            cachedPrototypeStructure = (Structure*)1;
         }
 
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
         Structure* cachedStructure;
-        PtrAndFlags<Structure, HasSeenShouldRepatch> cachedPrototypeStructure;
+        Structure* cachedPrototypeStructure;
     };
 
     struct FunctionRegisterInfo {
@@ -438,7 +447,7 @@ namespace JSC {
         size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
         void addConstantRegister(const Register& r) { return m_constantRegisters.append(r); }
         Register& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
-        ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
+        ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
         ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
 
         unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
@@ -482,6 +491,13 @@ namespace JSC {
     private:
 #if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
         void dump(ExecState*, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator&) const;
+
+        CString registerName(ExecState*, int r) const;
+        void printUnaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printBinaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printConditionalJump(ExecState*, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator&, int location, const char* op) const;
+        void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
 
         void reparseForExceptionInfoIfNecessary(CallFrame*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index 05834fc..a036dd4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -65,7 +65,7 @@ namespace JSC {
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
     private:
-        static const int maxCacheableSourceLength = 256;
+        static const unsigned maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
         typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalExecutable> > EvalCacheMap;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
index bcef7fb..ab6659f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
@@ -31,6 +31,7 @@
 
 #include "MacroAssembler.h"
 #include "Opcode.h"
+#include "PropertySlot.h"
 #include "Structure.h"
 #include <wtf/VectorTraits.h>
 
@@ -144,6 +145,7 @@ namespace JSC {
         Instruction(StructureChain* structureChain) { u.structureChain = structureChain; }
         Instruction(JSCell* jsCell) { u.jsCell = jsCell; }
         Instruction(PolymorphicAccessStructureList* polymorphicStructures) { u.polymorphicStructures = polymorphicStructures; }
+        Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
 
         union {
             Opcode opcode;
@@ -152,6 +154,7 @@ namespace JSC {
             StructureChain* structureChain;
             JSCell* jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
+            PropertySlot::GetValueFunc getterFunc;
         } u;
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index 4facbef..f7f53fd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -104,6 +104,16 @@ namespace JSC {
         macro(op_get_by_id_proto, 8) \
         macro(op_get_by_id_proto_list, 8) \
         macro(op_get_by_id_chain, 8) \
+        macro(op_get_by_id_getter_self, 8) \
+        macro(op_get_by_id_getter_self_list, 8) \
+        macro(op_get_by_id_getter_proto, 8) \
+        macro(op_get_by_id_getter_proto_list, 8) \
+        macro(op_get_by_id_getter_chain, 8) \
+        macro(op_get_by_id_custom_self, 8) \
+        macro(op_get_by_id_custom_self_list, 8) \
+        macro(op_get_by_id_custom_proto, 8) \
+        macro(op_get_by_id_custom_proto_list, 8) \
+        macro(op_get_by_id_custom_chain, 8) \
         macro(op_get_by_id_generic, 8) \
         macro(op_get_array_length, 8) \
         macro(op_get_string_length, 8) \
@@ -128,9 +138,11 @@ namespace JSC {
         macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
         macro(op_jnlesseq, 4) \
+        macro(op_jless, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
+        macro(op_loop_if_false, 3) \
         macro(op_loop_if_less, 4) \
         macro(op_loop_if_lesseq, 4) \
         macro(op_switch_imm, 4) \
@@ -194,8 +206,12 @@ namespace JSC {
     #undef VERIFY_OPCODE_ID
 
 #if HAVE(COMPUTED_GOTO)
+#if COMPILER(RVCT) || COMPILER(INTEL)
     typedef void* Opcode;
 #else
+    typedef const void* Opcode;
+#endif
+#else
     typedef OpcodeID Opcode;
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index 865c919..3f0babc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -33,7 +33,7 @@
 #include "Interpreter.h"
 #include "Opcode.h"
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 #include <unistd.h>
 #endif
 
@@ -91,7 +91,7 @@ void SamplingFlags::stop() {}
 uint32_t SamplingFlags::s_flags = 1 << 15;
 
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 static void sleepForMicroseconds(unsigned us)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 04dae15..e46bb15 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -616,7 +616,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* target)
 {
-    if (m_lastOpcodeID == op_less && !target->isForward()) {
+    if (m_lastOpcodeID == op_less) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -627,7 +627,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
             rewindBinaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_loop_if_less);
+            emitOpcode(target->isForward() ? op_jless : op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
             instructions().append(target->bind(begin, instructions().size()));
@@ -692,9 +692,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* target)
 {
-    ASSERT(target->isForward());
-
-    if (m_lastOpcodeID == op_less) {
+    if (m_lastOpcodeID == op_less && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -711,7 +709,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_lesseq) {
+    } else if (m_lastOpcodeID == op_lesseq && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -738,12 +736,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             rewindUnaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_jtrue);
+            emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
             instructions().append(srcIndex);
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_eq_null) {
+    } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -758,7 +756,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_neq_null) {
+    } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -776,7 +774,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
     }
 
     size_t begin = instructions().size();
-    emitOpcode(op_jfalse);
+    emitOpcode(target->isForward() ? op_jfalse : op_loop_if_false);
     instructions().append(cond->index());
     instructions().append(target->bind(begin, instructions().size()));
     return target;
@@ -906,7 +904,7 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
             && m_codeBlock->constantRegister(src2->index()).jsValue().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->value();
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -1942,9 +1940,9 @@ static int32_t keyForCharacterSwitch(ExpressionNode* node, int32_t min, int32_t
     UNUSED_PARAM(max);
     ASSERT(node->isString());
     UString::Rep* clause = static_cast<StringNode*>(node)->value().ustring().rep();
-    ASSERT(clause->size() == 1);
+    ASSERT(clause->length() == 1);
     
-    int32_t key = clause->data()[0];
+    int32_t key = clause->characters()[0];
     ASSERT(key >= min);
     ASSERT(key <= max);
     return key - min;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 4648fb5..8b6a425 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -192,6 +192,19 @@ namespace JSC {
             return emitNode(0, n);
         }
 
+        void emitNodeInConditionContext(ExpressionNode* n, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+        {
+            if (!m_codeBlock->numberOfLineInfos() || m_codeBlock->lastLineInfo().lineNumber != n->lineNo()) {
+                LineInfo info = { instructions().size(), n->lineNo() };
+                m_codeBlock->addLineInfo(info);
+            }
+            if (m_emitNodeDepth >= s_maxEmitNodeDepth)
+                emitThrowExpressionTooDeepException();
+            ++m_emitNodeDepth;
+            n->emitBytecodeInConditionContext(*this, trueTarget, falseTarget, fallThroughMeansTrue);
+            --m_emitNodeDepth;
+        }
+
         void emitExpressionInfo(unsigned divot, unsigned startOffset, unsigned endOffset)
         { 
             divot -= m_codeBlock->sourceOffset();
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp
new file mode 100644
index 0000000..e682c73
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -0,0 +1,1999 @@
+/*
+*  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+*  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+*  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+*  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+*  Copyright (C) 2007 Maks Orlovich
+*  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+*
+*  This library is free software; you can redistribute it and/or
+*  modify it under the terms of the GNU Library General Public
+*  License as published by the Free Software Foundation; either
+*  version 2 of the License, or (at your option) any later version.
+*
+*  This library is distributed in the hope that it will be useful,
+*  but WITHOUT ANY WARRANTY; without even the implied warranty of
+*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+*  Library General Public License for more details.
+*
+*  You should have received a copy of the GNU Library General Public License
+*  along with this library; see the file COPYING.LIB.  If not, write to
+*  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+*  Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "BytecodeGenerator.h"
+#include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSStaticScopeObject.h"
+#include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
+#include "Parser.h"
+#include "PropertyNameArray.h"
+#include "RegExpObject.h"
+#include "SamplingTool.h"
+#include <wtf/Assertions.h>
+#include <wtf/RefCountedLeakCounter.h>
+#include <wtf/Threading.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
+
+// ------------------------------ ThrowableExpressionData --------------------------------
+
+static void substitute(UString& string, const UString& substring)
+{
+    unsigned position = string.find("%s");
+    ASSERT(position != UString::NotFound);
+    string = makeString(string.substr(0, position), substring, string.substr(position + 2));
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
+{
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
+{
+    UString message = messageTemplate;
+    substitute(message, label);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
+{
+    return emitThrowError(generator, type, messageTemplate, label.ustring());
+}
+
+// ------------------------------ NullNode -------------------------------------
+
+RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, jsNull());
+}
+
+// ------------------------------ BooleanNode ----------------------------------
+
+RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ NumberNode -----------------------------------
+
+RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ StringNode -----------------------------------
+
+RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ RegExpNode -----------------------------------
+
+RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
+    if (!regExp->isValid())
+        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
+}
+
+// ------------------------------ ThisNode -------------------------------------
+
+RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
+}
+
+// ------------------------------ ResolveNode ----------------------------------
+
+bool ResolveNode::isPure(BytecodeGenerator& generator) const
+{
+    return generator.isLocal(m_ident);
+}
+
+RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+    
+    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
+    return generator.emitResolve(generator.finalDestination(dst), m_ident);
+}
+
+// ------------------------------ ArrayNode ------------------------------------
+
+RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // FIXME: Should we put all of this code into emitNewArray?
+
+    unsigned length = 0;
+    ElementNode* firstPutElement;
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
+        if (firstPutElement->elision())
+            break;
+        ++length;
+    }
+
+    if (!firstPutElement && !m_elision)
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
+
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
+
+    for (ElementNode* n = firstPutElement; n; n = n->next()) {
+        RegisterID* value = generator.emitNode(n->value());
+        length += n->elision();
+        generator.emitPutByIndex(array.get(), length++, value);
+    }
+
+    if (m_elision) {
+        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
+        generator.emitPutById(array.get(), generator.propertyNames().length, value);
+    }
+
+    return generator.moveToDestinationIfNeeded(dst, array.get());
+}
+
+bool ArrayNode::isSimpleArray() const
+{
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
+}
+
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
+{
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
+}
+
+// ------------------------------ ObjectLiteralNode ----------------------------
+
+RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+     if (!m_list) {
+         if (dst == generator.ignoredResult())
+             return 0;
+         return generator.emitNewObject(generator.finalDestination(dst));
+     }
+     return generator.emitNode(dst, m_list);
+}
+
+// ------------------------------ PropertyListNode -----------------------------
+
+RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
+    
+    generator.emitNewObject(newObj.get());
+    
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
+        
+        switch (p->m_node->m_type) {
+            case PropertyNode::Constant: {
+                generator.emitPutById(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Getter: {
+                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Setter: {
+                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            default:
+                ASSERT_NOT_REACHED();
+        }
+    }
+    
+    return generator.moveToDestinationIfNeeded(dst, newObj.get());
+}
+
+// ------------------------------ BracketAccessorNode --------------------------------
+
+RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
+}
+
+// ------------------------------ DotAccessorNode --------------------------------
+
+RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
+}
+
+// ------------------------------ ArgumentListNode -----------------------------
+
+RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ NewExprNode ----------------------------------
+
+RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ EvalFunctionCallNode ----------------------------------
+
+RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallValueNode ----------------------------------
+
+RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallResolveNode ----------------------------------
+
+RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    RefPtr<RegisterID> func = generator.newTemporary();
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    int identifierStart = divot() - startOffset();
+    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallBracketNode ----------------------------------
+
+RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
+    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallDotNode ----------------------------------
+
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> function = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitNode(thisRegister.get(), m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
+    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
+{
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
+}
+
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+
+// ------------------------------ PostfixResolveNode ----------------------------------
+
+static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
+{
+    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
+}
+
+static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
+{
+    if (srcDst == dst)
+        return generator.emitToJSNumber(dst, srcDst);
+    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
+}
+
+RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            return generator.emitToJSNumber(generator.finalDestination(dst), local);
+        }
+
+        if (dst == generator.ignoredResult())
+            return emitPreIncOrDec(generator, local, m_operator);
+        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RegisterID* oldValue;
+        if (dst == generator.ignoredResult()) {
+            oldValue = 0;
+            emitPreIncOrDec(generator, value.get(), m_operator);
+        } else {
+            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+        }
+        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
+        return oldValue;
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> value = generator.newTemporary();
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        emitPreIncOrDec(generator, value.get(), m_operator);
+    } else {
+        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+    }
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixBracketNode ----------------------------------
+
+RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixDotNode ----------------------------------
+
+RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixErrorNode -----------------------------------
+
+RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Postfix ++ operator applied to value that is not a reference."
+        : "Postfix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ DeleteResolveNode -----------------------------------
+
+RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (generator.registerFor(m_ident))
+        return generator.emitLoad(generator.finalDestination(dst), false);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
+}
+
+// ------------------------------ DeleteBracketNode -----------------------------------
+
+RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
+}
+
+// ------------------------------ DeleteDotNode -----------------------------------
+
+RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* r0 = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
+}
+
+// ------------------------------ DeleteValueNode -----------------------------------
+
+RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitNode(generator.ignoredResult(), m_expr);
+
+    // delete on a non-location expression ignores the value and returns true
+    return generator.emitLoad(generator.finalDestination(dst), true);
+}
+
+// ------------------------------ VoidNode -------------------------------------
+
+RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    return generator.emitLoad(dst, jsUndefined());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.emitTypeOf(generator.finalDestination(dst), local);
+    }
+
+    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
+    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
+}
+
+// ------------------------------ PrefixResolveNode ----------------------------------
+
+RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
+            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+        }
+
+        emitPreIncOrDec(generator, local, m_operator);
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        emitPreIncOrDec(generator, propDst.get(), m_operator);
+        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
+        return generator.moveToDestinationIfNeeded(dst, propDst.get());
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
+    emitPreIncOrDec(generator, propDst.get(), m_operator);
+    generator.emitPutById(base.get(), m_ident, propDst.get());
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixBracketNode ----------------------------------
+
+RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixDotNode ----------------------------------
+
+RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixErrorNode -----------------------------------
+
+RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Prefix ++ operator applied to value that is not a reference."
+        : "Prefix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ Unary Operation Nodes -----------------------------------
+
+RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* src = generator.emitNode(m_expr);
+    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
+}
+
+
+// ------------------------------ LogicalNotNode -----------------------------------
+
+void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    ASSERT(expr()->hasConditionContextCodegen());
+
+    // reverse the true and false targets
+    generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, !fallThroughMeansTrue);
+}
+
+
+// ------------------------------ Binary Operation Nodes -----------------------------------
+
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
+}
+
+RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
+    if (opcodeID == op_neq) {
+        if (m_expr1->isNull() || m_expr2->isNull()) {
+            RefPtr<RegisterID> src = generator.tempDestination(dst);
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
+        }
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr1->isNull() || m_expr2->isNull()) {
+        RefPtr<RegisterID> src = generator.tempDestination(dst);
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
+}
+
+RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitGetByIdExceptionInfo(op_instanceof);
+    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
+}
+
+// ------------------------------ LogicalOpNode ----------------------------
+
+RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> temp = generator.tempDestination(dst);
+    RefPtr<Label> target = generator.newLabel();
+    
+    generator.emitNode(temp.get(), m_expr1);
+    if (m_operator == OpLogicalAnd)
+        generator.emitJumpIfFalse(temp.get(), target.get());
+    else
+        generator.emitJumpIfTrue(temp.get(), target.get());
+    generator.emitNode(temp.get(), m_expr2);
+    generator.emitLabel(target.get());
+
+    return generator.moveToDestinationIfNeeded(dst, temp.get());
+}
+
+void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    if (m_expr1->hasConditionContextCodegen()) {
+        RefPtr<Label> afterExpr1 = generator.newLabel();
+        if (m_operator == OpLogicalAnd)
+            generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, true);
+        else 
+            generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), false);
+        generator.emitLabel(afterExpr1.get());
+    } else {
+        RegisterID* temp = generator.emitNode(m_expr1);
+        if (m_operator == OpLogicalAnd)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+
+    if (m_expr2->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMeansTrue);
+    else {
+        RegisterID* temp = generator.emitNode(m_expr2);
+        if (fallThroughMeansTrue)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+}
+
+// ------------------------------ ConditionalNode ------------------------------
+
+RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_logical->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_logical);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(newDst.get(), m_expr1);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+    generator.emitNode(newDst.get(), m_expr2);
+
+    generator.emitLabel(afterElse.get());
+
+    return newDst.get();
+}
+
+// ------------------------------ ReadModifyResolveNode -----------------------------------
+
+// FIXME: should this be moved to be a method on BytecodeGenerator?
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
+{
+    OpcodeID opcodeID;
+    switch (oper) {
+        case OpMultEq:
+            opcodeID = op_mul;
+            break;
+        case OpDivEq:
+            opcodeID = op_div;
+            break;
+        case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
+            opcodeID = op_add;
+            break;
+        case OpMinusEq:
+            opcodeID = op_sub;
+            break;
+        case OpLShift:
+            opcodeID = op_lshift;
+            break;
+        case OpRShift:
+            opcodeID = op_rshift;
+            break;
+        case OpURShift:
+            opcodeID = op_urshift;
+            break;
+        case OpAndEq:
+            opcodeID = op_bitand;
+            break;
+        case OpXOrEq:
+            opcodeID = op_bitxor;
+            break;
+        case OpOrEq:
+            opcodeID = op_bitor;
+            break;
+        case OpModEq:
+            opcodeID = op_mod;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            return dst;
+    }
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
+}
+
+RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        }
+        
+        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
+            RefPtr<RegisterID> result = generator.newTemporary();
+            generator.emitMove(result.get(), local);
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            generator.emitMove(local, result.get());
+            return generator.moveToDestinationIfNeeded(dst, result.get());
+        }
+        
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        generator.emitPutScopedVar(depth, index, result, globalObject);
+        return result;
+    }
+
+    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
+    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
+    return generator.emitPutById(base.get(), m_ident, result);
+}
+
+// ------------------------------ AssignResolveNode -----------------------------------
+
+RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident))
+            return generator.emitNode(dst, m_right);
+        
+        RegisterID* result = generator.emitNode(local, m_right);
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        if (dst == generator.ignoredResult())
+            dst = 0;
+        RegisterID* value = generator.emitNode(dst, m_right);
+        generator.emitPutScopedVar(depth, index, value, globalObject);
+        return value;
+    }
+
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* value = generator.emitNode(dst, m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+// ------------------------------ AssignDotNode -----------------------------------
+
+RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyDotNode -----------------------------------
+
+RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, updatedValue);
+}
+
+// ------------------------------ AssignErrorNode -----------------------------------
+
+RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
+}
+
+// ------------------------------ AssignBracketNode -----------------------------------
+
+RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyBracketNode -----------------------------------
+
+RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), updatedValue);
+
+    return updatedValue;
+}
+
+// ------------------------------ CommaNode ------------------------------------
+
+RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
+}
+
+// ------------------------------ ConstDeclNode ------------------------------------
+
+RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
+{
+    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
+        if (!m_init)
+            return local;
+
+        return generator.emitNode(local, m_init);
+    }
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
+    // FIXME: While this code should only be hit in eval code, it will potentially
+    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    RegisterID* result = 0;
+    for (ConstDeclNode* n = this; n; n = n->m_next)
+        result = n->emitCodeSingle(generator);
+
+    return result;
+}
+
+// ------------------------------ ConstStatementNode -----------------------------
+
+RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_next);
+}
+
+// ------------------------------ SourceElements -------------------------------
+
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    size_t size = m_statements.size();
+    return size ? m_statements[size - 1] : 0;
+}
+
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    size_t size = m_statements.size();
+    for (size_t i = 0; i < size; ++i)
+        generator.emitNode(dst, m_statements[i]);
+}
+
+// ------------------------------ BlockNode ------------------------------------
+
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
+RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+    return 0;
+}
+
+// ------------------------------ EmptyStatementNode ---------------------------
+
+RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ DebuggerStatementNode ---------------------------
+
+RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ ExprStatementNode ----------------------------
+
+RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ VarStatementNode ----------------------------
+
+RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_expr);
+}
+
+// ------------------------------ IfNode ---------------------------------------
+
+RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> afterThen = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), afterThen.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, afterThen.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitLabel(afterThen.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ IfElseNode ---------------------------------------
+
+RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+
+    generator.emitNode(dst, m_elseBlock);
+
+    generator.emitLabel(afterElse.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ DoWhileNode ----------------------------------
+
+RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+   
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ WhileNode ------------------------------------
+
+RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+    
+    generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion
+    return 0;
+}
+
+// ------------------------------ ForNode --------------------------------------
+
+RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_expr1)
+        generator.emitNode(generator.ignoredResult(), m_expr1);
+
+    RefPtr<Label> condition = generator.newLabel();
+    generator.emitJump(condition.get());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (m_expr3)
+        generator.emitNode(generator.ignoredResult(), m_expr3);
+
+    generator.emitLabel(condition.get());
+    if (m_expr2) {
+        if (m_expr2->hasConditionContextCodegen())
+            generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), false);
+        else {
+            RegisterID* cond = generator.emitNode(m_expr2);
+            generator.emitJumpIfTrue(cond, topOfLoop.get());
+        }
+    } else
+        generator.emitJump(topOfLoop.get());
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ ForInNode ------------------------------------
+
+RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    if (!m_lexpr->isLocation())
+        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_init)
+        generator.emitNode(generator.ignoredResult(), m_init);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> expectedSubscript;
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> loopStart = generator.newLabel();
+    generator.emitLabel(loopStart.get());
+
+    RegisterID* propertyName;
+    bool optimizedForinAccess = false;
+    if (m_lexpr->isResolveNode()) {
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+        propertyName = generator.registerFor(ident);
+        if (!propertyName) {
+            propertyName = generator.newTemporary();
+            RefPtr<RegisterID> protect = propertyName;
+            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
+
+            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+            generator.emitPutById(base, ident, propertyName);
+        } else {
+            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
+            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
+            optimizedForinAccess = true;
+        }
+    } else if (m_lexpr->isDotAccessorNode()) {
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
+        const Identifier& ident = assignNode->identifier();
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RegisterID* base = generator.emitNode(assignNode->base());
+
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutById(base, ident, propertyName);
+    } else {
+        ASSERT(m_lexpr->isBracketAccessorNode());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+        RegisterID* subscript = generator.emitNode(assignNode->subscript());
+        
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutByVal(base.get(), subscript, propertyName);
+    }   
+
+    generator.emitNode(dst, m_statement);
+
+    if (optimizedForinAccess)
+        generator.popOptimisedForIn();
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitLabel(scope->breakTarget());
+    return dst;
+}
+
+// ------------------------------ ContinueNode ---------------------------------
+
+// ECMA 12.7
+RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.continueTarget(m_ident);
+
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ BreakNode ------------------------------------
+
+// ECMA 12.8
+RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.breakTarget(m_ident);
+    
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ ReturnNode -----------------------------------
+
+RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (generator.codeType() != FunctionCode)
+        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
+    if (generator.scopeDepth()) {
+        RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
+        generator.emitJumpScopes(l0.get(), 0);
+        generator.emitLabel(l0.get());
+    }
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    return generator.emitReturn(r0);
+}
+
+// ------------------------------ WithNode -------------------------------------
+
+RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<RegisterID> scope = generator.newTemporary();
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
+    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
+    generator.emitPushScope(scope.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
+    generator.emitPopScope();
+    return result;
+}
+
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ CaseBlockNode --------------------------------
+
+enum SwitchKind { 
+    SwitchUnset = 0,
+    SwitchNumber = 1, 
+    SwitchString = 2, 
+    SwitchNeither = 3 
+};
+
+static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
+{
+    for (; list; list = list->getNext()) {
+        ExpressionNode* clauseExpression = list->getClause()->expr();
+        literalVector.append(clauseExpression);
+        if (clauseExpression->isNumber()) {
+            double value = static_cast<NumberNode*>(clauseExpression)->value();
+            int32_t intVal = static_cast<int32_t>(value);
+            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            if (intVal < min_num)
+                min_num = intVal;
+            if (intVal > max_num)
+                max_num = intVal;
+            typeForTable = SwitchNumber;
+            continue;
+        }
+        if (clauseExpression->isString()) {
+            if (typeForTable & ~SwitchString) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
+            if (singleCharacterSwitch &= value.size() == 1) {
+                int32_t intVal = value.rep()->characters()[0];
+                if (intVal < min_num)
+                    min_num = intVal;
+                if (intVal > max_num)
+                    max_num = intVal;
+            }
+            typeForTable = SwitchString;
+            continue;
+        }
+        typeForTable = SwitchNeither;
+        break;        
+    }
+}
+    
+SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
+{
+    SwitchKind typeForTable = SwitchUnset;
+    bool singleCharacterSwitch = true;
+    
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    
+    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
+        return SwitchInfo::SwitchNone;
+    
+    if (typeForTable == SwitchNumber) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchImmediate;
+        return SwitchInfo::SwitchNone;
+    } 
+    
+    ASSERT(typeForTable == SwitchString);
+    
+    if (singleCharacterSwitch) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchCharacter;
+    }
+
+    return SwitchInfo::SwitchString;
+}
+
+RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
+{
+    RefPtr<Label> defaultLabel;
+    Vector<RefPtr<Label>, 8> labelVector;
+    Vector<ExpressionNode*, 8> literalVector;
+    int32_t min_num = std::numeric_limits<int32_t>::max();
+    int32_t max_num = std::numeric_limits<int32_t>::min();
+    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
+
+    if (switchType != SwitchInfo::SwitchNone) {
+        // Prepare the various labels
+        for (uint32_t i = 0; i < literalVector.size(); i++)
+            labelVector.append(generator.newLabel());
+        defaultLabel = generator.newLabel();
+        generator.beginSwitch(switchExpression, switchType);
+    } else {
+        // Setup jumps
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        defaultLabel = generator.newLabel();
+        generator.emitJump(defaultLabel.get());
+    }
+
+    RegisterID* result = 0;
+
+    size_t i = 0;
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+
+    if (m_defaultClause) {
+        generator.emitLabel(defaultLabel.get());
+        m_defaultClause->emitBytecode(generator, dst);
+    }
+
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+    if (!m_defaultClause)
+        generator.emitLabel(defaultLabel.get());
+
+    ASSERT(i == labelVector.size());
+    if (switchType != SwitchInfo::SwitchNone) {
+        ASSERT(labelVector.size() == literalVector.size());
+        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
+    }
+    return result;
+}
+
+// ------------------------------ SwitchNode -----------------------------------
+
+RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
+
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
+
+    generator.emitLabel(scope->breakTarget());
+    return r1;
+}
+
+// ------------------------------ LabelNode ------------------------------------
+
+RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (generator.breakTarget(m_name))
+        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
+
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->breakTarget());
+    return r0;
+}
+
+// ------------------------------ ThrowNode ------------------------------------
+
+RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitThrow(expr.get());
+    return 0;
+}
+
+// ------------------------------ TryNode --------------------------------------
+
+RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // NOTE: The catch and finally blocks must be labeled explicitly, so the
+    // optimizer knows they may be jumped to from anywhere.
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    RefPtr<Label> tryStartLabel = generator.newLabel();
+    RefPtr<Label> finallyStart;
+    RefPtr<RegisterID> finallyReturnAddr;
+    if (m_finallyBlock) {
+        finallyStart = generator.newLabel();
+        finallyReturnAddr = generator.newTemporary();
+        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
+    }
+
+    generator.emitLabel(tryStartLabel.get());
+    generator.emitNode(dst, m_tryBlock);
+
+    if (m_catchBlock) {
+        RefPtr<Label> catchEndLabel = generator.newLabel();
+        
+        // Normal path: jump over the catch block.
+        generator.emitJump(catchEndLabel.get());
+
+        // Uncaught exception path: the catch block.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        if (m_catchHasEval) {
+            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
+            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
+            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
+            generator.emitPushScope(exceptionRegister.get());
+        } else
+            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
+        generator.emitNode(dst, m_catchBlock);
+        generator.emitPopScope();
+        generator.emitLabel(catchEndLabel.get());
+    }
+
+    if (m_finallyBlock) {
+        generator.popFinallyContext();
+        // there may be important registers live at the time we jump
+        // to a finally block (such as for a return or throw) so we
+        // ref the highest register ever used as a conservative
+        // approach to not clobbering anything important
+        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
+        RefPtr<Label> finallyEndLabel = generator.newLabel();
+
+        // Normal path: invoke the finally block, then jump over it.
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitJump(finallyEndLabel.get());
+
+        // Uncaught exception path: invoke the finally block, then re-throw the exception.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitThrow(tempExceptionRegister.get());
+
+        // The finally block.
+        generator.emitLabel(finallyStart.get());
+        generator.emitNode(dst, m_finallyBlock);
+        generator.emitSubroutineReturn(finallyReturnAddr.get());
+
+        generator.emitLabel(finallyEndLabel.get());
+    }
+
+    return dst;
+}
+
+// ------------------------------ ScopeNode -----------------------------
+
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_data->m_statements)
+        m_data->m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ ProgramNode -----------------------------
+
+RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ EvalNode -----------------------------
+
+RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ FunctionBodyNode -----------------------------
+
+RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
+    emitStatementsBytecode(generator, generator.ignoredResult());
+    StatementNode* singleStatement = this->singleStatement();
+    if (singleStatement && singleStatement->isBlock()) {
+        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
+            return 0;
+    }
+
+    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitReturn(r0);
+    return 0;
+}
+
+// ------------------------------ FuncDeclNode ---------------------------------
+
+RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    return dst;
+}
+
+// ------------------------------ FuncExprNode ---------------------------------
+
+RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/config.h b/src/3rdparty/webkit/JavaScriptCore/config.h
index 6681761..acc162a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/config.h
+++ b/src/3rdparty/webkit/JavaScriptCore/config.h
@@ -25,24 +25,26 @@
 
 #include <wtf/Platform.h>
 
-#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
 #define JS_EXPORTDATA __declspec(dllimport)
 #endif
+#define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
+#define JS_EXPORTCLASS
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 // If we don't define these, they get defined in windef.h. 
 // We want to use std::min and std::max
 #define max max
 #define min min
 
-#if !COMPILER(MSVC7) && !PLATFORM(WINCE)
+#if !COMPILER(MSVC7_OR_LOWER) && !OS(WINCE)
 // We need to define this before the first #include of stdlib.h or it won't contain rand_s.
 #ifndef _CRT_RAND_S
 #define _CRT_RAND_S
@@ -51,13 +53,12 @@
 
 #endif
 
-#if PLATFORM(FREEBSD) || PLATFORM(OPENBSD)
+#if OS(FREEBSD) || OS(OPENBSD)
 #define HAVE_PTHREAD_NP_H 1
 #endif
 
 /* FIXME: if all platforms have these, do they really need #defines? */
 #define HAVE_STDINT_H 1
-#define HAVE_STRING_H 1
 
 #define WTF_CHANGES 1
 
@@ -74,3 +75,15 @@
 #include <wtf/DisallowCType.h>
 #endif
 
+#if PLATFORM(CHROMIUM)
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 1
+#endif
+#endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
+#endif /* !defined(WTF_USE_V8) */
+
+/* Using V8 implies not using JSC and vice versa */
+#define WTF_USE_JSC !WTF_USE_V8
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_hash_table b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
index 4184500..77463fb 100755
--- a/src/3rdparty/webkit/JavaScriptCore/create_hash_table
+++ b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
@@ -252,18 +252,21 @@ sub output() {
     foreach my $key (@keys) {
         my $firstValue = "";
         my $secondValue = "";
+        my $castStr = "";
 
         if ($values[$i]{"type"} eq "Function") {
+            $castStr = "static_cast<NativeFunction>";
             $firstValue = $values[$i]{"function"};
             $secondValue = $values[$i]{"params"};
         } elsif ($values[$i]{"type"} eq "Property") {
+            $castStr = "static_cast<PropertySlot::GetValueFunc>";
             $firstValue = $values[$i]{"get"};
             $secondValue = $values[$i]{"put"};
         } elsif ($values[$i]{"type"} eq "Lexer") {
             $firstValue = $values[$i]{"value"};
             $secondValue = "0";
         }
-        print "   { \"$key\", $attrs[$i], (intptr_t)$firstValue, (intptr_t)$secondValue },\n";
+        print "   { \"$key\", $attrs[$i], (intptr_t)" . $castStr . "($firstValue), (intptr_t)$secondValue },\n";
         $i++;
     }
     print "   { 0, 0, 0, 0 }\n";
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs b/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs
new file mode 100644
index 0000000..4d510ea
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs
@@ -0,0 +1,69 @@
+#! /usr/bin/perl -w
+#
+# Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+# Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Library General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Library General Public License for more details.
+#
+# You should have received a copy of the GNU Library General Public License
+# along with this library; see the file COPYING.LIB.  If not, write to
+# the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+
+use strict;
+use File::Basename;
+use Getopt::Long;
+
+my $usage = basename($0) . " --prefix prefix [--offset offset] file";
+
+my $rtype_template = quotemeta("#rtype#");
+my $offset_template = quotemeta("#offset#");
+my $op_template = quotemeta("#op#");
+
+my $prefix;
+my $offset = 32;
+my $file;
+
+my $getOptionsResult = GetOptions(
+    'prefix=s' => \$prefix,
+    'offset=i' => \$offset
+);
+
+$file = $ARGV[0];
+
+die "$usage\n" unless ($prefix and $file);
+
+my $stub_template = "";
+my $stub = "";
+
+my $rtype = "";
+my $op = "";
+
+print STDERR "Creating JIT stubs for $file \n";
+open(IN, $file) or die "No such file $file";
+
+while ( $_ = <IN> ) {
+    if ( /^$prefix\((.*)\)/ ) {
+        $stub_template .= $1 . "\n";
+    }
+    if ( /^DEFINE_STUB_FUNCTION\((.*), (.*)\)/ ) {
+        $stub = $stub_template;
+        $rtype = quotemeta($1);
+        $op = quotemeta($2);
+        $stub =~ s/$offset_template/$offset/g;
+        $stub =~ s/$rtype_template/$rtype/g;
+        $stub =~ s/$op_template/$op/g;
+        $stub =~ s/\\\*/\*/g;
+        print $stub;
+    }
+}
+
+close(IN);
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index 902a802..cbcbd21 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -67,8 +67,9 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     FunctionExecutableSet functionExecutables;
     SourceProviderMap sourceProviders;
 
-    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
-    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
+    LiveObjectIterator it = globalData->heap.primaryHeapBegin();
+    LiveObjectIterator heapEnd = globalData->heap.primaryHeapEnd();
+    for ( ; it != heapEnd; ++it) {
         if (!(*it)->inherits(&JSFunction::info))
             continue;
 
@@ -93,7 +94,7 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     // JavaScript in the inspector.
     SourceProviderMap::const_iterator end = sourceProviders.end();
     for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed(iter->second, SourceCode(iter->first), -1, 0);
+        sourceParsed(iter->second, SourceCode(iter->first), -1, UString());
 }
 
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
index 3ee9767..3b9bec4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
@@ -42,7 +42,7 @@ namespace JSC {
         virtual void detach(JSGlobalObject*);
 
         virtual void sourceParsed(ExecState*, const SourceCode&, int errorLineNumber, const UString& errorMessage) = 0;
-        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler) = 0;
         virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
index 5cc9a9f..0444d23 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -71,14 +71,14 @@ bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& prope
     return m_activation->deleteProperty(exec, propertyName);
 }
 
-void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_activation->getPropertyNames(exec, propertyNames);
+    m_activation->getPropertyNames(exec, propertyNames, mode);
 }
 
-bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool DebuggerActivation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return m_activation->getPropertyAttributes(exec, propertyName, attributes);
+    return m_activation->getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
 void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index 63cf635..3927017 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -42,8 +42,8 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
@@ -51,7 +51,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index c9d7cc6..05a385d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -44,18 +44,18 @@ const UString* DebuggerCallFrame::functionName() const
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
-    return &function->name(&m_callFrame->globalData());
+    return &function->name(m_callFrame);
 }
     
 UString DebuggerCallFrame::calculatedFunctionName() const
 {
     if (!m_callFrame->codeBlock())
-        return 0;
+        return UString();
     
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
-        return 0;
-    return function->calculatedDisplayName(&m_callFrame->globalData());
+        return UString();
+    return function->calculatedDisplayName(m_callFrame);
 }
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
index 5732add..88d3717 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
@@ -1,31 +1,31 @@
-// Automatically generated from ../runtime/ArrayPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/ArrayPrototype.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue arrayTableValues[22] = {
-   { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
-   { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
-   { "join", DontEnum|Function, (intptr_t)arrayProtoFuncJoin, (intptr_t)1 },
-   { "pop", DontEnum|Function, (intptr_t)arrayProtoFuncPop, (intptr_t)0 },
-   { "push", DontEnum|Function, (intptr_t)arrayProtoFuncPush, (intptr_t)1 },
-   { "reverse", DontEnum|Function, (intptr_t)arrayProtoFuncReverse, (intptr_t)0 },
-   { "shift", DontEnum|Function, (intptr_t)arrayProtoFuncShift, (intptr_t)0 },
-   { "slice", DontEnum|Function, (intptr_t)arrayProtoFuncSlice, (intptr_t)2 },
-   { "sort", DontEnum|Function, (intptr_t)arrayProtoFuncSort, (intptr_t)1 },
-   { "splice", DontEnum|Function, (intptr_t)arrayProtoFuncSplice, (intptr_t)2 },
-   { "unshift", DontEnum|Function, (intptr_t)arrayProtoFuncUnShift, (intptr_t)1 },
-   { "every", DontEnum|Function, (intptr_t)arrayProtoFuncEvery, (intptr_t)1 },
-   { "forEach", DontEnum|Function, (intptr_t)arrayProtoFuncForEach, (intptr_t)1 },
-   { "some", DontEnum|Function, (intptr_t)arrayProtoFuncSome, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
-   { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
-   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
-   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
-   { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncToString), (intptr_t)0 },
+   { "toLocaleString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncToLocaleString), (intptr_t)0 },
+   { "concat", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncConcat), (intptr_t)1 },
+   { "join", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncJoin), (intptr_t)1 },
+   { "pop", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncPop), (intptr_t)0 },
+   { "push", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncPush), (intptr_t)1 },
+   { "reverse", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReverse), (intptr_t)0 },
+   { "shift", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncShift), (intptr_t)0 },
+   { "slice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSlice), (intptr_t)2 },
+   { "sort", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSort), (intptr_t)1 },
+   { "splice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSplice), (intptr_t)2 },
+   { "unshift", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncUnShift), (intptr_t)1 },
+   { "every", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncEvery), (intptr_t)1 },
+   { "forEach", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncForEach), (intptr_t)1 },
+   { "some", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSome), (intptr_t)1 },
+   { "indexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncIndexOf), (intptr_t)1 },
+   { "lastIndexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncLastIndexOf), (intptr_t)1 },
+   { "filter", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncFilter), (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReduce), (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReduceRight), (intptr_t)1 },
+   { "map", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncMap), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
index 8b1c735..0174298 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
@@ -1,56 +1,56 @@
-// Automatically generated from ../runtime/DatePrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/DatePrototype.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue dateTableValues[47] = {
-   { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
-   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
-   { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
-   { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
-   { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
-   { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
-   { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
-   { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
-   { "toGMTString", DontEnum|Function, (intptr_t)dateProtoFuncToGMTString, (intptr_t)0 },
-   { "getMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetMonth, (intptr_t)0 },
-   { "getUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMonth, (intptr_t)0 },
-   { "getDate", DontEnum|Function, (intptr_t)dateProtoFuncGetDate, (intptr_t)0 },
-   { "getUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDate, (intptr_t)0 },
-   { "getDay", DontEnum|Function, (intptr_t)dateProtoFuncGetDay, (intptr_t)0 },
-   { "getUTCDay", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDay, (intptr_t)0 },
-   { "getHours", DontEnum|Function, (intptr_t)dateProtoFuncGetHours, (intptr_t)0 },
-   { "getUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCHours, (intptr_t)0 },
-   { "getMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetMinutes, (intptr_t)0 },
-   { "getUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMinutes, (intptr_t)0 },
-   { "getSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetSeconds, (intptr_t)0 },
-   { "getUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCSeconds, (intptr_t)0 },
-   { "getMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetMilliSeconds, (intptr_t)0 },
-   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMilliseconds, (intptr_t)0 },
-   { "getTimezoneOffset", DontEnum|Function, (intptr_t)dateProtoFuncGetTimezoneOffset, (intptr_t)0 },
-   { "setTime", DontEnum|Function, (intptr_t)dateProtoFuncSetTime, (intptr_t)1 },
-   { "setMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetMilliSeconds, (intptr_t)1 },
-   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMilliseconds, (intptr_t)1 },
-   { "setSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetSeconds, (intptr_t)2 },
-   { "setUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCSeconds, (intptr_t)2 },
-   { "setMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetMinutes, (intptr_t)3 },
-   { "setUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMinutes, (intptr_t)3 },
-   { "setHours", DontEnum|Function, (intptr_t)dateProtoFuncSetHours, (intptr_t)4 },
-   { "setUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCHours, (intptr_t)4 },
-   { "setDate", DontEnum|Function, (intptr_t)dateProtoFuncSetDate, (intptr_t)1 },
-   { "setUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCDate, (intptr_t)1 },
-   { "setMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetMonth, (intptr_t)2 },
-   { "setUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMonth, (intptr_t)2 },
-   { "setFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetFullYear, (intptr_t)3 },
-   { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
-   { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
-   { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
-   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToString), (intptr_t)0 },
+   { "toISOString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToISOString), (intptr_t)0 },
+   { "toUTCString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToUTCString), (intptr_t)0 },
+   { "toDateString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToDateString), (intptr_t)0 },
+   { "toTimeString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToTimeString), (intptr_t)0 },
+   { "toLocaleString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleString), (intptr_t)0 },
+   { "toLocaleDateString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleDateString), (intptr_t)0 },
+   { "toLocaleTimeString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleTimeString), (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTime), (intptr_t)0 },
+   { "getTime", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTime), (intptr_t)0 },
+   { "getFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetFullYear), (intptr_t)0 },
+   { "getUTCFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCFullYear), (intptr_t)0 },
+   { "toGMTString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToGMTString), (intptr_t)0 },
+   { "getMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMonth), (intptr_t)0 },
+   { "getUTCMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMonth), (intptr_t)0 },
+   { "getDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetDate), (intptr_t)0 },
+   { "getUTCDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCDate), (intptr_t)0 },
+   { "getDay", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetDay), (intptr_t)0 },
+   { "getUTCDay", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCDay), (intptr_t)0 },
+   { "getHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetHours), (intptr_t)0 },
+   { "getUTCHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCHours), (intptr_t)0 },
+   { "getMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMinutes), (intptr_t)0 },
+   { "getUTCMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMinutes), (intptr_t)0 },
+   { "getSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetSeconds), (intptr_t)0 },
+   { "getUTCSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCSeconds), (intptr_t)0 },
+   { "getMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMilliSeconds), (intptr_t)0 },
+   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMilliseconds), (intptr_t)0 },
+   { "getTimezoneOffset", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTimezoneOffset), (intptr_t)0 },
+   { "setTime", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetTime), (intptr_t)1 },
+   { "setMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMilliSeconds), (intptr_t)1 },
+   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMilliseconds), (intptr_t)1 },
+   { "setSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetSeconds), (intptr_t)2 },
+   { "setUTCSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCSeconds), (intptr_t)2 },
+   { "setMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMinutes), (intptr_t)3 },
+   { "setUTCMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMinutes), (intptr_t)3 },
+   { "setHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetHours), (intptr_t)4 },
+   { "setUTCHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCHours), (intptr_t)4 },
+   { "setDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetDate), (intptr_t)1 },
+   { "setUTCDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCDate), (intptr_t)1 },
+   { "setMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMonth), (intptr_t)2 },
+   { "setUTCMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMonth), (intptr_t)2 },
+   { "setFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetFullYear), (intptr_t)3 },
+   { "setUTCFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCFullYear), (intptr_t)3 },
+   { "setYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetYear), (intptr_t)1 },
+   { "getYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetYear), (intptr_t)0 },
+   { "toJSON", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToJSON), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h b/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h
new file mode 100644
index 0000000..94ab756
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h
@@ -0,0 +1,1199 @@
+extern "C" EncodedJSValue JITStubThunked_op_convert_this(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_convert_this(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_convert_this
+    str lr, [sp, #32]
+    bl JITStubThunked_op_convert_this
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_end(STUB_ARGS_DECLARATION);
+__asm void cti_op_end(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_end
+    str lr, [sp, #32]
+    bl JITStubThunked_op_end
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_add(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_add(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_add
+    str lr, [sp, #32]
+    bl JITStubThunked_op_add
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_pre_inc(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_pre_inc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pre_inc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pre_inc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_timeout_check(STUB_ARGS_DECLARATION);
+__asm int cti_timeout_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_timeout_check
+    str lr, [sp, #32]
+    bl JITStubThunked_timeout_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_register_file_check(STUB_ARGS_DECLARATION);
+__asm void cti_register_file_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_register_file_check
+    str lr, [sp, #32]
+    bl JITStubThunked_register_file_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+__asm int cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_loop_if_lesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_loop_if_lesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_object(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_object
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id_generic(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_generic
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_generic
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_generic(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_generic
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_generic
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_transition_realloc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_transition_realloc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_method_check
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_method_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_self_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_self_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_getter_stub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_getter_stub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_custom_stub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_custom_stub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_list
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_list
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_list_full
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_list_full
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_array_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_array_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_string_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_string_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_instanceof(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_instanceof(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_instanceof
+    str lr, [sp, #32]
+    bl JITStubThunked_op_instanceof
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_del_by_id(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_del_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_del_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_del_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_mul(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_mul(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_mul
+    str lr, [sp, #32]
+    bl JITStubThunked_op_mul
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_func(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_func(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_func
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_func
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_call_JSFunction(STUB_ARGS_DECLARATION);
+__asm void* cti_op_call_JSFunction(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_JSFunction
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_JSFunction
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" VoidPtrPair JITStubThunked_op_call_arityCheck(STUB_ARGS_DECLARATION);
+__asm VoidPtrPair cti_op_call_arityCheck(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_arityCheck
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_arityCheck
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+__asm void* cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_vm_lazyLinkCall
+    str lr, [sp, #32]
+    bl JITStubThunked_vm_lazyLinkCall
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_activation(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_activation(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_activation
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_activation
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_NotJSFunction
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_NotJSFunction
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_create_arguments(STUB_ARGS_DECLARATION);
+__asm void cti_op_create_arguments(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_create_arguments
+    str lr, [sp, #32]
+    bl JITStubThunked_op_create_arguments
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+__asm void cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_create_arguments_no_params
+    str lr, [sp, #32]
+    bl JITStubThunked_op_create_arguments_no_params
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_tear_off_activation(STUB_ARGS_DECLARATION);
+__asm void cti_op_tear_off_activation(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_tear_off_activation
+    str lr, [sp, #32]
+    bl JITStubThunked_op_tear_off_activation
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+__asm void cti_op_tear_off_arguments(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_tear_off_arguments
+    str lr, [sp, #32]
+    bl JITStubThunked_op_tear_off_arguments
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_profile_will_call(STUB_ARGS_DECLARATION);
+__asm void cti_op_profile_will_call(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_profile_will_call
+    str lr, [sp, #32]
+    bl JITStubThunked_op_profile_will_call
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_profile_did_call(STUB_ARGS_DECLARATION);
+__asm void cti_op_profile_did_call(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_profile_did_call
+    str lr, [sp, #32]
+    bl JITStubThunked_op_profile_did_call
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+__asm void cti_op_ret_scopeChain(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_ret_scopeChain
+    str lr, [sp, #32]
+    bl JITStubThunked_op_ret_scopeChain
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_array(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_construct_JSConstruct
+    str lr, [sp, #32]
+    bl JITStubThunked_op_construct_JSConstruct
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_construct_NotJSConstruct
+    str lr, [sp, #32]
+    bl JITStubThunked_op_construct_NotJSConstruct
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val_string(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val_byte_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val_byte_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_sub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_sub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_sub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_sub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_val(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_val_byte_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_val_byte_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_lesseq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_lesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_lesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_lesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_load_varargs(STUB_ARGS_DECLARATION);
+__asm int cti_op_load_varargs(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_load_varargs
+    str lr, [sp, #32]
+    bl JITStubThunked_op_load_varargs
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_negate(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_negate(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_negate
+    str lr, [sp, #32]
+    bl JITStubThunked_op_negate
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_base(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_base(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_base
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_base
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_skip(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_skip(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_skip
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_skip
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_global(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_global(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_global
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_global
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_div(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_div(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_div
+    str lr, [sp, #32]
+    bl JITStubThunked_op_div
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_pre_dec(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_pre_dec(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pre_dec
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pre_dec
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jless(STUB_ARGS_DECLARATION);
+__asm int cti_op_jless(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jless
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jless
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jlesseq(STUB_ARGS_DECLARATION);
+__asm int cti_op_jlesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jlesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jlesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_not(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_not(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_not
+    str lr, [sp, #32]
+    bl JITStubThunked_op_not
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jtrue(STUB_ARGS_DECLARATION);
+__asm int cti_op_jtrue(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jtrue
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jtrue
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_post_inc(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_post_inc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_post_inc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_post_inc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_eq(STUB_ARGS_DECLARATION);
+__asm int cti_op_eq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_eq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_eq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_eq_strings(STUB_ARGS_DECLARATION);
+__asm int cti_op_eq_strings(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_eq_strings
+    str lr, [sp, #32]
+    bl JITStubThunked_op_eq_strings
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_lshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_lshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_lshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_lshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitand(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitand(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitand
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitand
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_rshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_rshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_rshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_rshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitnot(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitnot(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitnot
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitnot
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_with_base(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_with_base(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_with_base
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_with_base
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_func_exp(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_func_exp(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_func_exp
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_func_exp
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_mod(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_mod(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_mod
+    str lr, [sp, #32]
+    bl JITStubThunked_op_mod
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_less(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_less(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_less
+    str lr, [sp, #32]
+    bl JITStubThunked_op_less
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_post_dec(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_post_dec(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_post_dec
+    str lr, [sp, #32]
+    bl JITStubThunked_op_post_dec
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_urshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_urshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_urshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_urshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitxor(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitxor(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitxor
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitxor
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_regexp(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_regexp(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_regexp
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_regexp
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitor(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitor(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitor
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitor
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_call_eval(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_call_eval(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_eval
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_eval
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_throw(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_throw(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_throw
+    str lr, [sp, #32]
+    bl JITStubThunked_op_throw
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSPropertyNameIterator* JITStubThunked_op_get_pnames(STUB_ARGS_DECLARATION);
+__asm JSPropertyNameIterator* cti_op_get_pnames(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_pnames
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_pnames
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_has_property(STUB_ARGS_DECLARATION);
+__asm int cti_has_property(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_has_property
+    str lr, [sp, #32]
+    bl JITStubThunked_has_property
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_scope(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_pop_scope(STUB_ARGS_DECLARATION);
+__asm void cti_op_pop_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pop_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pop_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_typeof(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_typeof(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_typeof
+    str lr, [sp, #32]
+    bl JITStubThunked_op_typeof
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_undefined(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_undefined(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_undefined
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_undefined
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_boolean(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_boolean(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_boolean
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_boolean
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_number(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_number(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_number
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_number
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_string(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_object(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_object
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_function(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_function(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_function
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_function
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_stricteq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_stricteq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_stricteq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_stricteq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_to_primitive(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_to_primitive(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_to_primitive
+    str lr, [sp, #32]
+    bl JITStubThunked_op_to_primitive
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_strcat(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_strcat(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_strcat
+    str lr, [sp, #32]
+    bl JITStubThunked_op_strcat
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_nstricteq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_nstricteq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_nstricteq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_nstricteq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_to_jsnumber(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_to_jsnumber(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_to_jsnumber
+    str lr, [sp, #32]
+    bl JITStubThunked_op_to_jsnumber
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_in(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_in(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_in
+    str lr, [sp, #32]
+    bl JITStubThunked_op_in
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_new_scope(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_new_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_new_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_new_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_jmp_scopes(STUB_ARGS_DECLARATION);
+__asm void cti_op_jmp_scopes(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jmp_scopes
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jmp_scopes
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_index(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_index(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_index
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_index
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_imm(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_imm(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_imm
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_imm
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_char(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_char(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_char
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_char
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_string(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_del_by_val(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_del_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_del_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_del_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_getter(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_getter(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_getter
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_getter
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_setter(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_setter(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_setter
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_setter
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_error(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_error(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_error
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_error
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_debug(STUB_ARGS_DECLARATION);
+__asm void cti_op_debug(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_debug
+    str lr, [sp, #32]
+    bl JITStubThunked_op_debug
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_vm_throw(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_vm_throw(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_vm_throw
+    str lr, [sp, #32]
+    bl JITStubThunked_vm_throw
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_to_object(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_to_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_to_object
+    str lr, [sp, #32]
+    bl JITStubThunked_to_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 4f78903..e62a1c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -76,7 +76,7 @@
 /* Copy the first part of user declarations.  */
 
 /* Line 189 of yacc.c  */
-#line 3 "../parser/Grammar.y"
+#line 3 "parser/Grammar.y"
 
 
 /*
@@ -120,7 +120,7 @@
 // Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Avoid triggering warnings in older bison by not setting this on the Darwin platform.
 // FIXME: Is this still needed?
 #define YYERROR_VERBOSE
@@ -221,7 +221,7 @@ static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserAr
 
 
 /* Line 189 of yacc.c  */
-#line 225 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 225 "/JavaScriptCore/generated/Grammar.tab.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -321,7 +321,7 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 146 "../parser/Grammar.y"
+#line 146 "parser/Grammar.y"
 
     int                 intValue;
     double              doubleValue;
@@ -356,7 +356,7 @@ typedef union YYSTYPE
 
 
 /* Line 214 of yacc.c  */
-#line 360 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 360 "/JavaScriptCore/generated/Grammar.tab.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -380,7 +380,7 @@ typedef struct YYLTYPE
 /* Copy the second part of user declarations.  */
 
 /* Line 264 of yacc.c  */
-#line 178 "../parser/Grammar.y"
+#line 178 "parser/Grammar.y"
 
 
 template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
@@ -396,7 +396,7 @@ static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned
 
 
 /* Line 264 of yacc.c  */
-#line 400 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 400 "/JavaScriptCore/generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -2974,42 +2974,42 @@ yyreduce:
         case 2:
 
 /* Line 1455 of yacc.c  */
-#line 293 "../parser/Grammar.y"
+#line 293 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
 
 /* Line 1455 of yacc.c  */
-#line 294 "../parser/Grammar.y"
+#line 294 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
 
 /* Line 1455 of yacc.c  */
-#line 295 "../parser/Grammar.y"
+#line 295 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
 
 /* Line 1455 of yacc.c  */
-#line 296 "../parser/Grammar.y"
+#line 296 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
 
 /* Line 1455 of yacc.c  */
-#line 297 "../parser/Grammar.y"
+#line 297 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
 
 /* Line 1455 of yacc.c  */
-#line 298 "../parser/Grammar.y"
+#line 298 "parser/Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
                                             const Identifier* pattern;
@@ -3026,7 +3026,7 @@ yyreduce:
   case 8:
 
 /* Line 1455 of yacc.c  */
-#line 309 "../parser/Grammar.y"
+#line 309 "parser/Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
                                             const Identifier* pattern;
@@ -3043,35 +3043,35 @@ yyreduce:
   case 9:
 
 /* Line 1455 of yacc.c  */
-#line 323 "../parser/Grammar.y"
+#line 323 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
 
 /* Line 1455 of yacc.c  */
-#line 324 "../parser/Grammar.y"
+#line 324 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
 
 /* Line 1455 of yacc.c  */
-#line 325 "../parser/Grammar.y"
+#line 325 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
 
 /* Line 1455 of yacc.c  */
-#line 326 "../parser/Grammar.y"
+#line 326 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
 
 /* Line 1455 of yacc.c  */
-#line 328 "../parser/Grammar.y"
+#line 328 "parser/Grammar.y"
     {
                                                                  (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
                                                                  if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -3085,7 +3085,7 @@ yyreduce:
   case 14:
 
 /* Line 1455 of yacc.c  */
-#line 339 "../parser/Grammar.y"
+#line 339 "parser/Grammar.y"
     { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
@@ -3095,7 +3095,7 @@ yyreduce:
   case 15:
 
 /* Line 1455 of yacc.c  */
-#line 343 "../parser/Grammar.y"
+#line 343 "parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
                                           (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
@@ -3105,70 +3105,70 @@ yyreduce:
   case 17:
 
 /* Line 1455 of yacc.c  */
-#line 351 "../parser/Grammar.y"
+#line 351 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
 
 /* Line 1455 of yacc.c  */
-#line 352 "../parser/Grammar.y"
+#line 352 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
 
 /* Line 1455 of yacc.c  */
-#line 354 "../parser/Grammar.y"
+#line 354 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
 
 /* Line 1455 of yacc.c  */
-#line 358 "../parser/Grammar.y"
+#line 358 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
 
 /* Line 1455 of yacc.c  */
-#line 361 "../parser/Grammar.y"
+#line 361 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
 
 /* Line 1455 of yacc.c  */
-#line 362 "../parser/Grammar.y"
+#line 362 "parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
 
 /* Line 1455 of yacc.c  */
-#line 366 "../parser/Grammar.y"
+#line 366 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
 
 /* Line 1455 of yacc.c  */
-#line 367 "../parser/Grammar.y"
+#line 367 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
 
 /* Line 1455 of yacc.c  */
-#line 368 "../parser/Grammar.y"
+#line 368 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
 
 /* Line 1455 of yacc.c  */
-#line 372 "../parser/Grammar.y"
+#line 372 "parser/Grammar.y"
     { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3178,7 +3178,7 @@ yyreduce:
   case 29:
 
 /* Line 1455 of yacc.c  */
-#line 377 "../parser/Grammar.y"
+#line 377 "parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
                                           (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
@@ -3188,35 +3188,35 @@ yyreduce:
   case 30:
 
 /* Line 1455 of yacc.c  */
-#line 384 "../parser/Grammar.y"
+#line 384 "parser/Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
 
 /* Line 1455 of yacc.c  */
-#line 389 "../parser/Grammar.y"
+#line 389 "parser/Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
 
 /* Line 1455 of yacc.c  */
-#line 390 "../parser/Grammar.y"
+#line 390 "parser/Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
 
 /* Line 1455 of yacc.c  */
-#line 395 "../parser/Grammar.y"
+#line 395 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
 
 /* Line 1455 of yacc.c  */
-#line 396 "../parser/Grammar.y"
+#line 396 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3226,7 +3226,7 @@ yyreduce:
   case 37:
 
 /* Line 1455 of yacc.c  */
-#line 400 "../parser/Grammar.y"
+#line 400 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
@@ -3236,7 +3236,7 @@ yyreduce:
   case 38:
 
 /* Line 1455 of yacc.c  */
-#line 404 "../parser/Grammar.y"
+#line 404 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
@@ -3246,7 +3246,7 @@ yyreduce:
   case 40:
 
 /* Line 1455 of yacc.c  */
-#line 412 "../parser/Grammar.y"
+#line 412 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3256,7 +3256,7 @@ yyreduce:
   case 41:
 
 /* Line 1455 of yacc.c  */
-#line 416 "../parser/Grammar.y"
+#line 416 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
@@ -3266,7 +3266,7 @@ yyreduce:
   case 42:
 
 /* Line 1455 of yacc.c  */
-#line 420 "../parser/Grammar.y"
+#line 420 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
@@ -3276,7 +3276,7 @@ yyreduce:
   case 44:
 
 /* Line 1455 of yacc.c  */
-#line 428 "../parser/Grammar.y"
+#line 428 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
@@ -3286,7 +3286,7 @@ yyreduce:
   case 46:
 
 /* Line 1455 of yacc.c  */
-#line 436 "../parser/Grammar.y"
+#line 436 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
@@ -3296,21 +3296,21 @@ yyreduce:
   case 47:
 
 /* Line 1455 of yacc.c  */
-#line 443 "../parser/Grammar.y"
+#line 443 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
 
 /* Line 1455 of yacc.c  */
-#line 444 "../parser/Grammar.y"
+#line 444 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
 
 /* Line 1455 of yacc.c  */
-#line 445 "../parser/Grammar.y"
+#line 445 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3320,7 +3320,7 @@ yyreduce:
   case 50:
 
 /* Line 1455 of yacc.c  */
-#line 449 "../parser/Grammar.y"
+#line 449 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
@@ -3329,21 +3329,21 @@ yyreduce:
   case 51:
 
 /* Line 1455 of yacc.c  */
-#line 455 "../parser/Grammar.y"
+#line 455 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
 
 /* Line 1455 of yacc.c  */
-#line 456 "../parser/Grammar.y"
+#line 456 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
 
 /* Line 1455 of yacc.c  */
-#line 457 "../parser/Grammar.y"
+#line 457 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3353,7 +3353,7 @@ yyreduce:
   case 54:
 
 /* Line 1455 of yacc.c  */
-#line 461 "../parser/Grammar.y"
+#line 461 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
@@ -3363,21 +3363,21 @@ yyreduce:
   case 55:
 
 /* Line 1455 of yacc.c  */
-#line 468 "../parser/Grammar.y"
+#line 468 "parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
 
 /* Line 1455 of yacc.c  */
-#line 469 "../parser/Grammar.y"
+#line 469 "parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
 
 /* Line 1455 of yacc.c  */
-#line 473 "../parser/Grammar.y"
+#line 473 "parser/Grammar.y"
     { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
@@ -3387,7 +3387,7 @@ yyreduce:
   case 58:
 
 /* Line 1455 of yacc.c  */
-#line 477 "../parser/Grammar.y"
+#line 477 "parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
                                           (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
@@ -3397,252 +3397,252 @@ yyreduce:
   case 64:
 
 /* Line 1455 of yacc.c  */
-#line 495 "../parser/Grammar.y"
+#line 495 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
 
 /* Line 1455 of yacc.c  */
-#line 496 "../parser/Grammar.y"
+#line 496 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
 
 /* Line 1455 of yacc.c  */
-#line 501 "../parser/Grammar.y"
+#line 501 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
 
 /* Line 1455 of yacc.c  */
-#line 502 "../parser/Grammar.y"
+#line 502 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
 
 /* Line 1455 of yacc.c  */
-#line 506 "../parser/Grammar.y"
+#line 506 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
 
 /* Line 1455 of yacc.c  */
-#line 507 "../parser/Grammar.y"
+#line 507 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
 
 /* Line 1455 of yacc.c  */
-#line 508 "../parser/Grammar.y"
+#line 508 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
 
 /* Line 1455 of yacc.c  */
-#line 509 "../parser/Grammar.y"
+#line 509 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
 
 /* Line 1455 of yacc.c  */
-#line 510 "../parser/Grammar.y"
+#line 510 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
 
 /* Line 1455 of yacc.c  */
-#line 511 "../parser/Grammar.y"
+#line 511 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
 
 /* Line 1455 of yacc.c  */
-#line 512 "../parser/Grammar.y"
+#line 512 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
 
 /* Line 1455 of yacc.c  */
-#line 513 "../parser/Grammar.y"
+#line 513 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
 
 /* Line 1455 of yacc.c  */
-#line 514 "../parser/Grammar.y"
+#line 514 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
 
 /* Line 1455 of yacc.c  */
-#line 515 "../parser/Grammar.y"
+#line 515 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
 
 /* Line 1455 of yacc.c  */
-#line 516 "../parser/Grammar.y"
+#line 516 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
 
 /* Line 1455 of yacc.c  */
-#line 530 "../parser/Grammar.y"
+#line 530 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
 
 /* Line 1455 of yacc.c  */
-#line 531 "../parser/Grammar.y"
+#line 531 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
 
 /* Line 1455 of yacc.c  */
-#line 532 "../parser/Grammar.y"
+#line 532 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
 
 /* Line 1455 of yacc.c  */
-#line 538 "../parser/Grammar.y"
+#line 538 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
 
 /* Line 1455 of yacc.c  */
-#line 540 "../parser/Grammar.y"
+#line 540 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
 
 /* Line 1455 of yacc.c  */
-#line 542 "../parser/Grammar.y"
+#line 542 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
 
 /* Line 1455 of yacc.c  */
-#line 547 "../parser/Grammar.y"
+#line 547 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
 
 /* Line 1455 of yacc.c  */
-#line 548 "../parser/Grammar.y"
+#line 548 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
 
 /* Line 1455 of yacc.c  */
-#line 554 "../parser/Grammar.y"
+#line 554 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
 
 /* Line 1455 of yacc.c  */
-#line 556 "../parser/Grammar.y"
+#line 556 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
 
 /* Line 1455 of yacc.c  */
-#line 561 "../parser/Grammar.y"
+#line 561 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
 
 /* Line 1455 of yacc.c  */
-#line 562 "../parser/Grammar.y"
+#line 562 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
 
 /* Line 1455 of yacc.c  */
-#line 563 "../parser/Grammar.y"
+#line 563 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
 
 /* Line 1455 of yacc.c  */
-#line 568 "../parser/Grammar.y"
+#line 568 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
 
 /* Line 1455 of yacc.c  */
-#line 569 "../parser/Grammar.y"
+#line 569 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
 
 /* Line 1455 of yacc.c  */
-#line 570 "../parser/Grammar.y"
+#line 570 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
 
 /* Line 1455 of yacc.c  */
-#line 575 "../parser/Grammar.y"
+#line 575 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
 
 /* Line 1455 of yacc.c  */
-#line 576 "../parser/Grammar.y"
+#line 576 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
 
 /* Line 1455 of yacc.c  */
-#line 577 "../parser/Grammar.y"
+#line 577 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
 
 /* Line 1455 of yacc.c  */
-#line 578 "../parser/Grammar.y"
+#line 578 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
 
 /* Line 1455 of yacc.c  */
-#line 579 "../parser/Grammar.y"
+#line 579 "parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3651,7 +3651,7 @@ yyreduce:
   case 112:
 
 /* Line 1455 of yacc.c  */
-#line 582 "../parser/Grammar.y"
+#line 582 "parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3660,35 +3660,35 @@ yyreduce:
   case 114:
 
 /* Line 1455 of yacc.c  */
-#line 589 "../parser/Grammar.y"
+#line 589 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
 
 /* Line 1455 of yacc.c  */
-#line 590 "../parser/Grammar.y"
+#line 590 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
 
 /* Line 1455 of yacc.c  */
-#line 591 "../parser/Grammar.y"
+#line 591 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
 
 /* Line 1455 of yacc.c  */
-#line 592 "../parser/Grammar.y"
+#line 592 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
 
 /* Line 1455 of yacc.c  */
-#line 594 "../parser/Grammar.y"
+#line 594 "parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3697,35 +3697,35 @@ yyreduce:
   case 120:
 
 /* Line 1455 of yacc.c  */
-#line 601 "../parser/Grammar.y"
+#line 601 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
 
 /* Line 1455 of yacc.c  */
-#line 602 "../parser/Grammar.y"
+#line 602 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
 
 /* Line 1455 of yacc.c  */
-#line 603 "../parser/Grammar.y"
+#line 603 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
 
 /* Line 1455 of yacc.c  */
-#line 604 "../parser/Grammar.y"
+#line 604 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
 
 /* Line 1455 of yacc.c  */
-#line 606 "../parser/Grammar.y"
+#line 606 "parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3734,7 +3734,7 @@ yyreduce:
   case 125:
 
 /* Line 1455 of yacc.c  */
-#line 610 "../parser/Grammar.y"
+#line 610 "parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3743,217 +3743,217 @@ yyreduce:
   case 127:
 
 /* Line 1455 of yacc.c  */
-#line 617 "../parser/Grammar.y"
+#line 617 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
 
 /* Line 1455 of yacc.c  */
-#line 618 "../parser/Grammar.y"
+#line 618 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
 
 /* Line 1455 of yacc.c  */
-#line 619 "../parser/Grammar.y"
+#line 619 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
 
 /* Line 1455 of yacc.c  */
-#line 620 "../parser/Grammar.y"
+#line 620 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
 
 /* Line 1455 of yacc.c  */
-#line 626 "../parser/Grammar.y"
+#line 626 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
 
 /* Line 1455 of yacc.c  */
-#line 628 "../parser/Grammar.y"
+#line 628 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
 
 /* Line 1455 of yacc.c  */
-#line 630 "../parser/Grammar.y"
+#line 630 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
 
 /* Line 1455 of yacc.c  */
-#line 632 "../parser/Grammar.y"
+#line 632 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
 
 /* Line 1455 of yacc.c  */
-#line 638 "../parser/Grammar.y"
+#line 638 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
 
 /* Line 1455 of yacc.c  */
-#line 639 "../parser/Grammar.y"
+#line 639 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
 
 /* Line 1455 of yacc.c  */
-#line 641 "../parser/Grammar.y"
+#line 641 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
 
 /* Line 1455 of yacc.c  */
-#line 643 "../parser/Grammar.y"
+#line 643 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
 
 /* Line 1455 of yacc.c  */
-#line 648 "../parser/Grammar.y"
+#line 648 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
 
 /* Line 1455 of yacc.c  */
-#line 654 "../parser/Grammar.y"
+#line 654 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
 
 /* Line 1455 of yacc.c  */
-#line 659 "../parser/Grammar.y"
+#line 659 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
 
 /* Line 1455 of yacc.c  */
-#line 664 "../parser/Grammar.y"
+#line 664 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
 
 /* Line 1455 of yacc.c  */
-#line 670 "../parser/Grammar.y"
+#line 670 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
 
 /* Line 1455 of yacc.c  */
-#line 676 "../parser/Grammar.y"
+#line 676 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
 
 /* Line 1455 of yacc.c  */
-#line 681 "../parser/Grammar.y"
+#line 681 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
 
 /* Line 1455 of yacc.c  */
-#line 687 "../parser/Grammar.y"
+#line 687 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
 
 /* Line 1455 of yacc.c  */
-#line 693 "../parser/Grammar.y"
+#line 693 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
 
 /* Line 1455 of yacc.c  */
-#line 698 "../parser/Grammar.y"
+#line 698 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
 
 /* Line 1455 of yacc.c  */
-#line 704 "../parser/Grammar.y"
+#line 704 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
 
 /* Line 1455 of yacc.c  */
-#line 710 "../parser/Grammar.y"
+#line 710 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
 
 /* Line 1455 of yacc.c  */
-#line 715 "../parser/Grammar.y"
+#line 715 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
 
 /* Line 1455 of yacc.c  */
-#line 721 "../parser/Grammar.y"
+#line 721 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
 
 /* Line 1455 of yacc.c  */
-#line 726 "../parser/Grammar.y"
+#line 726 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
 
 /* Line 1455 of yacc.c  */
-#line 732 "../parser/Grammar.y"
+#line 732 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
 
 /* Line 1455 of yacc.c  */
-#line 738 "../parser/Grammar.y"
+#line 738 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
 
 /* Line 1455 of yacc.c  */
-#line 744 "../parser/Grammar.y"
+#line 744 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
 
 /* Line 1455 of yacc.c  */
-#line 750 "../parser/Grammar.y"
+#line 750 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3962,7 +3962,7 @@ yyreduce:
   case 180:
 
 /* Line 1455 of yacc.c  */
-#line 758 "../parser/Grammar.y"
+#line 758 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3971,7 +3971,7 @@ yyreduce:
   case 182:
 
 /* Line 1455 of yacc.c  */
-#line 766 "../parser/Grammar.y"
+#line 766 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3980,112 +3980,112 @@ yyreduce:
   case 183:
 
 /* Line 1455 of yacc.c  */
-#line 772 "../parser/Grammar.y"
+#line 772 "parser/Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
 
 /* Line 1455 of yacc.c  */
-#line 773 "../parser/Grammar.y"
+#line 773 "parser/Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
 
 /* Line 1455 of yacc.c  */
-#line 774 "../parser/Grammar.y"
+#line 774 "parser/Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
 
 /* Line 1455 of yacc.c  */
-#line 775 "../parser/Grammar.y"
+#line 775 "parser/Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
 
 /* Line 1455 of yacc.c  */
-#line 776 "../parser/Grammar.y"
+#line 776 "parser/Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
 
 /* Line 1455 of yacc.c  */
-#line 777 "../parser/Grammar.y"
+#line 777 "parser/Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
 
 /* Line 1455 of yacc.c  */
-#line 778 "../parser/Grammar.y"
+#line 778 "parser/Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
 
 /* Line 1455 of yacc.c  */
-#line 779 "../parser/Grammar.y"
+#line 779 "parser/Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
 
 /* Line 1455 of yacc.c  */
-#line 780 "../parser/Grammar.y"
+#line 780 "parser/Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
 
 /* Line 1455 of yacc.c  */
-#line 781 "../parser/Grammar.y"
+#line 781 "parser/Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
 
 /* Line 1455 of yacc.c  */
-#line 782 "../parser/Grammar.y"
+#line 782 "parser/Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
 
 /* Line 1455 of yacc.c  */
-#line 783 "../parser/Grammar.y"
+#line 783 "parser/Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
 
 /* Line 1455 of yacc.c  */
-#line 788 "../parser/Grammar.y"
+#line 788 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 
 /* Line 1455 of yacc.c  */
-#line 793 "../parser/Grammar.y"
+#line 793 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 
 /* Line 1455 of yacc.c  */
-#line 798 "../parser/Grammar.y"
+#line 798 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
 
 /* Line 1455 of yacc.c  */
-#line 822 "../parser/Grammar.y"
+#line 822 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4093,7 +4093,7 @@ yyreduce:
   case 219:
 
 /* Line 1455 of yacc.c  */
-#line 824 "../parser/Grammar.y"
+#line 824 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4101,7 +4101,7 @@ yyreduce:
   case 220:
 
 /* Line 1455 of yacc.c  */
-#line 829 "../parser/Grammar.y"
+#line 829 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4109,7 +4109,7 @@ yyreduce:
   case 221:
 
 /* Line 1455 of yacc.c  */
-#line 831 "../parser/Grammar.y"
+#line 831 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                           AUTO_SEMICOLON; ;}
@@ -4118,7 +4118,7 @@ yyreduce:
   case 222:
 
 /* Line 1455 of yacc.c  */
-#line 837 "../parser/Grammar.y"
+#line 837 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4131,7 +4131,7 @@ yyreduce:
   case 223:
 
 /* Line 1455 of yacc.c  */
-#line 844 "../parser/Grammar.y"
+#line 844 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
@@ -4146,7 +4146,7 @@ yyreduce:
   case 224:
 
 /* Line 1455 of yacc.c  */
-#line 854 "../parser/Grammar.y"
+#line 854 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4159,7 +4159,7 @@ yyreduce:
   case 225:
 
 /* Line 1455 of yacc.c  */
-#line 862 "../parser/Grammar.y"
+#line 862 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
@@ -4174,7 +4174,7 @@ yyreduce:
   case 226:
 
 /* Line 1455 of yacc.c  */
-#line 874 "../parser/Grammar.y"
+#line 874 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4187,7 +4187,7 @@ yyreduce:
   case 227:
 
 /* Line 1455 of yacc.c  */
-#line 881 "../parser/Grammar.y"
+#line 881 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
@@ -4202,7 +4202,7 @@ yyreduce:
   case 228:
 
 /* Line 1455 of yacc.c  */
-#line 891 "../parser/Grammar.y"
+#line 891 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4215,7 +4215,7 @@ yyreduce:
   case 229:
 
 /* Line 1455 of yacc.c  */
-#line 899 "../parser/Grammar.y"
+#line 899 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
@@ -4230,7 +4230,7 @@ yyreduce:
   case 230:
 
 /* Line 1455 of yacc.c  */
-#line 911 "../parser/Grammar.y"
+#line 911 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4238,7 +4238,7 @@ yyreduce:
   case 231:
 
 /* Line 1455 of yacc.c  */
-#line 914 "../parser/Grammar.y"
+#line 914 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
@@ -4246,7 +4246,7 @@ yyreduce:
   case 232:
 
 /* Line 1455 of yacc.c  */
-#line 919 "../parser/Grammar.y"
+#line 919 "parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
                                           (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -4260,7 +4260,7 @@ yyreduce:
   case 233:
 
 /* Line 1455 of yacc.c  */
-#line 928 "../parser/Grammar.y"
+#line 928 "parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
@@ -4274,42 +4274,42 @@ yyreduce:
   case 234:
 
 /* Line 1455 of yacc.c  */
-#line 939 "../parser/Grammar.y"
+#line 939 "parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
 
 /* Line 1455 of yacc.c  */
-#line 940 "../parser/Grammar.y"
+#line 940 "parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
 
 /* Line 1455 of yacc.c  */
-#line 944 "../parser/Grammar.y"
+#line 944 "parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
 
 /* Line 1455 of yacc.c  */
-#line 948 "../parser/Grammar.y"
+#line 948 "parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
 
 /* Line 1455 of yacc.c  */
-#line 952 "../parser/Grammar.y"
+#line 952 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
 
 /* Line 1455 of yacc.c  */
-#line 956 "../parser/Grammar.y"
+#line 956 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4317,7 +4317,7 @@ yyreduce:
   case 240:
 
 /* Line 1455 of yacc.c  */
-#line 958 "../parser/Grammar.y"
+#line 958 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
@@ -4325,7 +4325,7 @@ yyreduce:
   case 241:
 
 /* Line 1455 of yacc.c  */
-#line 964 "../parser/Grammar.y"
+#line 964 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
@@ -4333,7 +4333,7 @@ yyreduce:
   case 242:
 
 /* Line 1455 of yacc.c  */
-#line 967 "../parser/Grammar.y"
+#line 967 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
@@ -4345,7 +4345,7 @@ yyreduce:
   case 243:
 
 /* Line 1455 of yacc.c  */
-#line 976 "../parser/Grammar.y"
+#line 976 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
@@ -4353,7 +4353,7 @@ yyreduce:
   case 244:
 
 /* Line 1455 of yacc.c  */
-#line 978 "../parser/Grammar.y"
+#line 978 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
@@ -4361,7 +4361,7 @@ yyreduce:
   case 245:
 
 /* Line 1455 of yacc.c  */
-#line 980 "../parser/Grammar.y"
+#line 980 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
@@ -4369,7 +4369,7 @@ yyreduce:
   case 246:
 
 /* Line 1455 of yacc.c  */
-#line 983 "../parser/Grammar.y"
+#line 983 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
@@ -4380,7 +4380,7 @@ yyreduce:
   case 247:
 
 /* Line 1455 of yacc.c  */
-#line 989 "../parser/Grammar.y"
+#line 989 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
@@ -4392,7 +4392,7 @@ yyreduce:
   case 248:
 
 /* Line 1455 of yacc.c  */
-#line 996 "../parser/Grammar.y"
+#line 996 "parser/Grammar.y"
     {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
@@ -4406,7 +4406,7 @@ yyreduce:
   case 249:
 
 /* Line 1455 of yacc.c  */
-#line 1005 "../parser/Grammar.y"
+#line 1005 "parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
@@ -4417,7 +4417,7 @@ yyreduce:
   case 250:
 
 /* Line 1455 of yacc.c  */
-#line 1011 "../parser/Grammar.y"
+#line 1011 "parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
@@ -4430,21 +4430,21 @@ yyreduce:
   case 251:
 
 /* Line 1455 of yacc.c  */
-#line 1021 "../parser/Grammar.y"
+#line 1021 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
 
 /* Line 1455 of yacc.c  */
-#line 1026 "../parser/Grammar.y"
+#line 1026 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
 
 /* Line 1455 of yacc.c  */
-#line 1031 "../parser/Grammar.y"
+#line 1031 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4454,7 +4454,7 @@ yyreduce:
   case 256:
 
 /* Line 1455 of yacc.c  */
-#line 1035 "../parser/Grammar.y"
+#line 1035 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4464,7 +4464,7 @@ yyreduce:
   case 257:
 
 /* Line 1455 of yacc.c  */
-#line 1039 "../parser/Grammar.y"
+#line 1039 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4474,7 +4474,7 @@ yyreduce:
   case 258:
 
 /* Line 1455 of yacc.c  */
-#line 1043 "../parser/Grammar.y"
+#line 1043 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4484,7 +4484,7 @@ yyreduce:
   case 259:
 
 /* Line 1455 of yacc.c  */
-#line 1050 "../parser/Grammar.y"
+#line 1050 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
@@ -4493,7 +4493,7 @@ yyreduce:
   case 260:
 
 /* Line 1455 of yacc.c  */
-#line 1053 "../parser/Grammar.y"
+#line 1053 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
@@ -4502,7 +4502,7 @@ yyreduce:
   case 261:
 
 /* Line 1455 of yacc.c  */
-#line 1056 "../parser/Grammar.y"
+#line 1056 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
@@ -4511,7 +4511,7 @@ yyreduce:
   case 262:
 
 /* Line 1455 of yacc.c  */
-#line 1059 "../parser/Grammar.y"
+#line 1059 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
@@ -4520,7 +4520,7 @@ yyreduce:
   case 263:
 
 /* Line 1455 of yacc.c  */
-#line 1065 "../parser/Grammar.y"
+#line 1065 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
@@ -4529,7 +4529,7 @@ yyreduce:
   case 264:
 
 /* Line 1455 of yacc.c  */
-#line 1068 "../parser/Grammar.y"
+#line 1068 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
@@ -4538,7 +4538,7 @@ yyreduce:
   case 265:
 
 /* Line 1455 of yacc.c  */
-#line 1071 "../parser/Grammar.y"
+#line 1071 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
@@ -4547,7 +4547,7 @@ yyreduce:
   case 266:
 
 /* Line 1455 of yacc.c  */
-#line 1074 "../parser/Grammar.y"
+#line 1074 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
@@ -4556,7 +4556,7 @@ yyreduce:
   case 267:
 
 /* Line 1455 of yacc.c  */
-#line 1080 "../parser/Grammar.y"
+#line 1080 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
@@ -4565,7 +4565,7 @@ yyreduce:
   case 268:
 
 /* Line 1455 of yacc.c  */
-#line 1086 "../parser/Grammar.y"
+#line 1086 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
@@ -4574,14 +4574,14 @@ yyreduce:
   case 269:
 
 /* Line 1455 of yacc.c  */
-#line 1092 "../parser/Grammar.y"
+#line 1092 "parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
 
 /* Line 1455 of yacc.c  */
-#line 1094 "../parser/Grammar.y"
+#line 1094 "parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
@@ -4592,14 +4592,14 @@ yyreduce:
   case 271:
 
 /* Line 1455 of yacc.c  */
-#line 1102 "../parser/Grammar.y"
+#line 1102 "parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
 
 /* Line 1455 of yacc.c  */
-#line 1107 "../parser/Grammar.y"
+#line 1107 "parser/Grammar.y"
     { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
@@ -4611,7 +4611,7 @@ yyreduce:
   case 274:
 
 /* Line 1455 of yacc.c  */
-#line 1113 "../parser/Grammar.y"
+#line 1113 "parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
                                           (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
@@ -4624,35 +4624,35 @@ yyreduce:
   case 275:
 
 /* Line 1455 of yacc.c  */
-#line 1123 "../parser/Grammar.y"
+#line 1123 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
 
 /* Line 1455 of yacc.c  */
-#line 1124 "../parser/Grammar.y"
+#line 1124 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
 
 /* Line 1455 of yacc.c  */
-#line 1128 "../parser/Grammar.y"
+#line 1128 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
 
 /* Line 1455 of yacc.c  */
-#line 1129 "../parser/Grammar.y"
+#line 1129 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
 
 /* Line 1455 of yacc.c  */
-#line 1133 "../parser/Grammar.y"
+#line 1133 "parser/Grammar.y"
     { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
@@ -4661,7 +4661,7 @@ yyreduce:
   case 280:
 
 /* Line 1455 of yacc.c  */
-#line 1139 "../parser/Grammar.y"
+#line 1139 "parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
@@ -4671,7 +4671,7 @@ yyreduce:
   case 281:
 
 /* Line 1455 of yacc.c  */
-#line 1143 "../parser/Grammar.y"
+#line 1143 "parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
@@ -4681,7 +4681,7 @@ yyreduce:
   case 282:
 
 /* Line 1455 of yacc.c  */
-#line 1150 "../parser/Grammar.y"
+#line 1150 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
@@ -4693,7 +4693,7 @@ yyreduce:
   case 283:
 
 /* Line 1455 of yacc.c  */
-#line 1156 "../parser/Grammar.y"
+#line 1156 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
@@ -4705,7 +4705,7 @@ yyreduce:
   case 284:
 
 /* Line 1455 of yacc.c  */
-#line 1163 "../parser/Grammar.y"
+#line 1163 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
@@ -4717,7 +4717,7 @@ yyreduce:
   case 285:
 
 /* Line 1455 of yacc.c  */
-#line 1172 "../parser/Grammar.y"
+#line 1172 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4725,7 +4725,7 @@ yyreduce:
   case 286:
 
 /* Line 1455 of yacc.c  */
-#line 1174 "../parser/Grammar.y"
+#line 1174 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
@@ -4733,14 +4733,14 @@ yyreduce:
   case 287:
 
 /* Line 1455 of yacc.c  */
-#line 1179 "../parser/Grammar.y"
+#line 1179 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
     break;
 
   case 288:
 
 /* Line 1455 of yacc.c  */
-#line 1181 "../parser/Grammar.y"
+#line 1181 "parser/Grammar.y"
     {
           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4753,14 +4753,14 @@ yyreduce:
   case 289:
 
 /* Line 1455 of yacc.c  */
-#line 1191 "../parser/Grammar.y"
+#line 1191 "parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
 
 /* Line 1455 of yacc.c  */
-#line 1193 "../parser/Grammar.y"
+#line 1193 "parser/Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
@@ -4772,14 +4772,14 @@ yyreduce:
   case 291:
 
 /* Line 1455 of yacc.c  */
-#line 1199 "../parser/Grammar.y"
+#line 1199 "parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
 
 /* Line 1455 of yacc.c  */
-#line 1201 "../parser/Grammar.y"
+#line 1201 "parser/Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4791,7 +4791,7 @@ yyreduce:
   case 293:
 
 /* Line 1455 of yacc.c  */
-#line 1210 "../parser/Grammar.y"
+#line 1210 "parser/Grammar.y"
     { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
@@ -4800,7 +4800,7 @@ yyreduce:
   case 294:
 
 /* Line 1455 of yacc.c  */
-#line 1213 "../parser/Grammar.y"
+#line 1213 "parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
                                           (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
@@ -4809,28 +4809,28 @@ yyreduce:
   case 295:
 
 /* Line 1455 of yacc.c  */
-#line 1219 "../parser/Grammar.y"
+#line 1219 "parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
 
 /* Line 1455 of yacc.c  */
-#line 1220 "../parser/Grammar.y"
+#line 1220 "parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
 
 /* Line 1455 of yacc.c  */
-#line 1224 "../parser/Grammar.y"
+#line 1224 "parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
 
 /* Line 1455 of yacc.c  */
-#line 1225 "../parser/Grammar.y"
+#line 1225 "parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
@@ -4838,7 +4838,7 @@ yyreduce:
   case 299:
 
 /* Line 1455 of yacc.c  */
-#line 1230 "../parser/Grammar.y"
+#line 1230 "parser/Grammar.y"
     { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
@@ -4851,7 +4851,7 @@ yyreduce:
   case 300:
 
 /* Line 1455 of yacc.c  */
-#line 1237 "../parser/Grammar.y"
+#line 1237 "parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4863,259 +4863,259 @@ yyreduce:
   case 304:
 
 /* Line 1455 of yacc.c  */
-#line 1251 "../parser/Grammar.y"
+#line 1251 "parser/Grammar.y"
     { ;}
     break;
 
   case 305:
 
 /* Line 1455 of yacc.c  */
-#line 1252 "../parser/Grammar.y"
+#line 1252 "parser/Grammar.y"
     { ;}
     break;
 
   case 306:
 
 /* Line 1455 of yacc.c  */
-#line 1253 "../parser/Grammar.y"
+#line 1253 "parser/Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 307:
 
 /* Line 1455 of yacc.c  */
-#line 1254 "../parser/Grammar.y"
+#line 1254 "parser/Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 308:
 
 /* Line 1455 of yacc.c  */
-#line 1258 "../parser/Grammar.y"
+#line 1258 "parser/Grammar.y"
     { ;}
     break;
 
   case 309:
 
 /* Line 1455 of yacc.c  */
-#line 1259 "../parser/Grammar.y"
+#line 1259 "parser/Grammar.y"
     { ;}
     break;
 
   case 310:
 
 /* Line 1455 of yacc.c  */
-#line 1260 "../parser/Grammar.y"
+#line 1260 "parser/Grammar.y"
     { ;}
     break;
 
   case 311:
 
 /* Line 1455 of yacc.c  */
-#line 1261 "../parser/Grammar.y"
+#line 1261 "parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
 
 /* Line 1455 of yacc.c  */
-#line 1262 "../parser/Grammar.y"
+#line 1262 "parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
 
 /* Line 1455 of yacc.c  */
-#line 1272 "../parser/Grammar.y"
+#line 1272 "parser/Grammar.y"
     { ;}
     break;
 
   case 317:
 
 /* Line 1455 of yacc.c  */
-#line 1273 "../parser/Grammar.y"
+#line 1273 "parser/Grammar.y"
     { ;}
     break;
 
   case 318:
 
 /* Line 1455 of yacc.c  */
-#line 1275 "../parser/Grammar.y"
+#line 1275 "parser/Grammar.y"
     { ;}
     break;
 
   case 322:
 
 /* Line 1455 of yacc.c  */
-#line 1282 "../parser/Grammar.y"
+#line 1282 "parser/Grammar.y"
     { ;}
     break;
 
   case 517:
 
 /* Line 1455 of yacc.c  */
-#line 1650 "../parser/Grammar.y"
+#line 1650 "parser/Grammar.y"
     { ;}
     break;
 
   case 518:
 
 /* Line 1455 of yacc.c  */
-#line 1651 "../parser/Grammar.y"
+#line 1651 "parser/Grammar.y"
     { ;}
     break;
 
   case 520:
 
 /* Line 1455 of yacc.c  */
-#line 1656 "../parser/Grammar.y"
+#line 1656 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
 
 /* Line 1455 of yacc.c  */
-#line 1660 "../parser/Grammar.y"
+#line 1660 "parser/Grammar.y"
     { ;}
     break;
 
   case 522:
 
 /* Line 1455 of yacc.c  */
-#line 1661 "../parser/Grammar.y"
+#line 1661 "parser/Grammar.y"
     { ;}
     break;
 
   case 525:
 
 /* Line 1455 of yacc.c  */
-#line 1667 "../parser/Grammar.y"
+#line 1667 "parser/Grammar.y"
     { ;}
     break;
 
   case 526:
 
 /* Line 1455 of yacc.c  */
-#line 1668 "../parser/Grammar.y"
+#line 1668 "parser/Grammar.y"
     { ;}
     break;
 
   case 530:
 
 /* Line 1455 of yacc.c  */
-#line 1675 "../parser/Grammar.y"
+#line 1675 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
 
 /* Line 1455 of yacc.c  */
-#line 1684 "../parser/Grammar.y"
+#line 1684 "parser/Grammar.y"
     { ;}
     break;
 
   case 534:
 
 /* Line 1455 of yacc.c  */
-#line 1685 "../parser/Grammar.y"
+#line 1685 "parser/Grammar.y"
     { ;}
     break;
 
   case 539:
 
 /* Line 1455 of yacc.c  */
-#line 1702 "../parser/Grammar.y"
+#line 1702 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
 
 /* Line 1455 of yacc.c  */
-#line 1733 "../parser/Grammar.y"
+#line 1733 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
 
 /* Line 1455 of yacc.c  */
-#line 1735 "../parser/Grammar.y"
+#line 1735 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
 
 /* Line 1455 of yacc.c  */
-#line 1740 "../parser/Grammar.y"
+#line 1740 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
 
 /* Line 1455 of yacc.c  */
-#line 1742 "../parser/Grammar.y"
+#line 1742 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
 
 /* Line 1455 of yacc.c  */
-#line 1747 "../parser/Grammar.y"
+#line 1747 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
 
 /* Line 1455 of yacc.c  */
-#line 1749 "../parser/Grammar.y"
+#line 1749 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
 
 /* Line 1455 of yacc.c  */
-#line 1761 "../parser/Grammar.y"
+#line 1761 "parser/Grammar.y"
     { ;}
     break;
 
   case 569:
 
 /* Line 1455 of yacc.c  */
-#line 1762 "../parser/Grammar.y"
+#line 1762 "parser/Grammar.y"
     { ;}
     break;
 
   case 578:
 
 /* Line 1455 of yacc.c  */
-#line 1786 "../parser/Grammar.y"
+#line 1786 "parser/Grammar.y"
     { ;}
     break;
 
   case 580:
 
 /* Line 1455 of yacc.c  */
-#line 1791 "../parser/Grammar.y"
+#line 1791 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
 
 /* Line 1455 of yacc.c  */
-#line 1802 "../parser/Grammar.y"
+#line 1802 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
 
 /* Line 1455 of yacc.c  */
-#line 1818 "../parser/Grammar.y"
+#line 1818 "parser/Grammar.y"
     { ;}
     break;
 
 
 
 /* Line 1455 of yacc.c  */
-#line 5119 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 5119 "/JavaScriptCore/generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -5334,7 +5334,7 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 1834 "../parser/Grammar.y"
+#line 1834 "parser/Grammar.y"
 
 
 #undef GLOBAL_DATA
@@ -5491,12 +5491,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
index a485e42..04dfeb1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
@@ -112,7 +112,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 146 "../parser/Grammar.y"
+#line 146 "parser/Grammar.y"
 
     int                 intValue;
     double              doubleValue;
@@ -147,7 +147,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 151 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
+#line 151 "/JavaScriptCore/generated/Grammar.tab.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
index a9b1631..4ec868e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
@@ -1,12 +1,12 @@
-// Automatically generated from ../runtime/JSONObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/JSONObject.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue jsonTableValues[3] = {
-   { "parse", DontEnum|Function, (intptr_t)JSONProtoFuncParse, (intptr_t)1 },
-   { "stringify", DontEnum|Function, (intptr_t)JSONProtoFuncStringify, (intptr_t)1 },
+   { "parse", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(JSONProtoFuncParse), (intptr_t)1 },
+   { "stringify", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(JSONProtoFuncStringify), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
index 95c33b6..c17f34d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
@@ -1,46 +1,46 @@
-// Automatically generated from ../parser/Keywords.table using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from parser/Keywords.table using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue mainTableValues[37] = {
-   { "null", 0, (intptr_t)NULLTOKEN, (intptr_t)0 },
-   { "true", 0, (intptr_t)TRUETOKEN, (intptr_t)0 },
-   { "false", 0, (intptr_t)FALSETOKEN, (intptr_t)0 },
-   { "break", 0, (intptr_t)BREAK, (intptr_t)0 },
-   { "case", 0, (intptr_t)CASE, (intptr_t)0 },
-   { "catch", 0, (intptr_t)CATCH, (intptr_t)0 },
-   { "const", 0, (intptr_t)CONSTTOKEN, (intptr_t)0 },
-   { "default", 0, (intptr_t)DEFAULT, (intptr_t)0 },
-   { "finally", 0, (intptr_t)FINALLY, (intptr_t)0 },
-   { "for", 0, (intptr_t)FOR, (intptr_t)0 },
-   { "instanceof", 0, (intptr_t)INSTANCEOF, (intptr_t)0 },
-   { "new", 0, (intptr_t)NEW, (intptr_t)0 },
-   { "var", 0, (intptr_t)VAR, (intptr_t)0 },
-   { "continue", 0, (intptr_t)CONTINUE, (intptr_t)0 },
-   { "function", 0, (intptr_t)FUNCTION, (intptr_t)0 },
-   { "return", 0, (intptr_t)RETURN, (intptr_t)0 },
-   { "void", 0, (intptr_t)VOIDTOKEN, (intptr_t)0 },
-   { "delete", 0, (intptr_t)DELETETOKEN, (intptr_t)0 },
-   { "if", 0, (intptr_t)IF, (intptr_t)0 },
-   { "this", 0, (intptr_t)THISTOKEN, (intptr_t)0 },
-   { "do", 0, (intptr_t)DO, (intptr_t)0 },
-   { "while", 0, (intptr_t)WHILE, (intptr_t)0 },
-   { "else", 0, (intptr_t)ELSE, (intptr_t)0 },
-   { "in", 0, (intptr_t)INTOKEN, (intptr_t)0 },
-   { "switch", 0, (intptr_t)SWITCH, (intptr_t)0 },
-   { "throw", 0, (intptr_t)THROW, (intptr_t)0 },
-   { "try", 0, (intptr_t)TRY, (intptr_t)0 },
-   { "typeof", 0, (intptr_t)TYPEOF, (intptr_t)0 },
-   { "with", 0, (intptr_t)WITH, (intptr_t)0 },
-   { "debugger", 0, (intptr_t)DEBUGGER, (intptr_t)0 },
-   { "class", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "enum", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "export", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "extends", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "import", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "super", 0, (intptr_t)RESERVED, (intptr_t)0 },
+   { "null", 0, (intptr_t)(NULLTOKEN), (intptr_t)0 },
+   { "true", 0, (intptr_t)(TRUETOKEN), (intptr_t)0 },
+   { "false", 0, (intptr_t)(FALSETOKEN), (intptr_t)0 },
+   { "break", 0, (intptr_t)(BREAK), (intptr_t)0 },
+   { "case", 0, (intptr_t)(CASE), (intptr_t)0 },
+   { "catch", 0, (intptr_t)(CATCH), (intptr_t)0 },
+   { "const", 0, (intptr_t)(CONSTTOKEN), (intptr_t)0 },
+   { "default", 0, (intptr_t)(DEFAULT), (intptr_t)0 },
+   { "finally", 0, (intptr_t)(FINALLY), (intptr_t)0 },
+   { "for", 0, (intptr_t)(FOR), (intptr_t)0 },
+   { "instanceof", 0, (intptr_t)(INSTANCEOF), (intptr_t)0 },
+   { "new", 0, (intptr_t)(NEW), (intptr_t)0 },
+   { "var", 0, (intptr_t)(VAR), (intptr_t)0 },
+   { "continue", 0, (intptr_t)(CONTINUE), (intptr_t)0 },
+   { "function", 0, (intptr_t)(FUNCTION), (intptr_t)0 },
+   { "return", 0, (intptr_t)(RETURN), (intptr_t)0 },
+   { "void", 0, (intptr_t)(VOIDTOKEN), (intptr_t)0 },
+   { "delete", 0, (intptr_t)(DELETETOKEN), (intptr_t)0 },
+   { "if", 0, (intptr_t)(IF), (intptr_t)0 },
+   { "this", 0, (intptr_t)(THISTOKEN), (intptr_t)0 },
+   { "do", 0, (intptr_t)(DO), (intptr_t)0 },
+   { "while", 0, (intptr_t)(WHILE), (intptr_t)0 },
+   { "else", 0, (intptr_t)(ELSE), (intptr_t)0 },
+   { "in", 0, (intptr_t)(INTOKEN), (intptr_t)0 },
+   { "switch", 0, (intptr_t)(SWITCH), (intptr_t)0 },
+   { "throw", 0, (intptr_t)(THROW), (intptr_t)0 },
+   { "try", 0, (intptr_t)(TRY), (intptr_t)0 },
+   { "typeof", 0, (intptr_t)(TYPEOF), (intptr_t)0 },
+   { "with", 0, (intptr_t)(WITH), (intptr_t)0 },
+   { "debugger", 0, (intptr_t)(DEBUGGER), (intptr_t)0 },
+   { "class", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "enum", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "export", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "extends", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "import", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "super", 0, (intptr_t)(RESERVED), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
index 9cb0ee2..6222ef9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
@@ -1,28 +1,28 @@
-// Automatically generated from ../runtime/MathObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/MathObject.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue mathTableValues[19] = {
-   { "abs", DontEnum|Function, (intptr_t)mathProtoFuncAbs, (intptr_t)1 },
-   { "acos", DontEnum|Function, (intptr_t)mathProtoFuncACos, (intptr_t)1 },
-   { "asin", DontEnum|Function, (intptr_t)mathProtoFuncASin, (intptr_t)1 },
-   { "atan", DontEnum|Function, (intptr_t)mathProtoFuncATan, (intptr_t)1 },
-   { "atan2", DontEnum|Function, (intptr_t)mathProtoFuncATan2, (intptr_t)2 },
-   { "ceil", DontEnum|Function, (intptr_t)mathProtoFuncCeil, (intptr_t)1 },
-   { "cos", DontEnum|Function, (intptr_t)mathProtoFuncCos, (intptr_t)1 },
-   { "exp", DontEnum|Function, (intptr_t)mathProtoFuncExp, (intptr_t)1 },
-   { "floor", DontEnum|Function, (intptr_t)mathProtoFuncFloor, (intptr_t)1 },
-   { "log", DontEnum|Function, (intptr_t)mathProtoFuncLog, (intptr_t)1 },
-   { "max", DontEnum|Function, (intptr_t)mathProtoFuncMax, (intptr_t)2 },
-   { "min", DontEnum|Function, (intptr_t)mathProtoFuncMin, (intptr_t)2 },
-   { "pow", DontEnum|Function, (intptr_t)mathProtoFuncPow, (intptr_t)2 },
-   { "random", DontEnum|Function, (intptr_t)mathProtoFuncRandom, (intptr_t)0 },
-   { "round", DontEnum|Function, (intptr_t)mathProtoFuncRound, (intptr_t)1 },
-   { "sin", DontEnum|Function, (intptr_t)mathProtoFuncSin, (intptr_t)1 },
-   { "sqrt", DontEnum|Function, (intptr_t)mathProtoFuncSqrt, (intptr_t)1 },
-   { "tan", DontEnum|Function, (intptr_t)mathProtoFuncTan, (intptr_t)1 },
+   { "abs", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncAbs), (intptr_t)1 },
+   { "acos", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncACos), (intptr_t)1 },
+   { "asin", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncASin), (intptr_t)1 },
+   { "atan", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncATan), (intptr_t)1 },
+   { "atan2", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncATan2), (intptr_t)2 },
+   { "ceil", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncCeil), (intptr_t)1 },
+   { "cos", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncCos), (intptr_t)1 },
+   { "exp", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncExp), (intptr_t)1 },
+   { "floor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncFloor), (intptr_t)1 },
+   { "log", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncLog), (intptr_t)1 },
+   { "max", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncMax), (intptr_t)2 },
+   { "min", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncMin), (intptr_t)2 },
+   { "pow", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncPow), (intptr_t)2 },
+   { "random", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncRandom), (intptr_t)0 },
+   { "round", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncRound), (intptr_t)1 },
+   { "sin", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncSin), (intptr_t)1 },
+   { "sqrt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncSqrt), (intptr_t)1 },
+   { "tan", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncTan), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
index 6285d62..bfa6341 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
@@ -1,15 +1,15 @@
-// Automatically generated from ../runtime/NumberConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/NumberConstructor.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue numberTableValues[6] = {
-   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNaNValue, (intptr_t)0 },
-   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNegInfinity, (intptr_t)0 },
-   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorPosInfinity, (intptr_t)0 },
-   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMaxValue, (intptr_t)0 },
-   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMinValue, (intptr_t)0 },
+   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorNaNValue), (intptr_t)0 },
+   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorNegInfinity), (intptr_t)0 },
+   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorPosInfinity), (intptr_t)0 },
+   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorMaxValue), (intptr_t)0 },
+   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorMinValue), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
index a3f15b3..d45db01 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
@@ -1,31 +1,31 @@
-// Automatically generated from ../runtime/RegExpConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/RegExpConstructor.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue regExpConstructorTableValues[22] = {
-   { "input", None, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "$_", DontEnum, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "multiline", None, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "$*", DontEnum, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "lastMatch", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "lastParen", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "leftContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "rightContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$1", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar1, (intptr_t)0 },
-   { "$2", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar2, (intptr_t)0 },
-   { "$3", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar3, (intptr_t)0 },
-   { "$4", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar4, (intptr_t)0 },
-   { "$5", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar5, (intptr_t)0 },
-   { "$6", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar6, (intptr_t)0 },
-   { "$7", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar7, (intptr_t)0 },
-   { "$8", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar8, (intptr_t)0 },
-   { "$9", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar9, (intptr_t)0 },
+   { "input", None, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorInput), (intptr_t)setRegExpConstructorInput },
+   { "$_", DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorInput), (intptr_t)setRegExpConstructorInput },
+   { "multiline", None, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorMultiline), (intptr_t)setRegExpConstructorMultiline },
+   { "$*", DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorMultiline), (intptr_t)setRegExpConstructorMultiline },
+   { "lastMatch", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastMatch), (intptr_t)0 },
+   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastMatch), (intptr_t)0 },
+   { "lastParen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastParen), (intptr_t)0 },
+   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastParen), (intptr_t)0 },
+   { "leftContext", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLeftContext), (intptr_t)0 },
+   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLeftContext), (intptr_t)0 },
+   { "rightContext", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorRightContext), (intptr_t)0 },
+   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorRightContext), (intptr_t)0 },
+   { "$1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar1), (intptr_t)0 },
+   { "$2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar2), (intptr_t)0 },
+   { "$3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar3), (intptr_t)0 },
+   { "$4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar4), (intptr_t)0 },
+   { "$5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar5), (intptr_t)0 },
+   { "$6", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar6), (intptr_t)0 },
+   { "$7", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar7), (intptr_t)0 },
+   { "$8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar8), (intptr_t)0 },
+   { "$9", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar9), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
index 8c87f16..8dcb7c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
@@ -1,15 +1,15 @@
-// Automatically generated from ../runtime/RegExpObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/RegExpObject.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue regExpTableValues[6] = {
-   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectGlobal, (intptr_t)0 },
-   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectIgnoreCase, (intptr_t)0 },
-   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectMultiline, (intptr_t)0 },
-   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectSource, (intptr_t)0 },
-   { "lastIndex", DontDelete|DontEnum, (intptr_t)regExpObjectLastIndex, (intptr_t)setRegExpObjectLastIndex },
+   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectGlobal), (intptr_t)0 },
+   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectIgnoreCase), (intptr_t)0 },
+   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectMultiline), (intptr_t)0 },
+   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectSource), (intptr_t)0 },
+   { "lastIndex", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectLastIndex), (intptr_t)setRegExpObjectLastIndex },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index c8ff849..6ea0803 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -1,45 +1,45 @@
-// Automatically generated from ../runtime/StringPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime/StringPrototype.cpp using /JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue stringTableValues[36] = {
-   { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
-   { "charCodeAt", DontEnum|Function, (intptr_t)stringProtoFuncCharCodeAt, (intptr_t)1 },
-   { "concat", DontEnum|Function, (intptr_t)stringProtoFuncConcat, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)stringProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)stringProtoFuncLastIndexOf, (intptr_t)1 },
-   { "match", DontEnum|Function, (intptr_t)stringProtoFuncMatch, (intptr_t)1 },
-   { "replace", DontEnum|Function, (intptr_t)stringProtoFuncReplace, (intptr_t)2 },
-   { "search", DontEnum|Function, (intptr_t)stringProtoFuncSearch, (intptr_t)1 },
-   { "slice", DontEnum|Function, (intptr_t)stringProtoFuncSlice, (intptr_t)2 },
-   { "split", DontEnum|Function, (intptr_t)stringProtoFuncSplit, (intptr_t)2 },
-   { "substr", DontEnum|Function, (intptr_t)stringProtoFuncSubstr, (intptr_t)2 },
-   { "substring", DontEnum|Function, (intptr_t)stringProtoFuncSubstring, (intptr_t)2 },
-   { "toLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "localeCompare", DontEnum|Function, (intptr_t)stringProtoFuncLocaleCompare, (intptr_t)1 },
-   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "big", DontEnum|Function, (intptr_t)stringProtoFuncBig, (intptr_t)0 },
-   { "small", DontEnum|Function, (intptr_t)stringProtoFuncSmall, (intptr_t)0 },
-   { "blink", DontEnum|Function, (intptr_t)stringProtoFuncBlink, (intptr_t)0 },
-   { "bold", DontEnum|Function, (intptr_t)stringProtoFuncBold, (intptr_t)0 },
-   { "fixed", DontEnum|Function, (intptr_t)stringProtoFuncFixed, (intptr_t)0 },
-   { "italics", DontEnum|Function, (intptr_t)stringProtoFuncItalics, (intptr_t)0 },
-   { "strike", DontEnum|Function, (intptr_t)stringProtoFuncStrike, (intptr_t)0 },
-   { "sub", DontEnum|Function, (intptr_t)stringProtoFuncSub, (intptr_t)0 },
-   { "sup", DontEnum|Function, (intptr_t)stringProtoFuncSup, (intptr_t)0 },
-   { "fontcolor", DontEnum|Function, (intptr_t)stringProtoFuncFontcolor, (intptr_t)1 },
-   { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
-   { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
-   { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
-   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
-   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
-   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToString), (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToString), (intptr_t)0 },
+   { "charAt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncCharAt), (intptr_t)1 },
+   { "charCodeAt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncCharCodeAt), (intptr_t)1 },
+   { "concat", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncConcat), (intptr_t)1 },
+   { "indexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncIndexOf), (intptr_t)1 },
+   { "lastIndexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLastIndexOf), (intptr_t)1 },
+   { "match", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncMatch), (intptr_t)1 },
+   { "replace", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncReplace), (intptr_t)2 },
+   { "search", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSearch), (intptr_t)1 },
+   { "slice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSlice), (intptr_t)2 },
+   { "split", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSplit), (intptr_t)2 },
+   { "substr", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSubstr), (intptr_t)2 },
+   { "substring", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSubstring), (intptr_t)2 },
+   { "toLowerCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToLowerCase), (intptr_t)0 },
+   { "toUpperCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToUpperCase), (intptr_t)0 },
+   { "localeCompare", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLocaleCompare), (intptr_t)1 },
+   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToLowerCase), (intptr_t)0 },
+   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToUpperCase), (intptr_t)0 },
+   { "big", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBig), (intptr_t)0 },
+   { "small", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSmall), (intptr_t)0 },
+   { "blink", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBlink), (intptr_t)0 },
+   { "bold", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBold), (intptr_t)0 },
+   { "fixed", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFixed), (intptr_t)0 },
+   { "italics", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncItalics), (intptr_t)0 },
+   { "strike", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncStrike), (intptr_t)0 },
+   { "sub", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSub), (intptr_t)0 },
+   { "sup", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSup), (intptr_t)0 },
+   { "fontcolor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFontcolor), (intptr_t)1 },
+   { "fontsize", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFontsize), (intptr_t)1 },
+   { "anchor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncAnchor), (intptr_t)1 },
+   { "link", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLink), (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrim), (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrimLeft), (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrimRight), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
index e903b79..eb48a03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
             , m_exception(exception)
-            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().globalObject())
+            , m_globalObjectScope(callFrame, function->scope().globalObject())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
@@ -52,7 +52,14 @@ namespace JSC {
         }
         void setThis(JSValue v) { m_closure.setArgument(0, v); }
         void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
-        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+
+        CallFrame* newCallFrame(ExecState* exec)
+        {
+            CallFrame* callFrame = m_closure.newCallFrame;
+            callFrame->setScopeChain(exec->scopeChain());
+            return callFrame;
+        }
+
         ~CachedCall()
         {
             if (m_valid)
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index b4d49db..e3ea689 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -39,7 +39,11 @@ namespace JSC  {
     public:
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
-        ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        ScopeChainNode* scopeChain() const
+        {
+            ASSERT(this[RegisterFile::ScopeChain].Register::scopeChain());
+            return this[RegisterFile::ScopeChain].Register::scopeChain();
+        }
         int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
         JSValue thisValue();
@@ -66,6 +70,7 @@ namespace JSC  {
         // or a pointer everywhere.
         JSGlobalData& globalData() const
         {
+            ASSERT(scopeChain()->globalData);
             return *scopeChain()->globalData;
         }
 
@@ -105,9 +110,9 @@ namespace JSC  {
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
 
-        void setCalleeArguments(JSValue arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
-        void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
-        void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
+        void setCalleeArguments(JSValue arguments) { static_cast<Register*>(this)[RegisterFile::OptionalCalleeArguments] = arguments; }
+        void setCallerFrame(CallFrame* callerFrame) { static_cast<Register*>(this)[RegisterFile::CallerFrame] = callerFrame; }
+        void setScopeChain(ScopeChainNode* scopeChain) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
             CallFrame* callerFrame, int returnValueRegister, int argc, JSFunction* function)
@@ -117,8 +122,8 @@ namespace JSC  {
             setCodeBlock(codeBlock);
             setScopeChain(scopeChain);
             setCallerFrame(callerFrame);
-            this[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
-            this[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
+            static_cast<Register*>(this)[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
+            static_cast<Register*>(this)[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
             setArgumentCount(argc); // original argument count (for the sake of the "arguments" object)
             setCallee(function);
             setCalleeArguments(JSValue());
@@ -135,9 +140,9 @@ namespace JSC  {
         CallFrame* removeHostCallFrameFlag() { return reinterpret_cast<CallFrame*>(reinterpret_cast<intptr_t>(this) & ~HostCallFrameFlag); }
 
     private:
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = Register::withInt(count); }
-        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
-        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
+        void setArgumentCount(int count) { static_cast<Register*>(this)[RegisterFile::ArgumentCount] = Register::withInt(count); }
+        void setCallee(JSFunction* callee) { static_cast<Register*>(this)[RegisterFile::Callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { static_cast<Register*>(this)[RegisterFile::CodeBlock] = codeBlock; }
 
         static const intptr_t HostCallFrameFlag = 1;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index db0edc4..a56040c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -40,6 +40,7 @@
 #include "DebuggerCallFrame.h"
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -169,7 +170,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
@@ -300,7 +301,7 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     if (!program.isString())
         return program;
 
-    UString programSource = asString(program)->value();
+    UString programSource = asString(program)->value(callFrame);
 
     LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
     if (JSValue parsedObject = preparser.tryLiteralParse())
@@ -321,7 +322,13 @@ Interpreter::Interpreter()
     : m_sampleEntryDepth(0)
     , m_reentryDepth(0)
 {
+#if HAVE(COMPUTED_GOTO)
     privateExecute(InitializeAndReturn, 0, 0, 0);
+
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
+#endif // HAVE(COMPUTED_GOTO)
+
 #if ENABLE(OPCODE_SAMPLING)
     enableSampler();
 #endif
@@ -527,7 +534,8 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
+        bool hasHandler = codeBlock->handlerForBytecodeOffset(bytecodeOffset);
+        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset), hasHandler);
     }
 
     // If we throw in the middle of a call instruction, we need to notify
@@ -537,7 +545,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 2].u.operand).jsValue());
-        else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
+        else if (codeBlock->instructions().size() > (bytecodeOffset + 8) && codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 10].u.operand).jsValue());
 #else
         int functionRegisterIndex;
@@ -647,7 +655,7 @@ JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame*
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -777,7 +785,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
         }
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
@@ -1022,8 +1030,20 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     // Cache hit: Specialize instruction and ref Structures.
 
     if (slot.slotBase() == baseValue) {
-        vPC[0] = getOpcode(op_get_by_id_self);
-        vPC[5] = slot.cachedOffset();
+        switch (slot.cachedPropertyType()) {
+        case PropertySlot::Getter:
+            vPC[0] = getOpcode(op_get_by_id_getter_self);
+            vPC[5] = slot.cachedOffset();
+            break;
+        case PropertySlot::Custom:
+            vPC[0] = getOpcode(op_get_by_id_custom_self);
+            vPC[5] = slot.customGetter();
+            break;
+        default:
+            vPC[0] = getOpcode(op_get_by_id_self);
+            vPC[5] = slot.cachedOffset();
+            break;
+        }
 
         codeBlock->refStructures(vPC);
         return;
@@ -1038,33 +1058,62 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         ASSERT(slot.slotBase().isObject());
 
         JSObject* baseObject = asObject(slot.slotBase());
+        size_t offset = slot.cachedOffset();
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary())
-            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
+        if (baseObject->structure()->isDictionary()) {
+            baseObject->flattenDictionaryObject();
+            offset = baseObject->structure()->get(propertyName);
+        }
 
         ASSERT(!baseObject->structure()->isUncacheableDictionary());
-
-        vPC[0] = getOpcode(op_get_by_id_proto);
+        
+        switch (slot.cachedPropertyType()) {
+        case PropertySlot::Getter:
+            vPC[0] = getOpcode(op_get_by_id_getter_proto);
+            vPC[6] = offset;
+            break;
+        case PropertySlot::Custom:
+            vPC[0] = getOpcode(op_get_by_id_custom_proto);
+            vPC[6] = slot.customGetter();
+            break;
+        default:
+            vPC[0] = getOpcode(op_get_by_id_proto);
+            vPC[6] = offset;
+            break;
+        }
         vPC[5] = baseObject->structure();
-        vPC[6] = slot.cachedOffset();
 
         codeBlock->refStructures(vPC);
         return;
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    vPC[0] = getOpcode(op_get_by_id_chain);
+    
+    switch (slot.cachedPropertyType()) {
+    case PropertySlot::Getter:
+        vPC[0] = getOpcode(op_get_by_id_getter_chain);
+        vPC[7] = offset;
+        break;
+    case PropertySlot::Custom:
+        vPC[0] = getOpcode(op_get_by_id_custom_chain);
+        vPC[7] = slot.customGetter();
+        break;
+    default:
+        vPC[0] = getOpcode(op_get_by_id_chain);
+        vPC[7] = offset;
+        break;
+    }
     vPC[4] = structure;
     vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
-    vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
 }
 
@@ -1081,16 +1130,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
-    if (flag == InitializeAndReturn) {
+    if (UNLIKELY(flag == InitializeAndReturn)) {
         #if HAVE(COMPUTED_GOTO)
-            #define ADD_BYTECODE(id, length) m_opcodeTable[id] = &&id;
-                FOR_EACH_OPCODE_ID(ADD_BYTECODE);
-            #undef ADD_BYTECODE
-
-            #define ADD_OPCODE_ID(id, length) m_opcodeIDTable.add(&&id, id);
-                FOR_EACH_OPCODE_ID(ADD_OPCODE_ID);
-            #undef ADD_OPCODE_ID
-            ASSERT(m_opcodeIDTable.size() == numOpcodeIDs);
+            #define LIST_OPCODE_LABEL(id, length) &&id,
+                static Opcode labels[] = { FOR_EACH_OPCODE_ID(LIST_OPCODE_LABEL) };
+                for (size_t i = 0; i < sizeof(labels) / sizeof(Opcode); ++i)
+                    m_opcodeTable[i] = labels[i];
+            #undef LIST_OPCODE_LABEL
         #endif // HAVE(COMPUTED_GOTO)
         return JSValue();
     }
@@ -1306,7 +1352,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
@@ -1321,7 +1367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
@@ -1474,7 +1520,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = vPC[1].u.operand;
         JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
-        if (src.isInt32() && src.asInt32())
+        if (src.isInt32() && (src.asInt32() & 0x7fffffff)) // non-zero and no overflow
             callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
             JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
@@ -1495,7 +1541,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
             JSValue result = jsAdd(callFrame, src1, src2);
@@ -1582,7 +1628,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
@@ -2153,6 +2199,93 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         uncacheGetByID(callFrame->codeBlock(), vPC);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_proto);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_proto) {
+        /* op_get_by_id_getter_proto dst(r) base(r) property(id) structure(sID) prototypeStructure(sID) offset(n) nop(n)
+         
+         Cached property access: Attempts to get a cached getter property from the
+         value base's prototype. If the cache misses, op_get_by_id_getter_proto
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
+                JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+                Structure* prototypeStructure = vPC[5].u.structure;
+                
+                if (LIKELY(protoObject->structure() == prototypeStructure)) {
+                    int dst = vPC[1].u.operand;
+                    int offset = vPC[6].u.operand;
+                    if (GetterSetter* getterSetter = asGetterSetter(protoObject->getDirectOffset(offset).asCell())) {
+                        JSObject* getter = getterSetter->getter();
+                        CallData callData;
+                        CallType callType = getter->getCallData(callData);
+                        JSValue result = call(callFrame, getter, callType, callData, asObject(baseCell), ArgList());
+                        CHECK_FOR_EXCEPTION();
+                        callFrame->r(dst) = result;
+                    } else
+                        callFrame->r(dst) = jsUndefined();
+                    vPC += OPCODE_LENGTH(op_get_by_id_getter_proto);
+                    NEXT_INSTRUCTION();
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_proto:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_proto);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_proto) {
+        /* op_get_by_id_custom_proto dst(r) base(r) property(id) structure(sID) prototypeStructure(sID) offset(n) nop(n)
+         
+         Cached property access: Attempts to use a cached named property getter
+         from the value base's prototype. If the cache misses, op_get_by_id_custom_proto
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
+                JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+                Structure* prototypeStructure = vPC[5].u.structure;
+                
+                if (LIKELY(protoObject->structure() == prototypeStructure)) {
+                    int dst = vPC[1].u.operand;
+                    int property = vPC[3].u.operand;
+                    Identifier& ident = callFrame->codeBlock()->identifier(property);
+                    
+                    PropertySlot::GetValueFunc getter = vPC[6].u.getterFunc;
+                    JSValue result = getter(callFrame, protoObject, ident);
+                    CHECK_FOR_EXCEPTION();
+                    callFrame->r(dst) = result;
+                    vPC += OPCODE_LENGTH(op_get_by_id_custom_proto);
+                    NEXT_INSTRUCTION();
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_custom_proto:
+#endif
     DEFINE_OPCODE(op_get_by_id_self_list) {
         // Polymorphic self access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
@@ -2167,6 +2300,34 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_get_by_id_getter_self_list) {
+        // Polymorphic self access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_self_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_getter_proto_list) {
+        // Polymorphic prototype access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_custom_self_list) {
+        // Polymorphic self access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_custom_self_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_custom_proto_list) {
+        // Polymorphic prototype access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_get_by_id_chain) {
         /* op_get_by_id_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
 
@@ -2213,6 +2374,86 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         uncacheGetByID(callFrame->codeBlock(), vPC);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_self);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_self) {
+        /* op_get_by_id_self dst(r) base(r) property(id) structure(sID) offset(n) nop(n) nop(n)
+         
+         Cached property access: Attempts to get a cached property from the
+         value base. If the cache misses, op_get_by_id_getter_self reverts to
+         op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(baseCell->isObject());
+                JSObject* baseObject = asObject(baseCell);
+                int dst = vPC[1].u.operand;
+                int offset = vPC[5].u.operand;
+
+                if (GetterSetter* getterSetter = asGetterSetter(baseObject->getDirectOffset(offset).asCell())) {
+                    JSObject* getter = getterSetter->getter();
+                    CallData callData;
+                    CallType callType = getter->getCallData(callData);
+                    JSValue result = call(callFrame, getter, callType, callData, baseObject, ArgList());
+                    CHECK_FOR_EXCEPTION();
+                    callFrame->r(dst) = result;
+                } else
+                    callFrame->r(dst) = jsUndefined();
+
+                vPC += OPCODE_LENGTH(op_get_by_id_getter_self);
+                NEXT_INSTRUCTION();
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_self:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_self);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_self) {
+        /* op_get_by_id_custom_self dst(r) base(r) property(id) structure(sID) offset(n) nop(n) nop(n)
+         
+         Cached property access: Attempts to use a cached named property getter
+         from the value base. If the cache misses, op_get_by_id_custom_self reverts to
+         op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(baseCell->isObject());
+                int dst = vPC[1].u.operand;
+                int property = vPC[3].u.operand;
+                Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+                PropertySlot::GetValueFunc getter = vPC[5].u.getterFunc;
+                JSValue result = getter(callFrame, baseValue, ident);
+                CHECK_FOR_EXCEPTION();
+                callFrame->r(dst) = result;
+                vPC += OPCODE_LENGTH(op_get_by_id_custom_self);
+                NEXT_INSTRUCTION();
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+skip_id_custom_self:
+#endif
     DEFINE_OPCODE(op_get_by_id_generic) {
         /* op_get_by_id_generic dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -2233,6 +2474,113 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_generic);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_chain);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_chain) {
+        /* op_get_by_id_getter_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
+         
+         Cached property access: Attempts to get a cached property from the
+         value base's prototype chain. If the cache misses, op_get_by_id_getter_chain
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                size_t count = vPC[6].u.operand;
+                RefPtr<Structure>* end = it + count;
+                
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+                    
+                    if (UNLIKELY(baseObject->structure() != (*it).get()))
+                        break;
+                    
+                    if (++it == end) {
+                        int dst = vPC[1].u.operand;
+                        int offset = vPC[7].u.operand;
+                        if (GetterSetter* getterSetter = asGetterSetter(baseObject->getDirectOffset(offset).asCell())) {
+                            JSObject* getter = getterSetter->getter();
+                            CallData callData;
+                            CallType callType = getter->getCallData(callData);
+                            JSValue result = call(callFrame, getter, callType, callData, baseValue, ArgList());
+                            CHECK_FOR_EXCEPTION();
+                            callFrame->r(dst) = result;
+                        } else
+                            callFrame->r(dst) = jsUndefined();
+                        vPC += OPCODE_LENGTH(op_get_by_id_getter_chain);
+                        NEXT_INSTRUCTION();
+                    }
+                    
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_chain:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_chain);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_chain) {
+        /* op_get_by_id_custom_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
+         
+         Cached property access: Attempts to use a cached named property getter on the
+         value base's prototype chain. If the cache misses, op_get_by_id_custom_chain
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                size_t count = vPC[6].u.operand;
+                RefPtr<Structure>* end = it + count;
+                
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+                    
+                    if (UNLIKELY(baseObject->structure() != (*it).get()))
+                        break;
+                    
+                    if (++it == end) {
+                        int dst = vPC[1].u.operand;
+                        int property = vPC[3].u.operand;
+                        Identifier& ident = callFrame->codeBlock()->identifier(property);
+                        
+                        PropertySlot::GetValueFunc getter = vPC[7].u.getterFunc;
+                        JSValue result = getter(callFrame, baseObject, ident);
+                        CHECK_FOR_EXCEPTION();
+                        callFrame->r(dst) = result;
+                        vPC += OPCODE_LENGTH(op_get_by_id_custom_chain);
+                        NEXT_INSTRUCTION();
+                    }
+                    
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_custom_chain:
+#endif
     DEFINE_OPCODE(op_get_array_length) {
         /* op_get_array_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -2265,7 +2613,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
+            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->length());
             vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
@@ -2479,7 +2827,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 else
                     result = jsArray->JSArray::get(callFrame, i);
             } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-                result = asString(baseValue)->getIndex(&callFrame->globalData(), i);
+                result = asString(baseValue)->getIndex(callFrame, i);
             else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i))
                 result = asByteArray(baseValue)->getIndex(callFrame, i);
             else
@@ -2647,6 +2995,26 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_loop_if_false) {
+        /* loop_if_true cond(r) target(offset)
+         
+           Jumps to offset target from the current instruction, if and
+           only if register cond converts to boolean as false.
+
+           Additionally this loop instruction may terminate JS execution is
+           the JS timeout is reached.
+         */
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
+            vPC += target;
+            CHECK_FOR_TIMEOUT();
+            NEXT_INSTRUCTION();
+        }
+        
+        vPC += OPCODE_LENGTH(op_loop_if_true);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jtrue) {
         /* jtrue cond(r) target(offset)
 
@@ -2707,7 +3075,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
-        if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (!srcValue.isUndefinedOrNull() && (!srcValue.isCell() || !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -2810,6 +3178,29 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jless) {
+        /* jless src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than register src2, as
+           with the ECMAScript '<' operator, and then jumps to offset
+           target from the current instruction, if and only if the 
+           result of the comparison is true.
+        */
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
+
+        bool result = jsLess(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        vPC += OPCODE_LENGTH(op_jless);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jnlesseq) {
         /* jnlesseq src1(r) src2(r) target(offset)
 
@@ -2872,11 +3263,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
-            UString::Rep* value = asString(scrutinee)->value().rep();
-            if (value->size() != 1)
+            UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
+            if (value->length() != 1)
                 vPC += defaultOffset;
             else
-                vPC += callFrame->codeBlock()->characterSwitchJumpTable(tableIndex).offsetForValue(value->data()[0], defaultOffset);
+                vPC += callFrame->codeBlock()->characterSwitchJumpTable(tableIndex).offsetForValue(value->characters()[0], defaultOffset);
         }
         NEXT_INSTRUCTION();
     }
@@ -2895,7 +3286,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
-            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value().rep(), defaultOffset);
+            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value(callFrame).rep(), defaultOffset);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func) {
@@ -3063,9 +3454,10 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int argsOffset = vPC[2].u.operand;
         
         JSValue arguments = callFrame->r(argsOffset).jsValue();
-        int32_t argCount = 0;
+        uint32_t argCount = 0;
         if (!arguments) {
             argCount = (uint32_t)(callFrame->argumentCount()) - 1;
+            argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3074,7 +3466,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             }
             ASSERT(!callFrame->callee()->isHostFunction());
             int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
-            int32_t inplaceArgs = min(argCount, expectedParams);
+            int32_t inplaceArgs = min(static_cast<int32_t>(argCount), expectedParams);
             int32_t i = 0;
             Register* argStore = callFrame->registers() + argsOffset;
 
@@ -3082,8 +3474,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             for (; i < inplaceArgs; i++)
                 argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams];
             // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
-            for (; i < argCount; i++)
-                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
+            for (; i < static_cast<int32_t>(argCount); i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - static_cast<int32_t>(argCount) - 1];
         } else if (!arguments.isUndefinedOrNull()) {
             if (!arguments.isObject()) {
                 exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
@@ -3092,6 +3484,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             if (asObject(arguments)->classInfo() == &Arguments::info) {
                 Arguments* args = asArguments(arguments);
                 argCount = args->numProvidedArguments(callFrame);
+                argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
                 if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3102,6 +3495,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             } else if (isJSArray(&callFrame->globalData(), arguments)) {
                 JSArray* array = asArray(arguments);
                 argCount = array->length();
+                argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
                 if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3112,6 +3506,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             } else if (asObject(arguments)->inherits(&JSArray::info)) {
                 JSObject* argObject = asObject(arguments);
                 argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+                argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
                 if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3119,7 +3514,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                     goto vm_throw;
                 }
                 Register* argsBuffer = callFrame->registers() + argsOffset;
-                for (int32_t i = 0; i < argCount; ++i) {
+                for (uint32_t i = 0; i < argCount; ++i) {
                     argsBuffer[i] = asObject(arguments)->get(callFrame, i);
                     CHECK_FOR_EXCEPTION();
                 }
@@ -3487,7 +3882,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int src = vPC[2].u.operand;
         int count = vPC[3].u.operand;
 
-        callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        callFrame->r(dst) = jsString(callFrame, &callFrame->registers()[src], count);
+        CHECK_FOR_EXCEPTION();
         vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index 76184ba..ecd7403 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -51,17 +51,18 @@ namespace JSC {
     class Register : public WTF::FastAllocBase {
     public:
         Register();
-        Register(JSValue);
 
+        Register(const JSValue&);
+        Register& operator=(const JSValue&);
         JSValue jsValue() const;
         
-        Register(JSActivation*);
-        Register(CallFrame*);
-        Register(CodeBlock*);
-        Register(JSFunction*);
-        Register(JSPropertyNameIterator*);
-        Register(ScopeChainNode*);
-        Register(Instruction*);
+        Register& operator=(JSActivation*);
+        Register& operator=(CallFrame*);
+        Register& operator=(CodeBlock*);
+        Register& operator=(JSFunction*);
+        Register& operator=(JSPropertyNameIterator*);
+        Register& operator=(ScopeChainNode*);
+        Register& operator=(Instruction*);
 
         int32_t i() const;
         JSActivation* activation() const;
@@ -75,12 +76,12 @@ namespace JSC {
 
         static Register withInt(int32_t i)
         {
-            return Register(i);
+            Register r;
+            r.u.i = i;
+            return r;
         }
 
     private:
-        Register(int32_t);
-
         union {
             int32_t i;
             EncodedJSValue value;
@@ -98,13 +99,25 @@ namespace JSC {
     ALWAYS_INLINE Register::Register()
     {
 #ifndef NDEBUG
-        u.value = JSValue::encode(JSValue());
+        *this = JSValue();
+#endif
+    }
+
+    ALWAYS_INLINE Register::Register(const JSValue& v)
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
 #endif
+        u.value = JSValue::encode(v);
     }
 
-    ALWAYS_INLINE Register::Register(JSValue v)
+    ALWAYS_INLINE Register& Register::operator=(const JSValue& v)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         u.value = JSValue::encode(v);
+        return *this;
     }
 
     ALWAYS_INLINE JSValue Register::jsValue() const
@@ -114,44 +127,46 @@ namespace JSC {
 
     // Interpreter functions
 
-    ALWAYS_INLINE Register::Register(JSActivation* activation)
+    ALWAYS_INLINE Register& Register::operator=(JSActivation* activation)
     {
         u.activation = activation;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(CallFrame* callFrame)
+    ALWAYS_INLINE Register& Register::operator=(CallFrame* callFrame)
     {
         u.callFrame = callFrame;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(CodeBlock* codeBlock)
+    ALWAYS_INLINE Register& Register::operator=(CodeBlock* codeBlock)
     {
         u.codeBlock = codeBlock;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(JSFunction* function)
+    ALWAYS_INLINE Register& Register::operator=(JSFunction* function)
     {
         u.function = function;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(Instruction* vPC)
+    ALWAYS_INLINE Register& Register::operator=(Instruction* vPC)
     {
         u.vPC = vPC;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(ScopeChainNode* scopeChain)
+    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
     {
         u.scopeChain = scopeChain;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(JSPropertyNameIterator* propertyNameIterator)
+    ALWAYS_INLINE Register& Register::operator=(JSPropertyNameIterator* propertyNameIterator)
     {
         u.propertyNameIterator = propertyNameIterator;
-    }
-
-    ALWAYS_INLINE Register::Register(int32_t i)
-    {
-        u.i = i;
+        return *this;
     }
 
     ALWAYS_INLINE int32_t Register::i() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index 5424199..4a33c62 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -36,10 +36,12 @@ RegisterFile::~RegisterFile()
 #if HAVE(MMAP)
     munmap(m_buffer, ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
 #elif HAVE(VIRTUALALLOC)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     VirtualFree(m_buffer, DWORD(m_commitEnd) - DWORD(m_buffer), MEM_DECOMMIT);
 #endif
     VirtualFree(m_buffer, 0, MEM_RELEASE);
+#elif OS(SYMBIAN)
+    delete m_registerFileAllocator;
 #else
     fastFree(m_buffer);
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
index 953c70f..80cf991 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
@@ -41,6 +41,10 @@
 #include <sys/mman.h>
 #endif
 
+#if OS(SYMBIAN)
+#include <wtf/symbian/RegisterFileAllocatorSymbian.h>
+#endif
+
 namespace JSC {
 
 /*
@@ -152,12 +156,21 @@ namespace JSC {
 #if HAVE(VIRTUALALLOC)
         Register* m_commitEnd;
 #endif
+#if OS(SYMBIAN)
+        // Commits and frees a continguous chunk of memory as required
+        WTF::RegisterFileAllocator* m_registerFileAllocator;
+#endif
 
         JSGlobalObject* m_globalObject; // The global object whose vars are currently stored in the register file.
     };
 
     // FIXME: Add a generic getpagesize() to WTF, then move this function to WTF as well.
-    inline bool isPageAligned(size_t size) { return size != 0 && size % (8 * 1024) == 0; }
+    // This is still a hack that should be fixed later. We know that a Symbian page size is 4K.
+    #if OS(SYMBIAN)
+    inline bool isPageAligned(size_t size) { return size && !(size % (4 * 1024)); }
+    #else
+    inline bool isPageAligned(size_t size) { return size && !(size % (8 * 1024)); }
+    #endif
 
     inline RegisterFile::RegisterFile(size_t capacity, size_t maxGlobals)
         : m_numGlobals(0)
@@ -176,7 +189,7 @@ namespace JSC {
     #if HAVE(MMAP)
         m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
         if (m_buffer == MAP_FAILED) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -186,7 +199,7 @@ namespace JSC {
     #elif HAVE(VIRTUALALLOC)
         m_buffer = static_cast<Register*>(VirtualAlloc(0, roundUpAllocationSize(bufferLength, commitSize), MEM_RESERVE, PAGE_READWRITE));
         if (!m_buffer) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -196,7 +209,7 @@ namespace JSC {
         size_t committedSize = roundUpAllocationSize(maxGlobals * sizeof(Register), commitSize);
         void* commitCheck = VirtualAlloc(m_buffer, committedSize, MEM_COMMIT, PAGE_READWRITE);
         if (commitCheck != m_buffer) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -204,7 +217,13 @@ namespace JSC {
             CRASH();
         }
         m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + committedSize);
-    #else 
+    #elif OS(SYMBIAN)
+        m_registerFileAllocator = new WTF::RegisterFileAllocator(bufferLength);
+        m_buffer = (Register*)(m_registerFileAllocator->buffer());
+        // start by committing enough space to hold maxGlobals
+        void* newEnd = (void*)((int)m_buffer + (maxGlobals * sizeof(Register)));
+        m_registerFileAllocator->grow(newEnd);
+    #else
         /* 
          * If neither MMAP nor VIRTUALALLOC are available - use fastMalloc instead.
          *
@@ -226,8 +245,13 @@ namespace JSC {
         if (newEnd >= m_end)
             return;
         m_end = newEnd;
-        if (m_end == m_start && (m_maxUsed - m_start) > maxExcessCapacity)
+        if (m_end == m_start && (m_maxUsed - m_start) > maxExcessCapacity) {
+#if OS(SYMBIAN)
+            m_registerFileAllocator->shrink(newEnd);
+#endif
+
             releaseExcessCapacity();
+        }
     }
 
     inline bool RegisterFile::grow(Register* newEnd)
@@ -242,7 +266,7 @@ namespace JSC {
         if (newEnd > m_commitEnd) {
             size_t size = roundUpAllocationSize(reinterpret_cast<char*>(newEnd) - reinterpret_cast<char*>(m_commitEnd), commitSize);
             if (!VirtualAlloc(m_commitEnd, size, MEM_COMMIT, PAGE_READWRITE)) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
                 fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
                 fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -252,6 +276,9 @@ namespace JSC {
             m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_commitEnd) + size);
         }
 #endif
+#if OS(SYMBIAN)
+        m_registerFileAllocator->grow((void*)newEnd);
+#endif
 
         if (newEnd > m_maxUsed)
             m_maxUsed = newEnd;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 9ca62c8..8f46dee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -26,6 +26,7 @@
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
 
+#include <stddef.h> // for ptrdiff_t
 #include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
@@ -33,15 +34,25 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(IPHONE)
+#if OS(IPHONE_OS)
 #include <libkern/OSCacheControl.h>
 #include <sys/mman.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <e32std.h>
 #endif
 
+#if CPU(MIPS) && OS(LINUX)
+#include <sys/cachectl.h>
+#endif
+
+#if OS(WINCE)
+// From pkfuncs.h (private header file from the Platform Builder)
+#define CACHE_SYNC_ALL 0x07F
+extern "C" __declspec(dllimport) void CacheRangeFlush(LPVOID pAddr, DWORD dwLength, DWORD dwFlags);
+#endif
+
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
@@ -78,7 +89,7 @@ private:
     struct Allocation {
         char* pages;
         size_t size;
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         RChunk* chunk;
 #endif
     };
@@ -179,17 +190,43 @@ public:
 #endif
 
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
     static void cacheFlush(void*, size_t)
     {
     }
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
+#elif CPU(MIPS)
+    static void cacheFlush(void* code, size_t size)
+    {
+#if COMPILER(GCC) && (GCC_VERSION >= 40300)
+#if WTF_MIPS_ISA_REV(2) && (GCC_VERSION < 40403)
+        int lineSize;
+        asm("rdhwr %0, $1" : "=r" (lineSize));
+        //
+        // Modify "start" and "end" to avoid GCC 4.3.0-4.4.2 bug in
+        // mips_expand_synci_loop that may execute synci one more time.
+        // "start" points to the fisrt byte of the cache line.
+        // "end" points to the last byte of the line before the last cache line.
+        // Because size is always a multiple of 4, this is safe to set
+        // "end" to the last byte.
+        //
+        intptr_t start = reinterpret_cast<intptr_t>(code) & (-lineSize);
+        intptr_t end = ((reinterpret_cast<intptr_t>(code) + size - 1) & (-lineSize)) - 1;
+        __builtin___clear_cache(reinterpret_cast<char*>(start), reinterpret_cast<char*>(end));
+#else
+        intptr_t end = reinterpret_cast<intptr_t>(code) + size;
+        __builtin___clear_cache(reinterpret_cast<char*>(code), reinterpret_cast<char*>(end));
+#endif
+#else
+        _flush_cache(reinterpret_cast<char*>(code), size, BCACHE);
+#endif
+    }
+#elif CPU(ARM_THUMB2) && OS(IPHONE_OS)
     static void cacheFlush(void* code, size_t size)
     {
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(LINUX)
+#elif CPU(ARM_THUMB2) && OS(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
         asm volatile (
@@ -205,12 +242,12 @@ public:
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
             : "r0", "r1", "r2");
     }
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     static void cacheFlush(void* code, size_t size)
     {
         User::IMB_Range(code, static_cast<char*>(code) + size);
     }
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+#elif CPU(ARM_TRADITIONAL) && OS(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
         asm volatile (
@@ -226,6 +263,11 @@ public:
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
             : "r0", "r1", "r2");
     }
+#elif OS(WINCE)
+    static void cacheFlush(void* code, size_t size)
+    {
+        CacheRangeFlush(code, size, CACHE_SYNC_ALL);
+    }
 #else
     #error "The cacheFlush support is missing on this platform."
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 7682b9c..4d3c847 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -27,9 +27,9 @@
 
 #include "ExecutableAllocator.h"
 
-#include <errno.h>
+#if ENABLE(ASSEMBLER) && OS(DARWIN) && CPU(X86_64)
 
-#if ENABLE(ASSEMBLER) && PLATFORM(MAC) && PLATFORM(X86_64)
+#include <errno.h>
 
 #include "TCSpinLock.h"
 #include <mach/mach_init.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 13a8626..06375ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -27,7 +27,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(ASSEMBLER) && OS(UNIX) && !OS(SYMBIAN)
 
 #include <sys/mman.h>
 #include <unistd.h>
@@ -35,7 +35,7 @@
 
 namespace JSC {
 
-#if !(PLATFORM(MAC) && PLATFORM(X86_64))
+#if !(OS(DARWIN) && CPU(X86_64))
 
 void ExecutableAllocator::intializePageSize()
 {
@@ -57,7 +57,7 @@ void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
     ASSERT_UNUSED(result, !result);
 }
 
-#endif // !(PLATFORM(MAC) && PLATFORM(X86_64))
+#endif // !(OS(DARWIN) && CPU(X86_64))
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
 void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
index c96ecae..e82975c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
@@ -22,7 +22,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(SYMBIAN)
+#if ENABLE(ASSEMBLER) && OS(SYMBIAN)
 
 #include <e32hal.h>
 #include <e32std.h>
@@ -34,7 +34,7 @@ namespace JSC {
 
 void ExecutableAllocator::intializePageSize()
 {
-#if PLATFORM_ARM_ARCH(5)
+#if CPU(ARMV5_OR_LOWER)
     // The moving memory model (as used in ARMv5 and earlier platforms)
     // on Symbian OS limits the number of chunks for each process to 16. 
     // To mitigate this limitation increase the pagesize to 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index e6ac855..e38323c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -27,7 +27,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(ASSEMBLER) && OS(WINDOWS)
 
 #include "windows.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index 000e4b8..b414101 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -27,7 +27,7 @@
 #include "JIT.h"
 
 // This probably does not belong here; adding here for now as a quick Windows build fix.
-#if ENABLE(ASSEMBLER) && PLATFORM(X86) && !PLATFORM(MAC)
+#if ENABLE(ASSEMBLER) && CPU(X86) && !OS(MAC_OS_X)
 #include "MacroAssembler.h"
 JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
 #endif
@@ -37,7 +37,6 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
-#include "JITStubs.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -251,6 +250,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_jneq_null)
         DEFINE_OP(op_jneq_ptr)
         DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jless)
         DEFINE_OP(op_jnlesseq)
         DEFINE_OP(op_jsr)
         DEFINE_OP(op_jtrue)
@@ -259,6 +259,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_loop_if_less)
         DEFINE_OP(op_loop_if_lesseq)
         DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_loop_if_false)
         DEFINE_OP(op_lshift)
         DEFINE_OP(op_method_check)
         DEFINE_OP(op_mod)
@@ -321,6 +322,16 @@ void JIT::privateCompileMainPass()
         case op_get_by_id_proto_list:
         case op_get_by_id_self:
         case op_get_by_id_self_list:
+        case op_get_by_id_getter_chain:
+        case op_get_by_id_getter_proto:
+        case op_get_by_id_getter_proto_list:
+        case op_get_by_id_getter_self:
+        case op_get_by_id_getter_self_list:
+        case op_get_by_id_custom_chain:
+        case op_get_by_id_custom_proto:
+        case op_get_by_id_custom_proto_list:
+        case op_get_by_id_custom_self:
+        case op_get_by_id_custom_self_list:
         case op_get_string_length:
         case op_put_by_id_generic:
         case op_put_by_id_replace:
@@ -390,11 +401,13 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_instanceof)
         DEFINE_SLOWCASE_OP(op_jfalse)
         DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jless)
         DEFINE_SLOWCASE_OP(op_jnlesseq)
         DEFINE_SLOWCASE_OP(op_jtrue)
         DEFINE_SLOWCASE_OP(op_loop_if_less)
         DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
         DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_loop_if_false)
         DEFINE_SLOWCASE_OP(op_lshift)
         DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
@@ -579,7 +592,7 @@ void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
     // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
     // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
     // match).  Reset the check so it no longer matches.
-    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock.get());
+    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock);
 #if USE(JSVALUE32_64)
     repatchBuffer.repatch(callLinkInfo->hotPathBegin, 0);
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index e19ea17..a8f725d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -26,8 +26,6 @@
 #ifndef JIT_h
 #define JIT_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(JIT)
 
 // We've run into some problems where changing the size of the class JIT leads to
@@ -192,7 +190,7 @@ namespace JSC {
         // on x86/x86-64 it is ecx for performance reasons, since the
         // MacroAssembler will need to plant register swaps if it is not -
         // however the code will still function correctly.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
         static const RegisterID firstArgumentRegister = X86Registers::edi;
@@ -210,7 +208,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM(X86)
+#elif CPU(X86)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
         // On x86 we always use fastcall conventions = but on
@@ -228,7 +226,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM(ARM_THUMB2)
+#elif CPU(ARM_THUMB2)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -244,7 +242,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = ARMRegisters::d0;
         static const FPRegisterID fpRegT1 = ARMRegisters::d1;
         static const FPRegisterID fpRegT2 = ARMRegisters::d2;
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -283,32 +281,32 @@ namespace JSC {
             return JIT(globalData, codeBlock).privateCompile();
         }
 
-        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
+            jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, ident, slot, cachedOffset, returnAddress, callFrame);
         }
 
-        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, cachedOffset);
+            jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, ident, slot, cachedOffset);
         }
-        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset)
+        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, cachedOffset, callFrame);
+            jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, ident, slot, cachedOffset, callFrame);
         }
-        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset)
+        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
+            jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, ident, slot, cachedOffset, callFrame);
         }
 
-        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
+            jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, ident, slot, cachedOffset, returnAddress, callFrame);
         }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
@@ -317,10 +315,10 @@ namespace JSC {
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, TrampolineStructure *trampolines)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiStringLengthTrampoline, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, trampolines);
         }
 
         static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
@@ -354,14 +352,14 @@ namespace JSC {
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         JITCode privateCompile();
-        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
-        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
-        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, size_t cachedOffset);
+        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
+        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
+        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress);
 
-        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, TrampolineStructure *trampolines);
         void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
 
         void addSlowCase(Jump);
@@ -436,7 +434,7 @@ namespace JSC {
         void emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType);
         void emitBinaryDoubleOp(OpcodeID, unsigned dst, unsigned op1, unsigned op2, OperandTypes, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters = true, bool op2IsInRegisters = true);
 
-#if PLATFORM(X86)
+#if CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
@@ -465,6 +463,47 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
+#elif CPU(ARM_TRADITIONAL)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 4;
+        static const int patchOffsetPutByIdExternalLoad = 16;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 4;
+        static const int patchOffsetGetByIdBranchToSlowCase = 16;
+        static const int patchOffsetGetByIdExternalLoad = 16;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
+        static const int patchOffsetGetByIdPutResult = 36;
+#if ENABLE(OPCODE_SAMPLING)
+        #error "OPCODE_SAMPLING is not yet supported"
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 32;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 12;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
+
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 36;
+        static const int sequenceGetByIdHotPathConstantSpace = 4;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 36;
+        static const int sequencePutByIdConstantSpace = 4;
 #else
 #error "JSVALUE32_64 not supported on this platform."
 #endif
@@ -533,7 +572,7 @@ namespace JSC {
         void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 20;
@@ -556,7 +595,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 20;
         static const int patchOffsetMethodCheckProtoStruct = 30;
         static const int patchOffsetMethodCheckPutFunction = 50;
-#elif PLATFORM(X86)
+#elif CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
@@ -583,7 +622,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
-#elif PLATFORM(ARM_THUMB2)
+#elif CPU(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 26;
@@ -606,7 +645,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 24;
         static const int patchOffsetMethodCheckProtoStruct = 34;
         static const int patchOffsetMethodCheckPutFunction = 58;
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
         static const int patchOffsetPutByIdExternalLoad = 16;
@@ -629,10 +668,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 12;
         static const int patchOffsetMethodCheckProtoStruct = 20;
         static const int patchOffsetMethodCheckPutFunction = 32;
-#endif
-#endif // USE(JSVALUE32_64)
 
-#if PLATFORM(ARM_TRADITIONAL)
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
@@ -649,6 +685,7 @@ namespace JSC {
         static const int sequencePutByIdInstructionSpace = 28;
         static const int sequencePutByIdConstantSpace = 3;
 #endif
+#endif // USE(JSVALUE32_64)
 
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name) beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
@@ -697,6 +734,7 @@ namespace JSC {
         void emit_op_jneq_null(Instruction*);
         void emit_op_jneq_ptr(Instruction*);
         void emit_op_jnless(Instruction*);
+        void emit_op_jless(Instruction*);
         void emit_op_jnlesseq(Instruction*);
         void emit_op_jsr(Instruction*);
         void emit_op_jtrue(Instruction*);
@@ -705,6 +743,7 @@ namespace JSC {
         void emit_op_loop_if_less(Instruction*);
         void emit_op_loop_if_lesseq(Instruction*);
         void emit_op_loop_if_true(Instruction*);
+        void emit_op_loop_if_false(Instruction*);
         void emit_op_lshift(Instruction*);
         void emit_op_method_check(Instruction*);
         void emit_op_mod(Instruction*);
@@ -759,6 +798,9 @@ namespace JSC {
         void emit_op_to_jsnumber(Instruction*);
         void emit_op_to_primitive(Instruction*);
         void emit_op_unexpected_load(Instruction*);
+#if ENABLE(JIT_OPTIMIZE_MOD)
+        void softModulo();
+#endif
 
         void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -779,11 +821,13 @@ namespace JSC {
         void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jless(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_false(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -911,6 +955,46 @@ namespace JSC {
 #endif
 #endif
     } JIT_CLASS_ALIGNMENT;
+
+    inline void JIT::emit_op_loop(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jmp(currentInstruction);
+    }
+
+    inline void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jtrue(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jtrue(currentInstruction, iter);
+    }
+
+    inline void JIT::emit_op_loop_if_false(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jfalse(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_false(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jfalse(currentInstruction, iter);
+    }
+
+    inline void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jless(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jless(currentInstruction, iter);
+    }
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 8cda482..2e1ff40 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -31,6 +31,7 @@
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
+#include "JITStubs.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -55,8 +56,7 @@ void JIT::emit_op_negate(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(Equal, regT0, Imm32(0)));
-
+    addSlowCase(branchTest32(Zero, regT0, Imm32(0x7fffffff)));
     neg32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
 
@@ -77,7 +77,7 @@ void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEnt
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    linkSlowCase(iter); // 0 check
+    linkSlowCase(iter); // 0x7fffffff check
     linkSlowCase(iter); // double check
 
     JITStubCall stubCall(this, cti_op_negate);
@@ -148,6 +148,69 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Int32 less.
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, regT2), target);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(op_jless, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantImmediateInt(op1), isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!supportsFloatingPoint()) {
+        if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    } else {
+        if (!isOperandConstantImmediateInt(op1)) {
+            linkSlowCase(iter); // double check
+            linkSlowCase(iter); // int32 check
+        }
+        if (isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // double check
+    }
+
+    JITStubCall stubCall(this, cti_op_jless);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -829,11 +892,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThan, fpRegT2, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +949,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1000,20 +1071,11 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     divDouble(fpRegT1, fpRegT0);
 
     JumpList doubleResult;
-    if (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        convertInt32ToDouble(regT0, fpRegT1);
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
+    branchConvertDoubleToInt32(fpRegT0, regT0, doubleResult, fpRegT1);
 
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        
-        doubleResult.append(branchTest32(Zero, regT0));
-
-        // Int32 result.
-        emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
-        end.append(jump());
-    }
+    // Int32 result.
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+    end.append(jump());
 
     // Double result.
     doubleResult.link(this);
@@ -1054,7 +1116,7 @@ void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1116,7 +1178,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(dst);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1124,17 +1186,43 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if ENABLE(JIT_OPTIMIZE_MOD)    
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    
+    addSlowCase(branch32(Equal, regT2, Imm32(0)));
+    
+    emitNakedCall(m_globalData->jitStubs.ctiSoftModulo());
+
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+#else
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call(dst);
+#endif
 }
 
-void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(result);
+#else
+    ASSERT_NOT_REACHED();
+#endif
 }
 
-#endif // PLATFORM(X86) || PLATFORM(X86_64)
+#endif // CPU(X86) || CPU(X86_64)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
@@ -1152,13 +1240,8 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-    // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-    // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-    and32(Imm32(0x1f), regT2);
-#endif
     lshift32(regT2, regT0);
-#if !USE(JSVALUE64)
+#if USE(JSVALUE32)
     addSlowCase(branchAdd32(Overflow, regT0, regT0));
     signExtend32ToPtr(regT0, regT0);
 #endif
@@ -1203,11 +1286,7 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-#if USE(JSVALUE64)
         rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#else
-        rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#endif
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
         if (supportsFloatingPointTruncate()) {
@@ -1234,15 +1313,9 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
             emitJumpSlowCaseIfNotImmediateInteger(regT2);
         }
         emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-        // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-        // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-        and32(Imm32(0x1f), regT2);
-#endif
-#if USE(JSVALUE64)
         rshift32(regT2, regT0);
-#else
-        rshiftPtr(regT2, regT0);
+#if USE(JSVALUE32)
+        signExtend32ToPtr(regT0, regT0);
 #endif
     }
 #if USE(JSVALUE64)
@@ -1365,7 +1438,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1406,7 +1479,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1452,7 +1525,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1479,6 +1552,191 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     }
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(JSVALUE64)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(JSVALUE64)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT1, Imm32(op1imm)), target);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(LessThan, regT0, regT1), target);
+    }
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).asInt32();
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).asInt32();
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+    }
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -1550,7 +1808,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1591,7 +1849,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1637,7 +1895,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1849,7 +2107,7 @@ void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEn
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1898,7 +2156,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(result);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1906,18 +2164,43 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if ENABLE(JIT_OPTIMIZE_MOD)    
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT2);
+    
+    addSlowCase(branch32(Equal, regT2, Imm32(1)));
+
+    emitNakedCall(m_globalData->jitStubs.ctiSoftModulo());
+
+    emitPutVirtualRegister(result, regT0);
+#else
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1, regT2);
     stubCall.addArgument(op2, regT2);
     stubCall.call(result);
+#endif
 }
 
-void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+#else
     ASSERT_NOT_REACHED();
+#endif
 }
 
-#endif // PLATFORM(X86) || PLATFORM(X86_64)
+#endif // CPU(X86) || CPU(X86_64)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
@@ -2160,27 +2443,10 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     }
     divDouble(fpRegT1, fpRegT0);
 
-    JumpList doubleResult;
-    Jump end;
-    bool attemptIntConversion = (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) && isOperandConstantImmediateInt(op2);
-    if (attemptIntConversion) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        doubleResult.append(branchTest32(Zero, regT0));
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
-        
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        emitFastArithIntToImmNoCheck(regT0, regT0);
-        end = jump();
-    }
-
     // Double result.
-    doubleResult.link(this);
     moveDoubleToPtr(fpRegT0, regT0);
     subPtr(tagTypeNumberRegister, regT0);
 
-    if (attemptIntConversion)
-        end.link(this);
     emitPutVirtualRegister(dst, regT0);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index f7fcc0a..da603bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -159,7 +159,7 @@ void JIT::emit_op_construct_verify(Instruction* currentInstruction)
     emitLoad(dst, regT1, regT0);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
 }
 
 void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -315,7 +315,13 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     emitLoad(callee, regT1, regT0);
 
     DataLabelPtr addressOfLinkedFunctionCheck;
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
index 69cf167..5d889b5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
@@ -26,8 +26,6 @@
 #ifndef JITCode_h
 #define JITCode_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(JIT)
 
 #include "CallFrame.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index 93d6ce7..91d891e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -26,7 +26,6 @@
 #ifndef JITInlineMethods_h
 #define JITInlineMethods_h
 
-#include <wtf/Platform.h>
 
 #if ENABLE(JIT)
 
@@ -37,7 +36,7 @@ namespace JSC {
 // puts an arg onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(src, argumentStackOffset);
 }
 
@@ -45,7 +44,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumbe
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(Imm32(value), argumentStackOffset);
 }
 
@@ -53,7 +52,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argum
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(ImmPtr(value), argumentStackOffset);
 }
 
@@ -61,7 +60,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argument
 
 ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID dst)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     peek(dst, argumentStackOffset);
 }
 
@@ -115,7 +114,7 @@ ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 
 ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace)
 {
-#if PLATFORM(ARM_TRADITIONAL)
+#if CPU(ARM_TRADITIONAL)
 #ifndef NDEBUG
     // Ensure the label after the sequence can also fit
     insnSpace += sizeof(ARMWord);
@@ -144,7 +143,7 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
 
 #endif
 
-#if PLATFORM(ARM)
+#if CPU(ARM)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -161,7 +160,7 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
     loadPtr(address, linkRegister);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -194,10 +193,10 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
-#if PLATFORM(X86)
+#if CPU(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
@@ -265,9 +264,9 @@ ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 #if ENABLE(SAMPLING_COUNTERS)
 ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
 {
-#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+#if CPU(X86_64) // Or any other 64-bit plattform.
     addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
-#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+#elif CPU(X86) // Or any other little-endian 32-bit plattform.
     intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
     add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
     addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
@@ -278,7 +277,7 @@ ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t cou
 #endif
 
 #if ENABLE(OPCODE_SAMPLING)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
     move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
@@ -293,7 +292,7 @@ ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostF
 #endif
 
 #if ENABLE(CODEBLOCK_SAMPLING)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
     move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
@@ -585,7 +584,7 @@ ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op
 
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(payload, argumentStackOffset);
     poke(tag, argumentStackOffset + 1);
 }
@@ -594,7 +593,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, un
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue constant = m_codeBlock->getConstant(src);
         poke(Imm32(constant.payload()), argumentStackOffset);
@@ -817,7 +816,7 @@ ALWAYS_INLINE void JIT::emitFastArithImmToInt(RegisterID reg)
 #if USE(JSVALUE64)
     UNUSED_PARAM(reg);
 #else
-    rshiftPtr(Imm32(JSImmediate::IntegerPayloadShift), reg);
+    rshift32(Imm32(JSImmediate::IntegerPayloadShift), reg);
 #endif
 }
 
@@ -846,7 +845,7 @@ ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue value = m_codeBlock->getConstant(src);
         poke(ImmPtr(JSValue::encode(value)), argumentStackOffset);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index 14736cf..d04857c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,8 +41,12 @@ namespace JSC {
 
 #if USE(JSVALUE32_64)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    Label softModBegin = align();
+    softModulo();
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (1) This function provides fast property access for string length
     Label stringLengthBegin = align();
@@ -52,8 +57,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(UString::Rep, len)), regT2);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT2);
 
     Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
     move(regT2, regT0);
@@ -138,7 +142,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
     jump(regT0);
 
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(ARM_TRADITIONAL)
     Label nativeCallThunk = align();
     preserveReturnAddressAfterCall(regT0);
     emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
@@ -149,6 +153,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
+#if CPU(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -160,7 +165,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
      * stack pointer by the right amount after the call.
      */
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
 #if COMPILER(MSVC)
 #pragma pack(push)
 #pragma pack(4)
@@ -223,7 +228,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     storePtr(regT2, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
     storePtr(regT3, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
@@ -248,6 +253,95 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
+#elif CPU(ARM_TRADITIONAL)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    // Allocate stack space for our arglist
+    COMPILE_ASSERT((sizeof(ArgList) & 0x7) == 0 && sizeof(JSValue) == 8 && sizeof(Register) == 8, ArgList_should_by_8byte_aligned);
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in regT1
+    move(callFrameRegister, regT1);
+    sub32(Imm32(RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), regT1);
+
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT1)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+
+    // push pointer to arguments
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // Argument passing method:
+    // r0 - points to return value
+    // r1 - callFrame
+    // r2 - callee
+    // stack: this(JSValue) and a pointer to ArgList
+
+#if OS(WINCE)
+    // Setup arg4:
+    push(stackPointerRegister);
+
+    // Setup arg3:
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), ARMRegisters::r3);
+    push(ARMRegisters::r3);
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    // Setup arg0:
+    move(stackPointerRegister, regT0);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    load32(Address(stackPointerRegister, 0), regT0);
+    load32(Address(stackPointerRegister, 4), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 8), stackPointerRegister);
+#else // OS(WINCE)
+    move(stackPointerRegister, regT3);
+    subPtr(Imm32(8), stackPointerRegister);
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(8 + 4 + 4 /* padding */), stackPointerRegister);
+
+    // Setup arg4:
+    storePtr(regT3, Address(stackPointerRegister, 8));
+
+    // Setup arg3:
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 0));
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 4));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // Load return value
+    load32(Address(stackPointerRegister, 16), regT0);
+    load32(Address(stackPointerRegister, 20), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 16 + 8), stackPointerRegister);
+#endif // OS(WINCE)
+
+#endif
+
     // Check for an exception
     move(ImmPtr(&globalData->exception), regT2);
     Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
@@ -305,18 +399,21 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     CodeRef finalCode = patchBuffer.finalizeCode();
     *executablePool = finalCode.m_executablePool;
 
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+    trampolines->ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    trampolines->ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+    trampolines->ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
 #if ENABLE(JIT_OPTIMIZE_CALL)
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    trampolines->ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
 #else
     UNUSED_PARAM(ctiVirtualCallLink);
 #endif
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    trampolines->ctiSoftModulo = trampolineAt(finalCode, softModBegin);
+#endif
 }
 
 void JIT::emit_op_mov(Instruction* currentInstruction)
@@ -349,58 +446,6 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
     addJump(jump(), target);
 }
 
-void JIT::emit_op_loop(Instruction* currentInstruction)
-{
-    unsigned target = currentInstruction[1].u.operand;
-    emitTimeoutCheck();
-    addJump(jump(), target);
-}
-
-void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-
-    emitTimeoutCheck();
-
-    if (isOperandConstantImmediateInt(op1)) {
-        emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
-        return;
-    }
-    
-    if (isOperandConstantImmediateInt(op2)) {
-        emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
-        return;
-    }
-
-    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThan, regT0, regT2), target);
-}
-
-void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-
-    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
-        linkSlowCase(iter); // int32 check
-    linkSlowCase(iter); // int32 check
-
-    JITStubCall stubCall(this, cti_op_loop_if_less);
-    stubCall.addArgument(op1);
-    stubCall.addArgument(op2);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-}
-
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -471,7 +516,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
     // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -649,40 +694,6 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
-{
-    unsigned cond = currentInstruction[1].u.operand;
-    unsigned target = currentInstruction[2].u.operand;
-
-    emitTimeoutCheck();
-
-    emitLoad(cond, regT1, regT0);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addJump(branch32(NotEqual, regT0, Imm32(0)), target);
-    Jump isNotZero = jump();
-
-    isNotInteger.link(this);
-
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
-
-    isNotZero.link(this);
-}
-
-void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned cond = currentInstruction[1].u.operand;
-    unsigned target = currentInstruction[2].u.operand;
-
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_jtrue);
-    stubCall.addArgument(cond);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-}
-
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -786,7 +797,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
+        addJump(branchDouble(DoubleEqualOrUnordered, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -858,7 +869,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -885,7 +896,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -1198,7 +1209,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
         isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
     if (base != m_codeBlock->thisRegister()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -1477,7 +1488,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 
     map(m_bytecodeIndex + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
 }
@@ -1521,8 +1532,12 @@ void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
 #define RECORD_JUMP_TARGET(targetOffset) \
    do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    Label softModBegin = align();
+    softModulo();
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (2) The second function provides fast property access for string length
     Label stringLengthBegin = align();
@@ -1532,8 +1547,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
-    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
 
     Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
@@ -1628,7 +1642,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86Registers::ecx);
 
     // Allocate stack space for our arglist
@@ -1664,7 +1678,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     call(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
     
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
-#elif PLATFORM(X86)
+#elif CPU(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -1675,7 +1689,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
      * not the rest of the callframe so we need a nice way to ensure we increment the
      * stack pointer by the right amount after the call.
      */
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     struct NativeCallFrameStructure {
       //  CallFrame* callFrame; // passed in EDX
         JSObject* callee;
@@ -1728,7 +1742,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
@@ -1756,7 +1770,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     // Allocate stack space for our arglist
@@ -1780,7 +1794,30 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // push pointer to arguments
     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
 
-    // Setup arg3: regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+
+#if OS(WINCE)
+    // Setup arg3:
+    loadPtr(Address(regT1, -(int32_t)sizeof(Register)), ARMRegisters::r3);
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    // Setup arg0:
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(sizeof(Register)), stackPointerRegister);
+    storePtr(regT0, Address(stackPointerRegister));
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    loadPtr(Address(regT0), regT0);
+
+    addPtr(Imm32(sizeof(Register) + sizeof(ArgList)), stackPointerRegister);
+#else // OS(WINCE)
+    // Setup arg3:
     loadPtr(Address(regT1, -(int32_t)sizeof(Register)), regT2);
 
     // Setup arg2:
@@ -1790,11 +1827,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     move(callFrameRegister, regT0);
 
     // Setup arg4: This is a plain hack
-    move(stackPointerRegister, ARMRegisters::S0);
+    move(stackPointerRegister, ARMRegisters::r3);
 
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#endif // OS(WINCE)
 
 #elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
 #error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
@@ -1854,11 +1892,14 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     CodeRef finalCode = patchBuffer.finalizeCode();
     *executablePool = finalCode.m_executablePool;
 
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+    trampolines->ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    trampolines->ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    trampolines->ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    trampolines->ctiSoftModulo = trampolineAt(finalCode, softModBegin);
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+    trampolines->ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
@@ -1902,47 +1943,6 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
     RECORD_JUMP_TARGET(target);
 }
 
-void JIT::emit_op_loop(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target);
-}
-
-void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-    if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
-        int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
-    } else if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
-        int32_t op1imm = getConstantOperandImmediateInt(op1);
-#else
-        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
-#endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target);
-    } else {
-        emitGetVirtualRegisters(op1, regT0, op2, regT1);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThan, regT0, regT1), target);
-    }
-}
-
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 {
     emitTimeoutCheck();
@@ -1992,7 +1992,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
     // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -2153,7 +2153,7 @@ void JIT::emit_op_construct_verify(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
 
 }
 
@@ -2181,21 +2181,6 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned target = currentInstruction[2].u.operand;
-    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target);
-
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
-
-    isZero.link(this);
-};
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -2277,7 +2262,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
@@ -2298,7 +2283,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
@@ -2454,7 +2439,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
         isNotObject.append(emitJumpIfNotJSCell(regT0));
     if (base != m_codeBlock->thisRegister()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -2605,7 +2590,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
     
     wasImmediate.link(this);
 
@@ -2716,7 +2701,7 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    setTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    setTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
@@ -2741,7 +2726,7 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    setTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    setTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
@@ -2801,7 +2786,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    addSlowCase(branchTest32(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 
 }
 
@@ -2875,36 +2860,6 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubCall.call(dst);
 }
 
-void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-    if (isOperandConstantImmediateInt(op2)) {
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    } else if (isOperandConstantImmediateInt(op1)) {
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(regT0);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    } else {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    }
-}
-
 void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned op2 = currentInstruction[2].u.operand;
@@ -2945,15 +2900,6 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubPutByValCall.call();
 }
 
-void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    linkSlowCase(iter);
-    JITStubCall stubCall(this, cti_op_jtrue);
-    stubCall.addArgument(regT0);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
-}
-
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
@@ -3100,6 +3046,81 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
 
 #endif // USE(JSVALUE32_64)
 
+// For both JSValue32_64 and JSValue32
+#if ENABLE(JIT_OPTIMIZE_MOD)
+#if CPU(ARM_TRADITIONAL)
+void JIT::softModulo()
+{
+    push(regS0);
+    push(regS1);
+    push(regT1);
+    push(regT3);
+#if USE(JSVALUE32_64)
+    m_assembler.mov_r(regT3, regT2);
+    m_assembler.mov_r(regT2, regT0);
+#else
+    m_assembler.mov_r(regT3, m_assembler.asr(regT2, 1));
+    m_assembler.mov_r(regT2, m_assembler.asr(regT0, 1));
+#endif
+    m_assembler.mov_r(regT1, ARMAssembler::getOp2(0));
+    
+    m_assembler.teq_r(regT3, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT3, regT3, ARMAssembler::getOp2(0), ARMAssembler::MI);
+    m_assembler.eor_r(regT1, regT1, ARMAssembler::getOp2(1), ARMAssembler::MI);
+    
+    m_assembler.teq_r(regT2, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT2, regT2, ARMAssembler::getOp2(0), ARMAssembler::MI);
+    m_assembler.eor_r(regT1, regT1, ARMAssembler::getOp2(2), ARMAssembler::MI);
+    
+    Jump exitBranch = branch32(LessThan, regT2, regT3);
+
+    m_assembler.sub_r(regS1, regT3, ARMAssembler::getOp2(1));
+    m_assembler.tst_r(regS1, regT3);
+    m_assembler.and_r(regT2, regT2, regS1, ARMAssembler::EQ);
+    m_assembler.and_r(regT0, regS1, regT3);
+    Jump exitBranch2 = branchTest32(Zero, regT0);
+    
+    m_assembler.clz_r(regS1, regT2);
+    m_assembler.clz_r(regS0, regT3);
+    m_assembler.sub_r(regS0, regS0, regS1);
+
+    m_assembler.rsbs_r(regS0, regS0, ARMAssembler::getOp2(31));
+
+    m_assembler.mov_r(regS0, m_assembler.lsl(regS0, 1), ARMAssembler::NE);
+
+    m_assembler.add_r(ARMRegisters::pc, ARMRegisters::pc, m_assembler.lsl(regS0, 2), ARMAssembler::NE);
+    m_assembler.mov_r(regT0, regT0);
+    
+    for (int i = 31; i > 0; --i) {
+        m_assembler.cmp_r(regT2, m_assembler.lsl(regT3, i));
+        m_assembler.sub_r(regT2, regT2, m_assembler.lsl(regT3, i), ARMAssembler::CS);
+    }
+
+    m_assembler.cmp_r(regT2, regT3);
+    m_assembler.sub_r(regT2, regT2, regT3, ARMAssembler::CS);
+    
+    exitBranch.link(this);
+    exitBranch2.link(this);
+    
+    m_assembler.teq_r(regT1, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT2, regT2, ARMAssembler::getOp2(0), ARMAssembler::GT);
+    
+#if USE(JSVALUE32_64)
+    m_assembler.mov_r(regT0, regT2);
+#else
+    m_assembler.mov_r(regT0, m_assembler.lsl(regT2, 1));
+    m_assembler.eor_r(regT0, regT0, ARMAssembler::getOp2(1));
+#endif
+    pop(regT3);
+    pop(regT1);
+    pop(regS1);
+    pop(regS0);
+    ret();
+}
+#else
+#error "JIT_OPTIMIZE_MOD not yet supported on this platform."
+#endif // CPU(ARM_TRADITIONAL)
+#endif
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index bf367a6..3399f03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -24,11 +24,15 @@
  */
 
 #include "config.h"
+
+#if !USE(JSVALUE32_64)
+
 #include "JIT.h"
 
 #if ENABLE(JIT)
 
 #include "CodeBlock.h"
+#include "GetterSetter.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
@@ -48,958 +52,6 @@ using namespace std;
 
 namespace JSC {
 
-#if USE(JSVALUE32_64)
-
-void JIT::emit_op_put_by_index(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_index);
-    stubCall.addArgument(base);
-    stubCall.addArgument(Imm32(property));
-    stubCall.addArgument(value);
-    stubCall.call();
-}
-
-void JIT::emit_op_put_getter(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned function = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_getter);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.addArgument(function);
-    stubCall.call();
-}
-
-void JIT::emit_op_put_setter(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned function = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_setter);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.addArgument(function);
-    stubCall.call();
-}
-
-void JIT::emit_op_del_by_id(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_del_by_id);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.call(dst);
-}
-
-
-#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
-void JIT::emit_op_method_check(Instruction*) {}
-void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
-#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
-#endif
-
-void JIT::emit_op_get_by_val(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_put_by_val(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.addArgument(value);
-    stubCall.call();
-}
-
-void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_get_by_id(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_get_by_id_generic);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.call(dst);
-
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    m_propertyAccessInstructionIndex++;
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_put_by_id(Instruction* currentInstruction)
-{
-    int base = currentInstruction[1].u.operand;
-    int ident = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_id_generic);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.addArgument(value);
-    stubCall.call();
-
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    m_propertyAccessInstructionIndex++;
-    ASSERT_NOT_REACHED();
-}
-
-#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-
-void JIT::emit_op_method_check(Instruction* currentInstruction)
-{
-    // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
-
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-
-    // Do the method check - check the object & its prototype's structure inline (this is the common case).
-    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
-    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
-
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-
-    // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
-    move(Imm32(JSValue::CellTag), regT1);
-    Jump match = jump();
-
-    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
-    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
-    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
-
-    // Link the failure cases here.
-    structureCheck.link(this);
-    protoStructureCheck.link(this);
-
-    // Do a regular(ish) get_by_id (the slow case will be link to
-    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
-    compileGetByIdHotPath();
-
-    match.link(this);
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
-}
-
-void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
-}
-
-#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-
-// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
-void JIT::emit_op_method_check(Instruction*) {}
-void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
-
-#endif
-
-void JIT::emit_op_get_by_val(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    
-    emitLoad2(base, regT1, regT0, property, regT3, regT2);
-
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
-
-    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
-
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
-}
-
-void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    linkSlowCase(iter); // property int32 check
-    linkSlowCaseIfNotJSCell(iter, base); // base cell check
-    linkSlowCase(iter); // base array check
-    linkSlowCase(iter); // vector length check
-    linkSlowCase(iter); // empty value
-
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-void JIT::emit_op_put_by_val(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    emitLoad2(base, regT1, regT0, property, regT3, regT2);
-
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-
-    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
-
-    Label storeResult(this);
-    emitLoad(value, regT1, regT0);
-    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
-    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
-    Jump end = jump();
-
-    empty.link(this);
-    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
-    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
-
-    add32(Imm32(1), regT2, regT0);
-    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-    jump().linkTo(storeResult, this);
-
-    end.link(this);
-}
-
-void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    linkSlowCase(iter); // property int32 check
-    linkSlowCaseIfNotJSCell(iter, base); // base cell check
-    linkSlowCase(iter); // base not array check
-    linkSlowCase(iter); // in vector check
-
-    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
-    stubPutByValCall.addArgument(base);
-    stubPutByValCall.addArgument(property);
-    stubPutByValCall.addArgument(value);
-    stubPutByValCall.call();
-}
-
-void JIT::emit_op_get_by_id(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    compileGetByIdHotPath();
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
-}
-
-void JIT::compileGetByIdHotPath()
-{
-    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
-    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
-    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
-    // to jump back to if one of these trampolies finds a match.
-    Label hotPathBegin(this);
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
-    m_propertyAccessInstructionIndex++;
-
-    DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    addSlowCase(structureCheck);
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
-    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
-
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
-
-    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
-    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
-
-    Label putResult(this);
-    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
-}
-
-void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
-}
-
-void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
-{
-    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
-    // so that we only need track one pointer into the slow case code - we track a pointer to the location
-    // of the call (which we can use to look up the patch information), but should a array-length or
-    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
-    // the distance from the call to the head of the slow case.
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-
-    Label coldPathBegin(this);
-
-    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(ident));
-    Call call = stubCall.call(dst);
-
-    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
-
-    // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emit_op_put_by_id(Instruction* currentInstruction)
-{
-    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
-    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
-    // such that the Structure & offset are always at the same distance from this.
-
-    int base = currentInstruction[1].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    emitLoad2(base, regT1, regT0, value, regT3, regT2);
-
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-
-    Label hotPathBegin(this);
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
-    m_propertyAccessInstructionIndex++;
-
-    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
-    DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
-
-    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
-
-    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
-    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
-}
-
-void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    int base = currentInstruction[1].u.operand;
-    int ident = currentInstruction[2].u.operand;
-
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_put_by_id);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.addArgument(regT3, regT2); 
-    Call call = stubCall.call();
-
-    // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
-    m_propertyAccessInstructionIndex++;
-}
-
-// Compile a store into an object's property storage.  May overwrite base.
-void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
-{
-    int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitStore(offset, valueTag, valuePayload, base);
-}
-
-// Compile a load from an object's property storage.  May overwrite base.
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
-{
-    int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitLoad(offset, resultTag, resultPayload, base);
-}
-
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
-{
-    if (base->isUsingInlineStorage()) {
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
-        return;
-    }
-
-    size_t offset = cachedOffset * sizeof(JSValue);
-
-    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
-    load32(Address(temp, offset), resultPayload);
-    load32(Address(temp, offset + 4), resultTag);
-}
-
-void JIT::testPrototype(Structure* structure, JumpList& failureCases)
-{
-    if (structure->m_prototype.isNull())
-        return;
-
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
-}
-
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
-{
-    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
-
-    JumpList failureCases;
-    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
-    testPrototype(oldStructure, failureCases);
-
-    // Verify that nothing in the prototype chain has a setter for this property. 
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
-        testPrototype(it->get(), failureCases);
-
-    // Reallocate property storage if needed.
-    Call callTarget;
-    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
-    if (willNeedStorageRealloc) {
-        // This trampoline was called to like a JIT stub; before we can can call again we need to
-        // remove the return address from the stack, to prevent the stack from becoming misaligned.
-        preserveReturnAddressAfterCall(regT3);
- 
-        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
-        stubCall.skipArgument(); // base
-        stubCall.skipArgument(); // ident
-        stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
-        stubCall.call(regT0);
-
-        restoreReturnAddressBeforeReturn(regT3);
-    }
-
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
- 
-    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
-    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
-
-    // Write the value
-    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
-
-    ret();
-    
-    ASSERT(!failureCases.empty());
-    failureCases.link(this);
-    restoreArgumentReferenceForTrampoline();
-    Call failureCall = tailRecursiveCall();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
-
-    if (willNeedStorageRealloc) {
-        ASSERT(m_calls.size() == 1);
-        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
-    }
-    
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
-}
-
-void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
-    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
-
-    int offset = sizeof(JSValue) * cachedOffset;
-
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
-
-    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
-}
-
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
-
-    Structure* prototypeStructure = proto->structure();
-    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
-
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
-
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
-}
-
-void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
-
-    int offset = sizeof(JSValue) * cachedOffset;
-
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
-
-    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
-}
-
-void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
-{
-    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
-    
-    // regT0 holds a JSCell*
-
-    // Check for array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
-
-    // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
-
-    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
-    move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-    patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
-}
-
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-
-    Jump failureCases1 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
-#else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-#endif
-
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-    patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
-}
-
-
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
-{
-    // regT0 holds a JSCell*
-    
-    Jump failureCase = checkStructure(regT0, structure);
-    compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
-    if (!lastProtoBegin)
-        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-
-    patchBuffer.link(failureCase, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
-#else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-#endif
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
-    patchBuffer.link(failureCases1, lastProtoBegin);
-    patchBuffer.link(failureCases2, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
-
-    patchBuffer.link(bucketsOfFail, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    // Track the stub we have created so that it will be deleted later.
-    structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
-}
-
-/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
-{
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSValue) == 8);
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    finishedLoad.link(this);
-}
-
-void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    unsigned expected = currentInstruction[4].u.operand;
-    unsigned iter = currentInstruction[5].u.operand;
-    unsigned i = currentInstruction[6].u.operand;
-
-    emitLoad2(property, regT1, regT0, base, regT3, regT2);
-    emitJumpSlowCaseIfNotJSCell(property, regT1);
-    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
-    // Property registers are now available as the property is known
-    emitJumpSlowCaseIfNotJSCell(base, regT3);
-    emitLoadPayload(iter, regT1);
-    
-    // Test base's structure
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
-    load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
-    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
-
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
-}
-
-void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    
-    linkSlowCaseIfNotJSCell(iter, property);
-    linkSlowCase(iter);
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-#else // USE(JSVALUE32_64)
-
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
@@ -1031,6 +83,20 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     emitPutVirtualRegister(dst);
 }
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);
+    finishedLoad.link(this);
+}
+
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
@@ -1457,20 +523,6 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
-{
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
-    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);    
-    finishedLoad.link(this);
-}
-
 void JIT::testPrototype(Structure* structure, JumpList& failureCases)
 {
     if (structure->m_prototype.isNull())
@@ -1574,7 +626,6 @@ void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodC
     structure->ref();
 
     Structure* prototypeStructure = proto->structure();
-    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
     methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
     prototypeStructure->ref();
 
@@ -1645,7 +696,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -1656,18 +707,35 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     move(ImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
-
+    bool needsStubLink = false;
+    
+    // Checks out okay!
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
-
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -1678,6 +746,12 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
     // Track the stub we have created so that it will be deleted later.
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     stubInfo->stubRoutine = entryLabel;
@@ -1691,14 +765,43 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
 {
     Jump failureCase = checkStructure(regT0, structure);
-    compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        if (!structure->isUsingInlineStorage()) {
+            move(regT0, regT1);
+            compileGetDirectOffset(regT1, regT1, structure, cachedOffset);
+        } else
+            compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
     if (!lastProtoBegin)
@@ -1720,7 +823,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -1731,20 +834,45 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     move(ImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    // Checks out okay!
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
     patchBuffer.link(failureCases1, lastProtoBegin);
@@ -1765,10 +893,9 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
 {
     ASSERT(count);
-    
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
@@ -1784,7 +911,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         move(ImmPtr(currStructure), regT3);
         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
@@ -1792,11 +919,36 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 #endif
     }
     ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
@@ -1819,10 +971,10 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     ASSERT(count);
-    
+
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
@@ -1837,7 +989,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         move(ImmPtr(currStructure), regT3);
         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
@@ -1846,11 +998,36 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     }
     ASSERT(protoObject);
 
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
 
@@ -1874,8 +1051,8 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-#endif // USE(JSVALUE32_64)
-
 } // namespace JSC
 
 #endif // ENABLE(JIT)
+
+#endif // !USE(JSVALUE32_64)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
new file mode 100644
index 0000000..ec33026
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -0,0 +1,1145 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(JSVALUE32_64)
+
+#include "JIT.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "JITInlineMethods.h"
+#include "JITStubCall.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
+#include "Interpreter.h"
+#include "LinkBuffer.h"
+#include "RepatchBuffer.h"
+#include "ResultType.h"
+#include "SamplingTool.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+using namespace std;
+
+namespace JSC {
+    
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_index);
+    stubCall.addArgument(base);
+    stubCall.addArgument(Imm32(property));
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_getter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_setter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_del_by_id);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.call(dst);
+}
+
+
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_get_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.call(dst);
+    
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(value);
+    stubCall.call();
+    
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+    
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+    
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
+    move(Imm32(JSValue::CellTag), regT1);
+    Jump match = jump();
+    
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+    
+    // Link the failure cases here.
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+    
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath();
+    
+    match.link(this);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
+    
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
+    
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+    
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
+    
+    Label storeResult(this);
+    emitLoad(value, regT1, regT0);
+    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
+    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+    Jump end = jump();
+    
+    empty.link(this);
+    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+    
+    add32(Imm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+    
+    end.link(this);
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
+    
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(base);
+    stubPutByValCall.addArgument(property);
+    stubPutByValCall.addArgument(value);
+    stubPutByValCall.call();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    compileGetByIdHotPath();
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
+}
+
+void JIT::compileGetByIdHotPath()
+{
+    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
+    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
+    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
+    // to jump back to if one of these trampolies finds a match.
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+    
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+    
+    DataLabelPtr structureToCompare;
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    addSlowCase(structureCheck);
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
+    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
+    
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+    
+    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
+    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
+    
+    Label putResult(this);
+    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
+}
+
+void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
+{
+    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
+    // so that we only need track one pointer into the slow case code - we track a pointer to the location
+    // of the call (which we can use to look up the patch information), but should a array-length or
+    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
+    // the distance from the call to the head of the slow case.
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    
+#ifndef NDEBUG
+    Label coldPathBegin(this);
+#endif
+    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(dst);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    
+    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+    
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
+    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
+    // such that the Structure & offset are always at the same distance from this.
+    
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, value, regT3, regT2);
+    
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
+    
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+    
+    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
+    DataLabelPtr structureToCompare;
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
+    
+    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+    
+    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
+    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
+    
+    END_UNINTERRUPTED_SEQUENCE(sequencePutById);
+    
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_put_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(regT3, regT2); 
+    Call call = stubCall.call();
+    
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+// Compile a store into an object's property storage.  May overwrite base.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitStore(offset, valueTag, valuePayload, base);
+}
+
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitLoad(offset, resultTag, resultPayload, base);
+}
+
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage()) {
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
+        return;
+    }
+    
+    size_t offset = cachedOffset * sizeof(JSValue);
+    
+    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
+    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
+    load32(Address(temp, offset), resultPayload);
+    load32(Address(temp, offset + 4), resultTag);
+}
+
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+    
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
+{
+    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
+    
+    JumpList failureCases;
+    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    testPrototype(oldStructure, failureCases);
+    
+    // Verify that nothing in the prototype chain has a setter for this property. 
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
+    
+    // Reallocate property storage if needed.
+    Call callTarget;
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    if (willNeedStorageRealloc) {
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preserveReturnAddressAfterCall(regT3);
+        
+        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
+        stubCall.skipArgument(); // base
+        stubCall.skipArgument(); // ident
+        stubCall.skipArgument(); // value
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.call(regT0);
+        
+        restoreReturnAddressBeforeReturn(regT3);
+    }
+    
+    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
+    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
+    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+    
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
+    
+    // Write the value
+    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
+    
+    ret();
+    
+    ASSERT(!failureCases.empty());
+    failureCases.link(this);
+    restoreArgumentReferenceForTrampoline();
+    Call failureCall = tailRecursiveCall();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
+    
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
+    }
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
+}
+
+void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
+    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+    
+    int offset = sizeof(JSValue) * cachedOffset;
+    
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
+    
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+    
+    Structure* prototypeStructure = proto->structure();
+    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
+    prototypeStructure->ref();
+    
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
+    
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
+}
+
+void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
+    
+    int offset = sizeof(JSValue) * cachedOffset;
+    
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
+    
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
+{
+    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
+    
+    // regT0 holds a JSCell*
+    
+    // Check for array
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    
+    // Checks out okay! - get the length from the storage
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
+    
+    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
+    move(regT2, regT0);
+    move(Imm32(JSValue::Int32Tag), regT1);
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
+}
+
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+    
+    Jump failureCases1 = checkStructure(regT0, structure);
+    
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+    bool needsStubLink = false;
+    // Checks out okay!
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+{
+    // regT0 holds a JSCell*
+    Jump failureCase = checkStructure(regT0, structure);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        if (!structure->isUsingInlineStorage()) {
+            move(regT0, regT1);
+            compileGetDirectOffset(regT1, regT2, regT1, structure, cachedOffset);
+        } else
+            compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
+
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    if (!lastProtoBegin)
+        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    
+    patchBuffer.link(failureCase, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    structure->ref();
+    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+    
+    // Check eax is an object of the right Structure.
+    Jump failureCases1 = checkStructure(regT0, structure);
+    
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    patchBuffer.link(failureCases1, lastProtoBegin);
+    patchBuffer.link(failureCases2, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    structure->ref();
+    prototypeStructure->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+    
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+    
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+        
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    
+    patchBuffer.link(bucketsOfFail, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    // Track the stub we have created so that it will be deleted later.
+    structure->ref();
+    chain->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+    
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+    
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+        
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSValue) == 8);
+    
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    finishedLoad.link(this);
+}
+
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+    
+    emitLoad2(property, regT1, regT0, base, regT3, regT2);
+    emitJumpSlowCaseIfNotJSCell(property, regT1);
+    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
+    // Property registers are now available as the property is known
+    emitJumpSlowCaseIfNotJSCell(base, regT3);
+    emitLoadPayload(iter, regT1);
+    
+    // Test base's structure
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
+    
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, property);
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // ENABLE(JSVALUE32_64)
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index c5ed9e3..cfbd7dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -46,7 +46,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -54,7 +54,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(VoidPtr)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -62,7 +62,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -70,7 +70,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -78,7 +78,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Void)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -87,7 +87,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Value)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 #endif
@@ -145,7 +145,7 @@ namespace JSC {
 
         void getArgument(size_t argumentNumber, JIT::RegisterID tag, JIT::RegisterID payload)
         {
-            size_t stackIndex = stackIndexStart + (argumentNumber * stackIndexStep);
+            size_t stackIndex = JITSTACKFRAME_ARGS_INDEX + (argumentNumber * stackIndexStep);
             m_jit->peek(payload, stackIndex);
             m_jit->peek(tag, stackIndex + 1);
         }
@@ -222,7 +222,6 @@ namespace JSC {
 
     private:
         static const size_t stackIndexStep = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 2 : 1;
-        static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
         FunctionPtr m_stub;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 8385f92..23fcb96 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -38,6 +38,7 @@
 #include "Collector.h"
 #include "Debugger.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "GlobalEvalFunction.h"
 #include "JIT.h"
 #include "JSActivation.h"
@@ -56,6 +57,7 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include <wtf/StdLibExtras.h>
 #include <stdarg.h>
 #include <stdio.h>
 
@@ -63,31 +65,37 @@ using namespace std;
 
 namespace JSC {
 
-#if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
+#if OS(DARWIN) || OS(WINDOWS)
 #define SYMBOL_STRING(name) "_" #name
 #else
 #define SYMBOL_STRING(name) #name
 #endif
 
-#if PLATFORM(IPHONE)
+#if OS(IPHONE_OS)
 #define THUMB_FUNC_PARAM(name) SYMBOL_STRING(name)
 #else
 #define THUMB_FUNC_PARAM(name)
 #endif
 
-#if PLATFORM(LINUX) && PLATFORM(X86_64)
+#if OS(LINUX) && CPU(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
 #else
 #define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
 #endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // Mach-O platform
 #define HIDE_SYMBOL(name) ".private_extern _" #name
-#elif PLATFORM(AIX)
+#elif OS(AIX)
     // IBM's own file format
 #define HIDE_SYMBOL(name) ".lglobl " #name
-#elif PLATFORM(LINUX) || PLATFORM(FREEBSD) || PLATFORM(OPENBSD) || PLATFORM(SOLARIS) || (PLATFORM(HPUX) && PLATFORM(IA64)) || PLATFORM(SYMBIAN) || PLATFORM(NETBSD)
+#elif   OS(LINUX)               \
+     || OS(FREEBSD)             \
+     || OS(OPENBSD)             \
+     || OS(SOLARIS)             \
+     || (OS(HPUX) && CPU(IA64)) \
+     || OS(SYMBIAN)             \
+     || OS(NETBSD)
     // ELF platform
 #define HIDE_SYMBOL(name) ".hidden " #name
 #else
@@ -96,7 +104,7 @@ namespace JSC {
 
 #if USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && PLATFORM(X86)
+#if COMPILER(GCC) && CPU(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -105,57 +113,60 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x3c, JITStackFrame_s
 COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x58, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
 COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x50, JITStackFrame_code_offset_matches_ctiTrampoline);
 
-asm volatile (
-".text\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushl %ebp" "\n"
-    "movl %esp, %ebp" "\n"
-    "pushl %esi" "\n"
-    "pushl %edi" "\n"
-    "pushl %ebx" "\n"
-    "subl $0x3c, %esp" "\n"
-    "movl $512, %esi" "\n"
-    "movl 0x58(%esp), %edi" "\n"
-    "call *0x50(%esp)" "\n"
-    "addl $0x3c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-
-asm volatile (
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+static void __attribute__((used)) asm_wrapper()
+{
+    asm volatile (
+        ".text\n"
+        ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+        HIDE_SYMBOL(ctiTrampoline) "\n"
+        SYMBOL_STRING(ctiTrampoline) ":" "\n"
+        "pushl %ebp" "\n"
+        "movl %esp, %ebp" "\n"
+        "pushl %esi" "\n"
+        "pushl %edi" "\n"
+        "pushl %ebx" "\n"
+        "subl $0x3c, %esp" "\n"
+        "movl $512, %esi" "\n"
+        "movl 0x58(%esp), %edi" "\n"
+        "call *0x50(%esp)" "\n"
+        "addl $0x3c, %esp" "\n"
+        "popl %ebx" "\n"
+        "popl %edi" "\n"
+        "popl %esi" "\n"
+        "popl %ebp" "\n"
+        "ret" "\n"
+        );
+
+    asm volatile (
+        ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+        HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+        SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
-    "movl %esp, %ecx" "\n"
+        "movl %esp, %ecx" "\n"
 #endif
-    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "addl $0x3c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
+        "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+        "addl $0x3c, %esp" "\n"
+        "popl %ebx" "\n"
+        "popl %edi" "\n"
+        "popl %esi" "\n"
+        "popl %ebp" "\n"
+        "ret" "\n"
+        );
     
-asm volatile (
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "addl $0x3c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(GCC) && PLATFORM(X86_64)
+    asm volatile (
+        ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+        HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+        SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+        "addl $0x3c, %esp" "\n"
+        "popl %ebx" "\n"
+        "popl %edi" "\n"
+        "popl %esi" "\n"
+        "popl %ebp" "\n"
+        "ret" "\n"
+        );
+}
+
+#elif COMPILER(GCC) && CPU(X86_64)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
@@ -225,73 +236,28 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
+#elif COMPILER(GCC) && CPU(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x3c" "\n"
-    "str lr, [sp, #0x20]" "\n"
-    "str r4, [sp, #0x24]" "\n"
-    "str r5, [sp, #0x28]" "\n"
-    "str r6, [sp, #0x2c]" "\n"
-    "str r1, [sp, #0x30]" "\n"
-    "str r2, [sp, #0x34]" "\n"
-    "str r3, [sp, #0x38]" "\n"
-    "cpy r5, r2" "\n"
-    "mov r6, #512" "\n"
-    "blx r0" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET      0x3C
+#define PRESERVED_RETURN_ADDRESS_OFFSET  0x40
+#define PRESERVED_R4_OFFSET              0x44
+#define PRESERVED_R5_OFFSET              0x48
+#define PRESERVED_R6_OFFSET              0x4C
+#define REGISTER_FILE_OFFSET             0x50
+#define CALLFRAME_OFFSET                 0x54
+#define EXCEPTION_OFFSET                 0x58
+#define ENABLE_PROFILER_REFERENCE_OFFSET 0x64
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET 64
+#define PRESERVEDR4_OFFSET          68
 
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) && CPU(X86)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
@@ -355,11 +321,13 @@ extern "C" {
     }
 }
 
-#endif // COMPILER(GCC) && PLATFORM(X86)
+#else
+    #error "JIT not supported on this platform."
+#endif
 
 #else // USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && PLATFORM(X86)
+#if COMPILER(GCC) && CPU(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -417,7 +385,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
     
-#elif COMPILER(GCC) && PLATFORM(X86_64)
+#elif COMPILER(GCC) && CPU(X86_64)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
@@ -494,111 +462,67 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
+#elif COMPILER(GCC) && CPU(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x40" "\n"
-    "str lr, [sp, #0x20]" "\n"
-    "str r4, [sp, #0x24]" "\n"
-    "str r5, [sp, #0x28]" "\n"
-    "str r6, [sp, #0x2c]" "\n"
-    "str r1, [sp, #0x30]" "\n"
-    "str r2, [sp, #0x34]" "\n"
-    "str r3, [sp, #0x38]" "\n"
-    "cpy r5, r2" "\n"
-    "mov r6, #512" "\n"
-    "blx r0" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x40" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET      0x1C
+#define PRESERVED_RETURN_ADDRESS_OFFSET  0x20
+#define PRESERVED_R4_OFFSET              0x24
+#define PRESERVED_R5_OFFSET              0x28
+#define PRESERVED_R6_OFFSET              0x2C
+#define REGISTER_FILE_OFFSET             0x30
+#define CALLFRAME_OFFSET                 0x34
+#define EXCEPTION_OFFSET                 0x38
+#define ENABLE_PROFILER_REFERENCE_OFFSET 0x40
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x40" "\n"
-    "bx lr" "\n"
-);
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET 32
+#define PRESERVEDR4_OFFSET          36
 
-#elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
+#elif COMPILER(RVCT) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "stmdb sp!, {r1-r3}" "\n"
-    "stmdb sp!, {r4-r8, lr}" "\n"
-    "sub sp, sp, #36" "\n"
-    "mov r4, r2" "\n"
-    "mov r5, #512" "\n"
-    "mov lr, pc" "\n"
-    "mov pc, r0" "\n"
-    "add sp, sp, #36" "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
-    "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
-);
+__asm EncodedJSValue ctiTrampoline(void*, RegisterFile*, CallFrame*, JSValue*, Profiler**, JSGlobalData*)
+{
+    ARM
+    stmdb sp!, {r1-r3}
+    stmdb sp!, {r4-r8, lr}
+    sub sp, sp, #36
+    mov r4, r2
+    mov r5, #512
+    mov lr, pc
+    bx r0
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-asm volatile (
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "mov r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+__asm void ctiVMThrowTrampoline()
+{
+    ARM
+    PRESERVE8
+    mov r0, sp
+    bl cti_vm_throw
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-// Both has the same return sequence
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "add sp, sp, #36" "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
-    "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
-);
+__asm void ctiOpThrowNotCaught()
+{
+    ARM
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) && CPU(X86)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
@@ -661,10 +585,114 @@ extern "C" {
      }
 }
 
-#endif // COMPILER(GCC) && PLATFORM(X86)
+#else
+    #error "JIT not supported on this platform."
+#endif
 
 #endif // USE(JSVALUE32_64)
 
+#if COMPILER(GCC) && CPU(ARM_THUMB2)
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "sub sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "str lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "str r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "str r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "str r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "str r1, [sp, #" STRINGIZE_VALUE_OF(REGISTER_FILE_OFFSET) "]" "\n"
+    "str r2, [sp, #" STRINGIZE_VALUE_OF(CALLFRAME_OFFSET) "]" "\n"
+    "str r3, [sp, #" STRINGIZE_VALUE_OF(EXCEPTION_OFFSET) "]" "\n"
+    "cpy r5, r2" "\n"
+    "mov r6, #512" "\n"
+    "blx r0" "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "cpy r0, sp" "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
+
+asm volatile(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "stmdb sp!, {r1-r3}" "\n"
+    "stmdb sp!, {r4-r8, lr}" "\n"
+    "sub sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "mov r4, r2" "\n"
+    "mov r5, #512" "\n"
+    // r0 contains the code
+    "mov lr, pc" "\n"
+    "mov pc, r0" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+asm volatile(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+
+// Both has the same return sequence
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+#endif
+
 #if ENABLE(OPCODE_SAMPLING)
     #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
 #else
@@ -673,24 +701,30 @@ extern "C" {
 
 JITThunks::JITThunks(JSGlobalData* globalData)
 {
-    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_trampolineStructure);
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
     // and the OBJECT_OFFSETOF macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT
     // macros.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == 0x20);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == 0x24);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == 0x28);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == 0x2c);
-
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == 0x30);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == 0x34);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == 0x38);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == PRESERVED_RETURN_ADDRESS_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == PRESERVED_R4_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == PRESERVED_R5_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == PRESERVED_R6_OFFSET);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == REGISTER_FILE_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == CALLFRAME_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == EXCEPTION_OFFSET);
     // The fifth argument is the first item already on the stack.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x40);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == ENABLE_PROFILER_REFERENCE_OFFSET);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
+
+#elif CPU(ARM_TRADITIONAL)
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == PRESERVEDR4_OFFSET);
 
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == 0x1C);
 #endif
 }
 
@@ -790,8 +824,10 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
         stubInfo->initGetByIdSelf(structure);
-
-        JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
+        if (slot.cachedPropertyType() != PropertySlot::Value)
+            ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+        else
+            JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
         return;
     }
 
@@ -804,19 +840,25 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         ASSERT(slot.slotBase().isObject());
 
         JSObject* slotBaseObject = asObject(slot.slotBase());
-
+        size_t offset = slot.cachedOffset();
+        
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject();
+            offset = slotBaseObject->structure()->get(propertyName);
+        }
         
         stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
 
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
+        ASSERT(!structure->isDictionary());
+        ASSERT(!slotBaseObject->structure()->isDictionary());
+        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), propertyName, slot, offset, returnAddress);
         return;
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
@@ -824,7 +866,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
     stubInfo->initGetByIdChain(structure, prototypeChain);
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
+    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
 }
 
 #endif // ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
@@ -920,7 +962,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         } \
     } while (0)
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -934,14 +976,14 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".thumb" "\n" \
         ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #0x1c]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #0x1c]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bx lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
 
-#elif PLATFORM(ARM_TRADITIONAL) && COMPILER(GCC)
+#elif CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -950,13 +992,39 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
     asm volatile ( \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #32]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #32]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "mov pc, lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
+#elif CPU(ARM_TRADITIONAL) && COMPILER(RVCT)
+
+#define DEFINE_STUB_FUNCTION(rtype, op) rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
+
+/* The following is a workaround for RVCT toolchain; precompiler macros are not expanded before the code is passed to the assembler */
+
+/* The following section is a template to generate code for GeneratedJITStubs_RVCT.h */
+/* The pattern "#xxx#" will be replaced with "xxx" */
+
+/*
+RVCT(extern "C" #rtype# JITStubThunked_#op#(STUB_ARGS_DECLARATION);)
+RVCT(__asm #rtype# cti_#op#(STUB_ARGS_DECLARATION))
+RVCT({)
+RVCT(    ARM)
+RVCT(    IMPORT JITStubThunked_#op#)
+RVCT(    str lr, [sp, ##offset#])
+RVCT(    bl JITStubThunked_#op#)
+RVCT(    ldr lr, [sp, ##offset#])
+RVCT(    bx lr)
+RVCT(})
+RVCT()
+*/
+
+/* Include the generated file */
+#include "GeneratedJITStubs_RVCT.h"
+
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
@@ -988,38 +1056,19 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 
     JSValue v1 = stackFrame.args[0].jsValue();
     JSValue v2 = stackFrame.args[1].jsValue();
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = v2.getNumber(right);
-    if (rightIsNumber && v1.getNumber(left))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
-    
     CallFrame* callFrame = stackFrame.callFrame;
 
-    bool leftIsString = v1.isString();
-    if (leftIsString && v2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    if (v1.isString()) {
+        JSValue result = v2.isString()
+            ? jsString(callFrame, asString(v1), asString(v2))
+            : jsString(callFrame, asString(v1), v2.toPrimitiveString(callFrame));
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
     }
 
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = v2.isInt32() ?
-            concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
-    }
+    double left = 0.0, right;
+    if (v1.getNumber(left) && v2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
 
     // All other cases are pretty uncommon
     JSValue result = jsAddSlowCase(callFrame, v1, v2);
@@ -1068,19 +1117,6 @@ DEFINE_STUB_FUNCTION(void, register_file_check)
     throwStackOverflowError(oldCallFrame, stackFrame.globalData, ReturnAddressPtr(oldCallFrame->returnPC()), STUB_RETURN_ADDRESS);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_less)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
 DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1197,7 +1233,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     // If we successfully got something, then the base from which it is being accessed must
     // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
     // an isCacheable() chceck.
-    ASSERT(!slot.isCacheable() || slot.slotBase().isObject());
+    ASSERT(!slot.isCacheableValue() || slot.slotBase().isObject());
 
     // Check that:
     //   * We're dealing with a JSCell,
@@ -1208,7 +1244,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSCell* specific;
     JSObject* slotBaseObject;
     if (baseValue.isCell()
-        && slot.isCacheable()
+        && slot.isCacheableValue()
         && !(structure = asCell(baseValue)->structure())->isUncacheableDictionary()
         && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
         && specific
@@ -1219,7 +1255,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+            slotBaseObject->flattenDictionaryObject();
 
         // The result fetched should always be the callee!
         ASSERT(result == JSValue(callee));
@@ -1297,17 +1333,18 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
         if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
             polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
-            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
+            stubInfo->initGetByIdSelfList(polymorphicStructureList, 1);
         } else {
             polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
             listIndex = stubInfo->u.getByIdSelfList.listSize;
-            stubInfo->u.getByIdSelfList.listSize++;
         }
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
+            stubInfo->u.getByIdSelfList.listSize++;
+            JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset());
 
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+            if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+                ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+        }
     } else
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
     return JSValue::encode(result);
@@ -1332,29 +1369,62 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str
     case access_get_by_id_proto_list:
         prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
         listIndex = stubInfo->u.getByIdProtoList.listSize;
-        stubInfo->u.getByIdProtoList.listSize++;
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE)
+            stubInfo->u.getByIdProtoList.listSize++;
         break;
     default:
         ASSERT_NOT_REACHED();
     }
     
-    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
+    ASSERT(listIndex <= POLYMORPHIC_LIST_CACHE_SIZE);
     return prototypeStructureList;
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_getter_stub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    GetterSetter* getterSetter = asGetterSetter(stackFrame.args[0].jsObject());
+    if (!getterSetter->getter())
+        return JSValue::encode(jsUndefined());
+    JSObject* getter = asObject(getterSetter->getter());
+    CallData callData;
+    CallType callType = getter->getCallData(callData);
+    JSValue result = call(callFrame, getter, callType, callData, stackFrame.args[1].jsObject(), ArgList());
+    if (callFrame->hadException())
+        returnToThrowTrampoline(&callFrame->globalData(), stackFrame.args[2].returnAddress(), STUB_RETURN_ADDRESS);
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_custom_stub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSObject* slotBase = stackFrame.args[0].jsObject();
+    PropertySlot::GetValueFunc getter = reinterpret_cast<PropertySlot::GetValueFunc>(stackFrame.args[1].asPointer);
+    const Identifier& ident = stackFrame.args[2].identifier();
+    JSValue result = getter(callFrame, slotBase, ident);
+    if (callFrame->hadException())
+        returnToThrowTrampoline(&callFrame->globalData(), stackFrame.args[3].returnAddress(), STUB_RETURN_ADDRESS);
+    
+    return JSValue::encode(result);
+}
+
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
+    const Identifier& propertyName = stackFrame.args[1].identifier();
 
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
+    JSValue result = baseValue.get(callFrame, propertyName, slot);
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isUncacheableDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
@@ -1365,31 +1435,40 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     ASSERT(slot.slotBase().isObject());
     JSObject* slotBaseObject = asObject(slot.slotBase());
+    
+    size_t offset = slot.cachedOffset();
 
     if (slot.slotBase() == baseValue)
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
     else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject();
+            offset = slotBaseObject->structure()->get(propertyName);
+        }
 
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
+            JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
+            if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+                ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+        }
+    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
+            StructureChain* protoChain = structure->prototypeChain(callFrame);
+            JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
 
-        StructureChain* protoChain = structure->prototypeChain(callFrame);
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+            if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+                ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+        }
     } else
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
 
@@ -1531,7 +1610,7 @@ DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     CallData callData;
     ASSERT(stackFrame.args[0].jsValue().getCallData(callData) == CallTypeJS);
 #endif
@@ -1780,7 +1859,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
         VM_THROW_EXCEPTION();
     }
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     ConstructData constructData;
     ASSERT(constructor->getConstructData(constructData) == ConstructTypeJS);
 #endif
@@ -1850,7 +1929,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
         } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
@@ -1881,7 +1960,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
     if (LIKELY(subscript.isUInt32())) {
         uint32_t i = subscript.asUInt32();
         if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         else {
             result = baseValue.get(callFrame, i);
             if (!isJSString(globalData, baseValue))
@@ -2046,19 +2125,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_true)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = src1.toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-    
 DEFINE_STUB_FUNCTION(int, op_load_varargs)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2071,6 +2137,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
     if (!arguments) {
         int providedParams = callFrame->registers()[RegisterFile::ArgumentCount].i() - 1;
         argCount = providedParams;
+        argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
         int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
         Register* newEnd = callFrame->registers() + sizeDelta;
         if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2106,6 +2173,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
         if (asObject(arguments)->classInfo() == &Arguments::info) {
             Arguments* argsObject = asArguments(arguments);
             argCount = argsObject->numProvidedArguments(callFrame);
+            argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2116,6 +2184,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
         } else if (isJSArray(&callFrame->globalData(), arguments)) {
             JSArray* array = asArray(arguments);
             argCount = array->length();
+            argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2126,6 +2195,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
         } else if (asObject(arguments)->inherits(&JSArray::info)) {
             JSObject* argObject = asObject(arguments);
             argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+            argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2217,7 +2287,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)
                 globalResolveInfo.structure->deref();
@@ -2333,8 +2403,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
     return JSValue::encode(number);
 }
 
-#if USE(JSVALUE32_64)
-
 DEFINE_STUB_FUNCTION(int, op_eq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2342,6 +2410,7 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
+#if USE(JSVALUE32_64)
     start:
     if (src2.isUndefined()) {
         return src1.isNull() || 
@@ -2397,20 +2466,20 @@ DEFINE_STUB_FUNCTION(int, op_eq)
 
     if (cell1->isString()) {
         if (src2.isInt32())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asInt32();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asInt32();
             
         if (src2.isDouble())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asDouble();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asDouble();
 
         if (src2.isTrue())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 1.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 1.0;
 
         if (src2.isFalse())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 0.0;
 
         JSCell* cell2 = asCell(src2);
         if (cell2->isString())
-            return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame) == static_cast<JSString*>(cell2)->value(stackFrame.callFrame);
 
         src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
         CHECK_FOR_EXCEPTION();
@@ -2422,10 +2491,19 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     src1 = asObject(cell1)->toPrimitive(stackFrame.callFrame);
     CHECK_FOR_EXCEPTION();
     goto start;
+    
+#else // USE(JSVALUE32_64)
+    CallFrame* callFrame = stackFrame.callFrame;
+    
+    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+#endif // USE(JSVALUE32_64)
 }
 
 DEFINE_STUB_FUNCTION(int, op_eq_strings)
 {
+#if USE(JSVALUE32_64)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     JSString* string1 = stackFrame.args[0].jsString();
@@ -2433,27 +2511,14 @@ DEFINE_STUB_FUNCTION(int, op_eq_strings)
 
     ASSERT(string1->isString());
     ASSERT(string2->isString());
-    return string1->value() == string2->value();
-}
-
-#else // USE(JSVALUE32_64)
-
-DEFINE_STUB_FUNCTION(int, op_eq)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
+    return string1->value(stackFrame.callFrame) == string2->value(stackFrame.callFrame);
+#else
+    UNUSED_PARAM(args);
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
 }
 
-#endif // USE(JSVALUE32_64)
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2731,7 +2796,7 @@ DEFINE_STUB_FUNCTION(int, has_property)
 
     JSObject* base = stackFrame.args[0].jsObject();
     JSString* property = stackFrame.args[1].jsString();
-    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value(stackFrame.callFrame)));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -2808,7 +2873,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
@@ -2822,7 +2887,9 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+    JSValue result = jsString(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
@@ -2832,7 +2899,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
@@ -2941,9 +3008,9 @@ DEFINE_STUB_FUNCTION(void*, op_switch_char)
     void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        if (value->size() == 1)
-            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).executableAddress();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
+        if (value->length() == 1)
+            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->characters()[0]).executableAddress();
     }
 
     return result;
@@ -2961,7 +3028,7 @@ DEFINE_STUB_FUNCTION(void*, op_switch_string)
     void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
         result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).executableAddress();
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 69776cb..cf3a7f8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -29,8 +29,6 @@
 #ifndef JITStubs_h
 #define JITStubs_h
 
-#include <wtf/Platform.h>
-
 #include "MacroAssemblerCodeRef.h"
 #include "Register.h"
 
@@ -74,8 +72,16 @@ namespace JSC {
         JSString* jsString() { return static_cast<JSString*>(asPointer); }
         ReturnAddressPtr returnAddress() { return ReturnAddressPtr(asPointer); }
     };
+    
+    struct TrampolineStructure {
+        MacroAssemblerCodePtr ctiStringLengthTrampoline;
+        MacroAssemblerCodePtr ctiVirtualCallLink;
+        MacroAssemblerCodePtr ctiVirtualCall;
+        MacroAssemblerCodePtr ctiNativeCallThunk;
+        MacroAssemblerCodePtr ctiSoftModulo;
+    };
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -99,11 +105,11 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
-#elif PLATFORM(X86)
-#if COMPILER(MSVC)
+#elif CPU(X86)
+#if COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
 #pragma pack(push)
 #pragma pack(4)
-#endif // COMPILER(MSVC)
+#endif // COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -127,10 +133,10 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
-#if COMPILER(MSVC)
+#if COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
 #pragma pack(pop)
-#endif // COMPILER(MSVC)
-#elif PLATFORM(ARM_THUMB2)
+#endif // COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
+#elif CPU(ARM_THUMB2)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -158,7 +164,7 @@ namespace JSC {
         
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
     struct JITStackFrame {
         JITStubArg padding; // Unused
         JITStubArg args[7];
@@ -187,6 +193,8 @@ namespace JSC {
 #error "JITStackFrame not defined for this platform."
 #endif
 
+#define JITSTACKFRAME_ARGS_INDEX (OBJECT_OFFSETOF(JITStackFrame, args) / sizeof(void*))
+
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
     #define STUB_ARGS_DECLARATION void* args, ...
     #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
@@ -200,16 +208,16 @@ namespace JSC {
     #define STUB_ARGS_DECLARATION void** args
     #define STUB_ARGS (args)
 
-    #if PLATFORM(X86) && COMPILER(MSVC)
+    #if CPU(X86) && COMPILER(MSVC)
     #define JIT_STUB __fastcall
-    #elif PLATFORM(X86) && COMPILER(GCC)
+    #elif CPU(X86) && COMPILER(GCC)
     #define JIT_STUB  __attribute__ ((fastcall))
     #else
     #define JIT_STUB
     #endif
 #endif
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     struct VoidPtrPair {
         void* first;
         void* second;
@@ -237,18 +245,16 @@ namespace JSC {
         static void tryCacheGetByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&, StructureStubInfo* stubInfo);
         static void tryCachePutByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot&, StructureStubInfo* stubInfo);
 
-        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
-        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
-        MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
-        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
+        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_trampolineStructure.ctiStringLengthTrampoline; }
+        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_trampolineStructure.ctiVirtualCallLink; }
+        MacroAssemblerCodePtr ctiVirtualCall() { return m_trampolineStructure.ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_trampolineStructure.ctiNativeCallThunk; }
+        MacroAssemblerCodePtr ctiSoftModulo() { return m_trampolineStructure.ctiSoftModulo; }
 
     private:
         RefPtr<ExecutablePool> m_executablePool;
 
-        MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
-        MacroAssemblerCodePtr m_ctiVirtualCallLink;
-        MacroAssemblerCodePtr m_ctiVirtualCall;
-        MacroAssemblerCodePtr m_ctiNativeCallThunk;
+        TrampolineStructure m_trampolineStructure;
     };
 
 extern "C" {
@@ -268,6 +274,8 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
@@ -326,16 +334,12 @@ extern "C" {
     JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
     VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
-#if USE(JSVALUE32_64)
     int JIT_STUB cti_op_eq_strings(STUB_ARGS_DECLARATION);
-#endif
     int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index b6bc0aa..252fb96 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -37,7 +37,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 #include <unistd.h>
 #endif
 
@@ -54,10 +54,10 @@
 #include <signal.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
 #include <crtdbg.h>
-#include <windows.h>
 #include <mmsystem.h>
+#include <windows.h>
 #endif
 
 #if PLATFORM(QT)
@@ -88,8 +88,8 @@ static JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*, JSObject*, J
 
 struct Script {
     bool isFile;
-    char *argument;
-    
+    char* argument;
+
     Script(bool isFile, char *argument)
         : isFile(isFile)
         , argument(argument)
@@ -174,12 +174,12 @@ GlobalObject::GlobalObject(const Vector<UString>& arguments)
 JSValue JSC_HOST_CALL functionPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     for (unsigned i = 0; i < args.size(); ++i) {
-        if (i != 0)
+        if (i)
             putchar(' ');
-        
+
         printf("%s", args.at(i).toString(exec).UTF8String().c_str());
     }
-    
+
     putchar('\n');
     fflush(stdout);
     return jsUndefined();
@@ -194,7 +194,7 @@ JSValue JSC_HOST_CALL functionDebug(ExecState* exec, JSObject*, JSValue, const A
 JSValue JSC_HOST_CALL functionGC(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     JSLock lock(SilenceAssertionsOnly);
-    exec->heap()->collect();
+    exec->heap()->collectAllGarbage();
     return jsUndefined();
 }
 
@@ -292,8 +292,18 @@ JSValue JSC_HOST_CALL functionReadline(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
+    // Technically, destroying the heap in the middle of JS execution is a no-no,
+    // but we want to maintain compatibility with the Mozilla test suite, so
+    // we pretend that execution has terminated to avoid ASSERTs, then tear down the heap.
+    exec->globalData().dynamicGlobalObject = 0;
+
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);
+
+#if COMPILER(MSVC) && OS(WINCE)
+    // Without this, Visual Studio will complain that this method does not return a value.
+    return jsUndefined();
+#endif
 }
 
 // Use SEH for Release builds only to get rid of the crash report dialog
@@ -313,7 +323,7 @@ int jscmain(int argc, char** argv, JSGlobalData*);
 
 int main(int argc, char** argv)
 {
-#if defined(_DEBUG) && PLATFORM(WIN_OS)
+#if defined(_DEBUG) && OS(WINDOWS)
     _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
     _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
     _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
@@ -322,7 +332,7 @@ int main(int argc, char** argv)
     _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
     timeBeginPeriod(1);
 #endif
 
@@ -463,30 +473,27 @@ static void parseArguments(int argc, char** argv, Options& options, JSGlobalData
     int i = 1;
     for (; i < argc; ++i) {
         const char* arg = argv[i];
-        if (strcmp(arg, "-f") == 0) {
+        if (!strcmp(arg, "-f")) {
             if (++i == argc)
                 printUsageStatement(globalData);
             options.scripts.append(Script(true, argv[i]));
             continue;
         }
-        if (strcmp(arg, "-e") == 0) {
+        if (!strcmp(arg, "-e")) {
             if (++i == argc)
                 printUsageStatement(globalData);
             options.scripts.append(Script(false, argv[i]));
             continue;
         }
-        if (strcmp(arg, "-h") == 0 || strcmp(arg, "--help") == 0) {
-            printUsageStatement(globalData, true);
-        }
-        if (strcmp(arg, "-i") == 0) {
+        if (!strcmp(arg, "-i")) {
             options.interactive = true;
             continue;
         }
-        if (strcmp(arg, "-d") == 0) {
+        if (!strcmp(arg, "-d")) {
             options.dump = true;
             continue;
         }
-        if (strcmp(arg, "-s") == 0) {
+        if (!strcmp(arg, "-s")) {
 #if HAVE(SIGNAL_H)
             signal(SIGILL, _exit);
             signal(SIGFPE, _exit);
@@ -495,16 +502,18 @@ static void parseArguments(int argc, char** argv, Options& options, JSGlobalData
 #endif
             continue;
         }
-        if (strcmp(arg, "--") == 0) {
+        if (!strcmp(arg, "--")) {
             ++i;
             break;
         }
+        if (!strcmp(arg, "-h") || !strcmp(arg, "--help"))
+            printUsageStatement(globalData, true);
         options.scripts.append(Script(true, argv[i]));
     }
-    
+
     if (options.scripts.isEmpty())
         options.interactive = true;
-    
+
     for (; i < argc; ++i)
         options.arguments.append(argv[i]);
 }
@@ -532,20 +541,20 @@ static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>&
         return false;
     }
 
-    size_t buffer_size = 0;
-    size_t buffer_capacity = 1024;
+    size_t bufferSize = 0;
+    size_t bufferCapacity = 1024;
 
-    buffer.resize(buffer_capacity);
+    buffer.resize(bufferCapacity);
 
     while (!feof(f) && !ferror(f)) {
-        buffer_size += fread(buffer.data() + buffer_size, 1, buffer_capacity - buffer_size, f);
-        if (buffer_size == buffer_capacity) { // guarantees space for trailing '\0'
-            buffer_capacity *= 2;
-            buffer.resize(buffer_capacity);
+        bufferSize += fread(buffer.data() + bufferSize, 1, bufferCapacity - bufferSize, f);
+        if (bufferSize == bufferCapacity) { // guarantees space for trailing '\0'
+            bufferCapacity *= 2;
+            buffer.resize(bufferCapacity);
         }
     }
     fclose(f);
-    buffer[buffer_size] = '\0';
+    buffer[bufferSize] = '\0';
 
     return true;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp b/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp
new file mode 100644
index 0000000..17800d0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2009 Patrick Gansterer (paroga@paroga.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Vector.h"
+#include <winbase.h>
+#include <winnls.h>
+#include <wtf/UnusedParam.h>
+
+int main(int argc, char** argv);
+
+static inline char* convertToUtf8(LPCWSTR widecharString, int length)
+{
+    int requiredSize = WideCharToMultiByte(CP_UTF8, 0, widecharString, length, 0, 0, 0, 0);
+    char* multibyteString = new char[requiredSize + 1];
+
+    WideCharToMultiByte(CP_UTF8, 0, widecharString, length, multibyteString, requiredSize, 0, 0);
+    multibyteString[requiredSize] = '\0';
+
+    return multibyteString;
+}
+
+int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nCmdShow)
+{
+    UNUSED_PARAM(hInstance);
+    UNUSED_PARAM(hPrevInstance);
+    UNUSED_PARAM(nCmdShow);
+
+    Vector<char*> arguments;
+    TCHAR buffer[MAX_PATH];
+
+    int length = GetModuleFileNameW(0, buffer, MAX_PATH);
+    arguments.append(convertToUtf8(buffer, length));
+
+    WCHAR* commandLine = lpCmdLine;
+    while (commandLine[0] != '\0') {
+        int commandLineLength = 1;
+        WCHAR endChar = ' ';
+
+        while (commandLine[0] == ' ')
+            ++commandLine;
+
+        if (commandLine[0] == '\"') {
+            ++commandLine;
+            endChar = '\"';
+        }
+
+        while (commandLine[commandLineLength] != endChar && commandLine[commandLineLength] != '\0')
+            ++commandLineLength;
+
+        arguments.append(convertToUtf8(commandLine, commandLineLength));
+
+        commandLine += commandLineLength;
+        if (endChar != ' ' && commandLine[0] != '\0')
+            ++commandLine;
+    }
+
+    int res = main(arguments.size(), arguments.data());
+
+    for (size_t i = 0; i < arguments.size(); i++)
+        delete arguments[i];
+
+    return res;
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 6d953df..4d6e7d1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -43,7 +43,7 @@
 // Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Avoid triggering warnings in older bison by not setting this on the Darwin platform.
 // FIXME: Is this still needed?
 #define YYERROR_VERBOSE
@@ -1987,12 +1987,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index df30838..83f56bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -39,10 +39,7 @@ using namespace Unicode;
 // We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
-#ifndef KDE_USE_FINAL
 #include "Grammar.h"
-#endif
-
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
@@ -642,6 +639,8 @@ inStringEscapeSequence:
         shiftLineTerminator();
         goto inString;
     }
+    if (m_current == -1)
+        goto returnError;
     record16(singleEscape(m_current));
     shift1();
     goto inString;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 45009dc..4b97e9a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -49,63 +49,6 @@ using namespace WTF;
 
 namespace JSC {
 
-/*
-    Details of the emitBytecode function.
-
-    Return value: The register holding the production's value.
-             dst: An optional parameter specifying the most efficient destination at
-                  which to store the production's value. The callee must honor dst.
-
-    The dst argument provides for a crude form of copy propagation. For example,
-
-        x = 1
-
-    becomes
-    
-        load r[x], 1
-    
-    instead of 
-
-        load r0, 1
-        mov r[x], r0
-    
-    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
-*/
-
-// ------------------------------ ThrowableExpressionData --------------------------------
-
-static void substitute(UString& string, const UString& substring)
-{
-    int position = string.find("%s");
-    ASSERT(position != -1);
-    UString newString = string.substr(0, position);
-    newString.append(substring);
-    newString.append(string.substr(position + 2));
-    string = newString;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
-{
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
-{
-    UString message = messageTemplate;
-    substitute(message, label);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
-{
-    return emitThrowError(generator, type, messageTemplate, label.ustring());
-}
 
 // ------------------------------ StatementNode --------------------------------
 
@@ -130,1753 +73,6 @@ inline StatementNode* SourceElements::singleStatement() const
     return size == 1 ? m_statements[0] : 0;
 }
 
-inline StatementNode* SourceElements::lastStatement() const
-{
-    size_t size = m_statements.size();
-    return size ? m_statements[size - 1] : 0;
-}
-
-// ------------------------------ NullNode -------------------------------------
-
-RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, jsNull());
-}
-
-// ------------------------------ BooleanNode ----------------------------------
-
-RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ NumberNode -----------------------------------
-
-RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ StringNode -----------------------------------
-
-RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ RegExpNode -----------------------------------
-
-RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
-    if (!regExp->isValid())
-        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
-}
-
-// ------------------------------ ThisNode -------------------------------------
-
-RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
-}
-
-// ------------------------------ ResolveNode ----------------------------------
-
-bool ResolveNode::isPure(BytecodeGenerator& generator) const
-{
-    return generator.isLocal(m_ident);
-}
-
-RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-    
-    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
-    return generator.emitResolve(generator.finalDestination(dst), m_ident);
-}
-
-// ------------------------------ ArrayNode ------------------------------------
-
-RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // FIXME: Should we put all of this code into emitNewArray?
-
-    unsigned length = 0;
-    ElementNode* firstPutElement;
-    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
-        if (firstPutElement->elision())
-            break;
-        ++length;
-    }
-
-    if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element);
-
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
-
-    for (ElementNode* n = firstPutElement; n; n = n->next()) {
-        RegisterID* value = generator.emitNode(n->value());
-        length += n->elision();
-        generator.emitPutByIndex(array.get(), length++, value);
-    }
-
-    if (m_elision) {
-        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
-        generator.emitPutById(array.get(), generator.propertyNames().length, value);
-    }
-
-    return generator.moveToDestinationIfNeeded(dst, array.get());
-}
-
-bool ArrayNode::isSimpleArray() const
-{
-    if (m_elision || m_optional)
-        return false;
-    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
-        if (ptr->elision())
-            return false;
-    }
-    return true;
-}
-
-ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
-{
-    ASSERT(!m_elision && !m_optional);
-    ElementNode* ptr = m_element;
-    if (!ptr)
-        return 0;
-    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
-    ArgumentListNode* tail = head;
-    ptr = ptr->next();
-    for (; ptr; ptr = ptr->next()) {
-        ASSERT(!ptr->elision());
-        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
-    }
-    return head;
-}
-
-// ------------------------------ ObjectLiteralNode ----------------------------
-
-RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-     if (!m_list) {
-         if (dst == generator.ignoredResult())
-             return 0;
-         return generator.emitNewObject(generator.finalDestination(dst));
-     }
-     return generator.emitNode(dst, m_list);
-}
-
-// ------------------------------ PropertyListNode -----------------------------
-
-RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
-    
-    generator.emitNewObject(newObj.get());
-    
-    for (PropertyListNode* p = this; p; p = p->m_next) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign);
-        
-        switch (p->m_node->m_type) {
-            case PropertyNode::Constant: {
-                generator.emitPutById(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Getter: {
-                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Setter: {
-                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            default:
-                ASSERT_NOT_REACHED();
-        }
-    }
-    
-    return generator.moveToDestinationIfNeeded(dst, newObj.get());
-}
-
-// ------------------------------ BracketAccessorNode --------------------------------
-
-RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
-}
-
-// ------------------------------ DotAccessorNode --------------------------------
-
-RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
-}
-
-// ------------------------------ ArgumentListNode -----------------------------
-
-RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ NewExprNode ----------------------------------
-
-RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ EvalFunctionCallNode ----------------------------------
-
-RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallValueNode ----------------------------------
-
-RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallResolveNode ----------------------------------
-
-RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    RefPtr<RegisterID> func = generator.newTemporary();
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    int identifierStart = divot() - startOffset();
-    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallBracketNode ----------------------------------
-
-RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallDotNode ----------------------------------
-
-RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> function = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitNode(thisRegister.get(), m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    generator.emitMethodCheck();
-    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
-    {
-        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-        RefPtr<RegisterID> thisRegister = generator.newTemporary();
-        ArgumentListNode* oldList = m_args->m_listNode;
-        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            m_args->m_listNode = m_args->m_listNode->m_next;
-        } else
-            generator.emitLoad(thisRegister.get(), jsNull());
-
-        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-        generator.emitJump(end.get());
-        m_args->m_listNode = oldList;
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-    
-static bool areTrivialApplyArguments(ArgumentsNode* args)
-{
-    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
-        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
-}
-
-RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // A few simple cases can be trivially handled as ordinary function calls.
-    // function.apply(), function.apply(arg) -> identical to function.call
-    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
-    bool mayBeCall = areTrivialApplyArguments(m_args);
-
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
-    {
-        if (mayBeCall) {
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            ArgumentListNode* oldList = m_args->m_listNode;
-            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-                m_args->m_listNode = m_args->m_listNode->m_next;
-                if (m_args->m_listNode) {
-                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
-                    ASSERT(!m_args->m_listNode->m_next);
-                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
-                }
-            } else
-                generator.emitLoad(thisRegister.get(), jsNull());
-            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-            m_args->m_listNode = oldList;
-        } else {
-            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
-            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            RefPtr<RegisterID> argsRegister = generator.newTemporary();
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            ArgumentListNode* args = m_args->m_listNode->m_next;
-            bool isArgumentsApply = false;
-            if (args->m_expr->isResolveNode()) {
-                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
-                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
-                if (isArgumentsApply)
-                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
-            }
-            if (!isArgumentsApply)
-                generator.emitNode(argsRegister.get(), args->m_expr);
-            while ((args = args->m_next))
-                generator.emitNode(args->m_expr);
-
-            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
-            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
-        }
-        generator.emitJump(end.get());
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-
-// ------------------------------ PostfixResolveNode ----------------------------------
-
-static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
-{
-    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
-}
-
-static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
-{
-    if (srcDst == dst)
-        return generator.emitToJSNumber(dst, srcDst);
-    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
-}
-
-RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            return generator.emitToJSNumber(generator.finalDestination(dst), local);
-        }
-
-        if (dst == generator.ignoredResult())
-            return emitPreIncOrDec(generator, local, m_operator);
-        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RegisterID* oldValue;
-        if (dst == generator.ignoredResult()) {
-            oldValue = 0;
-            emitPreIncOrDec(generator, value.get(), m_operator);
-        } else {
-            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-        }
-        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
-        return oldValue;
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> value = generator.newTemporary();
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        emitPreIncOrDec(generator, value.get(), m_operator);
-    } else {
-        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-    }
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixBracketNode ----------------------------------
-
-RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixDotNode ----------------------------------
-
-RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixErrorNode -----------------------------------
-
-RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Postfix ++ operator applied to value that is not a reference."
-        : "Postfix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ DeleteResolveNode -----------------------------------
-
-RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (generator.registerFor(m_ident))
-        return generator.emitLoad(generator.finalDestination(dst), false);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
-}
-
-// ------------------------------ DeleteBracketNode -----------------------------------
-
-RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
-    RegisterID* r1 = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
-}
-
-// ------------------------------ DeleteDotNode -----------------------------------
-
-RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* r0 = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
-}
-
-// ------------------------------ DeleteValueNode -----------------------------------
-
-RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitNode(generator.ignoredResult(), m_expr);
-
-    // delete on a non-location expression ignores the value and returns true
-    return generator.emitLoad(generator.finalDestination(dst), true);
-}
-
-// ------------------------------ VoidNode -------------------------------------
-
-RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    return generator.emitLoad(dst, jsUndefined());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.emitTypeOf(generator.finalDestination(dst), local);
-    }
-
-    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr);
-    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
-}
-
-// ------------------------------ PrefixResolveNode ----------------------------------
-
-RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
-            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
-        }
-
-        emitPreIncOrDec(generator, local, m_operator);
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        emitPreIncOrDec(generator, propDst.get(), m_operator);
-        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
-        return generator.moveToDestinationIfNeeded(dst, propDst.get());
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
-    emitPreIncOrDec(generator, propDst.get(), m_operator);
-    generator.emitPutById(base.get(), m_ident, propDst.get());
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixBracketNode ----------------------------------
-
-RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixDotNode ----------------------------------
-
-RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixErrorNode -----------------------------------
-
-RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Prefix ++ operator applied to value that is not a reference."
-        : "Prefix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ Unary Operation Nodes -----------------------------------
-
-RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* src = generator.emitNode(m_expr);
-    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
-}
-
-// ------------------------------ Binary Operation Nodes -----------------------------------
-
-// BinaryOpNode::emitStrcat:
-//
-// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
-// more values, where we can determine a set of separate op_add operations would be operating on
-// string values.
-//
-// This function expects to be operating on a graph of AST nodes looking something like this:
-//
-//     (a)...     (b)
-//          \   /
-//           (+)     (c)
-//              \   /
-//      [d]     ((+))
-//         \    /
-//          [+=]
-//
-// The assignment operation is optional, if it exists the register holding the value on the
-// lefthand side of the assignment should be passing as the optional 'lhs' argument.
-//
-// The method should be called on the node at the root of the tree of regular binary add
-// operations (marked in the diagram with a double set of parentheses).  This node must
-// be performing a string concatenation (determined by statically detecting that at least
-// one child must be a string).  
-//
-// Since the minimum number of values being concatenated together is expected to be 3, if
-// a lhs to a concatenating assignment is not provided then the  root add should have at
-// least one left child that is also an add that can be determined to be operating on strings.
-//
-RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
-{
-    ASSERT(isAdd());
-    ASSERT(resultDescriptor().definitelyIsString());
-
-    // Create a list of expressions for all the adds in the tree of nodes we can convert into
-    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
-    // added first, and the leftmost child is never added, so the vector produced for the
-    // example above will be [ c, b ].
-    Vector<ExpressionNode*, 16> reverseExpressionList;
-    reverseExpressionList.append(m_expr2);
-
-    // Examine the left child of the add.  So long as this is a string add, add its right-child
-    // to the list, and keep processing along the left fork.
-    ExpressionNode* leftMostAddChild = m_expr1;
-    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
-        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
-        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
-    }
-
-    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
-
-    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
-    // We could possibly avoid this (the lhs is converted last anyway, we could let the
-    // op_strcat node handle its conversion if required).
-    if (lhs)
-        temporaryRegisters.append(generator.newTemporary());
-
-    // Emit code for the leftmost node ((a) in the example).
-    temporaryRegisters.append(generator.newTemporary());
-    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
-    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
-
-    // Note on ordering of conversions:
-    //
-    // We maintain the same ordering of conversions as we would see if the concatenations
-    // was performed as a sequence of adds (otherwise this optimization could change
-    // behaviour should an object have been provided a valueOf or toString method).
-    //
-    // Considering the above example, the sequnce of execution is:
-    //     * evaluate operand (a)
-    //     * evaluate operand (b)
-    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
-    //     * convert (b) to primitive   <-  (ditto)
-    //     * evaluate operand (c)
-    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
-    // And optionally, if there is an assignment:
-    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
-    //
-    // As such we do not plant an op to convert the leftmost child now.  Instead, use
-    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
-    // once the second node has been generated.  However, if the leftmost child is an
-    // immediate we can trivially determine that no conversion will be required.
-    // If this is the case
-    if (leftMostAddChild->isString())
-        leftMostAddChildTempRegister = 0;
-
-    while (reverseExpressionList.size()) {
-        ExpressionNode* node = reverseExpressionList.last();
-        reverseExpressionList.removeLast();
-
-        // Emit the code for the current node.
-        temporaryRegisters.append(generator.newTemporary());
-        generator.emitNode(temporaryRegisters.last().get(), node);
-
-        // On the first iteration of this loop, when we first reach this point we have just
-        // generated the second node, which means it is time to convert the leftmost operand.
-        if (leftMostAddChildTempRegister) {
-            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
-            leftMostAddChildTempRegister = 0; // Only do this once.
-        }
-        // Plant a conversion for this node, if necessary.
-        if (!node->isString())
-            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
-    }
-    ASSERT(temporaryRegisters.size() >= 3);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    // If there is an assignment convert the lhs now.  This will also copy lhs to
-    // the temporary register we allocated for it.
-    if (lhs)
-        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
-
-    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
-}
-
-RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    OpcodeID opcodeID = this->opcodeID();
-
-    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
-        return emitStrcat(generator, dst);
-
-    if (opcodeID == op_neq) {
-        if (m_expr1->isNull() || m_expr2->isNull()) {
-            RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
-        }
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_expr1->isNull() || m_expr2->isNull()) {
-        RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
-}
-
-RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitGetByIdExceptionInfo(op_instanceof);
-    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
-}
-
-// ------------------------------ LogicalOpNode ----------------------------
-
-RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> temp = generator.tempDestination(dst);
-    RefPtr<Label> target = generator.newLabel();
-    
-    generator.emitNode(temp.get(), m_expr1);
-    if (m_operator == OpLogicalAnd)
-        generator.emitJumpIfFalse(temp.get(), target.get());
-    else
-        generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2);
-    generator.emitLabel(target.get());
-
-    return generator.moveToDestinationIfNeeded(dst, temp.get());
-}
-
-// ------------------------------ ConditionalNode ------------------------------
-
-RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_logical);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(newDst.get(), m_expr1);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2);
-
-    generator.emitLabel(afterElse.get());
-
-    return newDst.get();
-}
-
-// ------------------------------ ReadModifyResolveNode -----------------------------------
-
-// FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
-{
-    OpcodeID opcodeID;
-    switch (oper) {
-        case OpMultEq:
-            opcodeID = op_mul;
-            break;
-        case OpDivEq:
-            opcodeID = op_div;
-            break;
-        case OpPlusEq:
-            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
-                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
-            opcodeID = op_add;
-            break;
-        case OpMinusEq:
-            opcodeID = op_sub;
-            break;
-        case OpLShift:
-            opcodeID = op_lshift;
-            break;
-        case OpRShift:
-            opcodeID = op_rshift;
-            break;
-        case OpURShift:
-            opcodeID = op_urshift;
-            break;
-        case OpAndEq:
-            opcodeID = op_bitand;
-            break;
-        case OpXOrEq:
-            opcodeID = op_bitxor;
-            break;
-        case OpOrEq:
-            opcodeID = op_bitor;
-            break;
-        case OpModEq:
-            opcodeID = op_mod;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            return dst;
-    }
-
-    RegisterID* src2 = generator.emitNode(m_right);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
-}
-
-RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        }
-        
-        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
-            RefPtr<RegisterID> result = generator.newTemporary();
-            generator.emitMove(result.get(), local);
-            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-            generator.emitMove(local, result.get());
-            return generator.moveToDestinationIfNeeded(dst, result.get());
-        }
-        
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        generator.emitPutScopedVar(depth, index, result, globalObject);
-        return result;
-    }
-
-    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
-    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
-    return generator.emitPutById(base.get(), m_ident, result);
-}
-
-// ------------------------------ AssignResolveNode -----------------------------------
-
-RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right);
-        
-        RegisterID* result = generator.emitNode(local, m_right);
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        if (dst == generator.ignoredResult())
-            dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right);
-        generator.emitPutScopedVar(depth, index, value, globalObject);
-        return value;
-    }
-
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-// ------------------------------ AssignDotNode -----------------------------------
-
-RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyDotNode -----------------------------------
-
-RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, updatedValue);
-}
-
-// ------------------------------ AssignErrorNode -----------------------------------
-
-RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
-}
-
-// ------------------------------ AssignBracketNode -----------------------------------
-
-RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyBracketNode -----------------------------------
-
-RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), updatedValue);
-
-    return updatedValue;
-}
-
-// ------------------------------ CommaNode ------------------------------------
-
-RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expressions.size() > 1);
-    for (size_t i = 0; i < m_expressions.size() - 1; i++)
-        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
-    return generator.emitNode(dst, m_expressions.last());
-}
-
-// ------------------------------ ConstDeclNode ------------------------------------
-
-RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
-{
-    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
-        if (!m_init)
-            return local;
-
-        return generator.emitNode(local, m_init);
-    }
-
-    if (generator.codeType() != EvalCode) {
-        if (m_init)
-            return generator.emitNode(m_init);
-        else
-            return generator.emitResolve(generator.newTemporary(), m_ident);
-    }
-    // FIXME: While this code should only be hit in eval code, it will potentially
-    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next)
-        result = n->emitCodeSingle(generator);
-
-    return result;
-}
-
-// ------------------------------ ConstStatementNode -----------------------------
-
-RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_next);
-}
-
-// ------------------------------ SourceElements -------------------------------
-
-inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    size_t size = m_statements.size();
-    for (size_t i = 0; i < size; ++i)
-        generator.emitNode(dst, m_statements[i]);
-}
-
-// ------------------------------ BlockNode ------------------------------------
-
-inline StatementNode* BlockNode::lastStatement() const
-{
-    return m_statements ? m_statements->lastStatement() : 0;
-}
-
-RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-    return 0;
-}
-
-// ------------------------------ EmptyStatementNode ---------------------------
-
-RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ DebuggerStatementNode ---------------------------
-
-RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ ExprStatementNode ----------------------------
-
-RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ VarStatementNode ----------------------------
-
-RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_expr);
-}
-
-// ------------------------------ IfNode ---------------------------------------
-
-RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> afterThen = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, afterThen.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitLabel(afterThen.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ IfElseNode ---------------------------------------
-
-RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-
-    generator.emitNode(dst, m_elseBlock);
-
-    generator.emitLabel(afterElse.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ DoWhileNode ----------------------------------
-
-RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-   
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ WhileNode ------------------------------------
-
-RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-    
-    generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion
-    return 0;
-}
-
-// ------------------------------ ForNode --------------------------------------
-
-RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1);
-
-    RefPtr<Label> condition = generator.newLabel();
-    generator.emitJump(condition.get());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3);
-
-    generator.emitLabel(condition.get());
-    if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2);
-        generator.emitJumpIfTrue(cond, topOfLoop.get());
-    } else
-        generator.emitJump(topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ ForInNode ------------------------------------
-
-RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    if (!m_lexpr->isLocation())
-        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init);
-
-    RefPtr<RegisterID> base = generator.newTemporary();
-    generator.emitNode(base.get(), m_expr);
-    RefPtr<RegisterID> i = generator.newTemporary();
-    RefPtr<RegisterID> size = generator.newTemporary();
-    RefPtr<RegisterID> expectedSubscript;
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> loopStart = generator.newLabel();
-    generator.emitLabel(loopStart.get());
-
-    RegisterID* propertyName;
-    bool optimizedForinAccess = false;
-    if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
-        propertyName = generator.registerFor(ident);
-        if (!propertyName) {
-            propertyName = generator.newTemporary();
-            RefPtr<RegisterID> protect = propertyName;
-            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
-
-            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-            generator.emitPutById(base, ident, propertyName);
-        } else {
-            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
-            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
-            optimizedForinAccess = true;
-        }
-    } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
-        const Identifier& ident = assignNode->identifier();
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RegisterID* base = generator.emitNode(assignNode->base());
-
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutById(base, ident, propertyName);
-    } else {
-        ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
-        RegisterID* subscript = generator.emitNode(assignNode->subscript());
-        
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutByVal(base.get(), subscript, propertyName);
-    }   
-
-    generator.emitNode(dst, m_statement);
-
-    if (optimizedForinAccess)
-        generator.popOptimisedForIn();
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    generator.emitLabel(scope->breakTarget());
-    return dst;
-}
-
-// ------------------------------ ContinueNode ---------------------------------
-
-// ECMA 12.7
-RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.continueTarget(m_ident);
-
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ BreakNode ------------------------------------
-
-// ECMA 12.8
-RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.breakTarget(m_ident);
-    
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ ReturnNode -----------------------------------
-
-RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (generator.codeType() != FunctionCode)
-        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
-    RefPtr<RegisterID> returnRegister;
-    if (generator.scopeDepth()) {
-        RefPtr<Label> l0 = generator.newLabel();
-        if (generator.hasFinaliser() && !r0->isTemporary()) {
-            returnRegister = generator.emitMove(generator.newTemporary(), r0);
-            r0 = returnRegister.get();
-        }
-        generator.emitJumpScopes(l0.get(), 0);
-        generator.emitLabel(l0.get());
-    }
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    return generator.emitReturn(r0);
-}
-
-// ------------------------------ WithNode -------------------------------------
-
-RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
-    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
-    generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement);
-    generator.emitPopScope();
-    return result;
-}
-
-// ------------------------------ CaseClauseNode --------------------------------
-
-inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-}
-
-// ------------------------------ CaseBlockNode --------------------------------
-
-enum SwitchKind { 
-    SwitchUnset = 0,
-    SwitchNumber = 1, 
-    SwitchString = 2, 
-    SwitchNeither = 3 
-};
-
-static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
-{
-    for (; list; list = list->getNext()) {
-        ExpressionNode* clauseExpression = list->getClause()->expr();
-        literalVector.append(clauseExpression);
-        if (clauseExpression->isNumber()) {
-            double value = static_cast<NumberNode*>(clauseExpression)->value();
-            int32_t intVal = static_cast<int32_t>(value);
-            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            if (intVal < min_num)
-                min_num = intVal;
-            if (intVal > max_num)
-                max_num = intVal;
-            typeForTable = SwitchNumber;
-            continue;
-        }
-        if (clauseExpression->isString()) {
-            if (typeForTable & ~SwitchString) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
-            if (singleCharacterSwitch &= value.size() == 1) {
-                int32_t intVal = value.rep()->data()[0];
-                if (intVal < min_num)
-                    min_num = intVal;
-                if (intVal > max_num)
-                    max_num = intVal;
-            }
-            typeForTable = SwitchString;
-            continue;
-        }
-        typeForTable = SwitchNeither;
-        break;        
-    }
-}
-    
-SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
-{
-    SwitchKind typeForTable = SwitchUnset;
-    bool singleCharacterSwitch = true;
-    
-    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    
-    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
-        return SwitchInfo::SwitchNone;
-    
-    if (typeForTable == SwitchNumber) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchImmediate;
-        return SwitchInfo::SwitchNone;
-    } 
-    
-    ASSERT(typeForTable == SwitchString);
-    
-    if (singleCharacterSwitch) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchCharacter;
-    }
-
-    return SwitchInfo::SwitchString;
-}
-
-RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
-{
-    RefPtr<Label> defaultLabel;
-    Vector<RefPtr<Label>, 8> labelVector;
-    Vector<ExpressionNode*, 8> literalVector;
-    int32_t min_num = std::numeric_limits<int32_t>::max();
-    int32_t max_num = std::numeric_limits<int32_t>::min();
-    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
-
-    if (switchType != SwitchInfo::SwitchNone) {
-        // Prepare the various labels
-        for (uint32_t i = 0; i < literalVector.size(); i++)
-            labelVector.append(generator.newLabel());
-        defaultLabel = generator.newLabel();
-        generator.beginSwitch(switchExpression, switchType);
-    } else {
-        // Setup jumps
-        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        
-        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        defaultLabel = generator.newLabel();
-        generator.emitJump(defaultLabel.get());
-    }
-
-    RegisterID* result = 0;
-
-    size_t i = 0;
-    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-
-    if (m_defaultClause) {
-        generator.emitLabel(defaultLabel.get());
-        m_defaultClause->emitBytecode(generator, dst);
-    }
-
-    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-    if (!m_defaultClause)
-        generator.emitLabel(defaultLabel.get());
-
-    ASSERT(i == labelVector.size());
-    if (switchType != SwitchInfo::SwitchNone) {
-        ASSERT(labelVector.size() == literalVector.size());
-        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
-    }
-    return result;
-}
-
-// ------------------------------ SwitchNode -----------------------------------
-
-RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
-
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
-
-    generator.emitLabel(scope->breakTarget());
-    return r1;
-}
-
-// ------------------------------ LabelNode ------------------------------------
-
-RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (generator.breakTarget(m_name))
-        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
-
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->breakTarget());
-    return r0;
-}
-
-// ------------------------------ ThrowNode ------------------------------------
-
-RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitThrow(expr.get());
-    return 0;
-}
-
-// ------------------------------ TryNode --------------------------------------
-
-RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // NOTE: The catch and finally blocks must be labeled explicitly, so the
-    // optimizer knows they may be jumped to from anywhere.
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    RefPtr<Label> tryStartLabel = generator.newLabel();
-    RefPtr<Label> finallyStart;
-    RefPtr<RegisterID> finallyReturnAddr;
-    if (m_finallyBlock) {
-        finallyStart = generator.newLabel();
-        finallyReturnAddr = generator.newTemporary();
-        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
-    }
-
-    generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock);
-
-    if (m_catchBlock) {
-        RefPtr<Label> catchEndLabel = generator.newLabel();
-        
-        // Normal path: jump over the catch block.
-        generator.emitJump(catchEndLabel.get());
-
-        // Uncaught exception path: the catch block.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        if (m_catchHasEval) {
-            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
-            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
-            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
-            generator.emitPushScope(exceptionRegister.get());
-        } else
-            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock);
-        generator.emitPopScope();
-        generator.emitLabel(catchEndLabel.get());
-    }
-
-    if (m_finallyBlock) {
-        generator.popFinallyContext();
-        // there may be important registers live at the time we jump
-        // to a finally block (such as for a return or throw) so we
-        // ref the highest register ever used as a conservative
-        // approach to not clobbering anything important
-        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
-        RefPtr<Label> finallyEndLabel = generator.newLabel();
-
-        // Normal path: invoke the finally block, then jump over it.
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitJump(finallyEndLabel.get());
-
-        // Uncaught exception path: invoke the finally block, then re-throw the exception.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitThrow(tempExceptionRegister.get());
-
-        // The finally block.
-        generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock);
-        generator.emitSubroutineReturn(finallyReturnAddr.get());
-
-        generator.emitLabel(finallyEndLabel.get());
-    }
-
-    return dst;
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
 ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, int numConstants)
@@ -1908,12 +104,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
 {
 }
 
-inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_data->m_statements)
-        m_data->m_statements->emitBytecode(generator, dst);
-}
-
 StatementNode* ScopeNode::singleStatement() const
 {
     return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
@@ -1937,19 +127,6 @@ PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElem
     return node.release();
 }
 
-RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ EvalNode -----------------------------
 
 inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1968,19 +145,6 @@ PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements*
     return node.release();
 }
 
-RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ FunctionBodyNode -----------------------------
 
 FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
@@ -2028,37 +192,4 @@ PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData,
     return node.release();
 }
 
-RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
-    emitStatementsBytecode(generator, generator.ignoredResult());
-    StatementNode* singleStatement = this->singleStatement();
-    if (singleStatement && singleStatement->isBlock()) {
-        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
-        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
-            return 0;
-    }
-
-    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    generator.emitReturn(r0);
-    return 0;
-}
-
-// ------------------------------ FuncDeclNode ---------------------------------
-
-RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    return dst;
-}
-
-// ------------------------------ FuncExprNode ---------------------------------
-
-RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index be84c4a..7852165 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -40,6 +40,7 @@ namespace JSC {
     class ArgumentListNode;
     class BytecodeGenerator;
     class FunctionBodyNode;
+    class Label;
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
@@ -151,6 +152,9 @@ namespace JSC {
         virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
+        virtual bool hasConditionContextCodegen() const { return false; }
+
+        virtual void emitBytecodeInConditionContext(BytecodeGenerator&, Label*, Label*, bool) { ASSERT_NOT_REACHED(); }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
@@ -757,6 +761,7 @@ namespace JSC {
 
     protected:
         ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -788,6 +793,9 @@ namespace JSC {
     class LogicalNotNode : public UnaryOpNode {
     public:
         LogicalNotNode(JSGlobalData*, ExpressionNode*);
+    private:
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return expr()->hasConditionContextCodegen(); }
     };
 
     class BinaryOpNode : public ExpressionNode {
@@ -952,6 +960,8 @@ namespace JSC {
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return true; }
 
         ExpressionNode* m_expr1;
         ExpressionNode* m_expr2;
@@ -1375,12 +1385,6 @@ namespace JSC {
 
         using ParserArenaRefCounted::operator new;
 
-        void adoptData(std::auto_ptr<ScopeNodeData> data)
-        {
-            ASSERT(!data->m_arena.contains(this));
-            ASSERT(!m_data);
-            m_data.adopt(data);
-        }
         ScopeNodeData* data() const { return m_data.get(); }
         void destroyData() { m_data.clear(); }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
index 4c046d0..039fc46 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
@@ -27,9 +27,6 @@
 #include "Lexer.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
-#include <memory>
-
-using std::auto_ptr;
 
 #ifndef yyparse
 extern int jscyyparse(void*);
@@ -50,7 +47,7 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
         errMsg = &defaultErrMsg;
 
     *errLine = -1;
-    *errMsg = 0;
+    *errMsg = UString();
 
     Lexer& lexer = *globalData->lexer;
     lexer.setCode(*m_source, m_arena);
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
index 1f0ea01..669b948 100755
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
@@ -269,4 +269,5 @@ sub readHeaderValues()
     
     eval $content;
     die "$@" if $@;
+    unlink $tempFile;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
index c33c67c..4f59e17 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
@@ -3,8 +3,6 @@ VPATH += $$PWD
 INCLUDEPATH += $$PWD $$OUTPUT_DIR/JavaScriptCore/tmp
 DEPENDPATH += $$PWD
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-
 SOURCES += \
     pcre_compile.cpp \
     pcre_exec.cpp \
@@ -12,24 +10,3 @@ SOURCES += \
     pcre_ucp_searchfuncs.cpp \
     pcre_xclass.cpp
 
-!CONFIG(QTDIR_build) {
-    defineTest(addExtraCompiler) {
-        QMAKE_EXTRA_COMPILERS += $$1
-        generated_files.depends += compiler_$${1}_make_all
-        export(QMAKE_EXTRA_COMPILERS)
-        export(generated_files.depends)
-        return(true)
-    }
-}
-
-# GENERATOR: "chartables.c": compile and execute the chartables generator (and add it to sources)
-win32-msvc*|wince*: PREPROCESSOR = "--preprocessor=\"$$QMAKE_CC /E\""
-DFTABLES = $$PWD/dftables
-ctgen.input = DFTABLES
-ctgen.output = $$GENERATED_SOURCES_DIR/chartables.c
-ctgen.commands = perl $$DFTABLES ${QMAKE_FILE_OUT} $$PREPROCESSOR
-ctgen.CONFIG += target_predeps no_link
-ctgen.variable_out = GENERATED_SOURCES
-ctgen.dependency_type = TYPE_C
-ctgen.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR}${QMAKE_FILE_BASE}
-addExtraCompiler(ctgen)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
index 16619d4..8ca2eb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
@@ -2164,14 +2164,14 @@ void Histogram::add(const JSRegExp* re, double elapsedTime)
 
 HistogramTimeLogger::HistogramTimeLogger(const JSRegExp* re)
     : m_re(re)
-    , m_startTime(getCurrentUTCTimeWithMicroseconds())
+    , m_startTime(currentTimeMS())
 {
 }
 
 HistogramTimeLogger::~HistogramTimeLogger()
 {
     static Histogram histogram;
-    histogram.add(m_re, getCurrentUTCTimeWithMicroseconds() - m_startTime);
+    histogram.add(m_re, currentTimeMS() - m_startTime);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
index de75e71..c90f9b0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
@@ -42,7 +42,7 @@ Profile::Profile(const UString& title, unsigned uid)
 {
     // FIXME: When multi-threading is supported this will be a vector and calls
     // into the profiler will need to know which thread it is executing on.
-    m_head = ProfileNode::create(CallIdentifier("Thread_1", 0, 0), 0, 0);
+    m_head = ProfileNode::create(CallIdentifier("Thread_1", UString(), 0), 0, 0);
 }
 
 Profile::~Profile()
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
index dc68ecb..f367033 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -63,7 +63,7 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
-    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
+    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(exec, function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     m_head->insertNode(m_currentNode.get());
 }
 
@@ -124,7 +124,7 @@ void ProfileGenerator::stopProfiling()
     m_currentNode = m_currentNode->parent();
 
    if (double headSelfTime = m_head->selfTime()) {
-        RefPtr<ProfileNode> idleNode = ProfileNode::create(CallIdentifier(NonJSExecution, 0, 0), m_head.get(), m_head.get());
+        RefPtr<ProfileNode> idleNode = ProfileNode::create(CallIdentifier(NonJSExecution, UString(), 0), m_head.get(), m_head.get());
 
         idleNode->setTotalTime(headSelfTime);
         idleNode->setSelfTime(headSelfTime);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
index 19050aa..fb126b3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
@@ -33,15 +33,17 @@
 #include <stdio.h>
 #include <wtf/DateMath.h>
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include <windows.h>
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 static double getCount()
 {
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     static LARGE_INTEGER frequency = {0};
     if (!frequency.QuadPart)
         QueryPerformanceFrequency(&frequency);
@@ -49,7 +51,7 @@ static double getCount()
     QueryPerformanceCounter(&counter);
     return static_cast<double>(counter.QuadPart) / frequency.QuadPart;
 #else
-    return WTF::getCurrentUTCTimeWithMicroseconds();
+    return currentTimeMS();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
index 6f72e08..fe8727a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
@@ -46,7 +46,7 @@ static const char* GlobalCodeExecution = "(program)";
 static const char* AnonymousFunction = "(anonymous function)";
 static unsigned ProfilesUID = 0;
 
-static CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData*, JSFunction*);
+static CallIdentifier createCallIdentifierFromFunctionImp(ExecState*, JSFunction*);
 
 Profiler* Profiler::s_sharedProfiler = 0;
 Profiler* Profiler::s_sharedEnabledProfilerReference = 0;
@@ -109,14 +109,14 @@ void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::willExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
@@ -125,17 +125,17 @@ void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
@@ -144,17 +144,17 @@ CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue
     if (asObject(functionValue)->inherits(&JSFunction::info)) {
         JSFunction* function = asFunction(functionValue);
         if (!function->executable()->isHostFunction())
-            return createCallIdentifierFromFunctionImp(globalData, function);
+            return createCallIdentifierFromFunctionImp(exec, function);
     }
     if (asObject(functionValue)->inherits(&InternalFunction::info))
-        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(globalData), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier("(" + asObject(functionValue)->className() + " object)", defaultSourceURL, defaultLineNumber);
+        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier(makeString("(", asObject(functionValue)->className(), " object)"), defaultSourceURL, defaultLineNumber);
 }
 
-CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
+CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSFunction* function)
 {
     ASSERT(!function->isHostFunction());
-    const UString& name = function->calculatedDisplayName(globalData);
+    const UString& name = function->calculatedDisplayName(exec);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->jsExecutable()->sourceURL(), function->jsExecutable()->lineNo());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
index 21621bf..4b8b4a0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
@@ -52,7 +52,7 @@ namespace JSC {
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(ExecState* exec, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
index 3227770..8e1fdbe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
@@ -104,7 +104,11 @@ namespace JSC {
         void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
-            
+
+#if ENABLE(JSC_ZOMBIES)
+            ASSERT(!v.isZombie());
+#endif
+
             if (m_isUsingInlineBuffer && m_size < inlineCapacity) {
                 m_vector.uncheckedAppend(v);
                 ++m_size;
@@ -187,6 +191,10 @@ namespace JSC {
             : m_args(args)
             , m_argCount(argCount)
         {
+#if ENABLE(JSC_ZOMBIES)
+            for (size_t i = 0; i < argCount; i++)
+                ASSERT(!m_args[i].isZombie());
+#endif
         }
         
         ArgList(Register* args, int argCount)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
index 86a8f0a..bb30e3b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
@@ -204,6 +204,19 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
+void Arguments::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties) {
+        for (unsigned i = 0; i < d->numArguments; ++i) {
+            if (!d->deletedArguments || !d->deletedArguments[i])
+                propertyNames.add(Identifier(exec, UString::from(i)));
+        }
+        propertyNames.add(exec->propertyNames().callee);
+        propertyNames.add(exec->propertyNames().length);
+    }
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index 9b674a2..cca3cf2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -55,6 +55,10 @@ namespace JSC {
 
     class Arguments : public JSObject {
     public:
+        // Use an enum because otherwise gcc insists on doing a memory
+        // read.
+        enum { MaxArguments = 0x10000 };
+
         enum NoParametersType { NoParameters };
 
         Arguments(CallFrame*);
@@ -85,7 +89,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
@@ -96,6 +100,7 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 7a89447..4e8dc02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -28,6 +28,7 @@
 #include "CachedCall.h"
 #include "Interpreter.h"
 #include "JIT.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "Lookup.h"
 #include "Operations.h"
@@ -182,8 +183,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
         totalSize += str.size();
         
         if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
+            throwOutOfMemoryError(exec);
         }
         
         if (exec->hadException())
@@ -195,17 +195,16 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
     Vector<UChar> buffer;
     buffer.reserveCapacity(totalSize);
     if (!buffer.data())
-        return throwError(exec, GeneralError, "Out of memory");
+        return throwOutOfMemoryError(exec);
         
     for (unsigned i = 0; i < length; i++) {
         if (i)
             buffer.append(',');
         if (RefPtr<UString::Rep> rep = strBuffer[i])
-            buffer.append(rep->data(), rep->size());
+            buffer.append(rep->characters(), rep->length());
     }
     ASSERT(buffer.size() == totalSize);
-    unsigned finalSize = buffer.size();
-    return jsString(exec, UString(buffer.releaseBuffer(), finalSize, false));
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -224,42 +223,28 @@ JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, J
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
+    JSStringBuilder strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
-        }
 
         JSValue element = thisObj->get(exec, k);
-        if (element.isUndefinedOrNull())
-            continue;
-
-        JSObject* o = element.toObject(exec);
-        JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
-        UString str;
-        CallData callData;
-        CallType callType = conversionFunction.getCallData(callData);
-        if (callType != CallTypeNone)
-            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
-        else
-            str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
+        if (!element.isUndefinedOrNull()) {
+            JSObject* o = element.toObject(exec);
+            JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+            UString str;
+            CallData callData;
+            CallType callType = conversionFunction.getCallData(callData);
+            if (callType != CallTypeNone)
+                str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
+            else
+                str = element.toString(exec);
+            strBuffer.append(str);
         }
-
-        if (exec->hadException())
-            break;
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    return strBuffer.build(exec);
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -276,38 +261,27 @@ JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thi
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
+    JSStringBuilder strBuffer;
 
-    UChar comma = ',';
-    UString separator = args.at(0).isUndefined() ? UString(&comma, 1) : args.at(0).toString(exec);
+    UString separator;
+    if (!args.at(0).isUndefined())
+        separator = args.at(0).toString(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
-        if (k >= 1)
-            strBuffer.append(separator.data(), separator.size());
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
+        if (k >= 1) {
+            if (separator.isNull())
+                strBuffer.append(',');
+            else
+                strBuffer.append(separator);
         }
 
         JSValue element = thisObj->get(exec, k);
-        if (element.isUndefinedOrNull())
-            continue;
-
-        UString str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-        }
-
-        if (exec->hadException())
-            break;
+        if (!element.isUndefinedOrNull())
+            strBuffer.append(element.toString(exec));
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    return strBuffer.build(exec);
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -532,14 +506,19 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
     JSValue result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+
+    // FIXME: Firefox returns an empty array.
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(0).toUInt32(exec);
-    if (begin < 0)
-        begin = std::max<int>(begin + length, 0);
-    else
-        begin = std::min<int>(begin, length);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    double relativeBegin = args.at(0).toInteger(exec);
+    unsigned begin;
+    if (relativeBegin < 0) {
+        relativeBegin += length;
+        begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
+    } else
+        begin = std::min<unsigned>(static_cast<unsigned>(relativeBegin), length);
 
     unsigned deleteCount;
     if (args.size() > 1)
@@ -565,7 +544,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
             for (unsigned k = length; k > length - deleteCount + additionalArgs; --k)
                 thisObj->deleteProperty(exec, k - 1);
         } else {
-            for (unsigned k = length - deleteCount; (int)k > begin; --k) {
+            for (unsigned k = length - deleteCount; k > begin; --k) {
                 if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
@@ -745,8 +724,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue th
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (!cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (!result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(false);
         }
     }
@@ -846,8 +825,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thi
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(true);
         }
     }
@@ -1034,7 +1013,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
@@ -1065,7 +1044,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSVa
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 929a5e7..74089a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -43,7 +43,7 @@ namespace JSC {
 
         ~BatchedTransitionOptimizer()
         {
-            m_object->setStructure(Structure::fromDictionaryTransition(m_object->structure()));
+            m_object->flattenDictionaryObject();
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 69c2e51..4b02acb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 6626182..0eca610 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -32,6 +32,7 @@
 #include "JSONObject.h"
 #include "JSString.h"
 #include "JSValue.h"
+#include "JSZombie.h"
 #include "MarkStack.h"
 #include "Nodes.h"
 #include "Tracing.h"
@@ -44,7 +45,7 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/VMTags.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #include <mach/mach_init.h>
 #include <mach/mach_port.h>
@@ -52,40 +53,24 @@
 #include <mach/thread_act.h>
 #include <mach/vm_map.h>
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 
 #include <windows.h>
 #include <malloc.h>
 
-#elif PLATFORM(HAIKU)
+#elif OS(HAIKU)
 
 #include <OS.h>
 
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
 
 #include <stdlib.h>
-#if !PLATFORM(HAIKU)
+#if !OS(HAIKU)
 #include <sys/mman.h>
 #endif
 #include <unistd.h>
 
-#if defined(QT_LINUXBASE)
-#include <dlfcn.h>
-#endif
-
-#if defined(__UCLIBC__)
-// versions of uClibc 0.9.28 and below do not have
-// pthread_getattr_np or pthread_attr_getstack.
-#if __UCLIBC_MAJOR__ == 0 && \
-    (__UCLIBC_MINOR__ < 9 || \
-    (__UCLIBC_MINOR__ == 9 && __UCLIBC_SUBLEVEL__ <= 30))
-#define UCLIBC_USE_PROC_SELF_MAPS 1
-#include <stdio_ext.h>
-extern int *__libc_stack_end;
-#endif
-#endif
-
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 #include <thread.h>
 #else
 #include <pthread.h>
@@ -95,7 +80,7 @@ extern int *__libc_stack_end;
 #include <pthread_np.h>
 #endif
 
-#if PLATFORM(QNX)
+#if OS(QNX)
 #include <fcntl.h>
 #include <sys/procfs.h>
 #include <stdio.h>
@@ -114,21 +99,17 @@ namespace JSC {
 
 const size_t GROWTH_FACTOR = 2;
 const size_t LOW_WATER_FACTOR = 4;
-const size_t ALLOCATIONS_PER_COLLECTION = 4000;
+const size_t ALLOCATIONS_PER_COLLECTION = 3600;
 // This value has to be a macro to be used in max() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
 #define MIN_ARRAY_SIZE (static_cast<size_t>(14))
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 typedef mach_port_t PlatformThread;
-#elif PLATFORM(WIN_OS)
-struct PlatformThread {
-    PlatformThread(DWORD _id, HANDLE _handle) : id(_id), handle(_handle) {}
-    DWORD id;
-    HANDLE handle;
-};
+#elif OS(WINDOWS)
+typedef HANDLE PlatformThread;
 #endif
 
 class Heap::Thread {
@@ -155,13 +136,13 @@ Heap::Heap(JSGlobalData* globalData)
     , m_currentThreadRegistrar(0)
 #endif
     , m_globalData(globalData)
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     , m_blockallocator(JSCCOLLECTOR_VIRTUALMEM_RESERVATION, BLOCK_SIZE)
 #endif
 {
     ASSERT(globalData);
-    memset(&primaryHeap, 0, sizeof(CollectorHeap));
-    memset(&numberHeap, 0, sizeof(CollectorHeap));
+    memset(&m_heap, 0, sizeof(CollectorHeap));
+    allocateBlock();
 }
 
 Heap::~Heap()
@@ -177,6 +158,9 @@ void Heap::destroy()
     if (!m_globalData)
         return;
 
+    ASSERT(!m_globalData->dynamicGlobalObject);
+    ASSERT(!isBusy());
+    
     // The global object is not GC protected at this point, so sweeping may delete it
     // (and thus the global data) before other objects that may use the global data.
     RefPtr<JSGlobalData> protect(m_globalData);
@@ -184,13 +168,7 @@ void Heap::destroy()
     delete m_markListSet;
     m_markListSet = 0;
 
-    sweep<PrimaryHeap>();
-    // No need to sweep number heap, because the JSNumber destructor doesn't do anything.
-
-    ASSERT(!primaryHeap.numLiveObjects);
-
-    freeBlocks(&primaryHeap);
-    freeBlocks(&numberHeap);
+    freeBlocks();
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     if (m_currentThreadRegistrar) {
@@ -205,30 +183,25 @@ void Heap::destroy()
         t = next;
     }
 #endif
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     m_blockallocator.destroy();
 #endif
     m_globalData = 0;
 }
 
-template <HeapType heapType>
 NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
-    // Disable the use of vm_map for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if OS(DARWIN)
     vm_address_t address = 0;
-    // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
     vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     void* address = m_blockallocator.alloc();  
     if (!address)
         CRASH();
-    memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     void* address = VirtualAlloc(NULL, BLOCK_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
-#elif PLATFORM(WIN_OS)
-#if COMPILER(MINGW)
+#elif OS(WINDOWS)
+#if COMPILER(MINGW) && !COMPILER(MINGW64)
     void* address = __mingw_aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
 #else
     void* address = _aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
@@ -237,7 +210,6 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 #elif HAVE(POSIX_MEMALIGN)
     void* address;
     posix_memalign(&address, BLOCK_SIZE, BLOCK_SIZE);
-    memset(address, 0, BLOCK_SIZE);
 #else
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -263,58 +235,64 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
         munmap(reinterpret_cast<char*>(address + adjust + BLOCK_SIZE), extra - adjust);
 
     address += adjust;
-    memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
 #endif
 
+    // Initialize block.
+
     CollectorBlock* block = reinterpret_cast<CollectorBlock*>(address);
-    block->freeList = block->cells;
     block->heap = this;
-    block->type = heapType;
+    clearMarkBits(block);
+
+    Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
+    for (size_t i = 0; i < HeapConstants::cellsPerBlock; ++i)
+        new (block->cells + i) JSCell(dummyMarkableCellStructure);
+    
+    // Add block to blocks vector.
 
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
-    size_t numBlocks = heap.numBlocks;
-    if (heap.usedBlocks == numBlocks) {
+    size_t numBlocks = m_heap.numBlocks;
+    if (m_heap.usedBlocks == numBlocks) {
         static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
         if (numBlocks > maxNumBlocks)
             CRASH();
         numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
-        heap.numBlocks = numBlocks;
-        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
+        m_heap.numBlocks = numBlocks;
+        m_heap.blocks = static_cast<CollectorBlock**>(fastRealloc(m_heap.blocks, numBlocks * sizeof(CollectorBlock*)));
     }
-    heap.blocks[heap.usedBlocks++] = block;
+    m_heap.blocks[m_heap.usedBlocks++] = block;
 
     return block;
 }
 
-template <HeapType heapType>
 NEVER_INLINE void Heap::freeBlock(size_t block)
 {
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    m_heap.didShrink = true;
 
-    freeBlock(heap.blocks[block]);
+    ObjectIterator it(m_heap, block);
+    ObjectIterator end(m_heap, block + 1);
+    for ( ; it != end; ++it)
+        (*it)->~JSCell();
+    freeBlockPtr(m_heap.blocks[block]);
 
     // swap with the last block so we compact as we go
-    heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
-    heap.usedBlocks--;
+    m_heap.blocks[block] = m_heap.blocks[m_heap.usedBlocks - 1];
+    m_heap.usedBlocks--;
 
-    if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
-        heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
-        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
+    if (m_heap.numBlocks > MIN_ARRAY_SIZE && m_heap.usedBlocks < m_heap.numBlocks / LOW_WATER_FACTOR) {
+        m_heap.numBlocks = m_heap.numBlocks / GROWTH_FACTOR; 
+        m_heap.blocks = static_cast<CollectorBlock**>(fastRealloc(m_heap.blocks, m_heap.numBlocks * sizeof(CollectorBlock*)));
     }
 }
 
-NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
+NEVER_INLINE void Heap::freeBlockPtr(CollectorBlock* block)
 {
-    // Disable the use of vm_deallocate for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if OS(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     m_blockallocator.free(reinterpret_cast<void*>(block));
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     VirtualFree(block, 0, MEM_RELEASE);
-#elif PLATFORM(WIN_OS)
-#if COMPILER(MINGW)
+#elif OS(WINDOWS)
+#if COMPILER(MINGW) && !COMPILER(MINGW64)
     __mingw_aligned_free(block);
 #else
     _aligned_free(block);
@@ -326,13 +304,34 @@ NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 #endif
 }
 
-void Heap::freeBlocks(CollectorHeap* heap)
+void Heap::freeBlocks()
 {
-    for (size_t i = 0; i < heap->usedBlocks; ++i)
-        if (heap->blocks[i])
-            freeBlock(heap->blocks[i]);
-    fastFree(heap->blocks);
-    memset(heap, 0, sizeof(CollectorHeap));
+    ProtectCountSet protectedValuesCopy = m_protectedValues;
+
+    clearMarkBits();
+    ProtectCountSet::iterator protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        markCell(it->first);
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
+    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
+    for ( ; it != end; ++it)
+        (*it)->~JSCell();
+
+    ASSERT(!protectedObjectCount());
+
+    protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        it->first->~JSCell();
+
+    for (size_t block = 0; block < m_heap.usedBlocks; ++block)
+        freeBlockPtr(m_heap.blocks[block]);
+
+    fastFree(m_heap.blocks);
+
+    memset(&m_heap, 0, sizeof(CollectorHeap));
 }
 
 void Heap::recordExtraCost(size_t cost)
@@ -347,123 +346,109 @@ void Heap::recordExtraCost(size_t cost)
     // are either very short lived temporaries, or have extremely long lifetimes. So
     // if a large value survives one garbage collection, there is not much point to
     // collecting more frequently as long as it stays alive.
-    // NOTE: we target the primaryHeap unconditionally as JSNumber doesn't modify cost 
 
-    primaryHeap.extraCost += cost;
+    if (m_heap.extraCost > maxExtraCost && m_heap.extraCost > m_heap.usedBlocks * BLOCK_SIZE / 2) {
+        // If the last iteration through the heap deallocated blocks, we need
+        // to clean up remaining garbage before marking. Otherwise, the conservative
+        // marking mechanism might follow a pointer to unmapped memory.
+        if (m_heap.didShrink)
+            sweep();
+        reset();
+    }
+    m_heap.extraCost += cost;
 }
 
-template <HeapType heapType> ALWAYS_INLINE void* Heap::heapAllocate(size_t s)
+void* Heap::allocate(size_t s)
 {
-    typedef typename HeapConstants<heapType>::Block Block;
-    typedef typename HeapConstants<heapType>::Cell Cell;
-
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    typedef HeapConstants::Block Block;
+    typedef HeapConstants::Cell Cell;
+    
     ASSERT(JSLock::lockCount() > 0);
     ASSERT(JSLock::currentThreadIsHoldingLock());
-    ASSERT_UNUSED(s, s <= HeapConstants<heapType>::cellSize);
+    ASSERT_UNUSED(s, s <= HeapConstants::cellSize);
 
-    ASSERT(heap.operationInProgress == NoOperation);
-    ASSERT(heapType == PrimaryHeap || heap.extraCost == 0);
-    // FIXME: If another global variable access here doesn't hurt performance
-    // too much, we could CRASH() in NDEBUG builds, which could help ensure we
-    // don't spend any time debugging cases where we allocate inside an object's
-    // deallocation code.
+    ASSERT(m_heap.operationInProgress == NoOperation);
 
 #if COLLECT_ON_EVERY_ALLOCATION
-    collect();
+    collectAllGarbage();
+    ASSERT(m_heap.operationInProgress == NoOperation);
 #endif
 
-    size_t numLiveObjects = heap.numLiveObjects;
-    size_t usedBlocks = heap.usedBlocks;
-    size_t i = heap.firstBlockWithPossibleSpace;
-
-    // if we have a huge amount of extra cost, we'll try to collect even if we still have
-    // free cells left.
-    if (heapType == PrimaryHeap && heap.extraCost > ALLOCATIONS_PER_COLLECTION) {
-        size_t numLiveObjectsAtLastCollect = heap.numLiveObjectsAtLastCollect;
-        size_t numNewObjects = numLiveObjects - numLiveObjectsAtLastCollect;
-        const size_t newCost = numNewObjects + heap.extraCost;
-        if (newCost >= ALLOCATIONS_PER_COLLECTION && newCost >= numLiveObjectsAtLastCollect)
-            goto collect;
-    }
+allocate:
 
-    ASSERT(heap.operationInProgress == NoOperation);
-#ifndef NDEBUG
-    // FIXME: Consider doing this in NDEBUG builds too (see comment above).
-    heap.operationInProgress = Allocation;
-#endif
+    // Fast case: find the next garbage cell and recycle it.
 
-scan:
-    Block* targetBlock;
-    size_t targetBlockUsedCells;
-    if (i != usedBlocks) {
-        targetBlock = reinterpret_cast<Block*>(heap.blocks[i]);
-        targetBlockUsedCells = targetBlock->usedCells;
-        ASSERT(targetBlockUsedCells <= HeapConstants<heapType>::cellsPerBlock);
-        while (targetBlockUsedCells == HeapConstants<heapType>::cellsPerBlock) {
-            if (++i == usedBlocks)
-                goto collect;
-            targetBlock = reinterpret_cast<Block*>(heap.blocks[i]);
-            targetBlockUsedCells = targetBlock->usedCells;
-            ASSERT(targetBlockUsedCells <= HeapConstants<heapType>::cellsPerBlock);
-        }
-        heap.firstBlockWithPossibleSpace = i;
-    } else {
+    do {
+        ASSERT(m_heap.nextBlock < m_heap.usedBlocks);
+        Block* block = reinterpret_cast<Block*>(m_heap.blocks[m_heap.nextBlock]);
+        do {
+            ASSERT(m_heap.nextCell < HeapConstants::cellsPerBlock);
+            if (!block->marked.get(m_heap.nextCell)) { // Always false for the last cell in the block
+                Cell* cell = block->cells + m_heap.nextCell;
 
-collect:
-        size_t numLiveObjectsAtLastCollect = heap.numLiveObjectsAtLastCollect;
-        size_t numNewObjects = numLiveObjects - numLiveObjectsAtLastCollect;
-        const size_t newCost = numNewObjects + heap.extraCost;
+                m_heap.operationInProgress = Allocation;
+                JSCell* imp = reinterpret_cast<JSCell*>(cell);
+                imp->~JSCell();
+                m_heap.operationInProgress = NoOperation;
 
-        if (newCost >= ALLOCATIONS_PER_COLLECTION && newCost >= numLiveObjectsAtLastCollect) {
-#ifndef NDEBUG
-            heap.operationInProgress = NoOperation;
-#endif
-            bool foundGarbage = collect();
-            numLiveObjects = heap.numLiveObjects;
-            usedBlocks = heap.usedBlocks;
-            i = heap.firstBlockWithPossibleSpace;
-#ifndef NDEBUG
-            heap.operationInProgress = Allocation;
-#endif
-            if (foundGarbage)
-                goto scan;
-        }
+                ++m_heap.nextCell;
+                return cell;
+            }
+        } while (++m_heap.nextCell != HeapConstants::cellsPerBlock);
+        m_heap.nextCell = 0;
+    } while (++m_heap.nextBlock != m_heap.usedBlocks);
 
-        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
-        targetBlock = reinterpret_cast<Block*>(allocateBlock<heapType>());
-        heap.firstBlockWithPossibleSpace = heap.usedBlocks - 1;
-        targetBlockUsedCells = 0;
-    }
+    // Slow case: reached the end of the heap. Mark live objects and start over.
 
-    // find a free spot in the block and detach it from the free list
-    Cell* newCell = targetBlock->freeList;
+    reset();
+    goto allocate;
+}
 
-    // "next" field is a cell offset -- 0 means next cell, so a zeroed block is already initialized
-    targetBlock->freeList = (newCell + 1) + newCell->u.freeCell.next;
+void Heap::resizeBlocks()
+{
+    m_heap.didShrink = false;
 
-    targetBlock->usedCells = static_cast<uint32_t>(targetBlockUsedCells + 1);
-    heap.numLiveObjects = numLiveObjects + 1;
+    size_t usedCellCount = markedCells();
+    size_t minCellCount = usedCellCount + max(ALLOCATIONS_PER_COLLECTION, usedCellCount);
+    size_t minBlockCount = (minCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
 
-#ifndef NDEBUG
-    // FIXME: Consider doing this in NDEBUG builds too (see comment above).
-    heap.operationInProgress = NoOperation;
-#endif
+    size_t maxCellCount = 1.25f * minCellCount;
+    size_t maxBlockCount = (maxCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
 
-    return newCell;
+    if (m_heap.usedBlocks < minBlockCount)
+        growBlocks(minBlockCount);
+    else if (m_heap.usedBlocks > maxBlockCount)
+        shrinkBlocks(maxBlockCount);
 }
 
-void* Heap::allocate(size_t s)
+void Heap::growBlocks(size_t neededBlocks)
 {
-    return heapAllocate<PrimaryHeap>(s);
+    ASSERT(m_heap.usedBlocks < neededBlocks);
+    while (m_heap.usedBlocks < neededBlocks)
+        allocateBlock();
 }
 
-void* Heap::allocateNumber(size_t s)
+void Heap::shrinkBlocks(size_t neededBlocks)
 {
-    return heapAllocate<NumberHeap>(s);
+    ASSERT(m_heap.usedBlocks > neededBlocks);
+    
+    // Clear the always-on last bit, so isEmpty() isn't fooled by it.
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        m_heap.blocks[i]->marked.clear(HeapConstants::cellsPerBlock - 1);
+
+    for (size_t i = 0; i != m_heap.usedBlocks && m_heap.usedBlocks != neededBlocks; ) {
+        if (m_heap.blocks[i]->marked.isEmpty()) {
+            freeBlock(i);
+        } else
+            ++i;
+    }
+
+    // Reset the always-on last bit.
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        m_heap.blocks[i]->marked.set(HeapConstants::cellsPerBlock - 1);
 }
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 void* g_stackBase = 0;
 
 inline bool isPageWritable(void* page)
@@ -520,7 +505,7 @@ static void* getStackBase(void* previousFrame)
 }
 #endif
 
-#if PLATFORM(QNX)
+#if OS(QNX)
 static inline void *currentThreadStackBaseQNX()
 {
     static void* stackBase = 0;
@@ -549,10 +534,10 @@ static inline void *currentThreadStackBaseQNX()
 
 static inline void* currentThreadStackBase()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     pthread_t thread = pthread_self();
     return pthread_get_stackaddr_np(thread);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(MSVC)
+#elif OS(WINDOWS) && CPU(X86) && COMPILER(MSVC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
     NT_TIB* pTib;
@@ -561,10 +546,7 @@ static inline void* currentThreadStackBase()
         MOV pTib, EAX
     }
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
-    PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
-    return reinterpret_cast<void*>(pTib->StackBase);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(GCC)
+#elif OS(WINDOWS) && CPU(X86) && COMPILER(GCC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
     NT_TIB* pTib;
@@ -572,83 +554,44 @@ static inline void* currentThreadStackBase()
           : "=r" (pTib)
         );
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(QNX)
+#elif OS(WINDOWS) && CPU(X86_64)
+    PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
+    return reinterpret_cast<void*>(pTib->StackBase);
+#elif OS(QNX)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     return currentThreadStackBaseQNX();
-#elif PLATFORM(SOLARIS)
+#elif OS(SOLARIS)
     stack_t s;
     thr_stksegment(&s);
     return s.ss_sp;
-#elif PLATFORM(OPENBSD)
+#elif OS(OPENBSD)
     pthread_t thread = pthread_self();
     stack_t stack;
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
-#elif PLATFORM(SYMBIAN)
-    static void* stackBase = 0;
-    if (stackBase == 0) {
-        TThreadStackInfo info;
-        RThread thread;
-        thread.StackInfo(info);
-        stackBase = (void*)info.iBase;
-    }
-    return (void*)stackBase;
-#elif PLATFORM(HAIKU)
+#elif OS(SYMBIAN)
+    TThreadStackInfo info;
+    RThread thread;
+    thread.StackInfo(info);
+    return (void*)info.iBase;
+#elif OS(HAIKU)
     thread_info threadInfo;
     get_thread_info(find_thread(NULL), &threadInfo);
     return threadInfo.stack_end;
-#elif PLATFORM(UNIX)
-#ifdef UCLIBC_USE_PROC_SELF_MAPS
-    // Read /proc/self/maps and locate the line whose address
-    // range contains __libc_stack_end.
-    FILE *file = fopen("/proc/self/maps", "r");
-    if (!file)
-        return 0;
-    __fsetlocking(file, FSETLOCKING_BYCALLER);
-    char *line = NULL;
-    size_t lineLen = 0;
-    while (!feof_unlocked(file)) {
-        if (getdelim(&line, &lineLen, '\n', file) <= 0)
-            break;
-
-        long from;
-        long to;
-        if (sscanf (line, "%lx-%lx", &from, &to) != 2)
-            continue;
-        if (from <= (long)__libc_stack_end && (long)__libc_stack_end < to) {
-            fclose(file);
-            free(line);
-#ifdef _STACK_GROWS_UP
-            return (void *)from;
-#else
-            return (void *)to;
-#endif
-        }
-    }
-    fclose(file);
-    free(line);
-    return 0;
-#else
+#elif OS(UNIX)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     static void* stackBase = 0;
     static size_t stackSize = 0;
     static pthread_t stackThread;
     pthread_t thread = pthread_self();
     if (stackBase == 0 || thread != stackThread) {
-#if defined(QT_LINUXBASE)
-        // LinuxBase is missing pthread_getattr_np - resolve it once at runtime instead
-        // see http://bugs.linuxbase.org/show_bug.cgi?id=2364
-        typedef int (*GetAttrPtr)(pthread_t, pthread_attr_t *);
-        static int (*pthread_getattr_np_ptr)(pthread_t, pthread_attr_t *) = 0;
-        if (!pthread_getattr_np_ptr)
-            *(void **)&pthread_getattr_np_ptr = dlsym(RTLD_DEFAULT, "pthread_getattr_np");
-#endif
         pthread_attr_t sattr;
         pthread_attr_init(&sattr);
-#if HAVE(PTHREAD_NP_H) || PLATFORM(NETBSD)
+#if HAVE(PTHREAD_NP_H) || OS(NETBSD)
         // e.g. on FreeBSD 5.4, neundorf@kde.org
         pthread_attr_get_np(thread, &sattr);
-#elif defined(QT_LINUXBASE)
-        if (pthread_getattr_np_ptr)
-            pthread_getattr_np_ptr(thread, &sattr);
 #else
         // FIXME: this function is non-portable; other POSIX systems may have different np alternatives
         pthread_getattr_np(thread, &sattr);
@@ -660,8 +603,9 @@ static inline void* currentThreadStackBase()
         stackThread = thread;
     }
     return static_cast<char*>(stackBase) + stackSize;
-#endif
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     if (g_stackBase)
         return g_stackBase;
     else {
@@ -677,11 +621,10 @@ static inline void* currentThreadStackBase()
 
 static inline PlatformThread getCurrentPlatformThread()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     return pthread_mach_thread_np(pthread_self());
-#elif PLATFORM(WIN_OS)
-    HANDLE threadHandle = pthread_getw32threadhandle_np(pthread_self());
-    return PlatformThread(GetCurrentThreadId(), threadHandle);
+#elif OS(WINDOWS)
+    return pthread_getw32threadhandle_np(pthread_self());
 #endif
 }
 
@@ -750,10 +693,37 @@ void Heap::registerThread()
 
 #endif
 
-#define IS_POINTER_ALIGNED(p) (((intptr_t)(p) & (sizeof(char*) - 1)) == 0)
+inline bool isPointerAligned(void* p)
+{
+    return (((intptr_t)(p) & (sizeof(char*) - 1)) == 0);
+}
+
+// Cell size needs to be a power of two for isPossibleCell to be valid.
+COMPILE_ASSERT(sizeof(CollectorCell) % 2 == 0, Collector_cell_size_is_power_of_two);
+
+#if USE(JSVALUE32)
+static bool isHalfCellAligned(void *p)
+{
+    return (((intptr_t)(p) & (CELL_MASK >> 1)) == 0);
+}
+
+static inline bool isPossibleCell(void* p)
+{
+    return isHalfCellAligned(p) && p;
+}
+
+#else
 
-// cell size needs to be a power of two for this to be valid
-#define IS_HALF_CELL_ALIGNED(p) (((intptr_t)(p) & (CELL_MASK >> 1)) == 0)
+static inline bool isCellAligned(void *p)
+{
+    return (((intptr_t)(p) & CELL_MASK) == 0);
+}
+
+static inline bool isPossibleCell(void* p)
+{
+    return isCellAligned(p) && p;
+}
+#endif // USE(JSVALUE32)
 
 void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
 {
@@ -764,46 +734,33 @@ void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
     }
 
     ASSERT((static_cast<char*>(end) - static_cast<char*>(start)) < 0x1000000);
-    ASSERT(IS_POINTER_ALIGNED(start));
-    ASSERT(IS_POINTER_ALIGNED(end));
+    ASSERT(isPointerAligned(start));
+    ASSERT(isPointerAligned(end));
 
     char** p = static_cast<char**>(start);
     char** e = static_cast<char**>(end);
 
-    size_t usedPrimaryBlocks = primaryHeap.usedBlocks;
-    size_t usedNumberBlocks = numberHeap.usedBlocks;
-    CollectorBlock** primaryBlocks = primaryHeap.blocks;
-    CollectorBlock** numberBlocks = numberHeap.blocks;
-
-    const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
-
+    CollectorBlock** blocks = m_heap.blocks;
     while (p != e) {
         char* x = *p++;
-        if (IS_HALF_CELL_ALIGNED(x) && x) {
+        if (isPossibleCell(x)) {
+            size_t usedBlocks;
             uintptr_t xAsBits = reinterpret_cast<uintptr_t>(x);
             xAsBits &= CELL_ALIGN_MASK;
+
             uintptr_t offset = xAsBits & BLOCK_OFFSET_MASK;
+            const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
+            if (offset > lastCellOffset)
+                continue;
+
             CollectorBlock* blockAddr = reinterpret_cast<CollectorBlock*>(xAsBits - offset);
-            // Mark the the number heap, we can mark these Cells directly to avoid the virtual call cost
-            for (size_t block = 0; block < usedNumberBlocks; block++) {
-                if ((numberBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    Heap::markCell(reinterpret_cast<JSCell*>(xAsBits));
-                    goto endMarkLoop;
-                }
+            usedBlocks = m_heap.usedBlocks;
+            for (size_t block = 0; block < usedBlocks; block++) {
+                if (blocks[block] != blockAddr)
+                    continue;
+                markStack.append(reinterpret_cast<JSCell*>(xAsBits));
+                markStack.drain();
             }
-          
-            // Mark the primary heap
-            for (size_t block = 0; block < usedPrimaryBlocks; block++) {
-                if ((primaryBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree) {
-                        markStack.append(reinterpret_cast<JSCell*>(xAsBits));
-                        markStack.drain();
-                    }
-                    break;
-                }
-            }
-        endMarkLoop:
-            ;
         }
     }
 }
@@ -842,10 +799,10 @@ void Heap::markCurrentThreadConservatively(MarkStack& markStack)
 
 static inline void suspendThread(const PlatformThread& platformThread)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     thread_suspend(platformThread);
-#elif PLATFORM(WIN_OS)
-    SuspendThread(platformThread.handle);
+#elif OS(WINDOWS)
+    SuspendThread(platformThread);
 #else
 #error Need a way to suspend threads on this platform
 #endif
@@ -853,10 +810,10 @@ static inline void suspendThread(const PlatformThread& platformThread)
 
 static inline void resumeThread(const PlatformThread& platformThread)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     thread_resume(platformThread);
-#elif PLATFORM(WIN_OS)
-    ResumeThread(platformThread.handle);
+#elif OS(WINDOWS)
+    ResumeThread(platformThread);
 #else
 #error Need a way to resume threads on this platform
 #endif
@@ -864,23 +821,23 @@ static inline void resumeThread(const PlatformThread& platformThread)
 
 typedef unsigned long usword_t; // word size, assumed to be either 32 or 64 bit
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
-#if PLATFORM(X86)
+#if CPU(X86)
 typedef i386_thread_state_t PlatformThreadRegisters;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
 typedef x86_thread_state64_t PlatformThreadRegisters;
-#elif PLATFORM(PPC)
+#elif CPU(PPC)
 typedef ppc_thread_state_t PlatformThreadRegisters;
-#elif PLATFORM(PPC64)
+#elif CPU(PPC64)
 typedef ppc_thread_state64_t PlatformThreadRegisters;
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
 typedef arm_thread_state_t PlatformThreadRegisters;
 #else
 #error Unknown Architecture
 #endif
 
-#elif PLATFORM(WIN_OS)&& PLATFORM(X86)
+#elif OS(WINDOWS) && CPU(X86)
 typedef CONTEXT PlatformThreadRegisters;
 #else
 #error Need a thread register struct for this platform
@@ -888,21 +845,21 @@ typedef CONTEXT PlatformThreadRegisters;
 
 static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
-#if PLATFORM(X86)
+#if CPU(X86)
     unsigned user_count = sizeof(regs)/sizeof(int);
     thread_state_flavor_t flavor = i386_THREAD_STATE;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     unsigned user_count = x86_THREAD_STATE64_COUNT;
     thread_state_flavor_t flavor = x86_THREAD_STATE64;
-#elif PLATFORM(PPC) 
+#elif CPU(PPC) 
     unsigned user_count = PPC_THREAD_STATE_COUNT;
     thread_state_flavor_t flavor = PPC_THREAD_STATE;
-#elif PLATFORM(PPC64)
+#elif CPU(PPC64)
     unsigned user_count = PPC_THREAD_STATE64_COUNT;
     thread_state_flavor_t flavor = PPC_THREAD_STATE64;
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     unsigned user_count = ARM_THREAD_STATE_COUNT;
     thread_state_flavor_t flavor = ARM_THREAD_STATE;
 #else
@@ -916,11 +873,11 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
         CRASH();
     }
     return user_count * sizeof(usword_t);
-// end PLATFORM(DARWIN)
+// end OS(DARWIN)
 
-#elif PLATFORM(WIN_OS) && PLATFORM(X86)
+#elif OS(WINDOWS) && CPU(X86)
     regs.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL | CONTEXT_SEGMENTS;
-    GetThreadContext(platformThread.handle, &regs);
+    GetThreadContext(platformThread, &regs);
     return sizeof(CONTEXT);
 #else
 #error Need a way to get thread registers on this platform
@@ -929,17 +886,17 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
 
 static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #if __DARWIN_UNIX03
 
-#if PLATFORM(X86)
+#if CPU(X86)
     return reinterpret_cast<void*>(regs.__esp);
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     return reinterpret_cast<void*>(regs.__rsp);
-#elif PLATFORM(PPC) || PLATFORM(PPC64)
+#elif CPU(PPC) || CPU(PPC64)
     return reinterpret_cast<void*>(regs.__r1);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     return reinterpret_cast<void*>(regs.__sp);
 #else
 #error Unknown Architecture
@@ -947,11 +904,11 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 
 #else // !__DARWIN_UNIX03
 
-#if PLATFORM(X86)
+#if CPU(X86)
     return reinterpret_cast<void*>(regs.esp);
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     return reinterpret_cast<void*>(regs.rsp);
-#elif (PLATFORM(PPC) || PLATFORM(PPC64))
+#elif CPU(PPC) || CPU(PPC64)
     return reinterpret_cast<void*>(regs.r1);
 #else
 #error Unknown Architecture
@@ -959,8 +916,8 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 
 #endif // __DARWIN_UNIX03
 
-// end PLATFORM(DARWIN)
-#elif PLATFORM(X86) && PLATFORM(WIN_OS)
+// end OS(DARWIN)
+#elif CPU(X86) && OS(WINDOWS)
     return reinterpret_cast<void*>((uintptr_t) regs.Esp);
 #else
 #error Need a way to get the stack pointer for another thread on this platform
@@ -1025,15 +982,15 @@ void Heap::protect(JSValue k)
     m_protectedValues.add(k.asCell());
 }
 
-void Heap::unprotect(JSValue k)
+bool Heap::unprotect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
     if (!k.isCell())
-        return;
+        return false;
 
-    m_protectedValues.remove(k.asCell());
+    return m_protectedValues.remove(k.asCell());
 }
 
 void Heap::markProtectedObjects(MarkStack& markStack)
@@ -1045,109 +1002,68 @@ void Heap::markProtectedObjects(MarkStack& markStack)
     }
 }
 
-template <HeapType heapType> size_t Heap::sweep()
+void Heap::clearMarkBits()
 {
-    typedef typename HeapConstants<heapType>::Block Block;
-    typedef typename HeapConstants<heapType>::Cell Cell;
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        clearMarkBits(m_heap.blocks[i]);
+}
 
-    // SWEEP: delete everything with a zero refcount (garbage) and unmark everything else
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
-    
-    size_t emptyBlocks = 0;
-    size_t numLiveObjects = heap.numLiveObjects;
-    
-    for (size_t block = 0; block < heap.usedBlocks; block++) {
-        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
-        
-        size_t usedCells = curBlock->usedCells;
-        Cell* freeList = curBlock->freeList;
-        
-        if (usedCells == HeapConstants<heapType>::cellsPerBlock) {
-            // special case with a block where all cells are used -- testing indicates this happens often
-            for (size_t i = 0; i < HeapConstants<heapType>::cellsPerBlock; i++) {
-                if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
-                    Cell* cell = curBlock->cells + i;
-                    
-                    if (heapType != NumberHeap) {
-                        JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                        // special case for allocated but uninitialized object
-                        // (We don't need this check earlier because nothing prior this point 
-                        // assumes the object has a valid vptr.)
-                        if (cell->u.freeCell.zeroIfFree == 0)
-                            continue;
-                        
-                        imp->~JSCell();
-                    }
-                    
-                    --usedCells;
-                    --numLiveObjects;
-                    
-                    // put cell on the free list
-                    cell->u.freeCell.zeroIfFree = 0;
-                    cell->u.freeCell.next = freeList - (cell + 1);
-                    freeList = cell;
-                }
-            }
-        } else {
-            size_t minimumCellsToProcess = usedCells;
-            for (size_t i = 0; (i < minimumCellsToProcess) & (i < HeapConstants<heapType>::cellsPerBlock); i++) {
-                Cell* cell = curBlock->cells + i;
-                if (cell->u.freeCell.zeroIfFree == 0) {
-                    ++minimumCellsToProcess;
-                } else {
-                    if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
-                        if (heapType != NumberHeap) {
-                            JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                            imp->~JSCell();
-                        }
-                        --usedCells;
-                        --numLiveObjects;
-                        
-                        // put cell on the free list
-                        cell->u.freeCell.zeroIfFree = 0;
-                        cell->u.freeCell.next = freeList - (cell + 1); 
-                        freeList = cell;
-                    }
-                }
-            }
-        }
-        
-        curBlock->usedCells = static_cast<uint32_t>(usedCells);
-        curBlock->freeList = freeList;
-        curBlock->marked.clearAll();
-        
-        if (!usedCells)
-            ++emptyBlocks;
-    }
-    
-    if (heap.numLiveObjects != numLiveObjects)
-        heap.firstBlockWithPossibleSpace = 0;
-    
-    heap.numLiveObjects = numLiveObjects;
-    heap.numLiveObjectsAtLastCollect = numLiveObjects;
-    heap.extraCost = 0;
-    
-    if (!emptyBlocks)
-        return numLiveObjects;
+void Heap::clearMarkBits(CollectorBlock* block)
+{
+    // allocate assumes that the last cell in every block is marked.
+    block->marked.clearAll();
+    block->marked.set(HeapConstants::cellsPerBlock - 1);
+}
+
+size_t Heap::markedCells(size_t startBlock, size_t startCell) const
+{
+    ASSERT(startBlock <= m_heap.usedBlocks);
+    ASSERT(startCell < HeapConstants::cellsPerBlock);
+
+    if (startBlock >= m_heap.usedBlocks)
+        return 0;
 
-    size_t neededCells = 1.25f * (numLiveObjects + max(ALLOCATIONS_PER_COLLECTION, numLiveObjects));
-    size_t neededBlocks = (neededCells + HeapConstants<heapType>::cellsPerBlock - 1) / HeapConstants<heapType>::cellsPerBlock;
-    for (size_t block = 0; block < heap.usedBlocks; block++) {
-        if (heap.usedBlocks <= neededBlocks)
-            break;
+    size_t result = 0;
+    result += m_heap.blocks[startBlock]->marked.count(startCell);
+    for (size_t i = startBlock + 1; i < m_heap.usedBlocks; ++i)
+        result += m_heap.blocks[i]->marked.count();
 
-        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
-        if (curBlock->usedCells)
-            continue;
+    return result;
+}
 
-        freeBlock<heapType>(block);
-        block--; // Don't move forward a step in this case
+void Heap::sweep()
+{
+    ASSERT(m_heap.operationInProgress == NoOperation);
+    if (m_heap.operationInProgress != NoOperation)
+        CRASH();
+    m_heap.operationInProgress = Collection;
+    
+#if !ENABLE(JSC_ZOMBIES)
+    Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
+#endif
+
+    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
+    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
+    for ( ; it != end; ++it) {
+        JSCell* cell = *it;
+#if ENABLE(JSC_ZOMBIES)
+        if (!cell->isZombie()) {
+            const ClassInfo* info = cell->classInfo();
+            cell->~JSCell();
+            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
+            Heap::markCell(cell);
+        }
+#else
+        cell->~JSCell();
+        // Callers of sweep assume it's safe to mark any cell in the heap.
+        new (cell) JSCell(dummyMarkableCellStructure);
+#endif
     }
 
-    return numLiveObjects;
+    m_heap.operationInProgress = NoOperation;
 }
 
-bool Heap::collect()
+void Heap::markRoots()
 {
 #ifndef NDEBUG
     if (m_globalData->isSharedInstance) {
@@ -1156,66 +1072,62 @@ bool Heap::collect()
     }
 #endif
 
-    ASSERT((primaryHeap.operationInProgress == NoOperation) | (numberHeap.operationInProgress == NoOperation));
-    if ((primaryHeap.operationInProgress != NoOperation) | (numberHeap.operationInProgress != NoOperation))
+    ASSERT(m_heap.operationInProgress == NoOperation);
+    if (m_heap.operationInProgress != NoOperation)
         CRASH();
 
-    JAVASCRIPTCORE_GC_BEGIN();
-    primaryHeap.operationInProgress = Collection;
-    numberHeap.operationInProgress = Collection;
+    m_heap.operationInProgress = Collection;
 
-    // MARK: first mark all referenced objects recursively starting out from the set of root objects
     MarkStack& markStack = m_globalData->markStack;
+
+    // Reset mark bits.
+    clearMarkBits();
+
+    // Mark stack roots.
     markStackObjectsConservatively(markStack);
+    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
+
+    // Mark explicitly registered roots.
     markProtectedObjects(markStack);
+
+    // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
         MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
     if (m_globalData->exception)
         markStack.append(m_globalData->exception);
-    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
-    m_globalData->smallStrings.markChildren(markStack);
     if (m_globalData->functionCodeBlockBeingReparsed)
         m_globalData->functionCodeBlockBeingReparsed->markAggregate(markStack);
     if (m_globalData->firstStringifierToMark)
         JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
 
+    // Mark the small strings cache last, since it will clear itself if nothing
+    // else has marked it.
+    m_globalData->smallStrings.markChildren(markStack);
+
     markStack.drain();
     markStack.compact();
-    JAVASCRIPTCORE_GC_MARKED();
-
-    size_t originalLiveObjects = primaryHeap.numLiveObjects + numberHeap.numLiveObjects;
-    size_t numLiveObjects = sweep<PrimaryHeap>();
-    numLiveObjects += sweep<NumberHeap>();
-
-    primaryHeap.operationInProgress = NoOperation;
-    numberHeap.operationInProgress = NoOperation;
-    JAVASCRIPTCORE_GC_END(originalLiveObjects, numLiveObjects);
 
-    return numLiveObjects < originalLiveObjects;
+    m_heap.operationInProgress = NoOperation;
 }
 
-size_t Heap::objectCount() 
+size_t Heap::objectCount() const
 {
-    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects - m_globalData->smallStrings.count(); 
+    return m_heap.nextBlock * HeapConstants::cellsPerBlock // allocated full blocks
+           + m_heap.nextCell // allocated cells in current block
+           + markedCells(m_heap.nextBlock, m_heap.nextCell) // marked cells in remainder of m_heap
+           - m_heap.usedBlocks; // 1 cell per block is a dummy sentinel
 }
 
-template <HeapType heapType> 
-static void addToStatistics(Heap::Statistics& statistics, const CollectorHeap& heap)
+void Heap::addToStatistics(Heap::Statistics& statistics) const
 {
-    typedef HeapConstants<heapType> HC;
-    for (size_t i = 0; i < heap.usedBlocks; ++i) {
-        if (heap.blocks[i]) {
-            statistics.size += BLOCK_SIZE;
-            statistics.free += (HC::cellsPerBlock - heap.blocks[i]->usedCells) * HC::cellSize;
-        }
-    }
+    statistics.size += m_heap.usedBlocks * BLOCK_SIZE;
+    statistics.free += m_heap.usedBlocks * BLOCK_SIZE - (objectCount() * HeapConstants::cellSize);
 }
 
 Heap::Statistics Heap::statistics() const
 {
     Statistics statistics = { 0, 0 };
-    JSC::addToStatistics<PrimaryHeap>(statistics, primaryHeap);
-    JSC::addToStatistics<NumberHeap>(statistics, numberHeap);
+    addToStatistics(statistics);
     return statistics;
 }
 
@@ -1261,12 +1173,13 @@ static const char* typeName(JSCell* cell)
         return "number";
 #endif
     if (cell->isGetterSetter())
-        return "gettersetter";
+        return "Getter-Setter";
     if (cell->isAPIValueWrapper())
-        return "value wrapper";
+        return "API wrapper";
     if (cell->isPropertyNameIterator())
-        return "for-in iterator";
-    ASSERT(cell->isObject());
+        return "For-in iterator";
+    if (!cell->isObject())
+        return "[empty cell]";
     const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
 }
@@ -1282,19 +1195,75 @@ HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
     return counts;
 }
 
+HashCountedSet<const char*>* Heap::objectTypeCounts()
+{
+    HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
+
+    LiveObjectIterator it = primaryHeapBegin();
+    LiveObjectIterator heapEnd = primaryHeapEnd();
+    for ( ; it != heapEnd; ++it)
+        counts->add(typeName(*it));
+
+    return counts;
+}
+
 bool Heap::isBusy()
 {
-    return (primaryHeap.operationInProgress != NoOperation) | (numberHeap.operationInProgress != NoOperation);
+    return m_heap.operationInProgress != NoOperation;
+}
+
+void Heap::reset()
+{
+    JAVASCRIPTCORE_GC_BEGIN();
+
+    markRoots();
+
+    JAVASCRIPTCORE_GC_MARKED();
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    m_heap.nextNumber = 0;
+    m_heap.extraCost = 0;
+#if ENABLE(JSC_ZOMBIES)
+    sweep();
+#endif
+    resizeBlocks();
+
+    JAVASCRIPTCORE_GC_END();
+}
+
+void Heap::collectAllGarbage()
+{
+    JAVASCRIPTCORE_GC_BEGIN();
+
+    // If the last iteration through the heap deallocated blocks, we need
+    // to clean up remaining garbage before marking. Otherwise, the conservative
+    // marking mechanism might follow a pointer to unmapped memory.
+    if (m_heap.didShrink)
+        sweep();
+
+    markRoots();
+
+    JAVASCRIPTCORE_GC_MARKED();
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    m_heap.nextNumber = 0;
+    m_heap.extraCost = 0;
+    sweep();
+    resizeBlocks();
+
+    JAVASCRIPTCORE_GC_END();
 }
 
-Heap::iterator Heap::primaryHeapBegin()
+LiveObjectIterator Heap::primaryHeapBegin()
 {
-    return iterator(primaryHeap.blocks, primaryHeap.blocks + primaryHeap.usedBlocks);
+    return LiveObjectIterator(m_heap, 0);
 }
 
-Heap::iterator Heap::primaryHeapEnd()
+LiveObjectIterator Heap::primaryHeapEnd()
 {
-    return iterator(primaryHeap.blocks + primaryHeap.usedBlocks, primaryHeap.blocks + primaryHeap.usedBlocks);
+    return LiveObjectIterator(m_heap, m_heap.usedBlocks);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index 086e519..3db3d7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -28,14 +28,14 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Threading.h>
 
-// This is supremely lame that we require pthreads to build on windows.
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <pthread.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <wtf/symbian/BlockAllocatorSymbian.h>
 #endif
 
@@ -51,19 +51,21 @@ namespace JSC {
     class MarkStack;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
-    enum HeapType { PrimaryHeap, NumberHeap };
 
-    template <HeapType> class CollectorHeapIterator;
+    class LiveObjectIterator;
 
     struct CollectorHeap {
+        size_t nextBlock;
+        size_t nextCell;
         CollectorBlock** blocks;
+        
+        void* nextNumber;
+
         size_t numBlocks;
         size_t usedBlocks;
-        size_t firstBlockWithPossibleSpace;
 
-        size_t numLiveObjects;
-        size_t numLiveObjectsAtLastCollect;
         size_t extraCost;
+        bool didShrink;
 
         OperationInProgress operationInProgress;
     };
@@ -71,21 +73,21 @@ namespace JSC {
     class Heap : public Noncopyable {
     public:
         class Thread;
-        typedef CollectorHeapIterator<PrimaryHeap> iterator;
 
         void destroy();
 
         void* allocateNumber(size_t);
         void* allocate(size_t);
 
-        bool collect();
         bool isBusy(); // true if an allocation or collection is in progress
+        void collectAllGarbage();
 
-        static const size_t minExtraCostSize = 256;
+        static const size_t minExtraCost = 256;
+        static const size_t maxExtraCost = 1024 * 1024;
 
         void reportExtraMemoryCost(size_t cost);
 
-        size_t objectCount();
+        size_t objectCount() const;
         struct Statistics {
             size_t size;
             size_t free;
@@ -93,7 +95,9 @@ namespace JSC {
         Statistics statistics() const;
 
         void protect(JSValue);
-        void unprotect(JSValue);
+        // Returns true if the value is no longer protected by any protect pointers
+        // (though it may still be alive due to heap/stack references).
+        bool unprotect(JSValue);
 
         static Heap* heap(JSValue); // 0 for immediate values
         static Heap* heap(JSCell*);
@@ -102,6 +106,7 @@ namespace JSC {
         size_t protectedObjectCount();
         size_t protectedGlobalObjectCount();
         HashCountedSet<const char*>* protectedObjectTypeCounts();
+        HashCountedSet<const char*>* objectTypeCounts();
 
         void registerThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
 
@@ -115,13 +120,12 @@ namespace JSC {
         JSGlobalData* globalData() const { return m_globalData; }
         static bool isNumber(JSCell*);
         
-        // Iterators for the object heap.
-        iterator primaryHeapBegin();
-        iterator primaryHeapEnd();
+        LiveObjectIterator primaryHeapBegin();
+        LiveObjectIterator primaryHeapEnd();
 
     private:
-        template <HeapType heapType> void* heapAllocate(size_t);
-        template <HeapType heapType> size_t sweep();
+        void reset();
+        void sweep();
         static CollectorBlock* cellBlock(const JSCell*);
         static size_t cellOffset(const JSCell*);
 
@@ -129,12 +133,22 @@ namespace JSC {
         Heap(JSGlobalData*);
         ~Heap();
 
-        template <HeapType heapType> NEVER_INLINE CollectorBlock* allocateBlock();
-        template <HeapType heapType> NEVER_INLINE void freeBlock(size_t);
-        NEVER_INLINE void freeBlock(CollectorBlock*);
-        void freeBlocks(CollectorHeap*);
+        NEVER_INLINE CollectorBlock* allocateBlock();
+        NEVER_INLINE void freeBlock(size_t);
+        NEVER_INLINE void freeBlockPtr(CollectorBlock*);
+        void freeBlocks();
+        void resizeBlocks();
+        void growBlocks(size_t neededBlocks);
+        void shrinkBlocks(size_t neededBlocks);
+        void clearMarkBits();
+        void clearMarkBits(CollectorBlock*);
+        size_t markedCells(size_t startBlock = 0, size_t startCell = 0) const;
 
         void recordExtraCost(size_t);
+
+        void addToStatistics(Statistics&) const;
+
+        void markRoots();
         void markProtectedObjects(MarkStack&);
         void markCurrentThreadConservatively(MarkStack&);
         void markCurrentThreadConservativelyInternal(MarkStack&);
@@ -143,8 +157,7 @@ namespace JSC {
 
         typedef HashCountedSet<JSCell*> ProtectCountSet;
 
-        CollectorHeap primaryHeap;
-        CollectorHeap numberHeap;
+        CollectorHeap m_heap;
 
         ProtectCountSet m_protectedValues;
 
@@ -161,7 +174,7 @@ namespace JSC {
         pthread_key_t m_currentThreadRegistrar;
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         // Allocates collector blocks with correct alignment
         WTF::AlignedBlockAllocator m_blockallocator; 
 #endif
@@ -180,7 +193,7 @@ namespace JSC {
 #endif
     template<> struct CellSize<sizeof(uint64_t)> { static const size_t m_value = 64; };
 
-#if PLATFORM(WINCE) || PLATFORM(SYMBIAN)
+#if OS(WINCE) || OS(SYMBIAN)
     const size_t BLOCK_SIZE = 64 * 1024; // 64k
 #else
     const size_t BLOCK_SIZE = 64 * 4096; // 256k
@@ -195,87 +208,60 @@ namespace JSC {
     const size_t SMALL_CELL_SIZE = CELL_SIZE / 2;
     const size_t CELL_MASK = CELL_SIZE - 1;
     const size_t CELL_ALIGN_MASK = ~CELL_MASK;
-    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE * 8 - sizeof(uint32_t) * 8 - sizeof(void *) * 8 - 2 * (7 + 3 * 8)) / (CELL_SIZE * 8 + 2);
-    const size_t SMALL_CELLS_PER_BLOCK = 2 * CELLS_PER_BLOCK;
+    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE - sizeof(Heap*)) * 8 * CELL_SIZE / (8 * CELL_SIZE + 1) / CELL_SIZE; // one bitmap byte can represent 8 cells.
+    
     const size_t BITMAP_SIZE = (CELLS_PER_BLOCK + 7) / 8;
     const size_t BITMAP_WORDS = (BITMAP_SIZE + 3) / sizeof(uint32_t);
-  
+
     struct CollectorBitmap {
         uint32_t bits[BITMAP_WORDS];
         bool get(size_t n) const { return !!(bits[n >> 5] & (1 << (n & 0x1F))); } 
         void set(size_t n) { bits[n >> 5] |= (1 << (n & 0x1F)); } 
         void clear(size_t n) { bits[n >> 5] &= ~(1 << (n & 0x1F)); } 
         void clearAll() { memset(bits, 0, sizeof(bits)); }
+        size_t count(size_t startCell = 0)
+        {
+            size_t result = 0;
+            for ( ; (startCell & 0x1F) != 0; ++startCell) {
+                if (get(startCell))
+                    ++result;
+            }
+            for (size_t i = startCell >> 5; i < BITMAP_WORDS; ++i)
+                result += WTF::bitCount(bits[i]);
+            return result;
+        }
+        size_t isEmpty() // Much more efficient than testing count() == 0.
+        {
+            for (size_t i = 0; i < BITMAP_WORDS; ++i)
+                if (bits[i] != 0)
+                    return false;
+            return true;
+        }
     };
   
     struct CollectorCell {
-        union {
-            double memory[CELL_ARRAY_LENGTH];
-            struct {
-                void* zeroIfFree;
-                ptrdiff_t next;
-            } freeCell;
-        } u;
-    };
-
-    struct SmallCollectorCell {
-        union {
-            double memory[CELL_ARRAY_LENGTH / 2];
-            struct {
-                void* zeroIfFree;
-                ptrdiff_t next;
-            } freeCell;
-        } u;
+        double memory[CELL_ARRAY_LENGTH];
     };
 
     class CollectorBlock {
     public:
         CollectorCell cells[CELLS_PER_BLOCK];
-        uint32_t usedCells;
-        CollectorCell* freeList;
         CollectorBitmap marked;
         Heap* heap;
-        HeapType type;
     };
 
-    class SmallCellCollectorBlock {
-    public:
-        SmallCollectorCell cells[SMALL_CELLS_PER_BLOCK];
-        uint32_t usedCells;
-        SmallCollectorCell* freeList;
-        CollectorBitmap marked;
-        Heap* heap;
-        HeapType type;
-    };
-    
-    template <HeapType heapType> struct HeapConstants;
-
-    template <> struct HeapConstants<PrimaryHeap> {
+    struct HeapConstants {
         static const size_t cellSize = CELL_SIZE;
         static const size_t cellsPerBlock = CELLS_PER_BLOCK;
-        static const size_t bitmapShift = 0;
         typedef CollectorCell Cell;
         typedef CollectorBlock Block;
     };
 
-    template <> struct HeapConstants<NumberHeap> {
-        static const size_t cellSize = SMALL_CELL_SIZE;
-        static const size_t cellsPerBlock = SMALL_CELLS_PER_BLOCK;
-        static const size_t bitmapShift = 1;
-        typedef SmallCollectorCell Cell;
-        typedef SmallCellCollectorBlock Block;
-    };
-
     inline CollectorBlock* Heap::cellBlock(const JSCell* cell)
     {
         return reinterpret_cast<CollectorBlock*>(reinterpret_cast<uintptr_t>(cell) & BLOCK_MASK);
     }
 
-    inline bool Heap::isNumber(JSCell* cell)
-    {
-        return Heap::cellBlock(cell)->type == NumberHeap;
-    }
-
     inline size_t Heap::cellOffset(const JSCell* cell)
     {
         return (reinterpret_cast<uintptr_t>(cell) & BLOCK_OFFSET_MASK) / CELL_SIZE;
@@ -293,8 +279,20 @@ namespace JSC {
 
     inline void Heap::reportExtraMemoryCost(size_t cost)
     {
-        if (cost > minExtraCostSize) 
-            recordExtraCost(cost / (CELL_SIZE * 2)); 
+        if (cost > minExtraCost) 
+            recordExtraCost(cost);
+    }
+    
+    inline void* Heap::allocateNumber(size_t s)
+    {
+        if (void* result = m_heap.nextNumber) {
+            m_heap.nextNumber = 0;
+            return result;
+        }
+
+        void* result = allocate(s);
+        m_heap.nextNumber = static_cast<char*>(result) + (CELL_SIZE / 2);
+        return result;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
index e38a852..be6f3c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
@@ -31,58 +31,108 @@
 
 namespace JSC {
 
-    template <HeapType heapType> class CollectorHeapIterator {
+    class CollectorHeapIterator {
     public:
-        CollectorHeapIterator(CollectorBlock** block, CollectorBlock** endBlock);
-
-        bool operator!=(const CollectorHeapIterator<heapType>& other) { return m_block != other.m_block || m_cell != other.m_cell; }
-        CollectorHeapIterator<heapType>& operator++();
+        bool operator!=(const CollectorHeapIterator& other);
         JSCell* operator*() const;
     
-    private:
-        typedef typename HeapConstants<heapType>::Block Block;
-        typedef typename HeapConstants<heapType>::Cell Cell;
-
-        Block** m_block;
-        Block** m_endBlock;
-        Cell* m_cell;
-        Cell* m_endCell;
+    protected:
+        CollectorHeapIterator(CollectorHeap&, size_t startBlock, size_t startCell);
+        void advance(size_t max);
+
+        CollectorHeap& m_heap;
+        size_t m_block;
+        size_t m_cell;
+    };
+
+    class LiveObjectIterator : public CollectorHeapIterator {
+    public:
+        LiveObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        LiveObjectIterator& operator++();
+    };
+
+    class DeadObjectIterator : public CollectorHeapIterator {
+    public:
+        DeadObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        DeadObjectIterator& operator++();
+    };
+
+    class ObjectIterator : public CollectorHeapIterator {
+    public:
+        ObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        ObjectIterator& operator++();
     };
 
-    template <HeapType heapType> 
-    CollectorHeapIterator<heapType>::CollectorHeapIterator(CollectorBlock** block, CollectorBlock** endBlock)
-        : m_block(reinterpret_cast<Block**>(block))
-        , m_endBlock(reinterpret_cast<Block**>(endBlock))
-        , m_cell(m_block == m_endBlock ? 0 : (*m_block)->cells)
-        , m_endCell(m_block == m_endBlock ? 0 : (*m_block)->cells + HeapConstants<heapType>::cellsPerBlock)
+    inline CollectorHeapIterator::CollectorHeapIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : m_heap(heap)
+        , m_block(startBlock)
+        , m_cell(startCell)
+    {
+    }
+
+    inline bool CollectorHeapIterator::operator!=(const CollectorHeapIterator& other)
     {
-        if (m_cell && m_cell->u.freeCell.zeroIfFree == 0)
-            ++*this;
+        return m_block != other.m_block || m_cell != other.m_cell;
     }
 
-    template <HeapType heapType> 
-    CollectorHeapIterator<heapType>& CollectorHeapIterator<heapType>::operator++()
+    inline JSCell* CollectorHeapIterator::operator*() const
+    {
+        return reinterpret_cast<JSCell*>(m_heap.blocks[m_block]->cells + m_cell);
+    }
+    
+    // Iterators advance up to the next-to-last -- and not the last -- cell in a
+    // block, since the last cell is a dummy sentinel.
+    inline void CollectorHeapIterator::advance(size_t max)
+    {
+        ++m_cell;
+        if (m_cell == max) {
+            m_cell = 0;
+            ++m_block;
+        }
+    }
+
+    inline LiveObjectIterator::LiveObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
+    {
+        ++(*this);
+    }
+
+    inline LiveObjectIterator& LiveObjectIterator::operator++()
+    {
+        advance(HeapConstants::cellsPerBlock - 1);
+        if (m_block < m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell < m_heap.nextCell))
+            return *this;
+
+        while (m_block < m_heap.usedBlocks && !m_heap.blocks[m_block]->marked.get(m_cell))
+            advance(HeapConstants::cellsPerBlock - 1);
+        return *this;
+    }
+
+    inline DeadObjectIterator::DeadObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
+    {
+        ++(*this);
+    }
+
+    inline DeadObjectIterator& DeadObjectIterator::operator++()
     {
         do {
-            for (++m_cell; m_cell != m_endCell; ++m_cell)
-                if (m_cell->u.freeCell.zeroIfFree != 0) {
-                    return *this;
-                }
-
-            if (++m_block != m_endBlock) {
-                m_cell = (*m_block)->cells;
-                m_endCell = (*m_block)->cells + HeapConstants<heapType>::cellsPerBlock;
-            }
-        } while(m_block != m_endBlock);
-
-        m_cell = 0;
+            advance(HeapConstants::cellsPerBlock - 1);
+            ASSERT(m_block > m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell >= m_heap.nextCell));
+        } while (m_block < m_heap.usedBlocks && m_heap.blocks[m_block]->marked.get(m_cell));
         return *this;
     }
 
-    template <HeapType heapType> 
-    JSCell* CollectorHeapIterator<heapType>::operator*() const
+    inline ObjectIterator::ObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
     {
-        return reinterpret_cast<JSCell*>(m_cell);
+        ++(*this);
+    }
+
+    inline ObjectIterator& ObjectIterator::operator++()
+    {
+        advance(HeapConstants::cellsPerBlock - 1);
+        return *this;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index abe5038..de24f4a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -50,6 +50,7 @@
     macro(get) \
     macro(getPrototypeOf) \
     macro(getOwnPropertyDescriptor) \
+    macro(getOwnPropertyNames) \
     macro(hasOwnProperty) \
     macro(ignoreCase) \
     macro(index) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index 2507698..2f88df9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -36,6 +36,7 @@ namespace JSC {
 Completion checkSyntax(ExecState* exec, const SourceCode& source)
 {
     JSLock lock(exec);
+    ASSERT(exec->globalData().identifierTable == currentIdentifierTable());
 
     RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
     JSObject* error = program->checkSyntax(exec);
@@ -48,6 +49,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
 Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
+    ASSERT(exec->globalData().identifierTable == currentIdentifierTable());
 
     RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
     JSObject* error = program->compile(exec, scopeChain.node());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index 9908fef..ab95d06 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -28,6 +28,7 @@
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include <math.h>
@@ -35,7 +36,7 @@
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 extern "C" time_t time(time_t* timer); // Provided by libce.
 #endif
 
@@ -77,14 +78,14 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     double value;
 
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
-        value = getCurrentUTCTime();
+        value = jsCurrentTime();
     else if (numArgs == 1) {
         if (args.at(0).inherits(&DateInstance::info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
             if (primitive.isString())
-                value = parseDate(primitive.getString());
+                value = parseDate(exec, primitive.getString(exec));
             else
                 value = primitive.toNumber(exec);
         }
@@ -108,7 +109,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
             t.second = args.at(5).toInt32(exec);
             t.isDST = -1;
             double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
-            value = gregorianDateTimeToMS(t, ms, false);
+            value = gregorianDateTimeToMS(exec, t, ms, false);
         }
     }
 
@@ -132,8 +133,12 @@ static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const
     time_t localTime = time(0);
     tm localTM;
     getLocalTime(&localTime, &localTM);
-    GregorianDateTime ts(localTM);
-    return jsNontrivialString(exec, formatDate(ts) + " " + formatTime(ts, false));
+    GregorianDateTime ts(exec, localTM);
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDate(ts, date);
+    formatTime(ts, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 CallType DateConstructor::getCallData(CallData& callData)
@@ -144,12 +149,12 @@ CallType DateConstructor::getCallData(CallData& callData)
 
 static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
+    return jsNumber(exec, parseDate(exec, args.at(0).toString(exec)));
 }
 
 static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, getCurrentUTCTime());
+    return jsNumber(exec, jsCurrentTime());
 }
 
 static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
@@ -173,7 +178,7 @@ static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const
     t.minute = args.at(4).toInt32(exec);
     t.second = args.at(5).toInt32(exec);
     double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
-    return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
+    return jsNumber(exec, timeClip(gregorianDateTimeToMS(exec, t, ms, true)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
index a725478..f129407 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
@@ -43,6 +43,7 @@
 #include "config.h"
 #include "DateConversion.h"
 
+#include "CallFrame.h"
 #include "UString.h"
 #include <wtf/DateMath.h>
 #include <wtf/StringExtras.h>
@@ -51,51 +52,51 @@ using namespace WTF;
 
 namespace JSC {
 
-double parseDate(const UString &date)
+double parseDate(ExecState* exec, const UString &date)
 {
-    return parseDateFromNullTerminatedCharacters(date.UTF8String().c_str());
+    if (date == exec->globalData().cachedDateString)
+        return exec->globalData().cachedDateStringValue;
+    double value = parseDateFromNullTerminatedCharacters(exec, date.UTF8String().c_str());
+    exec->globalData().cachedDateString = date;
+    exec->globalData().cachedDateStringValue = value;
+    return value;
 }
 
-UString formatDate(const GregorianDateTime &t)
+void formatDate(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
+    snprintf(buffer, DateConversionBufferSize, "%s %s %02d %04d",
         weekdayName[(t.weekDay + 6) % 7],
         monthName[t.month], t.monthDay, t.year + 1900);
-    return buffer;
 }
 
-UString formatDateUTCVariant(const GregorianDateTime &t)
+void formatDateUTCVariant(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
+    snprintf(buffer, DateConversionBufferSize, "%s, %02d %s %04d",
         weekdayName[(t.weekDay + 6) % 7],
         t.monthDay, monthName[t.month], t.year + 1900);
-    return buffer;
 }
 
-UString formatTime(const GregorianDateTime &t, bool utc)
+void formatTime(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    if (utc) {
-        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
-    } else {
-        int offset = abs(gmtoffset(t));
-        char timeZoneName[70];
-        struct tm gtm = t;
-        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+    int offset = abs(gmtoffset(t));
+    char timeZoneName[70];
+    struct tm gtm = t;
+    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 
-        if (timeZoneName[0]) {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
-        } else {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
-        }
+    if (timeZoneName[0]) {
+        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d (%s)",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+    } else {
+        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
     }
-    return UString(buffer);
+}
+
+void formatTimeUTC(const GregorianDateTime &t, DateConversionBuffer& buffer)
+{
+    snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
index 0d12815..ff32b50 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
@@ -42,18 +42,21 @@
 #ifndef DateConversion_h
 #define DateConversion_h
 
-namespace WTF {
-    struct GregorianDateTime;
-}
+#include "UString.h"
 
 namespace JSC {
 
-class UString;
+class ExecState;
+struct GregorianDateTime;
 
-double parseDate(const UString&);
-UString formatDate(const WTF::GregorianDateTime&);
-UString formatDateUTCVariant(const WTF::GregorianDateTime&);
-UString formatTime(const WTF::GregorianDateTime&, bool inputIsUTC);
+static const unsigned DateConversionBufferSize = 100;
+typedef char DateConversionBuffer[DateConversionBufferSize];
+
+double parseDate(ExecState* exec, const UString&);
+void formatDate(const GregorianDateTime&, DateConversionBuffer&);
+void formatDateUTCVariant(const GregorianDateTime&, DateConversionBuffer&);
+void formatTime(const GregorianDateTime&, DateConversionBuffer&);
+void formatTimeUTC(const GregorianDateTime&, DateConversionBuffer&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index d4c9ef7..b43b183 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -40,36 +40,48 @@ DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structu
     setInternalValue(jsNaN(exec));
 }
 
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
+    : JSWrapperObject(structure)
+{
+    setInternalValue(jsNumber(exec, timeClip(time)));
+}
+
 DateInstance::DateInstance(ExecState* exec, double time)
     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
 {
     setInternalValue(jsNumber(exec, timeClip(time)));
 }
 
-bool DateInstance::getGregorianDateTime(ExecState* exec, bool outputIsUTC, GregorianDateTime& t) const
+const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
 {
     double milli = internalNumber();
     if (isnan(milli))
-        return false;
+        return 0;
 
     if (!m_data)
         m_data = exec->globalData().dateInstanceCache.add(milli);
 
-    if (outputIsUTC) {
-        if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), true, m_data->m_cachedGregorianDateTimeUTC);
-            m_data->m_gregorianDateTimeUTCCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTimeUTC);
-    } else {
-        if (m_data->m_gregorianDateTimeCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), false, m_data->m_cachedGregorianDateTime);
-            m_data->m_gregorianDateTimeCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTime);
+    if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, false, m_data->m_cachedGregorianDateTime);
+        m_data->m_gregorianDateTimeCachedForMS = milli;
     }
+    return &m_data->m_cachedGregorianDateTime;
+}
+
+const GregorianDateTime* DateInstance::calculateGregorianDateTimeUTC(ExecState* exec) const
+{
+    double milli = internalNumber();
+    if (isnan(milli))
+        return 0;
 
-    return true;
+    if (!m_data)
+        m_data = exec->globalData().dateInstanceCache.add(milli);
+
+    if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, true, m_data->m_cachedGregorianDateTimeUTC);
+        m_data->m_gregorianDateTimeUTCCachedForMS = milli;
+    }
+    return &m_data->m_cachedGregorianDateTimeUTC;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index 38b321c..77d46de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -32,23 +32,38 @@ namespace JSC {
     class DateInstance : public JSWrapperObject {
     public:
         DateInstance(ExecState*, double);
+        DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
         explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
         static JS_EXPORTDATA const ClassInfo info;
 
-        bool getGregorianDateTime(ExecState*, bool outputIsUTC, WTF::GregorianDateTime&) const;
+        const GregorianDateTime* gregorianDateTime(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTime;
+            return calculateGregorianDateTime(exec);
+        }
+        
+        const GregorianDateTime* gregorianDateTimeUTC(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeUTCCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTimeUTC;
+            return calculateGregorianDateTimeUTC(exec);
+        }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
         static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 
     private:
+        const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
+        const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
         virtual const ClassInfo* classInfo() const { return &info; }
 
         mutable RefPtr<DateInstanceData> m_data;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
index b626c1d..d208580 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
@@ -40,9 +40,9 @@ namespace JSC {
         static PassRefPtr<DateInstanceData> create() { return adoptRef(new DateInstanceData); }
 
         double m_gregorianDateTimeCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTime;
+        GregorianDateTime m_cachedGregorianDateTime;
         double m_gregorianDateTimeUTCCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTimeUTC;
+        GregorianDateTime m_cachedGregorianDateTimeUTC;
 
     private:
         DateInstanceData()
@@ -56,6 +56,11 @@ namespace JSC {
     public:
         DateInstanceCache()
         {
+            reset();
+        }
+        
+        void reset()
+        {
             for (size_t i = 0; i < cacheSize; ++i)
                 m_cache[i].key = NaN;
         }
@@ -72,7 +77,7 @@ namespace JSC {
         }
 
     private:
-        static const size_t cacheSize = 64;
+        static const size_t cacheSize = 16;
 
         struct CacheEntry {
             double key;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index 3f3e1f9..25b0ac4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -26,9 +26,9 @@
 #include "DateConversion.h"
 #include "Error.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
-#include <float.h>
 
 #if !PLATFORM(MAC) && HAVE(LANGINFO_H)
 #include <langinfo.h>
@@ -60,7 +60,7 @@
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t); //provided by libce
 #endif
 
@@ -198,7 +198,7 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 {
 #if HAVE(LANGINFO_H)
     static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
-#elif (PLATFORM(WINCE) && !PLATFORM(QT)) || PLATFORM(SYMBIAN)
+#elif (OS(WINCE) && !PLATFORM(QT)) || OS(SYMBIAN)
      // strftime() does not support '#' on WinCE or Symbian
     static const char* const formatStrings[] = { "%c", "%x", "%X" };
 #else
@@ -253,11 +253,10 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 
 static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format, const ArgList&)
 {
-    GregorianDateTime gregorianDateTime;
-    const bool outputIsUTC = false;
-    if (!dateObject->getGregorianDateTime(exec, outputIsUTC, gregorianDateTime))
+    const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return formatLocaleDate(exec, gregorianDateTime, format);
+    return formatLocaleDate(exec, *gregorianDateTime, format);
 }
 
 #endif // !PLATFORM(MAC)
@@ -420,14 +419,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDate(*gregorianDateTime, date);
+    formatTime(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -435,14 +436,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDateUTCVariant(*gregorianDateTime, date);
+    formatTimeUTC(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -450,17 +453,15 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
-    const bool outputIsUTC = true;
-    
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
     // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
     char buffer[28];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year, gregorianDateTime->month + 1, gregorianDateTime->monthDay, gregorianDateTime->hour, gregorianDateTime->minute, gregorianDateTime->second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
@@ -470,14 +471,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t));
+    DateConversionBuffer date;
+    formatDate(*gregorianDateTime, date);
+    return jsNontrivialString(exec, date);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -485,14 +486,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatTime(t, outputIsUTC));
+    DateConversionBuffer time;
+    formatTime(*gregorianDateTime, time);
+    return jsNontrivialString(exec, time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -535,14 +536,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -550,14 +549,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -565,14 +562,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDateUTCVariant(*gregorianDateTime, date);
+    formatTimeUTC(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -580,14 +579,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -595,14 +592,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -610,14 +605,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -625,14 +618,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -640,14 +631,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -655,14 +644,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -670,14 +657,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -685,14 +670,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -700,14 +683,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -715,14 +696,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -730,14 +709,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -745,14 +722,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -790,14 +765,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
+    return jsNumber(exec, -gregorianDateTime->utcOffset / minutesPerHour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -830,16 +803,21 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
     double secs = floor(milli / msPerSecond);
     double ms = milli - secs * msPerSecond;
 
-    GregorianDateTime t;
-    thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    const GregorianDateTime* other = inputIsUTC 
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!other)
+        return jsNaN(exec);
 
-    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
+    GregorianDateTime gregorianDateTime;
+    gregorianDateTime.copyFrom(*other);
+    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -857,26 +835,28 @@ static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const
     }      
     
     double milli = thisDateObj->internalNumber();
-    double ms = 0;
-
-    GregorianDateTime t;
-    if (numArgsToUse == 3 && isnan(milli))
-        // Based on ECMA 262 15.9.5.40 - .41 (set[UTC]FullYear)
-        // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
-    else {
-        double secs = floor(milli / msPerSecond);
-        ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    double ms = 0; 
+
+    GregorianDateTime gregorianDateTime; 
+    if (numArgsToUse == 3 && isnan(milli)) 
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime); 
+    else { 
+        ms = milli - floor(milli / msPerSecond) * msPerSecond; 
+        const GregorianDateTime* other = inputIsUTC 
+            ? thisDateObj->gregorianDateTimeUTC(exec)
+            : thisDateObj->gregorianDateTime(exec);
+        if (!other)
+            return jsNaN(exec);
+        gregorianDateTime.copyFrom(*other);
     }
     
-    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
+    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -970,8 +950,6 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
         JSValue result = jsNaN(exec);
@@ -982,15 +960,16 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     double milli = thisDateObj->internalNumber();
     double ms = 0;
 
-    GregorianDateTime t;
+    GregorianDateTime gregorianDateTime;
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
         // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime);
     else {   
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, outputIsUTC, t);
+        if (const GregorianDateTime* other = thisDateObj->gregorianDateTime(exec))
+            gregorianDateTime.copyFrom(*other);
     }
     
     bool ok = true;
@@ -1001,8 +980,8 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
         return result;
     }
             
-    t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, outputIsUTC));
+    gregorianDateTime.year = (year > 99 || year < 0) ? year - 1900 : year;
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -1012,16 +991,14 @@ JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
 
     // NOTE: IE returns the full year even in getYear.
-    return jsNumber(exec, t.year);
+    return jsNumber(exec, gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index f565775..612ca06 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
index ddd4bc4..69464b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
@@ -94,7 +94,7 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const UString& message,
 
 JSObject* Error::create(ExecState* exec, ErrorType type, const char* message)
 {
-    return create(exec, type, message, -1, -1, NULL);
+    return create(exec, type, message, -1, -1, UString());
 }
 
 JSObject* throwError(ExecState* exec, JSObject* error)
@@ -105,21 +105,21 @@ JSObject* throwError(ExecState* exec, JSObject* error)
 
 JSObject* throwError(ExecState* exec, ErrorType type)
 {
-    JSObject* error = Error::create(exec, type, UString(), -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, UString(), -1, -1, UString());
     exec->setException(error);
     return error;
 }
 
 JSObject* throwError(ExecState* exec, ErrorType type, const UString& message)
 {
-    JSObject* error = Error::create(exec, type, message, -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, message, -1, -1, UString());
     exec->setException(error);
     return error;
 }
 
 JSObject* throwError(ExecState* exec, ErrorType type, const char* message)
 {
-    JSObject* error = Error::create(exec, type, message, -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, message, -1, -1, UString());
     exec->setException(error);
     return error;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
index a9a7a43..eb35733 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -23,6 +23,7 @@
 
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include "UString.h"
@@ -48,21 +49,19 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, NonNullPassRefPtr<Structure> str
 JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue name = thisObj->get(exec, exec->propertyNames().name);
+    JSValue message = thisObj->get(exec, exec->propertyNames().message);
 
-    UString s = "Error";
+    // Mozilla-compatible format.
 
-    JSValue v = thisObj->get(exec, exec->propertyNames().name);
-    if (!v.isUndefined())
-        s = v.toString(exec);
-
-    v = thisObj->get(exec, exec->propertyNames().message);
-    if (!v.isUndefined()) {
-        // Mozilla-compatible format.
-        s += ": ";
-        s += v.toString(exec);
+    if (!name.isUndefined()) {
+        if (!message.isUndefined())
+            return jsMakeNontrivialString(exec, name.toString(exec), ": ", message.toString(exec));
+        return jsNontrivialString(exec, name.toString(exec));
     }
-
-    return jsNontrivialString(exec, s);
+    if (!message.isUndefined())
+        return jsMakeNontrivialString(exec, "Error: ", message.toString(exec));
+    return jsNontrivialString(exec, "Error");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 5bead90..b9c6319 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -58,7 +58,7 @@ JSValue createInterruptedExecutionException(JSGlobalData* globalData)
 
 static JSValue createError(ExecState* exec, ErrorType e, const char* msg)
 {
-    return Error::create(exec, e, msg, -1, -1, 0);
+    return Error::create(exec, e, msg, -1, -1, UString());
 }
 
 JSValue createStackOverflowError(ExecState* exec)
@@ -77,9 +77,7 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString message = "Can't find variable: ";
-    message.append(ident.ustring());
-    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
+    JSObject* exception = Error::create(exec, ReferenceError, makeString("Can't find variable: ", ident.ustring()), line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -88,59 +86,36 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     
 static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
-    if (!expressionStop || expressionStart > codeBlock->source()->length()) {
-        UString errorText = value.toString(exec);
-        errorText.append(" is ");
-        errorText.append(error);
-        return errorText;
-    }
+    if (!expressionStop || expressionStart > codeBlock->source()->length())
+        return makeString(value.toString(exec), " is ", error);
+    if (expressionStart < expressionStop)
+        return makeString("Result of expression '", codeBlock->source()->getRange(expressionStart, expressionStop), "' [", value.toString(exec), "] is ", error, ".");
 
-    UString errorText = "Result of expression ";
-    
-    if (expressionStart < expressionStop) {
-        errorText.append('\'');
-        errorText.append(codeBlock->source()->getRange(expressionStart, expressionStop));
-        errorText.append("' [");
-        errorText.append(value.toString(exec));
-        errorText.append("] is ");
-    } else {
-        // No range information, so give a few characters of context
-        const UChar* data = codeBlock->source()->data();
-        int dataLength = codeBlock->source()->length();
-        int start = expressionStart;
-        int stop = expressionStart;
-        // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
-        // then strip whitespace.
-        while (start > 0 && (expressionStart - start < 20) && data[start - 1] != '\n')
-            start--;
-        while (start < (expressionStart - 1) && isStrWhiteSpace(data[start]))
-            start++;
-        while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
-            stop++;
-        while (stop > expressionStart && isStrWhiteSpace(data[stop]))
-            stop--;
-        errorText.append("near '...");
-        errorText.append(codeBlock->source()->getRange(start, stop));
-        errorText.append("...' [");
-        errorText.append(value.toString(exec));
-        errorText.append("] is ");
-    }
-    errorText.append(error);
-    errorText.append(".");
-    return errorText;
+    // No range information, so give a few characters of context
+    const UChar* data = codeBlock->source()->data();
+    int dataLength = codeBlock->source()->length();
+    int start = expressionStart;
+    int stop = expressionStart;
+    // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
+    // then strip whitespace.
+    while (start > 0 && (expressionStart - start < 20) && data[start - 1] != '\n')
+        start--;
+    while (start < (expressionStart - 1) && isStrWhiteSpace(data[start]))
+        start++;
+    while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
+        stop++;
+    while (stop > expressionStart && isStrWhiteSpace(data[stop]))
+        stop--;
+    return makeString("Result of expression near '...", codeBlock->source()->getRange(start, stop), "...' [", value.toString(exec), "] is ", error, ".");
 }
 
 JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
-    UString message = "not a valid argument for '";
-    message.append(op);
-    message.append("'");
-    
     int startOffset = 0;
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, message);
+    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, makeString("not a valid argument for '", op, "'"));
     JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
@@ -213,4 +188,9 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     return exception;
 }
 
+JSValue throwOutOfMemoryError(ExecState* exec)
+{
+    return throwError(exec, GeneralError, "Out of memory");
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index e739d09..b6e7373 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -51,6 +51,7 @@ namespace JSC {
     JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
+    JSValue throwOutOfMemoryError(ExecState*);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
index 7586746..79900dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
@@ -30,6 +30,7 @@
 #include "CodeBlock.h"
 #include "JIT.h"
 #include "Parser.h"
+#include "StringBuilder.h"
 #include "Vector.h"
 
 namespace JSC {
@@ -265,14 +266,13 @@ PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifi
 UString FunctionExecutable::paramString() const
 {
     FunctionParameters& parameters = *m_parameters;
-    UString s("");
+    StringBuilder builder;
     for (size_t pos = 0; pos < parameters.size(); ++pos) {
-        if (!s.isEmpty())
-            s += ", ";
-        s += parameters[pos].ustring();
+        if (!builder.isEmpty())
+            builder.append(", ");
+        builder.append(parameters[pos].ustring());
     }
-
-    return s;
+    return builder.build();
 }
 
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index 9d88400..9b0b1bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -21,14 +21,15 @@
 #include "config.h"
 #include "FunctionConstructor.h"
 
+#include "Debugger.h"
 #include "FunctionPrototype.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
-#include "Parser.h"
-#include "Debugger.h"
 #include "Lexer.h"
 #include "Nodes.h"
+#include "Parser.h"
+#include "StringBuilder.h"
 
 namespace JSC {
 
@@ -76,12 +77,19 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     if (args.isEmpty())
         program = "(function() { \n})";
     else if (args.size() == 1)
-        program = "(function() { " + args.at(0).toString(exec) + "\n})";
+        program = makeString("(function() { ", args.at(0).toString(exec), "\n})");
     else {
-        program = "(function(" + args.at(0).toString(exec);
-        for (size_t i = 1; i < args.size() - 1; i++)
-            program += "," + args.at(i).toString(exec);
-        program += ") { " + args.at(args.size() - 1).toString(exec) + "\n})";
+        StringBuilder builder;
+        builder.append("(function(");
+        builder.append(args.at(0).toString(exec));
+        for (size_t i = 1; i < args.size() - 1; i++) {
+            builder.append(",");
+            builder.append(args.at(i).toString(exec));
+        }
+        builder.append(") { ");
+        builder.append(args.at(args.size() - 1).toString(exec));
+        builder.append("\n})");
+        program = builder.build();
     }
 
     int errLine;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
index 45f17b1..a77b5b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -25,6 +25,7 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "Interpreter.h"
 #include "Lexer.h"
 #include "PrototypeFunction.h"
@@ -76,7 +77,7 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
         UChar ch = functionBody[i];
         if (!Lexer::isWhiteSpace(ch) && !Lexer::isLineTerminator(ch)) {
             if (ch != ';' && ch != '}')
-                functionBody = functionBody.substr(0, i + 1) + ";" + functionBody.substr(i + 1, functionBody.size() - (i + 1));
+                functionBody = makeString(functionBody.substr(0, i + 1), ";", functionBody.substr(i + 1, functionBody.size() - (i + 1)));
             return;
         }
     }
@@ -90,13 +91,13 @@ JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSVa
             FunctionExecutable* executable = function->jsExecutable();
             UString sourceString = executable->source().toString();
             insertSemicolonIfNeeded(sourceString);
-            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + executable->paramString() + ") " + sourceString);
+            return jsMakeNontrivialString(exec, "function ", function->name(exec), "(", executable->paramString(), ") ", sourceString);
         }
     }
 
     if (thisValue.inherits(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
+        return jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}");
     }
 
     return throwError(exec, TypeError);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index d1d6a1d..af783f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 68e9ea3..27ffbe7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -34,6 +34,7 @@ namespace JSC {
     // This is an internal value object which stores getter and setter functions
     // for a property.
     class GetterSetter : public JSCell {
+        friend class JIT;
     public:
         GetterSetter(ExecState* exec)
             : JSCell(exec->globalData().getterSetterStructure.get())
@@ -50,7 +51,7 @@ namespace JSC {
         void setSetter(JSObject* setter) { m_setter = setter; }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren));
+            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount);
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
index 389b1c3..a14ce4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -37,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 7db723b..9acccf0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -22,12 +22,15 @@
 #include "Identifier.h"
 
 #include "CallFrame.h"
+#include "NumericStrings.h"
 #include <new> // for placement new
 #include <string.h> // for strlen
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
 #include <wtf/HashSet.h>
 
+using WTF::ThreadSpecific;
+
 namespace JSC {
 
 typedef HashMap<const char*, RefPtr<UString::Rep>, PtrHash<const char*> > LiteralIdentifierTable;
@@ -38,13 +41,13 @@ public:
     {
         HashSet<UString::Rep*>::iterator end = m_table.end();
         for (HashSet<UString::Rep*>::iterator iter = m_table.begin(); iter != end; ++iter)
-            (*iter)->setIdentifierTable(0);
+            (*iter)->setIsIdentifier(false);
     }
-    
+
     std::pair<HashSet<UString::Rep*>::iterator, bool> add(UString::Rep* value)
     {
         std::pair<HashSet<UString::Rep*>::iterator, bool> result = m_table.add(value);
-        (*result.first)->setIdentifierTable(this);
+        (*result.first)->setIsIdentifier(true);
         return result;
     }
 
@@ -52,7 +55,7 @@ public:
     std::pair<HashSet<UString::Rep*>::iterator, bool> add(U value)
     {
         std::pair<HashSet<UString::Rep*>::iterator, bool> result = m_table.add<U, V>(value);
-        (*result.first)->setIdentifierTable(this);
+        (*result.first)->setIsIdentifier(true);
         return result;
     }
 
@@ -77,20 +80,20 @@ void deleteIdentifierTable(IdentifierTable* table)
 
 bool Identifier::equal(const UString::Rep* r, const char* s)
 {
-    int length = r->len;
-    const UChar* d = r->data();
+    int length = r->length();
+    const UChar* d = r->characters();
     for (int i = 0; i != length; ++i)
         if (d[i] != (unsigned char)s[i])
             return false;
     return s[length] == 0;
 }
 
-bool Identifier::equal(const UString::Rep* r, const UChar* s, int length)
+bool Identifier::equal(const UString::Rep* r, const UChar* s, unsigned length)
 {
-    if (r->len != length)
+    if (r->length() != length)
         return false;
-    const UChar* d = r->data();
-    for (int i = 0; i != length; ++i)
+    const UChar* d = r->characters();
+    for (unsigned i = 0; i != length; ++i)
         if (d[i] != s[i])
             return false;
     return true;
@@ -110,27 +113,21 @@ struct CStringTranslator {
     static void translate(UString::Rep*& location, const char* c, unsigned hash)
     {
         size_t length = strlen(c);
-        UChar* d = static_cast<UChar*>(fastMalloc(sizeof(UChar) * length));
+        UChar* d;
+        UString::Rep* r = UString::Rep::createUninitialized(length, d).releaseRef();
         for (size_t i = 0; i != length; i++)
             d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        
-        UString::Rep* r = UString::Rep::create(d, static_cast<int>(length)).releaseRef();
-        r->_hash = hash;
-
+        r->setHash(hash);
         location = r;
     }
 };
 
 PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const char* c)
 {
-    if (!c) {
-        UString::Rep::null().hash();
-        return &UString::Rep::null();
-    }
-    if (!c[0]) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
-    }
+    if (!c)
+        return UString::null().rep();
+    if (!c[0])
+        return UString::Rep::empty();
     if (!c[1])
         return add(globalData, globalData->smallStrings.singleCharacterStringRep(static_cast<unsigned char>(c[0])));
 
@@ -175,13 +172,11 @@ struct UCharBufferTranslator {
 
     static void translate(UString::Rep*& location, const UCharBuffer& buf, unsigned hash)
     {
-        UChar* d = static_cast<UChar*>(fastMalloc(sizeof(UChar) * buf.length));
+        UChar* d;
+        UString::Rep* r = UString::Rep::createUninitialized(buf.length, d).releaseRef();
         for (unsigned i = 0; i != buf.length; i++)
             d[i] = buf.s[i];
-        
-        UString::Rep* r = UString::Rep::create(d, buf.length).releaseRef();
-        r->_hash = hash;
-        
+        r->setHash(hash);
         location = r; 
     }
 };
@@ -193,10 +188,8 @@ PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const UChar*
         if (c <= 0xFF)
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
-    if (!length) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
-    }
+    if (!length)
+        return UString::Rep::empty();
     UCharBuffer buf = {s, length}; 
     pair<HashSet<UString::Rep*>::iterator, bool> addResult = globalData->identifierTable->add<UCharBuffer, UCharBufferTranslator>(buf);
 
@@ -212,22 +205,19 @@ PassRefPtr<UString::Rep> Identifier::add(ExecState* exec, const UChar* s, int le
 
 PassRefPtr<UString::Rep> Identifier::addSlowCase(JSGlobalData* globalData, UString::Rep* r)
 {
-    ASSERT(!r->identifierTable());
-    if (r->len == 1) {
-        UChar c = r->data()[0];
+    ASSERT(!r->isIdentifier());
+    // The empty & null strings are static singletons, and static strings are handled
+    // in ::add() in the header, so we should never get here with a zero length string.
+    ASSERT(r->length());
+
+    if (r->length() == 1) {
+        UChar c = r->characters()[0];
         if (c <= 0xFF)
             r = globalData->smallStrings.singleCharacterStringRep(c);
-            if (r->identifierTable()) {
-#ifndef NDEBUG
-                checkSameIdentifierTable(globalData, r);
-#endif
+            if (r->isIdentifier())
                 return r;
-            }
-    }
-    if (!r->len) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
     }
+
     return *globalData->identifierTable->add(r).first;
 }
 
@@ -238,29 +228,69 @@ PassRefPtr<UString::Rep> Identifier::addSlowCase(ExecState* exec, UString::Rep*
 
 void Identifier::remove(UString::Rep* r)
 {
-    r->identifierTable()->remove(r);
+    currentIdentifierTable()->remove(r);
+}
+    
+Identifier Identifier::from(ExecState* exec, unsigned value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, int value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, double value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
 }
 
 #ifndef NDEBUG
 
-void Identifier::checkSameIdentifierTable(ExecState* exec, UString::Rep* rep)
+void Identifier::checkCurrentIdentifierTable(JSGlobalData* globalData)
 {
-    ASSERT(rep->identifierTable() == exec->globalData().identifierTable);
+    // Check the identifier table accessible through the threadspecific matches the
+    // globalData's identifier table.
+    ASSERT_UNUSED(globalData, globalData->identifierTable == currentIdentifierTable());
 }
 
-void Identifier::checkSameIdentifierTable(JSGlobalData* globalData, UString::Rep* rep)
+void Identifier::checkCurrentIdentifierTable(ExecState* exec)
 {
-    ASSERT(rep->identifierTable() == globalData->identifierTable);
+    checkCurrentIdentifierTable(&exec->globalData());
 }
 
 #else
 
-void Identifier::checkSameIdentifierTable(ExecState*, UString::Rep*)
+// These only exists so that our exports are the same for debug and release builds.
+// This would be an ASSERT_NOT_REACHED(), but we're in NDEBUG only code here!
+void Identifier::checkCurrentIdentifierTable(JSGlobalData*) { CRASH(); }
+void Identifier::checkCurrentIdentifierTable(ExecState*) { CRASH(); }
+
+#endif
+
+ThreadSpecific<ThreadIdentifierTableData>* g_identifierTableSpecific = 0;
+
+#if ENABLE(JSC_MULTIPLE_THREADS)
+
+pthread_once_t createIdentifierTableSpecificOnce = PTHREAD_ONCE_INIT;
+static void createIdentifierTableSpecificCallback()
 {
+    ASSERT(!g_identifierTableSpecific);
+    g_identifierTableSpecific = new ThreadSpecific<ThreadIdentifierTableData>();
 }
+void createIdentifierTableSpecific()
+{
+    pthread_once(&createIdentifierTableSpecificOnce, createIdentifierTableSpecificCallback);
+    ASSERT(g_identifierTableSpecific);
+}
+
+#else 
 
-void Identifier::checkSameIdentifierTable(JSGlobalData*, UString::Rep*)
+void createIdentifierTableSpecific()
 {
+    ASSERT(!g_identifierTableSpecific);
+    g_identifierTableSpecific = new ThreadSpecific<ThreadIdentifierTableData>();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
index 2249179..48b1da1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
@@ -22,6 +22,7 @@
 #define Identifier_h
 
 #include "JSGlobalData.h"
+#include "ThreadSpecific.h"
 #include "UString.h"
 
 namespace JSC {
@@ -53,9 +54,9 @@ namespace JSC {
         
         const char* ascii() const { return _ustring.ascii(); }
         
-        static Identifier from(ExecState* exec, unsigned y) { return Identifier(exec, UString::from(y)); }
-        static Identifier from(ExecState* exec, int y) { return Identifier(exec, UString::from(y)); }
-        static Identifier from(ExecState* exec, double y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, unsigned y);
+        static Identifier from(ExecState* exec, int y);
+        static Identifier from(ExecState* exec, double y);
         
         bool isNull() const { return _ustring.isNull(); }
         bool isEmpty() const { return _ustring.isEmpty(); }
@@ -75,7 +76,7 @@ namespace JSC {
         static void remove(UString::Rep*);
 
         static bool equal(const UString::Rep*, const char*);
-        static bool equal(const UString::Rep*, const UChar*, int length);
+        static bool equal(const UString::Rep*, const UChar*, unsigned length);
         static bool equal(const UString::Rep* a, const UString::Rep* b) { return JSC::equal(a, b); }
 
         static PassRefPtr<UString::Rep> add(ExecState*, const char*); // Only to be used with string literals.
@@ -92,30 +93,28 @@ namespace JSC {
 
         static PassRefPtr<UString::Rep> add(ExecState* exec, UString::Rep* r)
         {
-            if (r->identifierTable()) {
 #ifndef NDEBUG
-                checkSameIdentifierTable(exec, r);
+            checkCurrentIdentifierTable(exec);
 #endif
+            if (r->isIdentifier())
                 return r;
-            }
             return addSlowCase(exec, r);
         }
         static PassRefPtr<UString::Rep> add(JSGlobalData* globalData, UString::Rep* r)
         {
-            if (r->identifierTable()) {
 #ifndef NDEBUG
-                checkSameIdentifierTable(globalData, r);
+            checkCurrentIdentifierTable(globalData);
 #endif
+            if (r->isIdentifier())
                 return r;
-            }
             return addSlowCase(globalData, r);
         }
 
         static PassRefPtr<UString::Rep> addSlowCase(ExecState*, UString::Rep* r);
         static PassRefPtr<UString::Rep> addSlowCase(JSGlobalData*, UString::Rep* r);
 
-        static void checkSameIdentifierTable(ExecState*, UString::Rep*);
-        static void checkSameIdentifierTable(JSGlobalData*, UString::Rep*);
+        static void checkCurrentIdentifierTable(ExecState*);
+        static void checkCurrentIdentifierTable(JSGlobalData*);
     };
     
     inline bool operator==(const Identifier& a, const Identifier& b)
@@ -141,6 +140,67 @@ namespace JSC {
     IdentifierTable* createIdentifierTable();
     void deleteIdentifierTable(IdentifierTable*);
 
+    struct ThreadIdentifierTableData {
+        ThreadIdentifierTableData()
+            : defaultIdentifierTable(0)
+            , currentIdentifierTable(0)
+        {
+        }
+
+        IdentifierTable* defaultIdentifierTable;
+        IdentifierTable* currentIdentifierTable;
+    };
+
+    extern WTF::ThreadSpecific<ThreadIdentifierTableData>* g_identifierTableSpecific;
+    void createIdentifierTableSpecific();
+
+    inline IdentifierTable* defaultIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        return data.defaultIdentifierTable;
+    }
+
+    inline void setDefaultIdentifierTable(IdentifierTable* identifierTable)
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        data.defaultIdentifierTable = identifierTable;
+    }
+
+    inline IdentifierTable* currentIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        return data.currentIdentifierTable;
+    }
+
+    inline IdentifierTable* setCurrentIdentifierTable(IdentifierTable* identifierTable)
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        IdentifierTable* oldIdentifierTable = data.currentIdentifierTable;
+        data.currentIdentifierTable = identifierTable;
+        return oldIdentifierTable;
+    }
+
+    inline void resetCurrentIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        data.currentIdentifierTable = data.defaultIdentifierTable;
+    }
+
 } // namespace JSC
 
 #endif // Identifier_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
index fea89f8..2605a9a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -41,7 +41,7 @@ using namespace WTF;
 
 namespace JSC {
 
-#if PLATFORM(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
+#if OS(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
 static pthread_once_t initializeThreadingKeyOnce = PTHREAD_ONCE_INIT;
 #endif
 
@@ -49,15 +49,16 @@ static void initializeThreadingOnce()
 {
     WTF::initializeThreading();
     initializeUString();
+    JSGlobalData::storeVPtrs();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    WTF::initializeDates();
+    initializeDates();
 #endif
 }
 
 void initializeThreading()
 {
-#if PLATFORM(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
+#if OS(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
     pthread_once(&initializeThreadingKeyOnce, initializeThreadingOnce);
 #else
     static bool initializedThreading = false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
index 2ba2984..c48d628 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
@@ -43,29 +43,29 @@ InternalFunction::InternalFunction(JSGlobalData* globalData, NonNullPassRefPtr<S
     putDirect(globalData->propertyNames->name, jsString(globalData, name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
-const UString& InternalFunction::name(JSGlobalData* globalData)
+const UString& InternalFunction::name(ExecState* exec)
 {
-    return asString(getDirect(globalData->propertyNames->name))->value();
+    return asString(getDirect(exec->globalData().propertyNames->name))->value(exec);
 }
 
-const UString InternalFunction::displayName(JSGlobalData* globalData)
+const UString InternalFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
     
-    if (displayName && isJSString(globalData, displayName))
-        return asString(displayName)->value();
+    if (displayName && isJSString(&exec->globalData(), displayName))
+        return asString(displayName)->value(exec);
     
     return UString::null();
 }
 
-const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+const UString InternalFunction::calculatedDisplayName(ExecState* exec)
 {
-    const UString explicitName = displayName(globalData);
+    const UString explicitName = displayName(exec);
     
     if (!explicitName.isEmpty())
         return explicitName;
     
-    return name(globalData);
+    return name(exec);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index de9a1d6..d19b82b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -36,13 +36,13 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const; 
         static JS_EXPORTDATA const ClassInfo info;
 
-        const UString& name(JSGlobalData*);
-        const UString displayName(JSGlobalData*);
-        const UString calculatedDisplayName(JSGlobalData*);
+        const UString& name(ExecState*);
+        const UString displayName(ExecState*);
+        const UString calculatedDisplayName(ExecState*);
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
index aca550e..10ded4c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -23,8 +23,6 @@
 #ifndef JSAPIValueWrapper_h
 #define JSAPIValueWrapper_h
 
-#include <wtf/Platform.h>
-
 #include "JSCell.h"
 #include "CallFrame.h"
 
@@ -39,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount);
         }
 
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
index 22fdaaf..85e8bba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
@@ -139,9 +139,9 @@ bool JSActivation::isDynamicScope() const
     return d()->functionExecutable->usesEval();
 }
 
-JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSActivation::argumentsGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSActivation* activation = asActivation(slot.slotBase());
+    JSActivation* activation = asActivation(slotBase);
 
     if (activation->d()->functionExecutable->usesArguments()) {
         PropertySlot slot;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index ee98191..91c960c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
@@ -89,7 +89,7 @@ namespace JSC {
             RefPtr<FunctionExecutable> functionExecutable;
         };
         
-        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
         JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index fd9e7b2..ae9e038 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -151,7 +151,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
     m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = 0;
     m_storage->m_sparseValueMap = 0;
-    m_storage->lazyCreationData = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     JSValue* vector = m_storage->m_vector;
     for (size_t i = 0; i < initialCapacity; ++i)
@@ -172,6 +173,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
     m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = initialCapacity;
     m_storage->m_sparseValueMap = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     size_t i = 0;
     ArgList::const_iterator end = list.end();
@@ -185,6 +188,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 
 JSArray::~JSArray()
 {
+    ASSERT(vptr() == JSGlobalData::jsArrayVPtr);
     checkConsistency(DestructorConsistencyCheck);
 
     delete m_storage->m_sparseValueMap;
@@ -328,13 +332,24 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         }
 
         // We miss some cases where we could compact the storage, such as a large array that is being filled from the end
-        // (which will only be compacted as we reach indices that are less than cutoff) - but this makes the check much faster.
+        // (which will only be compacted as we reach indices that are less than MIN_SPARSE_ARRAY_INDEX) - but this makes the check much faster.
         if ((i > MAX_STORAGE_VECTOR_INDEX) || !isDenseEnoughForVector(i + 1, storage->m_numValuesInVector + 1)) {
             if (!map) {
                 map = new SparseArrayValueMap;
                 storage->m_sparseValueMap = map;
             }
-            map->set(i, value);
+
+            pair<SparseArrayValueMap::iterator, bool> result = map->add(i, value);
+            if (!result.second) { // pre-existing entry
+                result.first->second = value;
+                return;
+            }
+
+            size_t capacity = map->capacity();
+            if (capacity != storage->reportedMapCapacity) {
+                Heap::heap(this)->reportExtraMemoryCost((capacity - storage->reportedMapCapacity) * (sizeof(unsigned) + sizeof(JSValue)));
+                storage->reportedMapCapacity = capacity;
+            }
             return;
         }
     }
@@ -380,8 +395,6 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
 
     unsigned vectorLength = m_vectorLength;
 
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
-
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
             storage->m_vector[j] = JSValue();
@@ -402,6 +415,8 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     m_storage = storage;
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
 }
 
 bool JSArray::deleteProperty(ExecState* exec, const Identifier& propertyName)
@@ -454,7 +469,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     return false;
 }
 
-void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // FIXME: Filling PropertyNameArray with an identifier for every integer
     // is incredibly inefficient for large arrays. We need a different approach,
@@ -474,7 +489,10 @@ void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
             propertyNames.add(Identifier::from(exec, it->first));
     }
 
-    JSObject::getOwnPropertyNames(exec, propertyNames);
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSArray::increaseVectorLength(unsigned newLength)
@@ -492,13 +510,15 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage))
         return false;
 
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
     m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         storage->m_vector[i] = JSValue();
 
     m_storage = storage;
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
+
     return true;
 }
 
@@ -785,7 +805,7 @@ struct AVLTreeAbstractorForArrayCompare {
             m_cachedCall->setThis(m_globalThisValue);
             m_cachedCall->setArgument(0, va);
             m_cachedCall->setArgument(1, vb);
-            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame(m_exec));
         } else {
             MarkedArgumentBuffer arguments;
             arguments.append(va);
@@ -928,10 +948,10 @@ void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 
 void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
 {
-    ASSERT(m_storage->m_length == maxSize);
+    ASSERT(m_storage->m_length >= maxSize);
     UNUSED_PARAM(maxSize);
     JSValue* vector = m_storage->m_vector;
-    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
+    unsigned vectorEnd = min(maxSize, m_vectorLength);
     unsigned i = 0;
     for (; i < vectorEnd; ++i) {
         JSValue& v = vector[i];
@@ -940,7 +960,7 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz
         buffer[i] = v;
     }
 
-    for (; i < m_storage->m_length; ++i)
+    for (; i < maxSize; ++i)
         buffer[i] = get(exec, i);
 }
 
@@ -1002,14 +1022,14 @@ unsigned JSArray::compactForSorting()
     return numDefined;
 }
 
-void* JSArray::lazyCreationData()
+void* JSArray::subclassData() const
 {
-    return m_storage->lazyCreationData;
+    return m_storage->subclassData;
 }
 
-void JSArray::setLazyCreationData(void* d)
+void JSArray::setSubclassData(void* d)
 {
-    m_storage->lazyCreationData = d;
+    m_storage->subclassData = d;
 }
 
 #if CHECK_ARRAY_CONSISTENCY
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 8c22451..f65f2bc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -31,7 +31,8 @@ namespace JSC {
         unsigned m_length;
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
-        void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
+        void* subclassData; // A JSArray subclass can use this to fill the vector lazily.
+        size_t reportedMapCapacity;
         JSValue m_vector[1];
     };
 
@@ -87,7 +88,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
@@ -97,11 +98,11 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void markChildren(MarkStack&);
 
-        void* lazyCreationData();
-        void setLazyCreationData(void*);
+        void* subclassData() const;
+        void setSubclassData(void*);
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 5e5003b..803a08c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -42,10 +42,18 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
 {
     putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
 }
-    
+
+#if !ASSERT_DISABLED
+JSByteArray::~JSByteArray()
+{
+    ASSERT(vptr() == JSGlobalData::jsByteArrayVPtr);
+}
+#endif
+
+
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     return result;
 }
 
@@ -96,12 +104,12 @@ void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
     setIndex(exec, propertyName, value);
 }
 
-void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     unsigned length = m_storage->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier::from(exec, i));
-    JSObject::getOwnPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index fe6e124..5b7adcf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -33,7 +33,7 @@
 namespace JSC {
 
     class JSByteArray : public JSObject {
-        friend struct VPtrSet;
+        friend class JSGlobalData;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
         JSValue getIndex(ExecState* exec, unsigned i)
@@ -82,7 +82,7 @@ namespace JSC {
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual const ClassInfo* classInfo() const { return m_classInfo; }
         static const ClassInfo s_defaultInfo;
@@ -91,6 +91,10 @@ namespace JSC {
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
 
+#if !ASSERT_DISABLED
+        virtual ~JSByteArray();
+#endif
+
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index fae056e..869fbfc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -59,10 +59,10 @@ static const union {
     } doubles;
     
 } NaNInf = { {
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
     { 0x7f, 0xf8, 0, 0, 0, 0, 0, 0 },
     { 0x7f, 0xf0, 0, 0, 0, 0, 0, 0 }
-#elif PLATFORM(MIDDLE_ENDIAN)
+#elif CPU(MIDDLE_ENDIAN)
     { 0, 0, 0xf8, 0x7f, 0, 0, 0, 0 },
     { 0, 0, 0xf0, 0x7f, 0, 0, 0, 0 }
 #else
@@ -76,27 +76,22 @@ extern const double Inf = NaNInf.doubles.Inf_Double;
  
 #endif // !(defined NAN && defined INFINITY)
 
-void* JSCell::operator new(size_t size, ExecState* exec)
-{
-    return exec->heap()->allocate(size);
-}
-
 bool JSCell::getUInt32(uint32_t&) const
 {
     return false;
 }
 
-bool JSCell::getString(UString&stringValue) const
+bool JSCell::getString(ExecState* exec, UString&stringValue) const
 {
     if (!isString())
         return false;
-    stringValue = static_cast<const JSString*>(this)->value();
+    stringValue = static_cast<const JSString*>(this)->value(exec);
     return true;
 }
 
-UString JSCell::getString() const
+UString JSCell::getString(ExecState* exec) const
 {
-    return isString() ? static_cast<const JSString*>(this)->value() : UString();
+    return isString() ? static_cast<const JSString*>(this)->value(exec) : UString();
 }
 
 JSObject* JSCell::getObject()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 722ae33..3c8c829 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -42,14 +42,19 @@ namespace JSC {
         friend class JSString;
         friend class JSValue;
         friend class JSAPIValueWrapper;
-        friend struct VPtrSet;
+        friend class JSZombie;
+        friend class JSGlobalData;
 
     private:
         explicit JSCell(Structure*);
-        JSCell(); // Only used for initializing Collector blocks.
         virtual ~JSCell();
 
     public:
+        static PassRefPtr<Structure> createDummyStructure()
+        {
+            return Structure::create(jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount);
+        }
+
         // Querying the type.
 #if USE(JSVALUE32)
         bool isNumber() const;
@@ -64,8 +69,8 @@ namespace JSC {
         Structure* structure() const;
 
         // Extracting the value.
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject(); // NULL if not an object
         const JSObject* getObject() const; // NULL if not an object
         
@@ -90,6 +95,9 @@ namespace JSC {
         void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
 
         virtual void markChildren(MarkStack&);
+#if ENABLE(JSC_ZOMBIES)
+        virtual bool isZombie() const { return false; }
+#endif
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
@@ -103,6 +111,10 @@ namespace JSC {
         virtual JSString* toThisJSString(ExecState*);
         virtual JSValue getJSNumber();
         void* vptr() { return *reinterpret_cast<void**>(this); }
+        void setVPtr(void* vptr) { *reinterpret_cast<void**>(this) = vptr; }
+
+    protected:
+        static const unsigned AnonymousSlotCount = 0;
 
     private:
         // Base implementation; for non-object classes implements getPropertySlot.
@@ -118,11 +130,6 @@ namespace JSC {
     {
     }
 
-    // Only used for initializing Collector blocks.
-    inline JSCell::JSCell()
-    {
-    }
-
     inline JSCell::~JSCell()
     {
     }
@@ -130,7 +137,7 @@ namespace JSC {
 #if USE(JSVALUE32)
     inline bool JSCell::isNumber() const
     {
-        return Heap::isNumber(const_cast<JSCell*>(this));
+        return m_structure->typeInfo().type() == NumberType;
     }
 #endif
 
@@ -158,6 +165,11 @@ namespace JSC {
         return globalData->heap.allocate(size);
     }
 
+    inline void* JSCell::operator new(size_t size, ExecState* exec)
+    {
+        return exec->heap()->allocate(size);
+    }
+
     // --- JSValue inlines ----------------------------
 
     inline bool JSValue::isString() const
@@ -175,14 +187,14 @@ namespace JSC {
         return isCell() && asCell()->isObject();
     }
 
-    inline bool JSValue::getString(UString& s) const
+    inline bool JSValue::getString(ExecState* exec, UString& s) const
     {
-        return isCell() && asCell()->getString(s);
+        return isCell() && asCell()->getString(exec, s);
     }
 
-    inline UString JSValue::getString() const
+    inline UString JSValue::getString(ExecState* exec) const
     {
-        return isCell() ? asCell()->getString() : UString();
+        return isCell() ? asCell()->getString(exec) : UString();
     }
 
     inline JSObject* JSValue::getObject() const
@@ -342,7 +354,13 @@ namespace JSC {
     {
         return cellBlock(c)->heap;
     }
-
+    
+#if ENABLE(JSC_ZOMBIES)
+    inline bool JSValue::isZombie() const
+    {
+        return isCell() && asCell() && asCell()->isZombie();
+    }
+#endif
 } // namespace JSC
 
 #endif // JSCell_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
index 024e586..cba6795 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
@@ -81,6 +81,8 @@ JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> ex
 
 JSFunction::~JSFunction()
 {
+    ASSERT(vptr() == JSGlobalData::jsFunctionVPtr);
+
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
@@ -120,23 +122,23 @@ JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args
     return exec->interpreter()->execute(jsExecutable(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
-JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::argumentsGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveArguments(exec, thisObj);
 }
 
-JSValue JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::callerGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return jsNumber(exec, thisObj->jsExecutable()->parameterCount());
 }
@@ -160,17 +162,17 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     }
 
     if (propertyName == exec->propertyNames().arguments) {
-        slot.setCustom(this, argumentsGetter);
+        slot.setCacheableCustom(this, argumentsGetter);
         return true;
     }
 
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
 
     if (propertyName == exec->propertyNames().caller) {
-        slot.setCustom(this, callerGetter);
+        slot.setCacheableCustom(this, callerGetter);
         return true;
     }
 
@@ -206,6 +208,17 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
         return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
     }
     
+void JSFunction::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (!isHostFunction() && (mode == IncludeDontEnumProperties)) {
+        propertyNames.add(exec->propertyNames().arguments);
+        propertyNames.add(exec->propertyNames().callee);
+        propertyNames.add(exec->propertyNames().caller);
+        propertyNames.add(exec->propertyNames().length);
+    }
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (isHostFunction()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index fcac9aa..afa24a8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -36,7 +36,7 @@ namespace JSC {
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend struct VPtrSet;
+        friend class JSGlobalData;
 
         typedef InternalFunction Base;
 
@@ -61,7 +61,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         NativeFunction nativeFunction()
@@ -82,6 +82,7 @@ namespace JSC {
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
@@ -89,9 +90,9 @@ namespace JSC {
 
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
+        static JSValue callerGetter(ExecState*, JSValue, const Identifier&);
+        static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
 
         RefPtr<ExecutableBase> m_executable;
         ScopeChain& scopeChain()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
index 1221ef2..45abc86 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -45,10 +45,10 @@
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
 #include "JSStaticScopeObject.h"
-#include "Parser.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
+#include "Parser.h"
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <wtf/Threading.h>
@@ -71,40 +71,38 @@ extern JSC_CONST_HASHTABLE HashTable regExpTable;
 extern JSC_CONST_HASHTABLE HashTable regExpConstructorTable;
 extern JSC_CONST_HASHTABLE HashTable stringTable;
 
-struct VPtrSet {
-    VPtrSet();
-
-    void* jsArrayVPtr;
-    void* jsByteArrayVPtr;
-    void* jsStringVPtr;
-    void* jsFunctionVPtr;
-};
+void* JSGlobalData::jsArrayVPtr;
+void* JSGlobalData::jsByteArrayVPtr;
+void* JSGlobalData::jsStringVPtr;
+void* JSGlobalData::jsFunctionVPtr;
 
-VPtrSet::VPtrSet()
+void JSGlobalData::storeVPtrs()
 {
-    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
-    void* storage = fastMalloc(sizeof(CollectorBlock));
+    CollectorCell cell;
+    void* storage = &cell;
 
+    COMPILE_ASSERT(sizeof(JSArray) <= sizeof(CollectorCell), sizeof_JSArray_must_be_less_than_CollectorCell);
     JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
-    jsArrayVPtr = jsArray->vptr();
+    JSGlobalData::jsArrayVPtr = jsArray->vptr();
     jsArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(CollectorCell), sizeof_JSByteArray_must_be_less_than_CollectorCell);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
-    jsByteArrayVPtr = jsByteArray->vptr();
+    JSGlobalData::jsByteArrayVPtr = jsByteArray->vptr();
     jsByteArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSString) <= sizeof(CollectorCell), sizeof_JSString_must_be_less_than_CollectorCell);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
-    jsStringVPtr = jsString->vptr();
+    JSGlobalData::jsStringVPtr = jsString->vptr();
     jsString->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(CollectorCell), sizeof_JSFunction_must_be_less_than_CollectorCell);
     JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
-    jsFunctionVPtr = jsFunction->vptr();
+    JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
     jsFunction->~JSCell();
-
-    fastFree(storage);
 }
 
-JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
+JSGlobalData::JSGlobalData(bool isShared)
     : isSharedInstance(isShared)
     , clientData(0)
     , arrayTable(fastNew<HashTable>(JSC::arrayTable))
@@ -124,13 +122,10 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , propertyNameIteratorStructure(JSPropertyNameIterator::createStructure(jsNull()))
     , getterSetterStructure(GetterSetter::createStructure(jsNull()))
     , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
+    , dummyMarkableCellStructure(JSCell::createDummyStructure())
 #if USE(JSVALUE32)
     , numberStructure(JSNumberCell::createStructure(jsNull()))
 #endif
-    , jsArrayVPtr(vptrSet.jsArrayVPtr)
-    , jsByteArrayVPtr(vptrSet.jsByteArrayVPtr)
-    , jsStringVPtr(vptrSet.jsStringVPtr)
-    , jsFunctionVPtr(vptrSet.jsFunctionVPtr)
     , identifierTable(createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
@@ -146,7 +141,9 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , dynamicGlobalObject(0)
     , functionCodeBlockBeingReparsed(0)
     , firstStringifierToMark(0)
-    , markStack(vptrSet.jsArrayVPtr)
+    , markStack(jsArrayVPtr)
+    , cachedUTCOffset(NaN)
+    , weakRandom(static_cast<int>(currentTime()))
 #ifndef NDEBUG
     , mainThreadOnly(false)
 #endif
@@ -197,9 +194,17 @@ JSGlobalData::~JSGlobalData()
     delete clientData;
 }
 
-PassRefPtr<JSGlobalData> JSGlobalData::create(bool isShared)
+PassRefPtr<JSGlobalData> JSGlobalData::createNonDefault()
+{
+    return adoptRef(new JSGlobalData(false));
+}
+
+PassRefPtr<JSGlobalData> JSGlobalData::create()
 {
-    return adoptRef(new JSGlobalData(isShared, VPtrSet()));
+    JSGlobalData* globalData = new JSGlobalData(false);
+    setDefaultIdentifierTable(globalData->identifierTable);
+    setCurrentIdentifierTable(globalData->identifierTable);
+    return adoptRef(globalData);
 }
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked()
@@ -219,7 +224,7 @@ JSGlobalData& JSGlobalData::sharedInstance()
 {
     JSGlobalData*& instance = sharedInstanceInternal();
     if (!instance) {
-        instance = create(true).releaseRef();
+        instance = new JSGlobalData(true);
 #if ENABLE(JSC_MULTIPLE_THREADS)
         instance->makeUsableFromMultipleThreads();
 #endif
@@ -251,6 +256,14 @@ JSGlobalData::ClientData::~ClientData()
 {
 }
 
+void JSGlobalData::resetDateCache()
+{
+    cachedUTCOffset = NaN;
+    dstOffsetCache.reset();
+    cachedDateString = UString();
+    dateInstanceCache.reset();
+}
+
 void JSGlobalData::startSampling()
 {
     interpreter->startSampling();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index d2aa2da..0f1f3c6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -38,6 +38,7 @@
 #include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "TimeoutChecker.h"
+#include "WeakRandom.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -61,7 +62,26 @@ namespace JSC {
 
     struct HashTable;
     struct Instruction;    
-    struct VPtrSet;
+
+    struct DSTOffsetCache {
+        DSTOffsetCache()
+        {
+            reset();
+        }
+        
+        void reset()
+        {
+            offset = 0.0;
+            start = 0.0;
+            end = -1.0;
+            increment = 0.0;
+        }
+
+        double offset;
+        double start;
+        double end;
+        double increment;
+    };
 
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
@@ -72,8 +92,9 @@ namespace JSC {
         static bool sharedInstanceExists();
         static JSGlobalData& sharedInstance();
 
-        static PassRefPtr<JSGlobalData> create(bool isShared = false);
+        static PassRefPtr<JSGlobalData> create();
         static PassRefPtr<JSGlobalData> createLeaked();
+        static PassRefPtr<JSGlobalData> createNonDefault();
         ~JSGlobalData();
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -102,15 +123,17 @@ namespace JSC {
         RefPtr<Structure> propertyNameIteratorStructure;
         RefPtr<Structure> getterSetterStructure;
         RefPtr<Structure> apiWrapperStructure;
+        RefPtr<Structure> dummyMarkableCellStructure;
 
 #if USE(JSVALUE32)
         RefPtr<Structure> numberStructure;
 #endif
 
-        void* jsArrayVPtr;
-        void* jsByteArrayVPtr;
-        void* jsStringVPtr;
-        void* jsFunctionVPtr;
+        static void storeVPtrs();
+        static JS_EXPORTDATA void* jsArrayVPtr;
+        static JS_EXPORTDATA void* jsByteArrayVPtr;
+        static JS_EXPORTDATA void* jsStringVPtr;
+        static JS_EXPORTDATA void* jsFunctionVPtr;
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
@@ -153,19 +176,29 @@ namespace JSC {
 
         MarkStack markStack;
 
+        double cachedUTCOffset;
+        DSTOffsetCache dstOffsetCache;
+        
+        UString cachedDateString;
+        double cachedDateStringValue;
+        
+        WeakRandom weakRandom;
+
 #ifndef NDEBUG
         bool mainThreadOnly;
 #endif
 
+        void resetDateCache();
+
         void startSampling();
         void stopSampling();
         void dumpSampleData(ExecState* exec);
     private:
-        JSGlobalData(bool isShared, const VPtrSet&);
+        JSGlobalData(bool isShared);
         static JSGlobalData*& sharedInstanceInternal();
         void createNativeThunk();
     };
-
+    
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index cf3f1d1..86690bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -128,6 +128,8 @@ void JSGlobalObject::init(JSObject* thisValue)
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
+    structure()->disableSpecificFunctionTracking();
+
     d()->globalData = Heap::heap(this)->globalData();
     d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
 
@@ -317,9 +319,9 @@ void JSGlobalObject::reset(JSValue prototype)
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, MathObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(JSONObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete)
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 720d3a5..bbb6d5e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -267,7 +267,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
@@ -413,11 +413,21 @@ namespace JSC {
     {
         return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
     }
+    
+    inline JSObject* constructEmptyObject(ExecState* exec, JSGlobalObject* globalObject)
+    {
+        return new (exec) JSObject(globalObject->emptyObjectStructure());
+    }
 
     inline JSArray* constructEmptyArray(ExecState* exec)
     {
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
     }
+    
+    inline JSArray* constructEmptyArray(ExecState* exec, JSGlobalObject* globalObject)
+    {
+        return new (exec) JSArray(globalObject->arrayStructure());
+    }
 
     inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     {
@@ -442,7 +452,13 @@ namespace JSC {
             : m_dynamicGlobalObjectSlot(callFrame->globalData().dynamicGlobalObject)
             , m_savedDynamicGlobalObject(m_dynamicGlobalObjectSlot)
         {
-            m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+            if (!m_dynamicGlobalObjectSlot) {
+                m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+
+                // Reset the date cache between JS invocations to force the VM
+                // to observe time zone changes.
+                callFrame->globalData().resetDateCache();
+            }
         }
 
         ~DynamicGlobalObjectScope()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index dc32718..be114d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -27,14 +27,17 @@
 
 #include "CallFrame.h"
 #include "GlobalEvalFunction.h"
+#include "Interpreter.h"
 #include "JSGlobalObject.h"
-#include "LiteralParser.h"
 #include "JSString.h"
-#include "Interpreter.h"
-#include "Parser.h"
-#include "dtoa.h"
+#include "JSStringBuilder.h"
 #include "Lexer.h"
+#include "LiteralParser.h"
 #include "Nodes.h"
+#include "Parser.h"
+#include "StringBuilder.h"
+#include "StringExtras.h"
+#include "dtoa.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -55,24 +58,24 @@ static JSValue encode(ExecState* exec, const ArgList& args, const char* doNotEsc
     if (!cstr.c_str())
         return throwError(exec, URIError, "String contained an illegal UTF-16 sequence.");
 
-    UString result = "";
+    JSStringBuilder builder;
     const char* p = cstr.c_str();
     for (size_t k = 0; k < cstr.size(); k++, p++) {
         char c = *p;
         if (c && strchr(doNotEscape, c))
-            result.append(c);
+            builder.append(c);
         else {
             char tmp[4];
-            sprintf(tmp, "%%%02X", static_cast<unsigned char>(c));
-            result += tmp;
+            snprintf(tmp, 4, "%%%02X", static_cast<unsigned char>(c));
+            builder.append(tmp);
         }
     }
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
 {
-    UString result = "";
+    JSStringBuilder builder;
     UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
@@ -106,7 +109,7 @@ static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUne
                             charLen = 0;
                         else if (character >= 0x10000) {
                             // Convert to surrogate pair.
-                            result.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
+                            builder.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
                             u = static_cast<UChar>(0xDC00 | ((character - 0x10000) & 0x3FF));
                         } else
                             u = static_cast<UChar>(character);
@@ -131,9 +134,9 @@ static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUne
             }
         }
         k++;
-        result.append(c);
+        builder.append(c);
     }
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 bool isStrWhiteSpace(UChar c)
@@ -376,32 +379,30 @@ JSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec, JSObject*, JSValue, cons
         "0123456789"
         "*+-./@_";
 
-    UString result = "";
-    UString s;
+    JSStringBuilder builder;
     UString str = args.at(0).toString(exec);
     const UChar* c = str.data();
-    for (int k = 0; k < str.size(); k++, c++) {
+    for (unsigned k = 0; k < str.size(); k++, c++) {
         int u = c[0];
         if (u > 255) {
             char tmp[7];
             sprintf(tmp, "%%u%04X", u);
-            s = UString(tmp);
+            builder.append(tmp);
         } else if (u != 0 && strchr(do_not_escape, static_cast<char>(u)))
-            s = UString(c, 1);
+            builder.append(c, 1);
         else {
             char tmp[4];
             sprintf(tmp, "%%%02X", u);
-            s = UString(tmp);
+            builder.append(tmp);
         }
-        result += s;
     }
 
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    UString result = "";
+    StringBuilder builder;
     UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
@@ -420,10 +421,10 @@ JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, co
             k += 2;
         }
         k++;
-        result.append(*c);
+        builder.append(*c);
     }
 
-    return jsString(exec, result);
+    return jsString(exec, builder.build());
 }
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
index 4ed35fc..0f54f60 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
@@ -22,8 +22,6 @@
 #ifndef JSImmediate_h
 #define JSImmediate_h
 
-#include <wtf/Platform.h>
-
 #if !USE(JSVALUE32_64)
 
 #include <wtf/Assertions.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
index c36dc10..f4764e2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -121,7 +121,7 @@ bool JSNotAnObject::deleteProperty(ExecState* exec, unsigned)
     return false;
 }
 
-void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&, EnumerationMode)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index a271c4e..339d41f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -62,7 +62,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
      private:
@@ -91,7 +91,7 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         JSNotAnObjectErrorStub* m_exception;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 309488f..bcb506b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -76,7 +76,7 @@ namespace JSC {
             return globalData->heap.allocateNumber(size);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -109,6 +109,11 @@ namespace JSC {
         return static_cast<JSNumberCell*>(v.asCell());
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState* exec, double d)
+    {
+        *this = jsNumberCell(exec, d);
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         JSValue v = JSImmediate::from(d);
@@ -193,6 +198,11 @@ namespace JSC {
 #endif // USE(JSVALUE32)
 
 #if USE(JSVALUE64)
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        *this = JSImmediate::fromNumberOutsideIntegerRange(d);
+    }
+
     inline JSValue::JSValue(ExecState*, double d)
     {
         JSValue v = JSImmediate::from(d);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
index 297d457..d5f3303 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
@@ -32,6 +32,7 @@
 #include "JSArray.h"
 #include "LiteralParser.h"
 #include "PropertyNameArray.h"
+#include "StringBuilder.h"
 #include <wtf/MathExtras.h>
 
 namespace JSC {
@@ -70,8 +71,6 @@ public:
     void markAggregate(MarkStack&);
 
 private:
-    typedef UString StringBuilder;
-
     class Holder {
     public:
         Holder(JSObject*);
@@ -136,7 +135,7 @@ static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
 
 static inline UString gap(ExecState* exec, JSValue space)
 {
-    const int maxGapLength = 10;
+    const unsigned maxGapLength = 10;
     space = unwrapBoxedPrimitive(exec, space);
 
     // If the space value is a number, create a gap string with that number of spaces.
@@ -156,7 +155,7 @@ static inline UString gap(ExecState* exec, JSValue space)
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    UString spaces = space.getString();
+    UString spaces = space.getString(exec);
     if (spaces.size() > maxGapLength) {
         spaces = spaces.substr(0, maxGapLength);
     }
@@ -213,7 +212,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
                 break;
 
             UString propertyName;
-            if (name.getString(propertyName)) {
+            if (name.getString(exec, propertyName)) {
                 m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
                 continue;
             }
@@ -269,7 +268,7 @@ JSValue Stringifier::stringify(JSValue value)
     if (m_exec->hadException())
         return jsNull();
 
-    return jsString(m_exec, result);
+    return jsString(m_exec, result.build());
 }
 
 void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
@@ -389,7 +388,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
     }
 
     UString stringValue;
-    if (value.getString(stringValue)) {
+    if (value.getString(m_exec, stringValue)) {
         appendQuotedString(builder, stringValue);
         return StringifySucceeded;
     }
@@ -457,9 +456,9 @@ inline bool Stringifier::willIndent() const
 inline void Stringifier::indent()
 {
     // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
-    int newSize = m_indent.size() + m_gap.size();
+    unsigned newSize = m_indent.size() + m_gap.size();
     if (newSize > m_repeatedGap.size())
-        m_repeatedGap.append(m_gap);
+        m_repeatedGap = makeString(m_repeatedGap, m_gap);
     ASSERT(newSize <= m_repeatedGap.size());
     m_indent = m_repeatedGap.substr(0, newSize);
 }
@@ -502,7 +501,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
                 m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
             else {
                 PropertyNameArray objectPropertyNames(exec);
-                m_object->getPropertyNames(exec, objectPropertyNames);
+                m_object->getOwnPropertyNames(exec, objectPropertyNames);
                 m_propertyNames = objectPropertyNames.releaseData();
             }
             m_size = m_propertyNames->propertyNameVector().size();
@@ -586,7 +585,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
             // This only occurs when get an undefined value for an object property.
             // In this case we don't want the separator and property name that we
             // already appended, so roll back.
-            builder = builder.substr(0, rollBackPoint);
+            builder.resize(rollBackPoint);
             break;
     }
 
@@ -747,7 +746,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 objectStack.append(object);
                 indexStack.append(0);
                 propertyStack.append(PropertyNameArray(m_exec));
-                object->getPropertyNames(m_exec, propertyStack.last());
+                object->getOwnPropertyNames(m_exec, propertyStack.last());
                 // fallthrough
             }
             objectStartVisitMember:
@@ -869,4 +868,12 @@ JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec, JSObject*, JSValue
     return Stringifier(exec, replacer, space).stringify(value);
 }
 
+UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
+{
+    JSValue result = Stringifier(exec, jsNull(), jsNumber(exec, indent)).stringify(value);
+    if (result.isUndefinedOrNull())
+        return UString();
+    return result.getString(exec);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
index ec3fa40..7a9e0a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -41,7 +41,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
@@ -57,6 +57,8 @@ namespace JSC {
         static const ClassInfo info;
     };
 
+    UString JSONStringify(ExecState* exec, JSValue value, unsigned indent);
+
 } // namespace JSC
 
 #endif // JSONObject_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index 6932ded..61d3bb1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -42,7 +42,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
-static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Add properties from the static hashtables of properties
     for (; classInfo; classInfo = classInfo->parentClass) {
@@ -55,7 +55,7 @@ static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo*
         int hashSizeMask = table->compactSize - 1;
         const HashEntry* entry = table->table;
         for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
+            if (entry->key() && (!(entry->attributes() & DontEnum) || (mode == IncludeDontEnumProperties)))
                 propertyNames.add(entry->key());
         }
     }
@@ -406,26 +406,10 @@ bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 
 bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyName) const
 {
-    unsigned attributes;
-    if (!getPropertyAttributes(exec, propertyName, attributes))
+    PropertyDescriptor descriptor;
+    if (!const_cast<JSObject*>(this)->getOwnPropertyDescriptor(exec, propertyName, descriptor))
         return false;
-    return !(attributes & DontEnum);
-}
-
-bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    JSCell* specificValue;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
-        return true;
-    
-    // Look in the static hashtable of properties
-    const HashEntry* entry = findPropertyHashEntry(exec, propertyName);
-    if (entry) {
-        attributes = entry->attributes();
-        return true;
-    }
-    
-    return false;
+    return descriptor.enumerable();
 }
 
 bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
@@ -441,9 +425,9 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
     return false;
 }
 
-void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    getOwnPropertyNames(exec, propertyNames);
+    getOwnPropertyNames(exec, propertyNames, mode);
 
     if (prototype().isNull())
         return;
@@ -451,10 +435,10 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     JSObject* prototype = asObject(this->prototype());
     while(1) {
         if (prototype->structure()->typeInfo().overridesGetPropertyNames()) {
-            prototype->getPropertyNames(exec, propertyNames);
+            prototype->getPropertyNames(exec, propertyNames, mode);
             break;
         }
-        prototype->getOwnPropertyNames(exec, propertyNames);
+        prototype->getOwnPropertyNames(exec, propertyNames, mode);
         JSValue nextProto = prototype->prototype();
         if (nextProto.isNull())
             break;
@@ -462,10 +446,10 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     }
 }
 
-void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_structure->getEnumerablePropertyNames(propertyNames);
-    getEnumerablePropertyNames(exec, classInfo(), propertyNames);
+    m_structure->getPropertyNames(propertyNames, mode);
+    getClassPropertyNames(exec, classInfo(), propertyNames, mode);
 }
 
 bool JSObject::toBoolean(ExecState*) const
@@ -522,19 +506,22 @@ void JSObject::removeDirect(const Identifier& propertyName)
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(exec)), function, attr);
 }
 
 NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
 {
-    if (JSObject* getterFunction = asGetterSetter(*location)->getter())
-        slot.setGetterSlot(getterFunction);
-    else
+    if (JSObject* getterFunction = asGetterSetter(*location)->getter()) {
+        if (!structure()->isDictionary())
+            slot.setCacheableGetterSlot(this, getterFunction, offsetForLocation(location));
+        else
+            slot.setGetterSlot(getterFunction);
+    } else
         slot.setUndefined();
 }
 
@@ -599,7 +586,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     if (descriptor.isEmpty())
         return true;
 
-    if (current.equalTo(descriptor))
+    if (current.equalTo(exec, descriptor))
         return true;
 
     // Filter out invalid changes
@@ -645,7 +632,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
                 return false;
             }
             if (!current.writable()) {
-                if (descriptor.value() || !JSValue::strictEqual(current.value(), descriptor.value())) {
+                if (descriptor.value() || !JSValue::strictEqual(exec, current.value(), descriptor.value())) {
                     if (throwException)
                         throwError(exec, TypeError, "Attempting to change value of a readonly property.");
                     return false;
@@ -667,12 +654,12 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // Changing the accessor functions of an existing accessor property
     ASSERT(descriptor.isAccessorDescriptor());
     if (!current.configurable()) {
-        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(current.setter(), descriptor.setter()))) {
+        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the setter of an unconfigurable property.");
             return false;
         }
-        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(current.getter(), descriptor.getter()))) {
+        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the getter of an unconfigurable property.");
             return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 5a89c40..cd8f7f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -122,8 +122,8 @@ namespace JSC {
 
         virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
@@ -135,7 +135,6 @@ namespace JSC {
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSObject* unwrappedObject();
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
@@ -207,19 +206,25 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+        }
+
+        void flattenDictionaryObject()
+        {
+            m_structure->flattenDictionaryStructure(this);
         }
 
     protected:
         static const unsigned StructureFlags = 0;
 
-        void addAnonymousSlots(unsigned count);
         void putAnonymousValue(unsigned index, JSValue value)
         {
+            ASSERT(index < m_structure->anonymousSlotCount());
             *locationForOffset(index) = value;
         }
-        JSValue getAnonymousValue(unsigned index)
+        JSValue getAnonymousValue(unsigned index) const
         {
+            ASSERT(index < m_structure->anonymousSlotCount());
             return *locationForOffset(index);
         }
 
@@ -229,7 +234,7 @@ namespace JSC {
         using JSCell::isGetterSetter;
         using JSCell::toObject;
         void getObject();
-        void getString();
+        void getString(ExecState* exec);
         void isObject();
         void isString();
 #if USE(JSVALUE32)
@@ -377,7 +382,7 @@ ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identif
 
 // It may seem crazy to inline a function this large but it makes a big difference
 // since this is function very hot in variable lookup
-inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     JSObject* object = this;
     while (true) {
@@ -390,7 +395,7 @@ inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propert
     }
 }
 
-inline bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     JSObject* object = this;
     while (true) {
@@ -431,12 +436,20 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         JSCell* currentSpecificFunction;
         size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
+            // If there is currently a specific function, and there now either isn't,
+            // or the new value is different, then despecify.
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
                 m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return;
             putDirectOffset(offset, value);
-            if (!specificFunction && !currentSpecificFunction)
+            // At this point, the objects structure only has a specific value set if previously there
+            // had been one set, and if the new value being specified is the same (otherwise we would
+            // have despecified, above).  So, if currentSpecificFunction is not set, or if the new
+            // value is different (or there is no new value), then the slot now has no value - and
+            // as such it is cachable.
+            // If there was previously a value, and the new value is the same, then we cannot cache.
+            if (!currentSpecificFunction || (specificFunction != currentSpecificFunction))
                 slot.setExistingProperty(this, offset);
             return;
         }
@@ -463,7 +476,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         ASSERT(offset < structure->propertyStorageCapacity());
         setStructure(structure.release());
         putDirectOffset(offset, value);
-        // See comment on setNewProperty call below.
+        // This is a new property; transitions with specific values are not currently cachable,
+        // so leave the slot in an uncachable state.
         if (!specificFunction)
             slot.setNewProperty(this, offset);
         return;
@@ -476,14 +490,28 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         if (checkReadOnly && currentAttributes & ReadOnly)
             return;
 
-        if (currentSpecificFunction && (specificFunction != currentSpecificFunction)) {
+        // There are three possibilities here:
+        //  (1) There is an existing specific value set, and we're overwriting with *the same value*.
+        //       * Do nothing - no need to despecify, but that means we can't cache (a cached
+        //         put could write a different value). Leave the slot in an uncachable state.
+        //  (2) There is a specific value currently set, but we're writing a different value.
+        //       * First, we have to despecify.  Having done so, this is now a regular slot
+        //         with no specific value, so go ahead & cache like normal.
+        //  (3) Normal case, there is no specific value set.
+        //       * Go ahead & cache like normal.
+        if (currentSpecificFunction) {
+            // case (1) Do the put, then return leaving the slot uncachable.
+            if (specificFunction == currentSpecificFunction) {
+                putDirectOffset(offset, value);
+                return;
+            }
+            // case (2) Despecify, fall through to (3).
             setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
-            putDirectOffset(offset, value);
-            // Function transitions are not currently cachable, so leave the slot in an uncachable state.
-            return;
         }
-        putDirectOffset(offset, value);
+
+        // case (3) set the slot, do the put, return.
         slot.setExistingProperty(this, offset);
+        putDirectOffset(offset, value);
         return;
     }
 
@@ -505,7 +533,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
     ASSERT(offset < structure->propertyStorageCapacity());
     setStructure(structure.release());
     putDirectOffset(offset, value);
-    // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+    // This is a new property; transitions with specific values are not currently cachable,
+    // so leave the slot in an uncachable state.
     if (!specificFunction)
         slot.setNewProperty(this, offset);
 }
@@ -524,17 +553,6 @@ inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
-inline void JSObject::addAnonymousSlots(unsigned count)
-{
-    size_t currentCapacity = m_structure->propertyStorageCapacity();
-    RefPtr<Structure> structure = Structure::addAnonymousSlotsTransition(m_structure, count);
-
-    if (currentCapacity != structure->propertyStorageCapacity())
-        allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
-
-    setStructure(structure.release());
-}
-
 inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6fd0344..a5d4da0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -35,6 +35,24 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
+    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
+    , m_cachedStructure(0)
+    , m_numCacheableSlots(numCacheableSlots)
+    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
+    , m_jsStrings(new JSValue[m_jsStringsSize])
+{
+    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
+    for (size_t i = 0; i < m_jsStringsSize; ++i)
+        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
+}
+
+JSPropertyNameIterator::~JSPropertyNameIterator()
+{
+    if (m_cachedStructure)
+        m_cachedStructure->clearEnumerationCache(this);
+}
+
 JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
     ASSERT(!o->structure()->enumerationCache() ||
@@ -45,7 +63,8 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     o->getPropertyNames(exec, propertyNames);
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
-        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        !o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
+        !o->structure()->typeInfo().overridesGetPropertyNames())
         numCacheableSlots = o->structure()->propertyStorageSize();
 
     JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
@@ -76,7 +95,7 @@ JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
     if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
         return identifier;
 
-    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
         return JSValue();
     return identifier;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 529ae8b..01700ac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -47,8 +47,10 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount);
         }
+        
+        virtual ~JSPropertyNameIterator();
 
         virtual bool isPropertyNameIterator() const { return true; }
 
@@ -65,8 +67,13 @@ namespace JSC {
         JSValue get(ExecState*, JSObject*, size_t i);
         size_t size() { return m_jsStringsSize; }
 
-        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
-        Structure* cachedStructure() { return m_cachedStructure; }
+        void setCachedStructure(Structure* structure)
+        {
+            ASSERT(!m_cachedStructure);
+            ASSERT(structure);
+            m_cachedStructure = structure;
+        }
+        Structure* cachedStructure() { return m_cachedStructure.get(); }
 
         void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
@@ -74,30 +81,28 @@ namespace JSC {
     private:
         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
-        Structure* m_cachedStructure;
+        RefPtr<Structure> m_cachedStructure;
         RefPtr<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
         OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_cachedStructure(0)
-    , m_numCacheableSlots(numCacheableSlots)
-    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
-    , m_jsStrings(new JSValue[m_jsStringsSize])
-{
-    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
-    for (size_t i = 0; i < m_jsStringsSize; ++i)
-        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
-}
-
-inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
-{
-    ASSERT(!isDictionary());
-    m_enumerationCache = enumerationCache;
-}
+    inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    {
+        ASSERT(!isDictionary());
+        m_enumerationCache = enumerationCache;
+    }
+
+    inline void Structure::clearEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    {
+        m_enumerationCache.clear(enumerationCache);
+    }
+
+    inline JSPropertyNameIterator* Structure::enumerationCache()
+    {
+        return m_enumerationCache.get();
+    }
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index 2542878..4d156d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -57,7 +57,7 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index 20ba868..815198b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -25,41 +25,127 @@
 
 #include "JSGlobalObject.h"
 #include "JSObject.h"
+#include "Operations.h"
 #include "StringObject.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
+// Overview: this methods converts a JSString from holding a string in rope form
+// down to a simple UString representation.  It does so by building up the string
+// backwards, since we want to avoid recursion, we expect that the tree structure
+// representing the rope is likely imbalanced with more nodes down the left side
+// (since appending to the string is likely more common) - and as such resolving
+// in this fashion should minimize work queue size.  (If we built the queue forwards
+// we would likely have to place all of the constituent UStringImpls into the
+// Vector before performing any concatenation, but by working backwards we likely
+// only fill the queue with the number of substrings at any given level in a
+// rope-of-ropes.)
+void JSString::resolveRope(ExecState* exec) const
+{
+    ASSERT(isRope());
+
+    // Allocate the buffer to hold the final string, position initially points to the end.
+    UChar* buffer;
+    if (PassRefPtr<UStringImpl> newImpl = UStringImpl::tryCreateUninitialized(m_length, buffer))
+        m_value = newImpl;
+    else {
+        for (unsigned i = 0; i < m_fiberCount; ++i) {
+            m_other.m_fibers[i]->deref();
+            m_other.m_fibers[i] = 0;
+        }
+        m_fiberCount = 0;
+        ASSERT(!isRope());
+        ASSERT(m_value == UString());
+        throwOutOfMemoryError(exec);
+        return;
+    }
+    UChar* position = buffer + m_length;
+
+    // Start with the current Rope.
+    Vector<Rope::Fiber, 32> workQueue;
+    Rope::Fiber currentFiber;
+    for (unsigned i = 0; i < (m_fiberCount - 1); ++i)
+        workQueue.append(m_other.m_fibers[i]);
+    currentFiber = m_other.m_fibers[m_fiberCount - 1];
+    while (true) {
+        if (currentFiber->isRope()) {
+            Rope* rope = static_cast<URopeImpl*>(currentFiber);
+            // Copy the contents of the current rope into the workQueue, with the last item in 'currentFiber'
+            // (we will be working backwards over the rope).
+            unsigned fiberCountMinusOne = rope->fiberCount() - 1;
+            for (unsigned i = 0; i < fiberCountMinusOne; ++i)
+                workQueue.append(rope->fibers(i));
+            currentFiber = rope->fibers(fiberCountMinusOne);
+        } else {
+            UStringImpl* string = static_cast<UStringImpl*>(currentFiber);
+            unsigned length = string->length();
+            position -= length;
+            UStringImpl::copyChars(position, string->characters(), length);
+
+            // Was this the last item in the work queue?
+            if (workQueue.isEmpty()) {
+                // Create a string from the UChar buffer, clear the rope RefPtr.
+                ASSERT(buffer == position);
+                for (unsigned i = 0; i < m_fiberCount; ++i) {
+                    m_other.m_fibers[i]->deref();
+                    m_other.m_fibers[i] = 0;
+                }
+                m_fiberCount = 0;
+
+                ASSERT(!isRope());
+                return;
+            }
+
+            // No! - set the next item up to process.
+            currentFiber = workQueue.last();
+            workQueue.removeLast();
+        }
+    }
+}
+
+JSString* JSString::getIndexSlowCase(ExecState* exec, unsigned i)
+{
+    ASSERT(isRope());
+    resolveRope(exec);
+    // Return a safe no-value result, this should never be used, since the excetion will be thrown.
+    if (exec->exception())
+        return jsString(exec, "");
+    ASSERT(!isRope());
+    ASSERT(i < m_value.size());
+    return jsSingleCharacterSubstring(exec, m_value, i);
+}
+
 JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
+bool JSString::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
-    value = this;
-    number = m_value.toDouble();
+    result = this;
+    number = value(exec).toDouble();
     return false;
 }
 
 bool JSString::toBoolean(ExecState*) const
 {
-    return !m_value.isEmpty();
+    return m_length;
 }
 
-double JSString::toNumber(ExecState*) const
+double JSString::toNumber(ExecState* exec) const
 {
-    return m_value.toDouble();
+    return value(exec).toDouble();
 }
 
-UString JSString::toString(ExecState*) const
+UString JSString::toString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
-UString JSString::toThisString(ExecState*) const
+UString JSString::toThisString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
 JSString* JSString::toThisJSString(ExecState*)
@@ -106,14 +192,14 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
 bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, m_value.size()), DontEnum | DontDelete | ReadOnly);
+        descriptor.setDescriptor(jsNumber(exec, m_length), DontEnum | DontDelete | ReadOnly);
         return true;
     }
     
     bool isStrictUInt32;
     unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-    if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, m_value, i), DontDelete | ReadOnly);
+    if (isStrictUInt32 && i < m_length) {
+        descriptor.setDescriptor(getIndex(exec, i), DontDelete | ReadOnly);
         return true;
     }
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index 39dfe75..58df013 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -41,7 +41,6 @@ namespace JSC {
 
     JSString* jsSingleCharacterString(JSGlobalData*, UChar);
     JSString* jsSingleCharacterString(ExecState*, UChar);
-    JSString* jsSingleCharacterSubstring(JSGlobalData*, const UString&, unsigned offset);
     JSString* jsSingleCharacterSubstring(ExecState*, const UString&, unsigned offset);
     JSString* jsSubstring(JSGlobalData*, const UString&, unsigned offset, unsigned length);
     JSString* jsSubstring(ExecState*, const UString&, unsigned offset, unsigned length);
@@ -59,14 +58,63 @@ namespace JSC {
     JSString* jsOwnedString(JSGlobalData*, const UString&); 
     JSString* jsOwnedString(ExecState*, const UString&); 
 
-    class JSString : public JSCell {
-        friend class JIT;
-        friend struct VPtrSet;
+    typedef void (*JSStringFinalizerCallback)(JSString*, void* context);
+    JSString* jsStringWithFinalizer(ExecState*, const UString&, JSStringFinalizerCallback callback, void* context);
 
+    class JS_EXPORTCLASS JSString : public JSCell {
     public:
-        JSString(JSGlobalData* globalData, const UString& value)
+        friend class JIT;
+        friend class JSGlobalData;
+
+        typedef URopeImpl Rope;
+
+        class RopeBuilder {
+        public:
+            RopeBuilder(unsigned fiberCount)
+                : m_index(0)
+                , m_rope(Rope::tryCreateUninitialized(fiberCount))
+            {
+            }
+
+            bool isOutOfMemory() { return !m_rope; }
+
+            void append(Rope::Fiber& fiber)
+            {
+                ASSERT(m_rope);
+                m_rope->initializeFiber(m_index, fiber);
+            }
+            void append(const UString& string)
+            {
+                ASSERT(m_rope);
+                m_rope->initializeFiber(m_index, string.rep());
+            }
+            void append(JSString* jsString)
+            {
+                if (jsString->isRope()) {
+                    for (unsigned i = 0; i < jsString->m_fiberCount; ++i)
+                        append(jsString->m_other.m_fibers[i]);
+                } else
+                    append(jsString->string());
+            }
+
+            PassRefPtr<Rope> release()
+            {
+                ASSERT(m_index == m_rope->fiberCount());
+                return m_rope.release();
+            }
+
+            unsigned length() { return m_rope->length(); }
+
+        private:
+            unsigned m_index;
+            RefPtr<Rope> m_rope;
+        };
+
+        ALWAYS_INLINE JSString(JSGlobalData* globalData, const UString& value)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
             , m_value(value)
+            , m_fiberCount(0)
         {
             Heap::heap(this)->reportExtraMemoryCost(value.cost());
         }
@@ -74,33 +122,173 @@ namespace JSC {
         enum HasOtherOwnerType { HasOtherOwner };
         JSString(JSGlobalData* globalData, const UString& value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
             , m_value(value)
+            , m_fiberCount(0)
         {
         }
         JSString(JSGlobalData* globalData, PassRefPtr<UString::Rep> value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value->length())
             , m_value(value)
+            , m_fiberCount(0)
         {
         }
-        
-        const UString& value() const { return m_value; }
+        JSString(JSGlobalData* globalData, PassRefPtr<Rope> rope)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(rope->length())
+            , m_fiberCount(1)
+        {
+            m_other.m_fibers[0] = rope.releaseRef();
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(s1->length() + s2->length())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, s2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, const UString& u2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(s1->length() + u2.size())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, u2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, const UString& u1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(u1.size() + s2->length())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, u1);
+            appendStringInConstruct(index, s2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating v1, v2 & v3.
+        // This should only be called with fiberCount <= 3 ... which since every
+        // value must require a fiberCount of at least one implies that the length
+        // for each value must be exactly 1!
+        JSString(ExecState* exec, JSValue v1, JSValue v2, JSValue v3)
+            : JSCell(exec->globalData().stringStructure.get())
+            , m_length(0)
+            , m_fiberCount(s_maxInternalRopeLength)
+        {
+            unsigned index = 0;
+            appendValueInConstructAndIncrementLength(exec, index, v1);
+            appendValueInConstructAndIncrementLength(exec, index, v2);
+            appendValueInConstructAndIncrementLength(exec, index, v3);
+            ASSERT(index == s_maxInternalRopeLength);
+        }
+
+        JSString(JSGlobalData* globalData, const UString& value, JSStringFinalizerCallback finalizer, void* context)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
+            , m_value(value)
+            , m_fiberCount(0)
+        {
+            // nasty hack because we can't union non-POD types
+            m_other.m_finalizerCallback = finalizer;
+            m_other.m_finalizerContext = context;
+            Heap::heap(this)->reportExtraMemoryCost(value.cost());
+        }
+
+        ~JSString()
+        {
+            ASSERT(vptr() == JSGlobalData::jsStringVPtr);
+            for (unsigned i = 0; i < m_fiberCount; ++i)
+                m_other.m_fibers[i]->deref();
+
+            if (!m_fiberCount && m_other.m_finalizerCallback)
+                m_other.m_finalizerCallback(this, m_other.m_finalizerContext);
+        }
+
+        const UString& value(ExecState* exec) const
+        {
+            if (isRope())
+                resolveRope(exec);
+            return m_value;
+        }
+        const UString tryGetValue() const
+        {
+            // If this is a rope, m_value should be null -
+            // if this is not a rope, m_value should be non-null.
+            ASSERT(isRope() == m_value.isNull());
+            return m_value;
+        }
+        unsigned length() { return m_length; }
 
         bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         bool getStringPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
-        bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
-        JSString* getIndex(JSGlobalData*, unsigned);
+        bool canGetIndex(unsigned i) { return i < m_length; }
+        JSString* getIndex(ExecState*, unsigned);
+        JSString* getIndexSlowCase(ExecState*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSString(VPtrStealingHackType) 
             : JSCell(0)
+            , m_fiberCount(0)
         {
         }
 
+        void resolveRope(ExecState*) const;
+
+        void appendStringInConstruct(unsigned& index, const UString& string)
+        {
+            UStringImpl* impl = string.rep();
+            impl->ref();
+            m_other.m_fibers[index++] = impl;
+        }
+
+        void appendStringInConstruct(unsigned& index, JSString* jsString)
+        {
+            if (jsString->isRope()) {
+                for (unsigned i = 0; i < jsString->m_fiberCount; ++i) {
+                    Rope::Fiber fiber = jsString->m_other.m_fibers[i];
+                    fiber->ref();
+                    m_other.m_fibers[index++] = fiber;
+                }
+            } else
+                appendStringInConstruct(index, jsString->string());
+        }
+
+        void appendValueInConstructAndIncrementLength(ExecState* exec, unsigned& index, JSValue v)
+        {
+            if (v.isString()) {
+                ASSERT(asCell(v)->isString());
+                JSString* s = static_cast<JSString*>(asCell(v));
+                ASSERT(s->fiberCount() == 1);
+                appendStringInConstruct(index, s);
+                m_length += s->length();
+            } else {
+                UString u(v.toString(exec));
+                UStringImpl* impl = u.rep();
+                impl->ref();
+                m_other.m_fibers[index++] = impl;
+                m_length += u.size();
+            }
+        }
+
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
@@ -117,11 +305,48 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        UString m_value;
+        static const unsigned s_maxInternalRopeLength = 3;
+
+        // A string is represented either by a UString or a Rope.
+        unsigned m_length;
+        mutable UString m_value;
+        mutable unsigned m_fiberCount;
+        // This structure exists to support a temporary workaround for a GC issue.
+        struct JSStringFinalizerStruct {
+            JSStringFinalizerStruct() : m_finalizerCallback(0) {}
+            union {
+                mutable Rope::Fiber m_fibers[s_maxInternalRopeLength];
+                struct {
+                    JSStringFinalizerCallback m_finalizerCallback;
+                    void* m_finalizerContext;
+                };
+            };
+        } m_other;
+
+        bool isRope() const { return m_fiberCount; }
+        UString& string() { ASSERT(!isRope()); return m_value; }
+        unsigned fiberCount() { return m_fiberCount ? m_fiberCount : 1; }
+
+        friend JSValue jsString(ExecState* exec, JSString* s1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, const UString& u1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, JSString* s1, const UString& u2);
+        friend JSValue jsString(ExecState* exec, Register* strings, unsigned count);
+        friend JSValue jsString(ExecState* exec, JSValue thisValue, const ArgList& args);
+        friend JSString* jsStringWithFinalizer(ExecState*, const UString&, JSStringFinalizerCallback callback, void* context);
     };
 
     JSString* asString(JSValue);
 
+    // When an object is created from a different DLL, MSVC changes vptr to a "local" one right after invoking a constructor,
+    // see <http://groups.google.com/group/microsoft.public.vc.language/msg/55cdcefeaf770212>.
+    // This breaks isJSString(), and we don't need that hack anyway, so we change vptr back to primary one.
+    // The below function must be called by any inline function that invokes a JSString constructor.
+#if COMPILER(MSVC) && !defined(BUILDING_JavaScriptCore)
+    inline JSString* fixupVPtr(JSGlobalData* globalData, JSString* string) { string->setVPtr(globalData->jsStringVPtr); return string; }
+#else
+    inline JSString* fixupVPtr(JSGlobalData*, JSString* string) { return string; }
+#endif
+
     inline JSString* asString(JSValue value)
     {
         ASSERT(asCell(value)->isString());
@@ -137,16 +362,17 @@ namespace JSC {
     {
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString(&c, 1));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(&c, 1)));
     }
 
-    inline JSString* jsSingleCharacterSubstring(JSGlobalData* globalData, const UString& s, unsigned offset)
+    inline JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset)
     {
+        JSGlobalData* globalData = &exec->globalData();
         ASSERT(offset < static_cast<unsigned>(s.size()));
         UChar c = s.data()[offset];
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, 1));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, 1))));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const char* s)
@@ -154,19 +380,22 @@ namespace JSC {
         ASSERT(s);
         ASSERT(s[0]);
         ASSERT(s[1]);
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const UString& s)
     {
         ASSERT(s.size() > 1);
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
 
-    inline JSString* JSString::getIndex(JSGlobalData* globalData, unsigned i)
+    inline JSString* JSString::getIndex(ExecState* exec, unsigned i)
     {
         ASSERT(canGetIndex(i));
-        return jsSingleCharacterSubstring(globalData, m_value, i);
+        if (isRope())
+            return getIndexSlowCase(exec, i);
+        ASSERT(i < m_value.size());
+        return jsSingleCharacterSubstring(exec, value(exec), i);
     }
 
     inline JSString* jsString(JSGlobalData* globalData, const UString& s)
@@ -179,9 +408,16 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
-        
+
+    inline JSString* jsStringWithFinalizer(ExecState* exec, const UString& s, JSStringFinalizerCallback callback, void* context)
+    {
+        ASSERT(s.size() && (s.size() > 1 || s.data()[0] > 0xFF));
+        JSGlobalData* globalData = &exec->globalData();
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s, callback, context));
+    }
+
     inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
     {
         ASSERT(offset <= static_cast<unsigned>(s.size()));
@@ -194,7 +430,7 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, length)), JSString::HasOtherOwner));
     }
 
     inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
@@ -207,13 +443,12 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s, JSString::HasOtherOwner));
     }
 
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
     inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
-    inline JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset) { return jsSingleCharacterSubstring(&exec->globalData(), s, offset); }
     inline JSString* jsSubstring(ExecState* exec, const UString& s, unsigned offset, unsigned length) { return jsSubstring(&exec->globalData(), s, offset, length); }
     inline JSString* jsNontrivialString(ExecState* exec, const UString& s) { return jsNontrivialString(&exec->globalData(), s); }
     inline JSString* jsNontrivialString(ExecState* exec, const char* s) { return jsNontrivialString(&exec->globalData(), s); }
@@ -222,14 +457,14 @@ namespace JSC {
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
     {
         if (propertyName == exec->propertyNames().length) {
-            slot.setValue(jsNumber(exec, m_value.size()));
+            slot.setValue(jsNumber(exec, m_length));
             return true;
         }
 
         bool isStrictUInt32;
         unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-        if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, i));
+        if (isStrictUInt32 && i < m_length) {
+            slot.setValue(getIndex(exec, i));
             return true;
         }
 
@@ -238,8 +473,8 @@ namespace JSC {
         
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
     {
-        if (propertyName < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, propertyName));
+        if (propertyName < m_length) {
+            slot.setValue(getIndex(exec, propertyName));
             return true;
         }
 
@@ -258,7 +493,7 @@ namespace JSC {
     inline UString JSValue::toString(ExecState* exec) const
     {
         if (isString())
-            return static_cast<JSString*>(asCell())->value();
+            return static_cast<JSString*>(asCell())->value(exec);
         if (isInt32())
             return exec->globalData().numericStrings.add(asInt32());
         if (isDouble())
@@ -275,6 +510,26 @@ namespace JSC {
         return asCell()->toString(exec);
     }
 
+    inline UString JSValue::toPrimitiveString(ExecState* exec) const
+    {
+        if (isString())
+            return static_cast<JSString*>(asCell())->value(exec);
+        if (isInt32())
+            return exec->globalData().numericStrings.add(asInt32());
+        if (isDouble())
+            return exec->globalData().numericStrings.add(asDouble());
+        if (isTrue())
+            return "true";
+        if (isFalse())
+            return "false";
+        if (isNull())
+            return "null";
+        if (isUndefined())
+            return "undefined";
+        ASSERT(isCell());
+        return asCell()->toPrimitive(exec, NoPreference).toString(exec);
+    }
+
 } // namespace JSC
 
 #endif // JSString_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h
new file mode 100644
index 0000000..8f208a1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSStringBuilder_h
+#define JSStringBuilder_h
+
+#include "ExceptionHelpers.h"
+#include "JSString.h"
+#include "Vector.h"
+
+namespace JSC {
+
+class JSStringBuilder {
+public:
+    JSStringBuilder()
+        : m_okay(true)
+    {
+    }
+
+    void append(const UChar u)
+    {
+        m_okay &= buffer.tryAppend(&u, 1);
+    }
+
+    void append(const char* str)
+    {
+        append(str, strlen(str));
+    }
+
+    void append(const char* str, size_t len)
+    {
+        m_okay &= buffer.tryReserveCapacity(buffer.size() + len);
+        for (size_t i = 0; i < len; i++) {
+            UChar u = static_cast<unsigned char>(str[i]);
+            m_okay &= buffer.tryAppend(&u, 1);
+        }
+    }
+
+    void append(const UChar* str, size_t len)
+    {
+        m_okay &= buffer.tryAppend(str, len);
+    }
+
+    void append(const UString& str)
+    {
+        m_okay &= buffer.tryAppend(str.data(), str.size());
+    }
+
+    JSValue build(ExecState* exec)
+    {
+        if (!m_okay)
+            return throwOutOfMemoryError(exec);
+        buffer.shrinkToFit();
+        if (!buffer.data())
+            return throwOutOfMemoryError(exec);
+        return jsString(exec, UString::adopt(buffer));
+    }
+
+protected:
+    Vector<UChar, 64> buffer;
+    bool m_okay;
+};
+
+template<typename StringType1, typename StringType2>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4, string5);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4, string5, string6);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
index 7c89600..e225bc7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
@@ -50,6 +50,8 @@ namespace JSC {
         TypeInfo(JSType type, unsigned flags = 0)
             : m_type(type)
         {
+            ASSERT(flags <= 0xFF);
+            ASSERT(type <= 0xFF);
             // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
             if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
                 m_flags = flags | ImplementsDefaultHasInstance;
@@ -57,7 +59,7 @@ namespace JSC {
                 m_flags = flags;
         }
 
-        JSType type() const { return m_type; }
+        JSType type() const { return (JSType)m_type; }
 
         bool masqueradesAsUndefined() const { return m_flags & MasqueradesAsUndefined; }
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
@@ -69,8 +71,8 @@ namespace JSC {
         unsigned flags() const { return m_flags; }
 
     private:
-        JSType m_type;
-        unsigned m_flags;
+        unsigned char m_type;
+        unsigned char m_flags;
     };
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index bafb85b..502312c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -174,7 +174,7 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
 
 NEVER_INLINE double nonInlineNaN()
 {
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     return nanval();
 #else
     return std::numeric_limits<double>::quiet_NaN();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index 1063cdc..6da921f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -80,6 +80,7 @@ namespace JSC {
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
         enum JSFalseTag { JSFalse };
+        enum EncodeAsDoubleTag { EncodeAsDouble };
 
         JSValue();
         JSValue(JSNullTag);
@@ -90,6 +91,7 @@ namespace JSC {
         JSValue(const JSCell* ptr);
 
         // Numbers
+        JSValue(EncodeAsDoubleTag, ExecState*, double);
         JSValue(ExecState*, double);
         JSValue(ExecState*, char);
         JSValue(ExecState*, unsigned char);
@@ -135,8 +137,8 @@ namespace JSC {
         bool getBoolean() const; // false if not a boolean
         bool getNumber(double&) const;
         double uncheckedGetNumber() const;
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject() const; // 0 if not an object
 
         CallType getCallData(CallData&);
@@ -156,6 +158,7 @@ namespace JSC {
         double toNumber(ExecState*) const;
         JSValue toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
         UString toString(ExecState*) const;
+        UString toPrimitiveString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
 
         // Integer conversions.
@@ -166,6 +169,10 @@ namespace JSC {
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
 
+#if ENABLE(JSC_ZOMBIES)
+        bool isZombie() const;
+#endif
+
         // Floating point conversions (this is a convenience method for webcore;
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
@@ -186,9 +193,9 @@ namespace JSC {
         static bool equal(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
-        static bool strictEqual(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
+        static bool strictEqual(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
 
         JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
@@ -228,7 +235,7 @@ namespace JSC {
         union {
             EncodedJSValue asEncodedJSValue;
             double asDouble;
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
             struct {
                 int32_t tag;
                 int32_t payload;
@@ -279,6 +286,11 @@ namespace JSC {
         return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
     }
 
+    ALWAYS_INLINE JSValue jsDoubleNumber(ExecState* exec, double d)
+    {
+        return JSValue(JSValue::EncodeAsDouble, exec, d);
+    }
+
     ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
     {
         return JSValue(exec, d);
@@ -431,6 +443,9 @@ namespace JSC {
     {
         JSValue v;
         v.u.asEncodedJSValue = encodedJSValue;
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         return v;
     }
 
@@ -477,6 +492,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
@@ -486,6 +504,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
@@ -583,6 +604,11 @@ namespace JSC {
         return reinterpret_cast<JSCell*>(u.asBits.payload);
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        u.asDouble = d;
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         const int32_t asInt32 = static_cast<int32_t>(d);
@@ -781,11 +807,17 @@ namespace JSC {
     inline JSValue::JSValue(JSCell* ptr)
         : m_ptr(ptr)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
         : m_ptr(const_cast<JSCell*>(ptr))
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
index 6586393..7365001 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -42,25 +42,15 @@ bool JSVariableObject::deleteProperty(ExecState* exec, const Identifier& propert
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
-        if (!(it->second.getAttributes() & DontEnum))
+        if (!(it->second.getAttributes() & DontEnum) || (mode == IncludeDontEnumProperties))
             propertyNames.add(Identifier(exec, it->first.get()));
     }
     
-    JSObject::getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSVariableObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    SymbolTableEntry entry = symbolTable().get(propertyName.ustring().rep());
-    if (!entry.isNull()) {
-        attributes = entry.getAttributes() | DontDelete;
-        return true;
-    }
-    return JSObject::getPropertyAttributes(exec, propertyName, attributes);
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSVariableObject::isVariableObject() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index d8b1479..6c679ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -49,18 +49,16 @@ namespace JSC {
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope() const = 0;
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
-
         Register& registerAt(int index) const { return d->registers[index]; }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
         
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 191ff3b..f19cd30 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -38,9 +38,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
+    protected:
+        static const unsigned AnonymousSlotCount = 1 + JSObject::AnonymousSlotCount;
+
     private:
         virtual void markChildren(MarkStack&);
         
@@ -50,7 +53,6 @@ namespace JSC {
     inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
         : JSObject(structure)
     {
-        addAnonymousSlots(1);
         putAnonymousValue(0, jsNull());
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp
new file mode 100644
index 0000000..072d29b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSZombie.h"
+#include "ClassInfo.h"
+
+#if ENABLE(JSC_ZOMBIES)
+
+namespace JSC {
+
+const ClassInfo JSZombie::s_info = { "Zombie", 0, 0, 0 };
+
+Structure* JSZombie::leakedZombieStructure() {
+    static Structure* structure = 0;
+    if (!structure) {
+        Structure::startIgnoringLeaks();
+        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType)).releaseRef();
+        Structure::stopIgnoringLeaks();
+    }
+    return structure;
+}
+
+}
+
+#endif // ENABLE(JSC_ZOMBIES)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h
new file mode 100644
index 0000000..8b33ea6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSZombie_h
+#define JSZombie_h
+
+#include "JSCell.h"
+
+#if ENABLE(JSC_ZOMBIES)
+namespace JSC {
+
+class JSZombie : public JSCell {
+public:
+    JSZombie(const ClassInfo* oldInfo, Structure* structure)
+        : JSCell(structure)
+        , m_oldInfo(oldInfo)
+    {
+    }
+    virtual bool isZombie() const { return true; }
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static Structure* leakedZombieStructure();
+
+    virtual bool isGetterSetter() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isAPIValueWrapper() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isPropertyNameIterator() const { ASSERT_NOT_REACHED(); return false; }
+    virtual CallType getCallData(CallData&) { ASSERT_NOT_REACHED(); return CallTypeNone; }
+    virtual ConstructType getConstructData(ConstructData&) { ASSERT_NOT_REACHED(); return ConstructTypeNone; }
+    virtual bool getUInt32(uint32_t&) const { ASSERT_NOT_REACHED(); return false; }
+    virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool toBoolean(ExecState*) const { ASSERT_NOT_REACHED(); return false; }
+    virtual double toNumber(ExecState*) const { ASSERT_NOT_REACHED(); return 0.0; }
+    virtual UString toString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSObject* toObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual void markChildren(MarkStack&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, unsigned, JSValue) { ASSERT_NOT_REACHED(); }
+    virtual bool deleteProperty(ExecState*, const Identifier&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool deleteProperty(ExecState*, unsigned) { ASSERT_NOT_REACHED(); return false; }
+    virtual JSObject* toThisObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual UString toThisString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSString* toThisJSString(ExecState*) { ASSERT_NOT_REACHED(); return 0; }
+    virtual JSValue getJSNumber() { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    
+    static const ClassInfo s_info;
+private:
+    const ClassInfo* m_oldInfo;
+};
+
+}
+
+#endif // ENABLE(JSC_ZOMBIES)
+
+#endif // JSZombie_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
index d242282..cc33bae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
@@ -29,6 +29,7 @@
 #include "JSArray.h"
 #include "JSString.h"
 #include "Lexer.h"
+#include "StringBuilder.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/dtoa.h>
 
@@ -134,48 +135,48 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
 {
     ++m_ptr;
     const UChar* runStart;
-    token.stringToken = UString();
+    StringBuilder builder;
     do {
         runStart = m_ptr;
         while (m_ptr < m_end && isSafeStringCharacter<mode>(*m_ptr))
             ++m_ptr;
         if (runStart < m_ptr)
-            token.stringToken.append(runStart, m_ptr - runStart);
+            builder.append(runStart, m_ptr - runStart);
         if ((mode == StrictJSON) && m_ptr < m_end && *m_ptr == '\\') {
             ++m_ptr;
             if (m_ptr >= m_end)
                 return TokError;
             switch (*m_ptr) {
                 case '"':
-                    token.stringToken.append('"');
+                    builder.append('"');
                     m_ptr++;
                     break;
                 case '\\':
-                    token.stringToken.append('\\');
+                    builder.append('\\');
                     m_ptr++;
                     break;
                 case '/':
-                    token.stringToken.append('/');
+                    builder.append('/');
                     m_ptr++;
                     break;
                 case 'b':
-                    token.stringToken.append('\b');
+                    builder.append('\b');
                     m_ptr++;
                     break;
                 case 'f':
-                    token.stringToken.append('\f');
+                    builder.append('\f');
                     m_ptr++;
                     break;
                 case 'n':
-                    token.stringToken.append('\n');
+                    builder.append('\n');
                     m_ptr++;
                     break;
                 case 'r':
-                    token.stringToken.append('\r');
+                    builder.append('\r');
                     m_ptr++;
                     break;
                 case 't':
-                    token.stringToken.append('\t');
+                    builder.append('\t');
                     m_ptr++;
                     break;
 
@@ -186,7 +187,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
                         if (!isASCIIHexDigit(m_ptr[i]))
                             return TokError;
                     }
-                    token.stringToken.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
+                    builder.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
                     m_ptr += 5;
                     break;
 
@@ -199,6 +200,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
     if (m_ptr >= m_end || *m_ptr != '"')
         return TokError;
 
+    token.stringToken = builder.build();
     token.type = TokString;
     token.end = ++m_ptr;
     return TokString;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
index 8359ff7..4e9e086 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
@@ -34,7 +34,7 @@ void HashTable::createTable(JSGlobalData* globalData) const
         entries[i].setKey(0);
     for (int i = 0; values[i].key; ++i) {
         UString::Rep* identifier = Identifier::add(globalData, values[i].key).releaseRef();
-        int hashIndex = identifier->computedHash() & compactHashSizeMask;
+        int hashIndex = identifier->existingHash() & compactHashSizeMask;
         HashEntry* entry = &entries[hashIndex];
 
         if (entry->key()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 4d70689..995aeee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -144,7 +144,7 @@ namespace JSC {
         {
             ASSERT(table);
 
-            const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & compactHashSizeMask];
+            const HashEntry* entry = &table[identifier.ustring().rep()->existingHash() & compactHashSizeMask];
 
             if (!entry->key())
                 return 0;
@@ -181,7 +181,7 @@ namespace JSC {
         if (entry->attributes() & Function)
             setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
         else
-            slot.setCustom(thisObj, entry->propertyGetter());
+            slot.setCacheableCustom(thisObj, entry->propertyGetter());
 
         return true;
     }
@@ -258,7 +258,7 @@ namespace JSC {
 
         ASSERT(!(entry->attributes() & Function));
 
-        slot.setCustom(thisObj, entry->propertyGetter());
+        slot.setCacheableCustom(thisObj, entry->propertyGetter());
         return true;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
index a114ae0..c551bac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -153,7 +153,7 @@ namespace JSC {
                 ASSERT(0 == (size % MarkStack::pageSize()));
                 if (size == m_allocated)
                     return;
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN) || PLATFORM(BREWMP)
                 // We cannot release a part of a region with VirtualFree.  To get around this,
                 // we'll release the entire region and reallocate the size that we want.
                 releaseStack(m_data, m_allocated);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp
new file mode 100644
index 0000000..b1ff48b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "MarkStack.h"
+
+#include "FastMalloc.h"
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    MarkStack::s_pageSize = 4096;
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return fastMalloc(size);
+}
+
+void MarkStack::releaseStack(void* addr, size_t)
+{
+    return fastFree(addr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
index 8e78ff3..c28bc0d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-
-
 #include "MarkStack.h"
 
+#if OS(UNIX) && !OS(SYMBIAN)
+
 #include <unistd.h>
 #include <sys/mman.h>
 
@@ -48,3 +48,5 @@ void MarkStack::releaseStack(void* addr, size_t size)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
index a0ce8f6..bda14ac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
@@ -20,6 +20,8 @@
 #include "config.h"
 #include "MarkStack.h"
 
+#if OS(SYMBIAN)
+
 #include <e32hal.h>
 
 namespace JSC {
@@ -42,3 +44,5 @@ void MarkStack::releaseStack(void* addr, size_t size)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
index 1fdd06a..a171c78 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-
-
 #include "MarkStack.h"
 
+#if OS(WINDOWS)
+
 #include "windows.h"
 
 namespace JSC {
@@ -51,3 +51,5 @@ void MarkStack::releaseStack(void* addr, size_t)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
index e8b7b97..8ef97e5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
@@ -96,7 +96,6 @@ MathObject::MathObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
-    WTF::initializeWeakRandomNumberGenerator();
 }
 
 // ECMA 15.8
@@ -120,22 +119,22 @@ JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
+    return jsDoubleNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -145,12 +144,12 @@ JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, con
 
 JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -160,7 +159,7 @@ JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, co
 
 JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -211,30 +210,29 @@ JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, WTF::weakRandomNumber());
+    return jsDoubleNumber(exec, exec->globalData().weakRandom.get());
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     double arg = args.at(0).toNumber(exec);
-    if (signbit(arg) && arg >= -0.5)
-         return jsNumber(exec, -0.0);
-    return jsNumber(exec, floor(arg + 0.5));
+    double integer = ceil(arg);
+    return jsNumber(exec, integer - (integer - arg > 0.5));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index 7f474b8..a9f7031 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -37,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index c655fae..403fc7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -33,7 +33,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
 NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
+    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString(exec)))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
index cc6c51d..cf549ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -29,11 +29,11 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberConstructor);
 
-static JSValue numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNaNValue(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorNegInfinity(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorPosInfinity(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorMaxValue(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&);
 
 } // namespace JSC
 
@@ -73,27 +73,27 @@ bool NumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, descriptor);
 }
 
-static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNaNValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNaN(exec);
 }
 
-static JSValue numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNegInfinity(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, -Inf);
 }
 
-static JSValue numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorPosInfinity(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, Inf);
 }
 
-static JSValue numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMaxValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, 1.7976931348623157E+308);
 }
 
-static JSValue numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMinValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, 5E-324);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index cf19b6f..723c4b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index 8223a90..6c18cdd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -33,7 +33,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
index df31404..5680eb1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -25,9 +25,11 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Operations.h"
 #include "PrototypeFunction.h"
+#include "StringBuilder.h"
 #include "dtoa.h"
-#include "Operations.h"
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
@@ -73,11 +75,12 @@ static UString integerPartNoExp(double d)
     bool resultIsInfOrNan = (decimalPoint == 9999);
     size_t length = strlen(result);
 
-    UString str = sign ? "-" : "";
+    StringBuilder builder;
+    builder.append(sign ? "-" : "");
     if (resultIsInfOrNan)
-        str += result;
+        builder.append((const char*)result);
     else if (decimalPoint <= 0)
-        str += "0";
+        builder.append("0");
     else {
         Vector<char, 1024> buf(decimalPoint + 1);
 
@@ -89,10 +92,10 @@ static UString integerPartNoExp(double d)
             strncpy(buf.data(), result, decimalPoint);
         buf[decimalPoint] = '\0';
 
-        str.append(buf.data());
+        builder.append((const char*)(buf.data()));
     }
 
-    return str;
+    return builder.build();
 }
 
 static UString charSequence(char c, int count)
@@ -236,13 +239,16 @@ JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue
 
     UString s;
     if (x < 0) {
-        s.append('-');
+        s = "-";
         x = -x;
-    } else if (x == -0.0)
-        x = 0;
+    } else {
+        s = "";
+        if (x == -0.0)
+            x = 0;
+    }
 
     if (x >= pow(10.0, 21.0))
-        return jsString(exec, s + UString::from(x));
+        return jsString(exec, makeString(s, UString::from(x)));
 
     const double tenToTheF = pow(10.0, f);
     double n = floor(x * tenToTheF);
@@ -253,17 +259,19 @@ JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue
 
     int k = m.size();
     if (k <= f) {
-        UString z;
+        StringBuilder z;
         for (int i = 0; i < f + 1 - k; i++)
             z.append('0');
-        m = z + m;
+        z.append(m);
+        m = z.build();
         k = f + 1;
-        ASSERT(k == m.size());
+        ASSERT(k == static_cast<int>(m.size()));
     }
     int kMinusf = k - f;
-    if (kMinusf < m.size())
-        return jsString(exec, s + m.substr(0, kMinusf) + "." + m.substr(kMinusf));
-    return jsString(exec, s + m.substr(0, kMinusf));
+
+    if (kMinusf < static_cast<int>(m.size()))
+        return jsString(exec, makeString(s, m.substr(0, kMinusf), ".", m.substr(kMinusf)));
+    return jsString(exec, makeString(s, m.substr(0, kMinusf)));
 }
 
 static void fractionalPartToString(char* buf, int& i, const char* result, int resultLength, int fractionalDigits)
@@ -391,7 +399,8 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
     if (x < 0) {
         s = "-";
         x = -x;
-    }
+    } else
+        s = "";
 
     if (!(doublePrecision >= 1 && doublePrecision <= 21)) // true for NaN
         return throwError(exec, RangeError, "toPrecision() argument must be between 1 and 21");
@@ -422,10 +431,10 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
         m = integerPartNoExp(n);
         if (e < -6 || e >= precision) {
             if (m.size() > 1)
-                m = m.substr(0, 1) + "." + m.substr(1);
+                m = makeString(m.substr(0, 1), ".", m.substr(1));
             if (e >= 0)
-                return jsNontrivialString(exec, s + m + "e+" + UString::from(e));
-            return jsNontrivialString(exec, s + m + "e-" + UString::from(-e));
+                return jsMakeNontrivialString(exec, s, m, "e+", UString::from(e));
+            return jsMakeNontrivialString(exec, s, m, "e-", UString::from(-e));
         }
     } else {
         m = charSequence('0', precision);
@@ -433,13 +442,13 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
     }
 
     if (e == precision - 1)
-        return jsString(exec, s + m);
+        return jsString(exec, makeString(s, m));
     if (e >= 0) {
-        if (e + 1 < m.size())
-            return jsString(exec, s + m.substr(0, e + 1) + "." + m.substr(e + 1));
-        return jsString(exec, s + m);
+        if (e + 1 < static_cast<int>(m.size()))
+            return jsString(exec, makeString(s, m.substr(0, e + 1), ".", m.substr(e + 1)));
+        return jsString(exec, makeString(s, m));
     }
-    return jsNontrivialString(exec, s + "0." + charSequence('0', -(e + 1)) + m);
+    return jsMakeNontrivialString(exec, s, "0.", charSequence('0', -(e + 1)), m);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
index c0696a4..89235af 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
@@ -45,6 +45,8 @@ namespace JSC {
 
         UString add(int i)
         {
+            if (static_cast<unsigned>(i) < cacheSize)
+                return lookupSmallString(static_cast<unsigned>(i));
             CacheEntry<int>& entry = lookup(i);
             if (i == entry.key && !entry.value.isNull())
                 return entry.value;
@@ -53,6 +55,17 @@ namespace JSC {
             return entry.value;
         }
 
+        UString add(unsigned i)
+        {
+            if (i < cacheSize)
+                return lookupSmallString(static_cast<unsigned>(i));
+            CacheEntry<unsigned>& entry = lookup(i);
+            if (i == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = i;
+            entry.value = UString::from(i);
+            return entry.value;
+        }
     private:
         static const size_t cacheSize = 64;
 
@@ -64,9 +77,19 @@ namespace JSC {
 
         CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
         CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
+        CacheEntry<unsigned>& lookup(unsigned i) { return unsignedCache[WTF::IntHash<unsigned>::hash(i) & (cacheSize - 1)]; }
+        const UString& lookupSmallString(unsigned i)
+        {
+            ASSERT(i < cacheSize);
+            if (smallIntCache[i].isNull())
+                smallIntCache[i] = UString::from(i);
+            return smallIntCache[i];
+        }
 
         CacheEntry<double> doubleCache[cacheSize];
         CacheEntry<int> intCache[cacheSize];
+        CacheEntry<unsigned> unsignedCache[cacheSize];
+        UString smallIntCache[cacheSize];
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index 837d5a6..0838eb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -36,6 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(ObjectConstructor);
 
 static JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorKeys(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*, JSObject*, JSValue, const ArgList&);
@@ -52,6 +53,7 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, NonNullPassRefPtr<Structur
     
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getOwnPropertyNames, objectConstructorGetOwnPropertyNames), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 3, exec->propertyNames().defineProperty, objectConstructorDefineProperty), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().defineProperties, objectConstructorDefineProperties), DontEnum);
@@ -126,6 +128,20 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
 }
 
 // FIXME: Use the enumeration cache.
+JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested property names of a value that is not an object.");
+    PropertyNameArray properties(exec);
+    asObject(args.at(0))->getOwnPropertyNames(exec, properties, IncludeDontEnumProperties);
+    JSArray* names = constructEmptyArray(exec);
+    size_t numProperties = properties.size();
+    for (size_t i = 0; i < numProperties; i++)
+        names->push(exec, jsOwnedString(exec, properties[i].ustring()));
+    return names;
+}
+
+// FIXME: Use the enumeration cache.
 JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (!args.at(0).isObject())
@@ -148,14 +164,14 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
     JSObject* description = asObject(in);
 
-    PropertySlot enumerableSlot;
+    PropertySlot enumerableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
         desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot configurableSlot;
+    PropertySlot configurableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
         desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
         if (exec->hadException())
@@ -163,21 +179,21 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
 
     JSValue value;
-    PropertySlot valueSlot;
+    PropertySlot valueSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
         desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot writableSlot;
+    PropertySlot writableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
         desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot getSlot;
+    PropertySlot getSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
         JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
         if (exec->hadException())
@@ -193,7 +209,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setGetter(get);
     }
 
-    PropertySlot setSlot;
+    PropertySlot setSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
         JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
         if (exec->hadException())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
index 0970b7c..c32a007 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -24,6 +24,7 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
@@ -148,7 +149,7 @@ JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec, JSObject*,
 
 JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return jsNontrivialString(exec, "[object " + thisValue.toThisObject(exec)->className() + "]");
+    return jsMakeNontrivialString(exec, "[object ", thisValue.toThisObject(exec)->className(), "]");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
index 093bbec..cf236bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
@@ -29,10 +29,6 @@
 #include <stdio.h>
 #include <wtf/MathExtras.h>
 
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 namespace JSC {
 
 bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
@@ -40,16 +36,9 @@ bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
-{
-    return strictEqualSlowCaseInline(v1, v2);
-}
-
-NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
+bool JSValue::strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
-    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-    exec->setException(error);
-    return error;
+    return strictEqualSlowCaseInline(exec, v1, v2);
 }
 
 NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -58,12 +47,13 @@ NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
     JSValue p1 = v1.toPrimitive(callFrame);
     JSValue p2 = v2.toPrimitive(callFrame);
 
-    if (p1.isString() || p2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
+    if (p1.isString()) {
+        return p2.isString()
+            ? jsString(callFrame, asString(p1), asString(p2))
+            : jsString(callFrame, asString(p1), p2.toString(callFrame));
     }
+    if (p2.isString())
+        return jsString(callFrame, p1.toString(callFrame), asString(p2));
 
     return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index 1aa68b3..cc0d603 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -22,6 +22,7 @@
 #ifndef Operations_h
 #define Operations_h
 
+#include "ExceptionHelpers.h"
 #include "Interpreter.h"
 #include "JSImmediate.h"
 #include "JSNumberCell.h"
@@ -29,12 +30,176 @@
 
 namespace JSC {
 
-    NEVER_INLINE JSValue throwOutOfMemoryError(ExecState*);
     NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
     JSValue jsTypeStringForValue(CallFrame*, JSValue);
     bool jsIsObjectType(JSValue);
     bool jsIsFunctionType(JSValue);
 
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
+    {
+        unsigned length1 = s1->length();
+        if (!length1)
+            return s2;
+        unsigned length2 = s2->length();
+        if (!length2)
+            return s1;
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = s1->fiberCount() + s2->fiberCount();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, s1, s2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(s1);
+        ropeBuilder.append(s2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, const UString& u1, JSString* s2)
+    {
+        unsigned length1 = u1.size();
+        if (!length1)
+            return s2;
+        unsigned length2 = s2->length();
+        if (!length2)
+            return jsString(exec, u1);
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = 1 + s2->fiberCount();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, u1, s2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(u1);
+        ropeBuilder.append(s2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, const UString& u2)
+    {
+        unsigned length1 = s1->length();
+        if (!length1)
+            return jsString(exec, u2);
+        unsigned length2 = u2.size();
+        if (!length2)
+            return s1;
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = s1->fiberCount() + 1;
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, s1, u2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(s1);
+        ropeBuilder.append(u2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        unsigned fiberCount = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                fiberCount += asString(v)->fiberCount();
+            else
+                ++fiberCount;
+        }
+
+        JSGlobalData* globalData = &exec->globalData();
+        if (fiberCount == 3)
+            return new (globalData) JSString(exec, strings[0].jsValue(), strings[1].jsValue(), strings[2].jsValue());
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+
+        unsigned length = 0;
+        bool overflow = false;
+
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                ropeBuilder.append(asString(v));
+            else
+                ropeBuilder.append(v.toString(exec));
+
+            unsigned newLength = ropeBuilder.length();
+            if (newLength < length)
+                overflow = true;
+            length = newLength;
+        }
+
+        if (overflow)
+            return throwOutOfMemoryError(exec);
+
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSValue thisValue, const ArgList& args)
+    {
+        unsigned fiberCount = 0;
+        if (LIKELY(thisValue.isString()))
+            fiberCount += asString(thisValue)->fiberCount();
+        else
+            ++fiberCount;
+        for (unsigned i = 0; i < args.size(); ++i) {
+            JSValue v = args.at(i);
+            if (LIKELY(v.isString()))
+                fiberCount += asString(v)->fiberCount();
+            else
+                ++fiberCount;
+        }
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+
+        if (LIKELY(thisValue.isString()))
+            ropeBuilder.append(asString(thisValue));
+        else
+            ropeBuilder.append(thisValue.toString(exec));
+
+        unsigned length = 0;
+        bool overflow = false;
+
+        for (unsigned i = 0; i < args.size(); ++i) {
+            JSValue v = args.at(i);
+            if (LIKELY(v.isString()))
+                ropeBuilder.append(asString(v));
+            else
+                ropeBuilder.append(v.toString(exec));
+
+            unsigned newLength = ropeBuilder.length();
+            if (newLength < length)
+                overflow = true;
+            length = newLength;
+        }
+
+        if (overflow)
+            return throwOutOfMemoryError(exec);
+
+        JSGlobalData* globalData = &exec->globalData();
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
     // ECMA 11.9.3
     inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
     {
@@ -53,7 +218,7 @@ namespace JSC {
             bool s1 = v1.isString();
             bool s2 = v2.isString();
             if (s1 && s2)
-                return asString(v1)->value() == asString(v2)->value();
+                return asString(v1)->value(exec) == asString(v2)->value(exec);
 
             if (v1.isUndefinedOrNull()) {
                 if (v2.isUndefinedOrNull())
@@ -110,17 +275,17 @@ namespace JSC {
     }
 
     // ECMA 11.9.3
-    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
     {
         ASSERT(v1.isCell() && v2.isCell());
 
         if (v1.asCell()->isString() && v2.asCell()->isString())
-            return asString(v1)->value() == asString(v2)->value();
+            return asString(v1)->value(exec) == asString(v2)->value(exec);
 
         return v1 == v2;
     }
 
-    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
+    inline bool JSValue::strictEqual(ExecState* exec, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1 == v2;
@@ -131,10 +296,10 @@ namespace JSC {
         if (!v1.isCell() || !v2.isCell())
             return v1 == v2;
 
-        return strictEqualSlowCaseInline(v1, v2);
+        return strictEqualSlowCaseInline(exec, v1, v2);
     }
 
-    inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1.asInt32() < v2.asInt32();
@@ -146,7 +311,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return asString(v1)->value() < asString(v2)->value();
+            return asString(v1)->value(callFrame) < asString(v2)->value(callFrame);
 
         JSValue p1;
         JSValue p2;
@@ -156,7 +321,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 < n2;
 
-        return asString(p1)->value() < asString(p2)->value();
+        return asString(p1)->value(callFrame) < asString(p2)->value(callFrame);
     }
 
     inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -171,7 +336,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return !(asString(v2)->value() < asString(v1)->value());
+            return !(asString(v2)->value(callFrame) < asString(v1)->value(callFrame));
 
         JSValue p1;
         JSValue p2;
@@ -181,7 +346,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 <= n2;
 
-        return !(asString(p2)->value() < asString(p1)->value());
+        return !(asString(p2)->value(callFrame) < asString(p1)->value(callFrame));
     }
 
     // Fast-path choices here are based on frequency data from SunSpider:
@@ -195,36 +360,21 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        double left;
-        double right = 0.0;
-
-        bool rightIsNumber = v2.getNumber(right);
-        if (rightIsNumber && v1.getNumber(left))
+        double left = 0.0, right;
+        if (v1.getNumber(left) && v2.getNumber(right))
             return jsNumber(callFrame, left + right);
         
-        bool leftIsString = v1.isString();
-        if (leftIsString && v2.isString()) {
-            RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
-        }
-
-        if (rightIsNumber & leftIsString) {
-            RefPtr<UString::Rep> value = v2.isInt32() ?
-                concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-                concatenate(asString(v1)->value().rep(), right);
-
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
+        if (v1.isString()) {
+            return v2.isString()
+                ? jsString(callFrame, asString(v1), asString(v2))
+                : jsString(callFrame, asString(v1), v2.toPrimitiveString(callFrame));
         }
 
         // All other cases are pretty uncommon
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, size_t& slotOffset)
     {
         JSCell* cell = asCell(base);
         size_t count = 0;
@@ -242,8 +392,11 @@ namespace JSC {
 
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
-            if (cell->structure()->isDictionary())
-                asObject(cell)->setStructure(Structure::fromDictionaryTransition(cell->structure()));
+            if (cell->structure()->isDictionary()) {
+                asObject(cell)->flattenDictionaryObject();
+                if (slotBase == cell)
+                    slotOffset = cell->structure()->get(propertyName); 
+            }
 
             ++count;
         }
@@ -265,7 +418,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (base->structure()->isDictionary())
-                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+                asObject(base)->flattenDictionaryObject();
 
             ++count;
         }
@@ -293,52 +446,6 @@ namespace JSC {
         ASSERT_NOT_REACHED();
         return JSValue();
     }
-
-    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
-    {
-        ASSERT(count >= 3);
-
-        // Estimate the amount of space required to hold the entire string.  If all
-        // arguments are strings, we can easily calculate the exact amount of space
-        // required.  For any other arguments, for now let's assume they may require
-        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
-        // reasonable for the other immediates.  We may want to come back and tune
-        // this value at some point.
-        unsigned bufferSize = 0;
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                bufferSize += asString(v)->value().size();
-            else
-                bufferSize += 11;
-        }
-
-        // Allocate an output string to store the result.
-        // If the first argument is a String, and if it has the capacity (or can grow
-        // its capacity) to hold the entire result then use this as a base to concatenate
-        // onto.  Otherwise, allocate a new empty output buffer.
-        JSValue firstValue = strings[0].jsValue();
-        RefPtr<UString::Rep> resultRep;
-        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
-            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
-            ++strings;
-            --count;
-        } else
-            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
-        UString result(resultRep);
-
-        // Loop over the operands, writing them into the output buffer.
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                result.append(asString(v)->value());
-            else
-                result.append(v.toString(callFrame));
-        }
-
-        return jsString(callFrame, result);
-    }
-
 } // namespace JSC
 
 #endif // Operations_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
index 4db814f..558ae28 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -153,15 +153,15 @@ void PropertyDescriptor::setGetter(JSValue getter)
     m_attributes &= ~ReadOnly;
 }
 
-bool PropertyDescriptor::equalTo(const PropertyDescriptor& other) const
+bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
 {
     if (!other.m_value == m_value ||
         !other.m_getter == m_getter ||
         !other.m_setter == m_setter)
         return false;
-    return (!m_value || JSValue::strictEqual(other.m_value, m_value)) && 
-           (!m_getter || JSValue::strictEqual(other.m_getter, m_getter)) && 
-           (!m_setter || JSValue::strictEqual(other.m_setter, m_setter)) &&
+    return (!m_value || JSValue::strictEqual(exec, other.m_value, m_value)) && 
+           (!m_getter || JSValue::strictEqual(exec, other.m_getter, m_getter)) && 
+           (!m_setter || JSValue::strictEqual(exec, other.m_setter, m_setter)) &&
            attributesEqual(other);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
index 40bec86..ff9f160 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -61,7 +61,7 @@ namespace JSC {
         bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
         bool setterPresent() const { return m_setter; }
         bool getterPresent() const { return m_getter; }
-        bool equalTo(const PropertyDescriptor& other) const;
+        bool equalTo(ExecState* exec, const PropertyDescriptor& other) const;
         bool attributesEqual(const PropertyDescriptor& other) const;
         unsigned attributesWithOverride(const PropertyDescriptor& other) const;
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
index 5b63f79..44dc2b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -61,7 +61,6 @@ namespace JSC {
         unsigned size;
         unsigned keyCount;
         unsigned deletedSentinelCount;
-        unsigned anonymousSlotCount;
         unsigned lastIndexUsed;
         Vector<unsigned>* deletedOffsets;
         unsigned entryIndices[1];
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index c28b6a4..6b24669 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -30,7 +30,7 @@ static const size_t setThreshold = 20;
 
 void PropertyNameArray::add(UString::Rep* identifier)
 {
-    ASSERT(identifier == &UString::Rep::null() || identifier == &UString::Rep::empty() || identifier->identifierTable());
+    ASSERT(identifier == UString::null().rep() || identifier == UString::Rep::empty() || identifier->isIdentifier());
 
     size_t size = m_data->propertyNameVector().size();
     if (size < setThreshold) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
index a0a2f48..2306a11 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
@@ -26,19 +26,19 @@
 
 namespace JSC {
 
-JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue PropertySlot::functionGetter(ExecState* exec) const
 {
     // Prevent getter functions from observing execution if an exception is pending.
     if (exec->hadException())
         return exec->exception();
 
     CallData callData;
-    CallType callType = slot.m_data.getterFunc->getCallData(callData);
+    CallType callType = m_data.getterFunc->getCallData(callData);
     if (callType == CallTypeHost)
-        return callData.native.function(exec, slot.m_data.getterFunc, slot.slotBase(), exec->emptyList());
+        return callData.native.function(exec, m_data.getterFunc, thisValue(), exec->emptyList());
     ASSERT(callType == CallTypeJS);
     // FIXME: Can this be done more efficiently using the callData?
-    return asFunction(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
+    return asFunction(m_data.getterFunc)->call(exec, thisValue(), exec->emptyList());
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
index 15d9034..de9ddc9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
@@ -34,10 +34,20 @@ namespace JSC {
 
 #define JSC_VALUE_SLOT_MARKER 0
 #define JSC_REGISTER_SLOT_MARKER reinterpret_cast<GetValueFunc>(1)
+#define INDEX_GETTER_MARKER reinterpret_cast<GetValueFunc>(2)
+#define GETTER_FUNCTION_MARKER reinterpret_cast<GetValueFunc>(3)
 
     class PropertySlot {
     public:
+        enum CachedPropertyType {
+            Uncacheable,
+            Getter,
+            Custom,
+            Value
+        };
+
         PropertySlot()
+            : m_cachedPropertyType(Uncacheable)
         {
             clearBase();
             clearOffset();
@@ -46,12 +56,14 @@ namespace JSC {
 
         explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
+            , m_cachedPropertyType(Uncacheable)
         {
             clearOffset();
             clearValue();
         }
 
-        typedef JSValue (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
+        typedef JSValue (*GetValueFunc)(ExecState*, JSValue slotBase, const Identifier&);
+        typedef JSValue (*GetIndexValueFunc)(ExecState*, JSValue slotBase, unsigned);
 
         JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
@@ -59,7 +71,11 @@ namespace JSC {
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
                 return (*m_data.registerSlot).jsValue();
-            return m_getValue(exec, propertyName, *this);
+            if (m_getValue == INDEX_GETTER_MARKER)
+                return m_getIndexValue(exec, slotBase(), index());
+            if (m_getValue == GETTER_FUNCTION_MARKER)
+                return functionGetter(exec);
+            return m_getValue(exec, slotBase(), propertyName);
         }
 
         JSValue getValue(ExecState* exec, unsigned propertyName) const
@@ -68,10 +84,16 @@ namespace JSC {
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
                 return (*m_data.registerSlot).jsValue();
-            return m_getValue(exec, Identifier::from(exec, propertyName), *this);
+            if (m_getValue == INDEX_GETTER_MARKER)
+                return m_getIndexValue(exec, m_slotBase, m_data.index);
+            if (m_getValue == GETTER_FUNCTION_MARKER)
+                return functionGetter(exec);
+            return m_getValue(exec, slotBase(), Identifier::from(exec, propertyName));
         }
 
-        bool isCacheable() const { return m_offset != WTF::notFound; }
+        CachedPropertyType cachedPropertyType() const { return m_cachedPropertyType; }
+        bool isCacheable() const { return m_cachedPropertyType != Uncacheable; }
+        bool isCacheableValue() const { return m_cachedPropertyType == Value; }
         size_t cachedOffset() const
         {
             ASSERT(isCacheable());
@@ -102,6 +124,7 @@ namespace JSC {
             m_slotBase = slotBase;
             m_data.valueSlot = valueSlot;
             m_offset = offset;
+            m_cachedPropertyType = Value;
         }
         
         void setValue(JSValue value)
@@ -128,25 +151,49 @@ namespace JSC {
             ASSERT(slotBase);
             ASSERT(getValue);
             m_getValue = getValue;
+            m_getIndexValue = 0;
             m_slotBase = slotBase;
         }
-
-        void setCustomIndex(JSValue slotBase, unsigned index, GetValueFunc getValue)
+        
+        void setCacheableCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
             m_getValue = getValue;
+            m_getIndexValue = 0;
+            m_slotBase = slotBase;
+            m_cachedPropertyType = Custom;
+        }
+
+        void setCustomIndex(JSValue slotBase, unsigned index, GetIndexValueFunc getIndexValue)
+        {
+            ASSERT(slotBase);
+            ASSERT(getIndexValue);
+            m_getValue = INDEX_GETTER_MARKER;
+            m_getIndexValue = getIndexValue;
             m_slotBase = slotBase;
             m_data.index = index;
         }
-        
+
         void setGetterSlot(JSObject* getterFunc)
         {
             ASSERT(getterFunc);
-            m_getValue = functionGetter;
+            m_thisValue = m_slotBase;
+            m_getValue = GETTER_FUNCTION_MARKER;
             m_data.getterFunc = getterFunc;
         }
-        
+
+        void setCacheableGetterSlot(JSValue slotBase, JSObject* getterFunc, unsigned offset)
+        {
+            ASSERT(getterFunc);
+            m_getValue = GETTER_FUNCTION_MARKER;
+            m_thisValue = m_slotBase;
+            m_slotBase = slotBase;
+            m_data.getterFunc = getterFunc;
+            m_offset = offset;
+            m_cachedPropertyType = Getter;
+        }
+
         void setUndefined()
         {
             setValue(jsUndefined());
@@ -182,15 +229,24 @@ namespace JSC {
         {
             // Clear offset even in release builds, in case this PropertySlot has been used before.
             // (For other data members, we don't need to clear anything because reuse would meaningfully overwrite them.)
-            m_offset = WTF::notFound;
+            m_offset = 0;
+            m_cachedPropertyType = Uncacheable;
         }
 
         unsigned index() const { return m_data.index; }
 
+        JSValue thisValue() const { return m_thisValue; }
+
+        GetValueFunc customGetter() const
+        {
+            ASSERT(m_cachedPropertyType == Custom);
+            return m_getValue;
+        }
     private:
-        static JSValue functionGetter(ExecState*, const Identifier&, const PropertySlot&);
+        JSValue functionGetter(ExecState*) const;
 
         GetValueFunc m_getValue;
+        GetIndexValueFunc m_getIndexValue;
         
         JSValue m_slotBase;
         union {
@@ -201,8 +257,10 @@ namespace JSC {
         } m_data;
 
         JSValue m_value;
+        JSValue m_thisValue;
 
         size_t m_offset;
+        CachedPropertyType m_cachedPropertyType;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
index 7dd4a8f..f097943 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
@@ -40,20 +40,12 @@
 
 #else
 
-#if ENABLE(WREC)
-#include "JIT.h"
-#include "WRECGenerator.h"
-#endif
 #include <pcre/pcre.h>
 
 #endif
 
 namespace JSC {
 
-#if ENABLE(WREC)
-using namespace WREC;
-#endif
-
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
     : m_pattern(pattern)
     , m_flagBits(0)
@@ -65,18 +57,17 @@ inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
 
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
-    , m_flags(flags)
     , m_flagBits(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
-    if (flags.find('g') != -1)
+    if (flags.find('g') != UString::NotFound)
         m_flagBits |= Global;
-    if (flags.find('i') != -1)
+    if (flags.find('i') != UString::NotFound)
         m_flagBits |= IgnoreCase;
-    if (flags.find('m') != -1)
+    if (flags.find('m') != UString::NotFound)
         m_flagBits |= Multiline;
 
     compile(globalData);
@@ -118,7 +109,7 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
 #if ENABLE(YARR_JIT)
@@ -165,18 +156,9 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
 
 #else
 
-void RegExp::compile(JSGlobalData* globalData)
+void RegExp::compile(JSGlobalData*)
 {
     m_regExp = 0;
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, m_pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, ignoreCase(), multiline());
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#else
-    UNUSED_PARAM(globalData);
-#endif
-
     JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
     JSRegExpMultilineOption multilineOption = multiline() ? JSRegExpMultiline : JSRegExpSingleLine;
     m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(m_pattern.data()), m_pattern.size(), ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
@@ -189,39 +171,9 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
-#if ENABLE(WREC)
-    if (m_wrecFunction) {
-        int offsetVectorSize = (m_numSubpatterns + 1) * 2;
-        int* offsetVector;
-        Vector<int, 32> nonReturnedOvector;
-        if (ovector) {
-            ovector->resize(offsetVectorSize);
-            offsetVector = ovector->data();
-        } else {
-            nonReturnedOvector.resize(offsetVectorSize);
-            offsetVector = nonReturnedOvector.data();
-        }
-        ASSERT(offsetVector);
-        for (int j = 0; j < offsetVectorSize; ++j)
-            offsetVector[j] = -1;
-
-        int result = m_wrecFunction(s.data(), startOffset, s.size(), offsetVector);
-
-        if (result < 0) {
-#ifndef NDEBUG
-            // TODO: define up a symbol, rather than magic -1
-            if (result != -1)
-                fprintf(stderr, "jsRegExpExecute failed with result %d\n", result);
-#endif
-            if (ovector)
-                ovector->clear();
-        }
-        return result;
-    } else
-#endif
     if (m_regExp) {
         // Set up the offset vector for the result.
         // First 2/3 used for result, the last third used by PCRE.
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
index 24d4199..695b688 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
@@ -23,7 +23,6 @@
 #define RegExp_h
 
 #include "UString.h"
-#include "WREC.h"
 #include "ExecutableAllocator.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -49,7 +48,6 @@ namespace JSC {
         bool multiline() const { return m_flagBits & Multiline; }
 
         const UString& pattern() const { return m_pattern; }
-        const UString& flags() const { return m_flags; }
 
         bool isValid() const { return !m_constructionError; }
         const char* errorMessage() const { return m_constructionError; }
@@ -66,7 +64,6 @@ namespace JSC {
         enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
 
         UString m_pattern; // FIXME: Just decompile m_regExp instead of storing this.
-        UString m_flags; // FIXME: Just decompile m_regExp instead of storing this.
         int m_flagBits;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
@@ -76,10 +73,6 @@ namespace JSC {
 #elif ENABLE(YARR)
         OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
 #else
-#if ENABLE(WREC)
-        WREC::CompiledRegExp m_wrecFunction;
-        RefPtr<ExecutablePool> m_executablePool;
-#endif
         JSRegExp* m_regExp;
 #endif
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index c609e08..c0cfc37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -35,21 +35,21 @@
 
 namespace JSC {
 
-static JSValue regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorInput(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorMultiline(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLastMatch(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLastParen(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLeftContext(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorRightContext(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar1(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar2(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar3(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar4(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar5(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar6(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar7(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar8(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar9(ExecState*, JSValue, const Identifier&);
 
 static void setRegExpConstructorInput(ExecState*, JSObject*, JSValue);
 static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValue);
@@ -113,17 +113,17 @@ RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate
     memcpy(d->lastOvector().data(), data->lastOvector().data(), offsetVectorSize * sizeof(int));
     // d->multiline is not needed, and remains uninitialized
 
-    setLazyCreationData(d);
+    setSubclassData(d);
 }
 
 RegExpMatchesArray::~RegExpMatchesArray()
 {
-    delete static_cast<RegExpConstructorPrivate*>(lazyCreationData());
+    delete static_cast<RegExpConstructorPrivate*>(subclassData());
 }
 
 void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
 {
-    RegExpConstructorPrivate* d = static_cast<RegExpConstructorPrivate*>(lazyCreationData());
+    RegExpConstructorPrivate* d = static_cast<RegExpConstructorPrivate*>(subclassData());
     ASSERT(d);
 
     unsigned lastNumSubpatterns = d->lastNumSubPatterns;
@@ -132,6 +132,8 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
         int start = d->lastOvector()[2 * i];
         if (start >= 0)
             JSArray::put(exec, i, jsSubstring(exec, d->lastInput, start, d->lastOvector()[2 * i + 1] - start));
+        else
+            JSArray::put(exec, i, jsUndefined());
     }
 
     PutPropertySlot slot;
@@ -139,7 +141,7 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
     JSArray::put(exec, exec->propertyNames().input, jsString(exec, d->input), slot);
 
     delete d;
-    setLazyCreationData(0);
+    setSubclassData(0);
 }
 
 JSObject* RegExpConstructor::arrayOfMatches(ExecState* exec) const
@@ -193,79 +195,79 @@ bool RegExpConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, descriptor);
 }
 
-JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 1);
 }
 
-JSValue regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 2);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 2);
 }
 
-JSValue regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar3(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 3);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 3);
 }
 
-JSValue regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar4(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 4);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 4);
 }
 
-JSValue regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar5(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 5);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 5);
 }
 
-JSValue regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar6(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 6);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 6);
 }
 
-JSValue regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar7(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 7);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 7);
 }
 
-JSValue regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar8(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 8);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 8);
 }
 
-JSValue regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar9(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 9);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 9);
 }
 
-JSValue regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorInput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsString(exec, asRegExpConstructor(slot.slotBase())->input());
+    return jsString(exec, asRegExpConstructor(slotBase)->input());
 }
 
-JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorMultiline(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpConstructor(slot.slotBase())->multiline());
+    return jsBoolean(asRegExpConstructor(slotBase)->multiline());
 }
 
-JSValue regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastMatch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 0);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 0);
 }
 
-JSValue regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastParen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getLastParen(exec);
+    return asRegExpConstructor(slotBase)->getLastParen(exec);
 }
 
-JSValue regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLeftContext(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getLeftContext(exec);
+    return asRegExpConstructor(slotBase)->getLeftContext(exec);
 }
 
-JSValue regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorRightContext(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getRightContext(exec);
+    return asRegExpConstructor(slotBase)->getRightContext(exec);
 }
 
 void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -300,7 +302,7 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 
     RefPtr<RegExp> regExp = RegExp::create(&exec->globalData(), pattern, flags);
     if (!regExp->isValid())
-        return throwError(exec, SyntaxError, UString("Invalid regular expression: ").append(regExp->errorMessage()));
+        return throwError(exec, SyntaxError, makeString("Invalid regular expression: ", regExp->errorMessage()));
     return new (exec) RegExpObject(exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f9ca9cf..8f4be71 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -59,7 +59,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
index 829f7cf..b823621 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -32,58 +32,58 @@ namespace JSC {
     private:
         virtual bool getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
         virtual bool getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
         virtual bool getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertyDescriptor(exec, propertyName, descriptor);
         }
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v, slot);
         }
 
         virtual void put(ExecState* exec, unsigned propertyName, JSValue v)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v);
         }
 
         virtual bool deleteProperty(ExecState* exec, const Identifier& propertyName)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::deleteProperty(exec, propertyName);
         }
 
         virtual bool deleteProperty(ExecState* exec, unsigned propertyName)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::deleteProperty(exec, propertyName);
         }
 
-        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr)
+        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr, EnumerationMode mode = ExcludeDontEnumProperties)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
-            JSArray::getOwnPropertyNames(exec, arr);
+            JSArray::getOwnPropertyNames(exec, arr, mode);
         }
 
         void fillArrayInstance(ExecState*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 679d072..3758e53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -30,11 +30,11 @@
 
 namespace JSC {
 
-static JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectGlobal(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectIgnoreCase(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectMultiline(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectSource(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectLastIndex(ExecState*, JSValue, const Identifier&);
 static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
@@ -77,29 +77,29 @@ bool RegExpObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, descriptor);
 }
 
-JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectGlobal(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->global());
 }
 
-JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectIgnoreCase(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->ignoreCase());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->ignoreCase());
 }
  
-JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectMultiline(ExecState*, JSValue slotBase, const Identifier&)
 {            
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->multiline());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->multiline());
 }
 
-JSValue regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsString(exec, asRegExpObject(slot.slotBase())->regExp()->pattern());
+    return jsString(exec, asRegExpObject(slotBase)->regExp()->pattern());
 }
 
-JSValue regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectLastIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsNumber(exec, asRegExpObject(slot.slotBase())->lastIndex());
+    return jsNumber(exec, asRegExpObject(slotBase)->lastIndex());
 }
 
 void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -142,7 +142,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
 
     UString input = args.isEmpty() ? regExpConstructor->input() : args.at(0).toString(exec);
     if (input.isNull()) {
-        throwError(exec, GeneralError, "No input to " + toString(exec) + ".");
+        throwError(exec, GeneralError, makeString("No input to ", toString(exec), "."));
         return false;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index 3117c86..4ad11ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -49,7 +49,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
index bbc9e85..dd5fe02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -27,6 +27,7 @@
 #include "JSFunction.h"
 #include "JSObject.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "JSValue.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -91,7 +92,7 @@ JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue
     }
 
     if (!regExp->isValid())
-        return throwError(exec, SyntaxError, UString("Invalid regular expression: ").append(regExp->errorMessage()));
+        return throwError(exec, SyntaxError, makeString("Invalid regular expression: ", regExp->errorMessage()));
 
     asRegExpObject(thisValue)->setRegExp(regExp.release());
     asRegExpObject(thisValue)->setLastIndex(0);
@@ -106,15 +107,17 @@ JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValu
         return throwError(exec, TypeError);
     }
 
-    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
-    result.append('/');
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
-        result.append('g');
+        postfix[index++] = 'g';
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
-        result.append('i');
+        postfix[index++] = 'i';
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline).toBoolean(exec))
-        result.append('m');
-    return jsNontrivialString(exec, result);
+        postfix[index] = 'm';
+    UString source = asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
+    // If source is empty, use "/(?:)/" to avoid colliding with comment syntax
+    return jsMakeNontrivialString(exec, "/", source.size() ? source : UString("(?:)"), postfix);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
index 04701cb..78bd4e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
@@ -34,6 +34,11 @@
 namespace JSC {
 static const unsigned numCharactersToStore = 0x100;
 
+static inline bool isMarked(JSString* string)
+{
+    return string && Heap::isCellMarked(string);
+}
+
 class SmallStringsStorage : public Noncopyable {
 public:
     SmallStringsStorage();
@@ -41,41 +46,23 @@ public:
     UString::Rep* rep(unsigned char character) { return &m_reps[character]; }
 
 private:
-    UChar m_characters[numCharactersToStore];
-    UString::BaseString m_base;
     UString::Rep m_reps[numCharactersToStore];
 };
 
 SmallStringsStorage::SmallStringsStorage()
-    : m_base(m_characters, numCharactersToStore)
 {
-    m_base.rc = numCharactersToStore + 1;
-    // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
-    m_base.usedCapacity = numCharactersToStore + 1;
-    m_base.capacity = numCharactersToStore + 1;
-    m_base.checkConsistency();
-
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_characters[i] = i;
-
-    memset(&m_reps, 0, sizeof(m_reps));
+    UChar* characterBuffer = 0;
+    RefPtr<UStringImpl> baseString = UStringImpl::createUninitialized(numCharactersToStore, characterBuffer);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
-        m_reps[i].offset = i;
-        m_reps[i].len = 1;
-        m_reps[i].rc = 1;
-        m_reps[i].setBaseString(&m_base);
-        m_reps[i].checkConsistency();
+        characterBuffer[i] = i;
+        new (&m_reps[i]) UString::Rep(&characterBuffer[i], 1, PassRefPtr<UStringImpl>(baseString));
     }
 }
 
 SmallStrings::SmallStrings()
-    : m_emptyString(0)
-    , m_storage(0)
 {
     COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
-
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_singleCharacterStrings[i] = 0;
+    clear();
 }
 
 SmallStrings::~SmallStrings()
@@ -84,6 +71,25 @@ SmallStrings::~SmallStrings()
 
 void SmallStrings::markChildren(MarkStack& markStack)
 {
+    /*
+       Our hypothesis is that small strings are very common. So, we cache them
+       to avoid GC churn. However, in cases where this hypothesis turns out to
+       be false -- including the degenerate case where all JavaScript execution
+       has terminated -- we don't want to waste memory.
+
+       To test our hypothesis, we check if any small string has been marked. If
+       so, it's probably reasonable to mark the rest. If not, we clear the cache.
+     */
+
+    bool isAnyStringMarked = isMarked(m_emptyString);
+    for (unsigned i = 0; i < numCharactersToStore && !isAnyStringMarked; ++i)
+        isAnyStringMarked = isMarked(m_singleCharacterStrings[i]);
+    
+    if (!isAnyStringMarked) {
+        clear();
+        return;
+    }
+    
     if (m_emptyString)
         markStack.append(m_emptyString);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
@@ -92,6 +98,13 @@ void SmallStrings::markChildren(MarkStack& markStack)
     }
 }
 
+void SmallStrings::clear()
+{
+    m_emptyString = 0;
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        m_singleCharacterStrings[i] = 0;
+}
+
 unsigned SmallStrings::count() const
 {
     unsigned count = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
index efecbb0..cc11d0a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
@@ -57,6 +57,7 @@ namespace JSC {
         UString::Rep* singleCharacterStringRep(unsigned char character);
 
         void markChildren(MarkStack&);
+        void clear();
 
         unsigned count() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h
new file mode 100644
index 0000000..59b01e0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef StringBuilder_h
+#define StringBuilder_h
+
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class StringBuilder {
+public:
+    void append(const UChar u)
+    {
+        buffer.append(u);
+    }
+
+    void append(const char* str)
+    {
+        append(str, strlen(str));
+    }
+
+    void append(const char* str, size_t len)
+    {
+        buffer.reserveCapacity(buffer.size() + len);
+        for (size_t i = 0; i < len; i++)
+            buffer.append(static_cast<unsigned char>(str[i]));
+    }
+
+    void append(const UChar* str, size_t len)
+    {
+        buffer.append(str, len);
+    }
+
+    void append(const UString& str)
+    {
+        buffer.append(str.data(), str.size());
+    }
+
+    bool isEmpty() { return buffer.isEmpty(); }
+    void reserveCapacity(size_t newCapacity) { buffer.reserveCapacity(newCapacity); }
+    void resize(size_t size) { buffer.resize(size); }
+    size_t size() const { return buffer.size(); }
+
+    UChar operator[](size_t i) const { return buffer.at(i); }
+
+    UString build()
+    {
+        buffer.shrinkToFit();
+        ASSERT(buffer.data() || !buffer.size());
+        return UString::adopt(buffer);
+    }
+
+protected:
+    Vector<UChar, 64> buffer;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
index 2f3adbe..c7b62bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
@@ -30,12 +30,12 @@ namespace JSC {
 
 static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
 {
-    UChar* buf = static_cast<UChar*>(fastMalloc(args.size() * sizeof(UChar)));
-    UChar* p = buf;
-    ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        *p++ = static_cast<UChar>((*it).toUInt32(exec));
-    return jsString(exec, UString(buf, p - buf, false));
+    unsigned length = args.size();
+    UChar* buf;
+    PassRefPtr<UStringImpl> impl = UStringImpl::createUninitialized(length, buf);
+    for (unsigned i = 0; i < length; ++i)
+        buf[i] = static_cast<UChar>(args.at(i).toUInt32(exec));
+    return jsString(exec, impl);
 }
 
 static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
index 7216d3a..f8e0e87 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
@@ -79,15 +79,21 @@ bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyNam
 {
     if (propertyName == exec->propertyNames().length)
         return false;
+    bool isStrictUInt32;
+    unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
+    if (isStrictUInt32 && internalValue()->canGetIndex(i))
+        return false;
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    int size = internalValue()->value().size();
+    int size = internalValue()->length();
     for (int i = 0; i < size; ++i)
         propertyNames.add(Identifier(exec, UString::from(i)));
-    return JSObject::getOwnPropertyNames(exec, propertyNames);
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+    return JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 84e1ad2..e3add77 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const JS_EXPORTDATA ClassInfo info;
@@ -48,7 +48,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 69e1939..43c3e38 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,7 +44,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index a0cc9f1..bef4083 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -28,7 +28,9 @@
 #include "JSGlobalObjectFunctions.h"
 #include "JSArray.h"
 #include "JSFunction.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
+#include "Operations.h"
 #include "PropertyNameArray.h"
 #include "RegExpConstructor.h"
 #include "RegExpObject.h"
@@ -148,12 +150,11 @@ bool StringPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier
 
 // ------------------------------ Functions --------------------------
 
-static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacement, const UString& source, const int* ovector, RegExp* reg, unsigned i)
 {
-    UString substitutedReplacement;
+    Vector<UChar> substitutedReplacement;
     int offset = 0;
-    int i = -1;
-    while ((i = replacement.find('$', i + 1)) != -1) {
+    do {
         if (i + 1 == replacement.size())
             break;
 
@@ -205,15 +206,21 @@ static inline UString substituteBackreferences(const UString& replacement, const
         i += 1 + advance;
         offset = i + 1;
         substitutedReplacement.append(source.data() + backrefStart, backrefLength);
-    }
-
-    if (!offset)
-        return replacement;
+    } while ((i = replacement.find('$', i + 1)) != UString::NotFound);
 
     if (replacement.size() - offset)
         substitutedReplacement.append(replacement.data() + offset, replacement.size() - offset);
 
-    return substitutedReplacement;
+    substitutedReplacement.shrinkToFit();
+    return UString::adopt(substitutedReplacement);
+}
+
+static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+{
+    unsigned i = replacement.find('$', 0);
+    if (UNLIKELY(i != UString::NotFound))
+        return substituteBackreferencesSlow(replacement, source, ovector, reg, i);
+    return replacement;
 }
 
 static inline int localeCompare(const UString& a, const UString& b)
@@ -221,10 +228,90 @@ static inline int localeCompare(const UString& a, const UString& b)
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.data()), a.size(), reinterpret_cast<const ::UChar*>(b.data()), b.size());
 }
 
+struct StringRange {
+public:
+    StringRange(int pos, int len)
+        : position(pos)
+        , length(len)
+    {
+    }
+
+    StringRange()
+    {
+    }
+
+    int position;
+    int length;
+};
+
+JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount);
+JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount)
+{
+    if (rangeCount == 1 && separatorCount == 0) {
+        int sourceSize = source.size();
+        int position = substringRanges[0].position;
+        int length = substringRanges[0].length;
+        if (position <= 0 && length >= sourceSize)
+            return sourceVal;
+        // We could call UString::substr, but this would result in redundant checks
+        return jsString(exec, UStringImpl::create(source.rep(), max(0, position), min(sourceSize, length)));
+    }
+
+    int totalLength = 0;
+    for (int i = 0; i < rangeCount; i++)
+        totalLength += substringRanges[i].length;
+    for (int i = 0; i < separatorCount; i++)
+        totalLength += separators[i].size();
+
+    if (totalLength == 0)
+        return jsString(exec, "");
+
+    UChar* buffer;
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec);
+
+    int maxCount = max(rangeCount, separatorCount);
+    int bufferPos = 0;
+    for (int i = 0; i < maxCount; i++) {
+        if (i < rangeCount) {
+            UStringImpl::copyChars(buffer + bufferPos, source.data() + substringRanges[i].position, substringRanges[i].length);
+            bufferPos += substringRanges[i].length;
+        }
+        if (i < separatorCount) {
+            UStringImpl::copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
+            bufferPos += separators[i].size();
+        }
+    }
+
+    return jsString(exec, impl);
+}
+
+JSValue jsReplaceRange(ExecState* exec, const UString& source, int rangeStart, int rangeLength, const UString& replacement);
+JSValue jsReplaceRange(ExecState* exec, const UString& source, int rangeStart, int rangeLength, const UString& replacement)
+{
+    int replacementLength = replacement.size();
+    int totalLength = source.size() - rangeLength + replacementLength;
+    if (totalLength == 0)
+        return jsString(exec, "");
+
+    UChar* buffer;
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec);
+
+    UStringImpl::copyChars(buffer, source.data(), rangeStart);
+    UStringImpl::copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    int rangeEnd = rangeStart + rangeLength;
+    UStringImpl::copyChars(buffer + rangeStart + replacementLength, source.data() + rangeEnd, source.size() - rangeEnd);
+
+    return jsString(exec, impl);
+}
+
 JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSString* sourceVal = thisValue.toThisJSString(exec);
-    const UString& source = sourceVal->value();
+    const UString& source = sourceVal->value(exec);
 
     JSValue pattern = args.at(0);
 
@@ -242,9 +329,9 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
         int lastIndex = 0;
-        int startPosition = 0;
+        unsigned startPosition = 0;
 
-        Vector<UString::Range, 16> sourceRanges;
+        Vector<StringRange, 16> sourceRanges;
         Vector<UString, 16> replacements;
 
         // This is either a loop (if global is set) or a one-way (if not).
@@ -263,7 +350,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 if (matchIndex < 0)
                     break;
                 
-                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 int completeMatchStart = ovector[0];
                 unsigned i = 0;
@@ -281,7 +368,8 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 cachedCall.setArgument(i++, sourceVal);
                 
                 cachedCall.setThis(exec->globalThisValue());
-                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
+                JSValue result = cachedCall.call();
+                replacements.append(result.toString(cachedCall.newCallFrame(exec)));
                 if (exec->hadException())
                     break;
 
@@ -304,7 +392,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 if (matchIndex < 0)
                     break;
 
-                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 if (callType != CallTypeNone) {
                     int completeMatchStart = ovector[0];
@@ -344,19 +432,18 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         if (!lastIndex && replacements.isEmpty())
             return sourceVal;
 
-        if (lastIndex < source.size())
-            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+        if (static_cast<unsigned>(lastIndex) < source.size())
+            sourceRanges.append(StringRange(lastIndex, source.size() - lastIndex));
 
-        return jsString(exec, source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(),
-            replacements.data(), replacements.size()));
+        return jsSpliceSubstringsWithSeparators(exec, sourceVal, source, sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size());
     }
 
     // Not a regular expression, so treat the pattern as a string.
 
     UString patternString = pattern.toString(exec);
-    int matchPos = source.find(patternString);
+    unsigned matchPos = source.find(patternString);
 
-    if (matchPos == -1)
+    if (matchPos == UString::NotFound)
         return sourceVal;
 
     int matchLen = patternString.size();
@@ -370,7 +457,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
     }
 
     int ovector[2] = { matchPos, matchPos + matchLen };
-    return jsString(exec, source.replaceRange(matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0)));
+    return jsReplaceRange(exec, source, matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -422,12 +509,14 @@ JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isString() && (args.size() == 1)) {
+        JSValue v = args.at(0);
+        return v.isString()
+            ? jsString(exec, asString(thisValue), asString(v))
+            : jsString(exec, asString(thisValue), v.toString(exec));
+    }
 
-    ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        s += (*it).toString(exec);
-    return jsString(exec, s);
+    return jsString(exec, thisValue, args);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -452,7 +541,10 @@ JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         pos = static_cast<int>(dpos);
     }
 
-    return jsNumber(exec, s.find(u2, pos));
+    unsigned result = s.find(u2, pos);
+    if (result == UString::NotFound)
+        return jsNumber(exec, -1);
+    return jsNumber(exec, result);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -469,12 +561,16 @@ JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSV
         dpos = 0;
     else if (!(dpos <= len)) // true for NaN
         dpos = len;
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     // Work around for broken NaN compare operator
     else if (isnan(dpos))
         dpos = len;
 #endif
-    return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
+
+    unsigned result = s.rfind(u2, static_cast<unsigned>(dpos));
+    if (result == UString::NotFound)
+        return jsNumber(exec, -1);
+    return jsNumber(exec, result);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -586,7 +682,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
 
     JSArray* result = constructEmptyArray(exec);
     unsigned i = 0;
-    int p0 = 0;
+    unsigned p0 = 0;
     unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
     if (a0.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
@@ -594,7 +690,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
             // empty string matched by regexp -> empty array
             return result;
         }
-        int pos = 0;
+        unsigned pos = 0;
         while (i != limit && pos < s.size()) {
             Vector<int, 32> ovector;
             int mpos = reg->match(s, pos, &ovector);
@@ -602,7 +698,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
                 break;
             int mlen = ovector[1] - ovector[0];
             pos = mpos + (mlen == 0 ? 1 : mlen);
-            if (mpos != p0 || mlen) {
+            if (static_cast<unsigned>(mpos) != p0 || mlen) {
                 result->put(exec, i++, jsSubstring(exec, s, p0, mpos - p0));
                 p0 = mpos + mlen;
             }
@@ -624,8 +720,9 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
             while (i != limit && p0 < s.size() - 1)
                 result->put(exec, i++, jsSingleCharacterSubstring(exec, s, p0++));
         } else {
-            int pos;
-            while (i != limit && (pos = s.find(u2, p0)) >= 0) {
+            unsigned pos;
+            
+            while (i != limit && (pos = s.find(u2, p0)) != UString::NotFound) {
                 result->put(exec, i++, jsSubstring(exec, s, p0, pos - p0));
                 p0 = pos + u2.size();
             }
@@ -696,7 +793,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSVal
 JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -712,7 +809,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
         buffer[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7f))
-        return jsString(exec, UString(buffer.releaseBuffer(), sSize, false));
+        return jsString(exec, UString::adopt(buffer));
 
     bool error;
     int length = Unicode::toLower(buffer.data(), sSize, sData, sSize, &error);
@@ -722,15 +819,18 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
         if (error)
             return sVal;
     }
-    if (length == sSize && memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
-        return sVal;
-    return jsString(exec, UString(buffer.releaseBuffer(), length, false));
+    if (length == sSize) {
+        if (memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
+            return sVal;
+    } else
+        buffer.resize(length);
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -746,7 +846,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSV
         buffer[i] = toASCIIUpper(c);
     }
     if (!(ored & ~0x7f))
-        return jsString(exec, UString(buffer.releaseBuffer(), sSize, false));
+        return jsString(exec, UString::adopt(buffer));
 
     bool error;
     int length = Unicode::toUpper(buffer.data(), sSize, sData, sSize, &error);
@@ -756,9 +856,12 @@ JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSV
         if (error)
             return sVal;
     }
-    if (length == sSize && memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
-        return sVal;
-    return jsString(exec, UString(buffer.releaseBuffer(), length, false));
+    if (length == sSize) {
+        if (memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
+            return sVal;
+    } else
+        buffer.resize(length);
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -774,62 +877,62 @@ JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, J
 JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<big>" + s + "</big>");
+    return jsMakeNontrivialString(exec, "<big>", s, "</big>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<small>" + s + "</small>");
+    return jsMakeNontrivialString(exec, "<small>", s, "</small>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<blink>" + s + "</blink>");
+    return jsMakeNontrivialString(exec, "<blink>", s, "</blink>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<b>" + s + "</b>");
+    return jsMakeNontrivialString(exec, "<b>", s, "</b>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsString(exec, "<tt>" + s + "</tt>");
+    return jsMakeNontrivialString(exec, "<tt>", s, "</tt>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<i>" + s + "</i>");
+    return jsMakeNontrivialString(exec, "<i>", s, "</i>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<strike>" + s + "</strike>");
+    return jsMakeNontrivialString(exec, "<strike>", s, "</strike>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<sub>" + s + "</sub>");
+    return jsMakeNontrivialString(exec, "<sub>", s, "</sub>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<sup>" + s + "</sup>");
+    return jsMakeNontrivialString(exec, "<sup>", s, "</sup>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     JSValue a0 = args.at(0);
-    return jsNontrivialString(exec, "<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    return jsMakeNontrivialString(exec, "<font color=\"", a0.toString(exec), "\">", s, "</font>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -842,7 +945,8 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
         unsigned stringSize = s.size();
         unsigned bufferSize = 22 + stringSize;
         UChar* buffer;
-        if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
+        PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(bufferSize, buffer);
+        if (!impl)
             return jsUndefined();
         buffer[0] = '<';
         buffer[1] = 'f';
@@ -867,17 +971,17 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
         buffer[19 + stringSize] = 'n';
         buffer[20 + stringSize] = 't';
         buffer[21 + stringSize] = '>';
-        return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+        return jsNontrivialString(exec, impl);
     }
 
-    return jsNontrivialString(exec, "<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    return jsMakeNontrivialString(exec, "<font size=\"", a0.toString(exec), "\">", s, "</font>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     JSValue a0 = args.at(0);
-    return jsNontrivialString(exec, "<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
+    return jsMakeNontrivialString(exec, "<a name=\"", a0.toString(exec), "\">", s, "</a>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -890,7 +994,8 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     unsigned stringSize = s.size();
     unsigned bufferSize = 15 + linkTextSize + stringSize;
     UChar* buffer;
-    if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(bufferSize, buffer);
+    if (!impl)
         return jsUndefined();
     buffer[0] = '<';
     buffer[1] = 'a';
@@ -909,7 +1014,7 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     buffer[12 + linkTextSize + stringSize] = '/';
     buffer[13 + linkTextSize + stringSize] = 'a';
     buffer[14 + linkTextSize + stringSize] = '>';
-    return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+    return jsNontrivialString(exec, impl);
 }
 
 enum {
@@ -925,12 +1030,12 @@ static inline bool isTrimWhitespace(UChar c)
 static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
 {
     UString str = thisValue.toThisString(exec);
-    int left = 0;
+    unsigned left = 0;
     if (trimKind & TrimLeft) {
         while (left < str.size() && isTrimWhitespace(str[left]))
             left++;
     }
-    int right = str.size();
+    unsigned right = str.size();
     if (trimKind & TrimRight) {
         while (right > left && isTrimWhitespace(str[right - 1]))
             right--;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 65b62f9..6d13f4b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -77,6 +77,108 @@ static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
 static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
+static int comparePropertyMapEntryIndices(const void* a, const void* b);
+
+inline void Structure::setTransitionTable(TransitionTable* table)
+{
+    ASSERT(m_isUsingSingleSlot);
+#ifndef NDEBUG
+    setSingleTransition(0);
+#endif
+    m_isUsingSingleSlot = false;
+    m_transitions.m_table = table;
+    // This implicitly clears the flag that indicates we're using a single transition
+    ASSERT(!m_isUsingSingleSlot);
+}
+
+// The contains and get methods accept imprecise matches, so if an unspecialised transition exists
+// for the given key they will consider that transition to be a match.  If a specialised transition
+// exists and it matches the provided specificValue, get will return the specific transition.
+inline bool Structure::transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        Structure* existingTransition = singleTransition();
+        return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+               && existingTransition->m_attributesInPrevious == key.second
+               && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
+    }
+    TransitionTable::iterator find = transitionTable()->find(key);
+    if (find == transitionTable()->end())
+        return false;
+
+    return find->second.first || find->second.second->transitionedFor(specificValue);
+}
+
+inline Structure* Structure::transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+{
+    if (m_isUsingSingleSlot) {
+        Structure* existingTransition = singleTransition();
+        if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+            && existingTransition->m_attributesInPrevious == key.second
+            && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
+            return existingTransition;
+        return 0;
+    }
+
+    Transition transition = transitionTable()->get(key);
+    if (transition.second && transition.second->transitionedFor(specificValue))
+        return transition.second;
+    return transition.first;
+}
+
+inline bool Structure::transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const
+{
+    if (m_isUsingSingleSlot) {
+        Structure* transition = singleTransition();
+        return transition && transition->m_nameInPrevious == key.first
+        && transition->m_attributesInPrevious == key.second;
+    }
+    return transitionTable()->contains(key);
+}
+
+inline void Structure::transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        ASSERT(transitionTableContains(key, specificValue));
+        setSingleTransition(0);
+        return;
+    }
+    TransitionTable::iterator find = transitionTable()->find(key);
+    if (!specificValue)
+        find->second.first = 0;
+    else
+        find->second.second = 0;
+    if (!find->second.first && !find->second.second)
+        transitionTable()->remove(find);
+}
+
+inline void Structure::transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        if (!singleTransition()) {
+            setSingleTransition(structure);
+            return;
+        }
+        Structure* existingTransition = singleTransition();
+        TransitionTable* transitionTable = new TransitionTable;
+        setTransitionTable(transitionTable);
+        if (existingTransition)
+            transitionTableAdd(std::make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+    }
+    if (!specificValue) {
+        TransitionTable::iterator find = transitionTable()->find(key);
+        if (find == transitionTable()->end())
+            transitionTable()->add(key, Transition(structure, static_cast<Structure*>(0)));
+        else
+            find->second.first = structure;
+    } else {
+        // If we're adding a transition to a specific value, then there cannot be
+        // an existing transition
+        ASSERT(!transitionTable()->contains(key));
+        transitionTable()->add(key, Transition(static_cast<Structure*>(0), structure));
+    }
+}
+
 void Structure::dumpStatistics()
 {
 #if DUMP_STRUCTURE_ID_STATISTICS
@@ -121,7 +223,7 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
+Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
     : m_typeInfo(typeInfo)
     , m_prototype(prototype)
     , m_specificValueInPrevious(0)
@@ -132,7 +234,12 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
     , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_anonymousSlotCount(anonymousSlotCount)
+    , m_isUsingSingleSlot(true)
 {
+    m_transitions.m_singleTransition = 0;
+
     ASSERT(m_prototype);
     ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
@@ -154,15 +261,11 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
 Structure::~Structure()
 {
     if (m_previous) {
-        if (m_nameInPrevious)
-            m_previous->table.remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
-        else
-            m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
+        ASSERT(m_nameInPrevious);
+        m_previous->transitionTableRemove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
 
     }
-    
-    if (m_enumerationCache)
-        m_enumerationCache->setCachedStructure(0);
+    ASSERT(!m_enumerationCache.hasDeadObject());
 
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
@@ -175,6 +278,9 @@ Structure::~Structure()
         fastFree(m_propertyTable);
     }
 
+    if (!m_isUsingSingleSlot)
+        delete transitionTable();
+
 #ifndef NDEBUG
 #if ENABLE(JSC_MULTIPLE_THREADS)
     MutexLocker protect(ignoreSetMutex);
@@ -273,12 +379,8 @@ void Structure::materializePropertyMap()
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
-        if (!structure->m_nameInPrevious) {
-            m_propertyTable->anonymousSlotCount += structure->m_anonymousSlotsInPrevious;
-            continue;
-        }
         structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
@@ -300,7 +402,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
     ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -318,7 +420,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -342,9 +444,11 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
-    if (Structure* existingTransition = structure->table.get(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
+    if (Structure* existingTransition = structure->transitionTableGet(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
         ASSERT(existingTransition->m_offset != noOffset);
-        offset = existingTransition->m_offset;
+        offset = existingTransition->m_offset + existingTransition->m_anonymousSlotCount;
+        ASSERT(offset >= structure->m_anonymousSlotCount);
+        ASSERT(structure->m_anonymousSlotCount == existingTransition->m_anonymousSlotCount);
         return existingTransition;
     }
 
@@ -356,17 +460,22 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
+    
+    if (structure->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        specificValue = 0;
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
         ASSERT(structure != transition);
         offset = transition->put(propertyName, attributes, specificValue);
+        ASSERT(offset >= structure->m_anonymousSlotCount);
+        ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
         return transition.release();
     }
 
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
@@ -376,6 +485,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -392,12 +502,14 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     }
 
     offset = transition->put(propertyName, attributes, specificValue);
+    ASSERT(offset >= structure->m_anonymousSlotCount);
+    ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
         transition->growPropertyStorageCapacity();
 
-    transition->m_offset = offset;
-
-    structure->table.add(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
+    transition->m_offset = offset - structure->m_anonymousSlotCount;
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    structure->transitionTableAdd(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
     return transition.release();
 }
 
@@ -408,34 +520,40 @@ PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure,
     RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
 
     offset = transition->remove(propertyName);
+    ASSERT(offset >= structure->m_anonymousSlotCount);
+    ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
 
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
-    RefPtr<Structure> transition = create(prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount + 1;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -443,67 +561,32 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
 
-    bool removed = transition->despecifyFunction(replaceFunction);
-    ASSERT_UNUSED(removed, removed);
-
-    return transition.release();
-}
-
-PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structure, unsigned count)
-{
-    if (Structure* transition = structure->table.getAnonymousSlotTransition(count)) {
-        ASSERT(transition->storedPrototype() == structure->storedPrototype());
-        return transition;
+    if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        transition->despecifyAllFunctions();
+    else {
+        bool removed = transition->despecifyFunction(replaceFunction);
+        ASSERT_UNUSED(removed, removed);
     }
-    ASSERT(count);
-    ASSERT(count < ((1<<6) - 2));
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
     
-    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
-    transition->m_previous = structure;
-    transition->m_nameInPrevious = 0;
-    transition->m_attributesInPrevious = 0;
-    transition->m_anonymousSlotsInPrevious = count;
-    transition->m_specificValueInPrevious = 0;
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-
-    if (structure->m_propertyTable) {
-        if (structure->m_isPinnedPropertyTable)
-            transition->m_propertyTable = structure->copyPropertyTable();
-        else {
-            transition->m_propertyTable = structure->m_propertyTable;
-            structure->m_propertyTable = 0;
-        }
-    } else {
-        if (structure->m_previous)
-            transition->materializePropertyMap();
-        else
-            transition->createPropertyMapHashTable();
-    }
-
-    transition->addAnonymousSlots(count);
-    if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
-        transition->growPropertyStorageCapacity();
-
-    structure->table.addAnonymousSlotTransition(count, transition.get());
-    return transition.release();    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    return transition.release();
 }
 
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
@@ -511,16 +594,18 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
 {
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
     
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
     
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
@@ -534,32 +619,62 @@ PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* st
     return toDictionaryTransition(structure, UncachedDictionaryKind);
 }
 
-PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
+PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSObject* object)
 {
-    ASSERT(structure->isDictionary());
-
-    // Since dictionary Structures are not shared, and no opcodes specialize
-    // for them, we don't need to allocate a new Structure when transitioning
-    // to non-dictionary status.
-
-    // FIMXE: We can make this more efficient by canonicalizing the Structure (draining the
-    // deleted offsets vector) before transitioning from dictionary. 
-    if (!structure->m_propertyTable || !structure->m_propertyTable->deletedOffsets || structure->m_propertyTable->deletedOffsets->isEmpty())
-        structure->m_dictionaryKind = NoneDictionaryKind;
+    ASSERT(isDictionary());
+    if (isUncacheableDictionary()) {
+        ASSERT(m_propertyTable);
+        Vector<PropertyMapEntry*> sortedPropertyEntries(m_propertyTable->keyCount);
+        PropertyMapEntry** p = sortedPropertyEntries.data();
+        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+        for (unsigned i = 1; i <= entryCount; i++) {
+            if (m_propertyTable->entries()[i].key)
+                *p++ = &m_propertyTable->entries()[i];
+        }
+        size_t propertyCount = p - sortedPropertyEntries.data();
+        qsort(sortedPropertyEntries.data(), propertyCount, sizeof(PropertyMapEntry*), comparePropertyMapEntryIndices);
+        sortedPropertyEntries.resize(propertyCount);
+
+        // We now have the properties currently defined on this object
+        // in the order that they are expected to be in, but we need to
+        // reorder the storage, so we have to copy the current values out
+        Vector<JSValue> values(propertyCount);
+        unsigned anonymousSlotCount = m_anonymousSlotCount;
+        for (unsigned i = 0; i < propertyCount; i++) {
+            PropertyMapEntry* entry = sortedPropertyEntries[i];
+            values[i] = object->getDirectOffset(entry->offset);
+            // Update property table to have the new property offsets
+            entry->offset = anonymousSlotCount + i;
+            entry->index = i;
+        }
+        
+        // Copy the original property values into their final locations
+        for (unsigned i = 0; i < propertyCount; i++)
+            object->putDirectOffset(anonymousSlotCount + i, values[i]);
+
+        if (m_propertyTable->deletedOffsets) {
+            delete m_propertyTable->deletedOffsets;
+            m_propertyTable->deletedOffsets = 0;
+        }
+    }
 
-    return structure;
+    m_dictionaryKind = NoneDictionaryKind;
+    return this;
 }
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_enumerationCache);
+
+    if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        specificValue = 0;
+
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    if (attributes & DontEnum)
-        m_hasNonEnumerableProperties = true;
 
     size_t offset = put(propertyName, attributes, specificValue);
+    ASSERT(offset >= m_anonymousSlotCount);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     return offset;
@@ -574,6 +689,7 @@ size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
+    ASSERT(offset >= m_anonymousSlotCount);
     return offset;
 }
 
@@ -630,7 +746,6 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     if (m_propertyTable->deletedOffsets)
         newTable->deletedOffsets = new Vector<unsigned>(*m_propertyTable->deletedOffsets);
 
-    newTable->anonymousSlotCount = m_propertyTable->anonymousSlotCount;
     return newTable;
 }
 
@@ -640,7 +755,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     if (!m_propertyTable)
         return notFound;
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -653,6 +768,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
         attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
         specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
+        ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
         return m_propertyTable->entries()[entryIndex - 1].offset;
     }
 
@@ -660,7 +776,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -676,6 +792,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
         if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
             attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
             specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
+            ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
             return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
@@ -691,7 +808,7 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
 
     UString::Rep* rep = propertyName._ustring.rep();
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -711,7 +828,7 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -732,6 +849,17 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
     }
 }
 
+void Structure::despecifyAllFunctions()
+{
+    materializePropertyMapIfNecessary();
+    if (!m_propertyTable)
+        return;
+    
+    unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+    for (unsigned i = 1; i <= entryCount; ++i)
+        m_propertyTable->entries()[i].specificValue = 0;
+}
+
 size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
@@ -739,6 +867,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     checkConsistency();
 
+    if (attributes & DontEnum)
+        m_hasNonEnumerableProperties = true;
+
     UString::Rep* rep = propertyName._ustring.rep();
 
     if (!m_propertyTable)
@@ -746,7 +877,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     // FIXME: Consider a fast case for tables with no deleted sentinels.
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
     unsigned k = 0;
     bool foundDeletedElement = false;
     unsigned deletedElementIndex = 0; // initialize to make the compiler happy
@@ -769,7 +900,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         }
 
         if (k == 0) {
-            k = 1 | doubleHash(rep->computedHash());
+            k = 1 | doubleHash(rep->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -810,9 +941,10 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         newOffset = m_propertyTable->deletedOffsets->last();
         m_propertyTable->deletedOffsets->removeLast();
     } else
-        newOffset = m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount;
+        newOffset = m_propertyTable->keyCount + m_anonymousSlotCount;
     m_propertyTable->entries()[entryIndex - 1].offset = newOffset;
-
+    
+    ASSERT(newOffset >= m_anonymousSlotCount);
     ++m_propertyTable->keyCount;
 
     if ((m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount) * 2 >= m_propertyTable->size)
@@ -822,14 +954,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
     return newOffset;
 }
 
-void Structure::addAnonymousSlots(unsigned count)
-{
-    m_propertyTable->anonymousSlotCount += count;
-}
-
 bool Structure::hasTransition(UString::Rep* rep, unsigned attributes)
 {
-    return table.hasTransition(make_pair(rep, attributes));
+    return transitionTableHasTransition(make_pair(rep, attributes));
 }
 
 size_t Structure::remove(const Identifier& propertyName)
@@ -849,7 +976,7 @@ size_t Structure::remove(const Identifier& propertyName)
 #endif
 
     // Find the thing to remove.
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
     unsigned k = 0;
     unsigned entryIndex;
     UString::Rep* key = 0;
@@ -863,7 +990,7 @@ size_t Structure::remove(const Identifier& propertyName)
             break;
 
         if (k == 0) {
-            k = 1 | doubleHash(rep->computedHash());
+            k = 1 | doubleHash(rep->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -881,6 +1008,7 @@ size_t Structure::remove(const Identifier& propertyName)
     m_propertyTable->entryIndices[i & m_propertyTable->sizeMask] = deletedSentinelIndex;
 
     size_t offset = m_propertyTable->entries()[entryIndex - 1].offset;
+    ASSERT(offset >= m_anonymousSlotCount);
 
     key->deref();
     m_propertyTable->entries()[entryIndex - 1].key = 0;
@@ -906,8 +1034,8 @@ size_t Structure::remove(const Identifier& propertyName)
 void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
 {
     ASSERT(m_propertyTable);
-
-    unsigned i = entry.key->computedHash();
+    ASSERT(entry.offset >= m_anonymousSlotCount);
+    unsigned i = entry.key->existingHash();
     unsigned k = 0;
 
 #if DUMP_PROPERTYMAP_STATS
@@ -920,7 +1048,7 @@ void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
             break;
 
         if (k == 0) {
-            k = 1 | doubleHash(entry.key->computedHash());
+            k = 1 | doubleHash(entry.key->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -985,7 +1113,6 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
     m_propertyTable->size = newTableSize;
     m_propertyTable->sizeMask = newTableSize - 1;
-    m_propertyTable->anonymousSlotCount = oldTable->anonymousSlotCount;
 
     unsigned lastIndexUsed = 0;
     unsigned entryCount = oldTable->keyCount + oldTable->deletedSentinelCount;
@@ -1003,7 +1130,7 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     checkConsistency();
 }
 
-static int comparePropertyMapEntryIndices(const void* a, const void* b)
+int comparePropertyMapEntryIndices(const void* a, const void* b)
 {
     unsigned ia = static_cast<PropertyMapEntry* const*>(a)[0]->index;
     unsigned ib = static_cast<PropertyMapEntry* const*>(b)[0]->index;
@@ -1014,7 +1141,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
+void Structure::getPropertyNames(PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1025,7 +1152,8 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
         int i = 0;
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned k = 1; k <= entryCount; k++) {
-            if (m_propertyTable->entries()[k].key && !(m_propertyTable->entries()[k].attributes & DontEnum)) {
+            ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[k].attributes & DontEnum));
+            if (m_propertyTable->entries()[k].key && (!(m_propertyTable->entries()[k].attributes & DontEnum) || (mode == IncludeDontEnumProperties))) {
                 PropertyMapEntry* value = &m_propertyTable->entries()[k];
                 int j;
                 for (j = i - 1; j >= 0 && a[j]->index > value->index; --j)
@@ -1052,7 +1180,7 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
     PropertyMapEntry** p = sortedEnumerables.data();
     unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
     for (unsigned i = 1; i <= entryCount; i++) {
-        if (m_propertyTable->entries()[i].key && !(m_propertyTable->entries()[i].attributes & DontEnum))
+        if (m_propertyTable->entries()[i].key && (!(m_propertyTable->entries()[i].attributes & DontEnum) || (mode == IncludeDontEnumProperties)))
             *p++ = &m_propertyTable->entries()[i];
     }
 
@@ -1112,11 +1240,13 @@ void Structure::checkConsistency()
 
     unsigned nonEmptyEntryCount = 0;
     for (unsigned c = 1; c <= m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount; ++c) {
+        ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[c].attributes & DontEnum));
         UString::Rep* rep = m_propertyTable->entries()[c].key;
+        ASSERT(m_propertyTable->entries()[c].offset >= m_anonymousSlotCount);
         if (!rep)
             continue;
         ++nonEmptyEntryCount;
-        unsigned i = rep->computedHash();
+        unsigned i = rep->existingHash();
         unsigned k = 0;
         unsigned entryIndex;
         while (1) {
@@ -1125,7 +1255,7 @@ void Structure::checkConsistency()
             if (rep == m_propertyTable->entries()[entryIndex - 1].key)
                 break;
             if (k == 0)
-                k = 1 | doubleHash(rep->computedHash());
+                k = 1 | doubleHash(rep->existingHash());
             i += k;
         }
         ASSERT(entryIndex == c + 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index f355c53..968443a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -36,6 +36,7 @@
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
+#include "WeakGCPtr.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -51,13 +52,18 @@ namespace JSC {
     class PropertyNameArray;
     class PropertyNameArrayData;
 
+    enum EnumerationMode {
+        ExcludeDontEnumProperties,
+        IncludeDontEnumProperties
+    };
+
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
         friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
+        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
         {
-            return adoptRef(new Structure(prototype, typeInfo));
+            return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount));
         }
 
         static void startIgnoringLeaks();
@@ -70,11 +76,11 @@ namespace JSC {
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
         static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
         static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
-        static PassRefPtr<Structure> addAnonymousSlotsTransition(Structure*, unsigned count);
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
+
+        PassRefPtr<Structure> flattenDictionaryStructure(JSObject*);
 
         ~Structure();
 
@@ -96,7 +102,7 @@ namespace JSC {
 
         void growPropertyStorageCapacity();
         unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        unsigned propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : static_cast<unsigned>(m_offset + 1)); }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -121,19 +127,22 @@ namespace JSC {
 
         bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
 
-        bool hasAnonymousSlots() const { return m_propertyTable && m_propertyTable->anonymousSlotCount; }
+        bool hasAnonymousSlots() const { return !!m_anonymousSlotCount; }
+        unsigned anonymousSlotCount() const { return m_anonymousSlotCount; }
         
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
-        JSCell* specificValue() { return m_specificValueInPrevious; }
         void despecifyDictionaryFunction(const Identifier& propertyName);
+        void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
 
         void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        JSPropertyNameIterator* enumerationCache() { return m_enumerationCache.get(); }
-        void getEnumerablePropertyNames(PropertyNameArray&);
-
+        void clearEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
+        void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
+        
     private:
-        Structure(JSValue prototype, const TypeInfo&);
+
+        Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount);
         
         typedef enum { 
             NoneDictionaryKind = 0,
@@ -144,7 +153,6 @@ namespace JSC {
 
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void addAnonymousSlots(unsigned slotCount);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -155,6 +163,7 @@ namespace JSC {
         void checkConsistency();
 
         bool despecifyFunction(const Identifier&);
+        void despecifyAllFunctions();
 
         PropertyMapHashTable* copyPropertyTable();
         void materializePropertyMap();
@@ -170,6 +179,20 @@ namespace JSC {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
+
+        typedef std::pair<Structure*, Structure*> Transition;
+        typedef HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> TransitionTable;
+
+        inline bool transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
+        inline void transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
+        inline void transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue);
+        inline bool transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const;
+        inline Structure* transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const;
+
+        TransitionTable* transitionTable() const { ASSERT(!m_isUsingSingleSlot); return m_transitions.m_table; }
+        inline void setTransitionTable(TransitionTable* table);
+        Structure* singleTransition() const { ASSERT(m_isUsingSingleSlot); return m_transitions.m_singleTransition; }
+        void setSingleTransition(Structure* structure) { ASSERT(m_isUsingSingleSlot); m_transitions.m_singleTransition = structure; }
         
         bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
@@ -179,6 +202,8 @@ namespace JSC {
 
         static const signed char noOffset = -1;
 
+        static const unsigned maxSpecificFunctionThrashCount = 3;
+
         TypeInfo m_typeInfo;
 
         JSValue m_prototype;
@@ -188,13 +213,19 @@ namespace JSC {
         RefPtr<UString::Rep> m_nameInPrevious;
         JSCell* m_specificValueInPrevious;
 
-        StructureTransitionTable table;
+        // 'm_isUsingSingleSlot' indicates whether we are using the single transition optimisation.
+        union {
+            TransitionTable* m_table;
+            Structure* m_singleTransition;
+        } m_transitions;
 
-        ProtectedPtr<JSPropertyNameIterator> m_enumerationCache;
+        WeakGCPtr<JSPropertyNameIterator> m_enumerationCache;
 
         PropertyMapHashTable* m_propertyTable;
 
         uint32_t m_propertyStorageCapacity;
+
+        // m_offset does not account for anonymous slots
         signed char m_offset;
 
         unsigned m_dictionaryKind : 2;
@@ -209,7 +240,10 @@ namespace JSC {
 #else
         unsigned m_attributesInPrevious : 7;
 #endif
-        unsigned m_anonymousSlotsInPrevious : 6;
+        unsigned m_specificFunctionThrashCount : 2;
+        unsigned m_anonymousSlotCount : 5;
+        unsigned m_isUsingSingleSlot : 1;
+        // 4 free bits
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
@@ -222,7 +256,7 @@ namespace JSC {
 
         UString::Rep* rep = propertyName._ustring.rep();
 
-        unsigned i = rep->computedHash();
+        unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
         ++numProbes;
@@ -239,7 +273,7 @@ namespace JSC {
         ++numCollisions;
 #endif
 
-        unsigned k = 1 | WTF::doubleHash(rep->computedHash());
+        unsigned k = 1 | WTF::doubleHash(rep->existingHash());
 
         while (1) {
             i += k;
@@ -256,58 +290,7 @@ namespace JSC {
                 return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
-    
-    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                   && existingTransition->m_attributesInPrevious == key.second
-                   && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
-        }
-        TransitionTable::iterator find = table()->find(key);
-        if (find == table()->end())
-            return false;
 
-        return find->second.first || find->second.second->transitionedFor(specificValue);
-    }
-
-    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                && existingTransition->m_attributesInPrevious == key.second
-                && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
-                return existingTransition;
-            return 0;
-        }
-
-        Transition transition = table()->get(key);
-        if (transition.second && transition.second->transitionedFor(specificValue))
-            return transition.second;
-        return transition.first;
-    }
-
-    bool StructureTransitionTable::hasTransition(const StructureTransitionTableHash::Key& key) const
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* transition = singleTransition();
-            return transition && transition->m_nameInPrevious == key.first
-            && transition->m_attributesInPrevious == key.second;
-        }
-        return table()->contains(key);
-    }
-    
-    void StructureTransitionTable::reifySingleTransition()
-    {
-        ASSERT(usingSingleTransitionSlot());
-        Structure* existingTransition = singleTransition();
-        TransitionTable* transitionTable = new TransitionTable;
-        setTransitionTable(transitionTable);
-        if (existingTransition)
-            add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
-    }
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
index 0fa7b73..d1dc2d9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -30,7 +30,6 @@
 #include <wtf/HashFunctions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -42,7 +41,7 @@ namespace JSC {
         typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
         static unsigned hash(const Key& p)
         {
-            return p.first->computedHash();
+            return p.first->existingHash();
         }
 
         static bool equal(const Key& a, const Key& b)
@@ -67,148 +66,6 @@ namespace JSC {
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
-    class StructureTransitionTable {
-        typedef std::pair<Structure*, Structure*> Transition;
-        struct TransitionTable : public HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> {
-            typedef HashMap<unsigned, Structure*> AnonymousSlotMap;
-
-            void addSlotTransition(unsigned count, Structure* structure)
-            {
-                ASSERT(!getSlotTransition(count));
-                if (!m_anonymousSlotTable)
-                    m_anonymousSlotTable.set(new AnonymousSlotMap);
-                m_anonymousSlotTable->add(count, structure);
-            }
-
-            void removeSlotTransition(unsigned count)
-            {
-                ASSERT(getSlotTransition(count));
-                m_anonymousSlotTable->remove(count);
-            }
-
-            Structure* getSlotTransition(unsigned count)
-            {
-                if (!m_anonymousSlotTable)
-                    return 0;
-
-                AnonymousSlotMap::iterator find = m_anonymousSlotTable->find(count);
-                if (find == m_anonymousSlotTable->end())
-                    return 0;
-                return find->second;
-            }
-        private:
-            OwnPtr<AnonymousSlotMap> m_anonymousSlotTable;
-        };
-    public:
-        StructureTransitionTable() {
-            m_transitions.m_singleTransition.set(0);
-            m_transitions.m_singleTransition.setFlag(usingSingleSlot);
-        }
-
-        ~StructureTransitionTable() {
-            if (!usingSingleTransitionSlot())
-                delete table();
-        }
-
-        // The contains and get methods accept imprecise matches, so if an unspecialised transition exists
-        // for the given key they will consider that transition to be a match.  If a specialised transition
-        // exists and it matches the provided specificValue, get will return the specific transition.
-        inline bool contains(const StructureTransitionTableHash::Key&, JSCell* specificValue);
-        inline Structure* get(const StructureTransitionTableHash::Key&, JSCell* specificValue) const;
-        inline bool hasTransition(const StructureTransitionTableHash::Key& key) const;
-        void remove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-        {
-            if (usingSingleTransitionSlot()) {
-                ASSERT(contains(key, specificValue));
-                setSingleTransition(0);
-                return;
-            }
-            TransitionTable::iterator find = table()->find(key);
-            if (!specificValue)
-                find->second.first = 0;
-            else
-                find->second.second = 0;
-            if (!find->second.first && !find->second.second)
-                table()->remove(find);
-        }
-        void add(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
-        {
-            if (usingSingleTransitionSlot()) {
-                if (!singleTransition()) {
-                    setSingleTransition(structure);
-                    return;
-                }
-                reifySingleTransition();
-            }
-            if (!specificValue) {
-                TransitionTable::iterator find = table()->find(key);
-                if (find == table()->end())
-                    table()->add(key, Transition(structure, 0));
-                else
-                    find->second.first = structure;
-            } else {
-                // If we're adding a transition to a specific value, then there cannot be
-                // an existing transition
-                ASSERT(!table()->contains(key));
-                table()->add(key, Transition(0, structure));
-            }
-        }
-
-        Structure* getAnonymousSlotTransition(unsigned count)
-        {
-            if (usingSingleTransitionSlot())
-                return 0;
-            return table()->getSlotTransition(count);
-        }
-
-        void addAnonymousSlotTransition(unsigned count, Structure* structure)
-        {
-            if (usingSingleTransitionSlot())
-                reifySingleTransition();
-            ASSERT(!table()->getSlotTransition(count));
-            table()->addSlotTransition(count, structure);
-        }
-        
-        void removeAnonymousSlotTransition(unsigned count)
-        {
-            ASSERT(!usingSingleTransitionSlot());
-            table()->removeSlotTransition(count);
-        }
-    private:
-        TransitionTable* table() const { ASSERT(!usingSingleTransitionSlot()); return m_transitions.m_table; }
-        Structure* singleTransition() const {
-            ASSERT(usingSingleTransitionSlot());
-            return m_transitions.m_singleTransition.get();
-        }
-        bool usingSingleTransitionSlot() const { return m_transitions.m_singleTransition.isFlagSet(usingSingleSlot); }
-        void setSingleTransition(Structure* structure)
-        { 
-            ASSERT(usingSingleTransitionSlot());
-            m_transitions.m_singleTransition.set(structure);
-        }
-
-        void setTransitionTable(TransitionTable* table)
-        {
-            ASSERT(usingSingleTransitionSlot());
-#ifndef NDEBUG
-            setSingleTransition(0);
-#endif
-            m_transitions.m_table = table;
-            // This implicitly clears the flag that indicates we're using a single transition
-            ASSERT(!usingSingleTransitionSlot());
-        }
-        inline void reifySingleTransition();
-
-        enum UsingSingleSlot {
-            usingSingleSlot
-        };
-        // Last bit indicates whether we are using the single transition optimisation
-        union {
-            TransitionTable* m_table;
-            PtrAndFlagsBase<Structure, UsingSingleSlot> m_singleTransition;
-        } m_transitions;
-    };
-
 } // namespace JSC
 
 #endif // StructureTransitionTable_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
index 2a056c9..2dc1028 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -33,14 +33,18 @@
 #include "CallFrame.h"
 #include "JSGlobalObject.h"
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include <mach/mach.h>
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #include <windows.h>
 #else
 #include "CurrentTime.h"
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEStdLib.h>
+#endif
+
 using namespace std;
 
 namespace JSC {
@@ -54,7 +58,7 @@ static const int intervalBetweenChecks = 1000;
 // Returns the time the current thread has spent executing, in milliseconds.
 static inline unsigned getCPUTime()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
     thread_basic_info_data_t info;
 
@@ -67,7 +71,7 @@ static inline unsigned getCPUTime()
     time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
     
     return time;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     union {
         FILETIME fileTime;
         unsigned long long fileTimeAsLong;
@@ -80,6 +84,18 @@ static inline unsigned getCPUTime()
     GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#elif OS(SYMBIAN)
+    RThread current;
+    TTimeIntervalMicroSeconds cpuTime;
+
+    TInt err = current.GetCpuTime(cpuTime);
+    ASSERT_WITH_MESSAGE(err == KErrNone, "GetCpuTime failed with %d", err);
+    return cpuTime.Int64() / 1000;
+#elif PLATFORM(BREWMP)
+    // This function returns a continuously and linearly increasing millisecond
+    // timer from the time the device was powered on.
+    // There is only one thread in BREW, so this is enough.
+    return GETUPTIMEMS();
 #else
     // FIXME: We should return the time the current thread has spent executing.
     return currentTime() * 1000;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
index e544f66..c28c85f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
@@ -33,7 +33,7 @@
 #define JAVASCRIPTCORE_GC_BEGIN()
 #define JAVASCRIPTCORE_GC_BEGIN_ENABLED() 0
 
-#define JAVASCRIPTCORE_GC_END(arg0, arg1)
+#define JAVASCRIPTCORE_GC_END()
 #define JAVASCRIPTCORE_GC_END_ENABLED() 0
 
 #define JAVASCRIPTCORE_GC_MARKED()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
index e66ca93..9da669d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
@@ -30,12 +30,12 @@
 #include "Identifier.h"
 #include "Operations.h"
 #include <ctype.h>
-#include <float.h>
 #include <limits.h>
 #include <limits>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
@@ -44,9 +44,6 @@
 #include <wtf/unicode/UTF8.h>
 #include <wtf/StringExtras.h>
 
-#if HAVE(STRING_H)
-#include <string.h>
-#endif
 #if HAVE(STRINGS_H)
 #include <strings.h>
 #endif
@@ -55,52 +52,11 @@ using namespace WTF;
 using namespace WTF::Unicode;
 using namespace std;
 
-// This can be tuned differently per platform by putting platform #ifs right here.
-// If you don't define this macro at all, then copyChars will just call directly
-// to memcpy.
-#define USTRING_COPY_CHARS_INLINE_CUTOFF 20
-
 namespace JSC {
- 
+
 extern const double NaN;
 extern const double Inf;
 
-// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
-static const int minLengthToShare = 10;
-
-static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
-static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
-
-static inline PossiblyNull<UChar*> allocChars(size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastMalloc(sizeof(UChar) * length);
-}
-
-static inline PossiblyNull<UChar*> reallocChars(UChar* buffer, size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastRealloc(buffer, sizeof(UChar) * length);
-}
-
-static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
-{
-#ifdef USTRING_COPY_CHARS_INLINE_CUTOFF
-    if (numCharacters <= USTRING_COPY_CHARS_INLINE_CUTOFF) {
-        for (unsigned i = 0; i < numCharacters; ++i)
-            destination[i] = source[i];
-        return;
-    }
-#endif
-    memcpy(destination, source, numCharacters * sizeof(UChar));
-}
-
-COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes);
-
 CString::CString(const char* c)
     : m_length(strlen(c))
     , m_data(new char[m_length + 1])
@@ -190,728 +146,33 @@ bool operator==(const CString& c1, const CString& c2)
     return len == c2.size() && (len == 0 || memcmp(c1.c_str(), c2.c_str(), len) == 0);
 }
 
-// These static strings are immutable, except for rc, whose initial value is chosen to 
-// reduce the possibility of it becoming zero due to ref/deref not being thread-safe.
-static UChar sharedEmptyChar;
-UString::BaseString* UString::Rep::nullBaseString;
-UString::BaseString* UString::Rep::emptyBaseString;
-UString* UString::nullUString;
-
-static void initializeStaticBaseString(UString::BaseString& base)
-{
-    base.rc = INT_MAX / 2;
-    base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
-    base.checkConsistency();
-}
+// The null string is immutable, except for refCount.
+UString::Rep* UString::s_nullRep;
+UString* UString::s_nullUString;
 
 void initializeUString()
 {
-    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
-    initializeStaticBaseString(*UString::Rep::nullBaseString);
-
-    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
-    initializeStaticBaseString(*UString::Rep::emptyBaseString);
-
-    UString::nullUString = new UString;
-}
-
-static char* statBuffer = 0; // Only used for debugging via UString::ascii().
-
-PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
-{
-    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
-    copyChars(copyD, d, l);
-    return create(copyD, l);
-}
-
-PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
-{
-    if (!string)
-        return &UString::Rep::null();
-
-    size_t length = strlen(string);
-    Vector<UChar, 1024> buffer(length);
-    UChar* p = buffer.data();
-    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return &UString::Rep::null();
-
-    return UString::Rep::createCopying(buffer.data(), p - buffer.data());
-}
-
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    PassRefPtr<UString::Rep> rep = create(string, length);
-    rep->baseString()->setSharedBuffer(sharedBuffer);
-    rep->checkConsistency();
-    return rep;
-}
-
-UString::SharedUChar* UString::Rep::sharedBuffer()
-{
-    UString::BaseString* base = baseString();
-    if (len < minLengthToShare)
-        return 0;
-
-    return base->sharedBuffer();
-}
-
-void UString::Rep::destroy()
-{
-    checkConsistency();
-
-    // Static null and empty strings can never be destroyed, but we cannot rely on 
-    // reference counting, because ref/deref are not thread-safe.
-    if (!isStatic()) {
-        if (identifierTable())
-            Identifier::remove(this);
-
-        UString::BaseString* base = baseString();
-        if (base == this) {
-            if (m_sharedBuffer)
-                m_sharedBuffer->deref();
-            else
-                fastFree(base->buf);
-        } else
-            base->deref();
-
-        delete this;
-    }
-}
-
-// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-// or anything like that.
-const unsigned PHI = 0x9e3779b9U;
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const UChar* s, int len)
-{
-    unsigned l = len;
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    int rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += s[0];
-        tmp = (s[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += s[0];
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const char* s, int l)
-{
-    // This hash is designed to work on 16-bit chunks at a time. But since the normal case
-    // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
-    // were 16-bit chunks, which should give matching results
-
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    size_t rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += static_cast<unsigned char>(s[0]);
-        tmp = (static_cast<unsigned char>(s[1]) << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += static_cast<unsigned char>(s[0]);
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-#ifndef NDEBUG
-void UString::Rep::checkConsistency() const
-{
-    const UString::BaseString* base = baseString();
-
-    // There is no recursion for base strings.
-    ASSERT(base == base->baseString());
-
-    if (isStatic()) {
-        // There are only two static strings: null and empty.
-        ASSERT(!len);
-
-        // Static strings cannot get in identifier tables, because they are globally shared.
-        ASSERT(!identifierTable());
-    }
-
-    // The string fits in buffer.
-    ASSERT(base->usedPreCapacity <= base->preCapacity);
-    ASSERT(base->usedCapacity <= base->capacity);
-    ASSERT(-offset <= base->usedPreCapacity);
-    ASSERT(offset + len <= base->usedCapacity);
-}
-#endif
-
-UString::SharedUChar* UString::BaseString::sharedBuffer()
-{
-    if (!m_sharedBuffer)
-        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
-    return m_sharedBuffer;
-}
-
-void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
-    // is in a union with another variable to avoid making BaseString any larger.
-    if (m_sharedBuffer)
-        m_sharedBuffer->deref();
-    m_sharedBuffer = sharedBuffer.releaseRef();
-}
-
-bool UString::BaseString::slowIsBufferReadOnly()
-{
-    // The buffer may not be modified as soon as the underlying data has been shared with another class.
-    if (m_sharedBuffer->isShared())
-        return true;
-
-    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
-    // so get rid of m_sharedBuffer.
-    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
-    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
-    setSharedBuffer(0);
-    preCapacity += (buf - unsharedBuf);
-    buf = unsharedBuf;
-    return false;
-}
-
-// Put these early so they can be inlined.
-static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
-{
-    // Combine capacitySize & precapacitySize to produce a single size to allocate,
-    // check that doing so does not result in overflow.
-    size_t size = capacitySize + precapacitySize;
-    if (size < capacitySize)
-        return overflowIndicator();
-
-    // Small Strings (up to 4 pages):
-    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
-    // to our previous policy, however 112.5% is cheaper to calculate.
-    if (size < 0x4000) {
-        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Medium Strings (up to 128 pages):
-    // For pages covering multiple pages over-allocation is less of a concern - any unused
-    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
-    // these strings allocate 2x the requested size.
-    if (size < 0x80000) {
-        size_t expandedSize = ((size + size) | 0xfff) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Large Strings (to infinity and beyond!):
-    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
-    // any individual string be responsible for.
-    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
-
-    // Check for overflow - any result that is at least as large as requested (but
-    // still below the limit) is okay.
-    if ((expandedSize >= size) && (expandedSize < maxUChars()))
-        return expandedSize;
-    return overflowIndicator();
-}
-
-static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
-{
-    rep->checkConsistency();
-    ASSERT(!rep->baseString()->isBufferReadOnly());
-
-    UString::BaseString* base = rep->baseString();
-
-    if (requiredLength > base->capacity) {
-        size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
-        UChar* oldBuf = base->buf;
-        if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-            base->buf = oldBuf;
-            return false;
-        }
-        base->capacity = newCapacity - base->preCapacity;
-    }
-    if (requiredLength > base->usedCapacity)
-        base->usedCapacity = requiredLength;
-
-    rep->checkConsistency();
-    return true;
-}
-
-bool UString::Rep::reserveCapacity(int capacity)
-{
-    // If this is an empty string there is no point 'growing' it - just allocate a new one.
-    // If the BaseString is shared with another string that is using more capacity than this
-    // string is, then growing the buffer won't help.
-    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
-    UString::BaseString* base = baseString();
-    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
-        return false;
-    
-    // If there is already sufficient capacity, no need to grow!
-    if (capacity <= base->capacity)
-        return true;
-
-    checkConsistency();
-
-    size_t newCapacity = expandedSize(capacity, base->preCapacity);
-    UChar* oldBuf = base->buf;
-    if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-        base->buf = oldBuf;
-        return false;
-    }
-    base->capacity = newCapacity - base->preCapacity;
-
-    checkConsistency();
-    return true;
-}
-
-void UString::expandCapacity(int requiredLength)
-{
-    if (!JSC::expandCapacity(m_rep.get(), requiredLength))
-        makeNull();
-}
-
-void UString::expandPreCapacity(int requiredPreCap)
-{
-    m_rep->checkConsistency();
-    ASSERT(!m_rep->baseString()->isBufferReadOnly());
-
-    BaseString* base = m_rep->baseString();
-
-    if (requiredPreCap > base->preCapacity) {
-        size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
-        int delta = newCapacity - base->capacity - base->preCapacity;
-
-        UChar* newBuf;
-        if (!allocChars(newCapacity).getValue(newBuf)) {
-            makeNull();
-            return;
-        }
-        copyChars(newBuf + delta, base->buf, base->capacity + base->preCapacity);
-        fastFree(base->buf);
-        base->buf = newBuf;
-
-        base->preCapacity = newCapacity - base->capacity;
-    }
-    if (requiredPreCap > base->usedPreCapacity)
-        base->usedPreCapacity = requiredPreCap;
-
-    m_rep->checkConsistency();
-}
-
-static PassRefPtr<UString::Rep> createRep(const char* c)
-{
-    if (!c)
-        return &UString::Rep::null();
-
-    if (!c[0])
-        return &UString::Rep::empty();
-
-    size_t length = strlen(c);
-    UChar* d;
-    if (!allocChars(length).getValue(d))
-        return &UString::Rep::null();
-    else {
-        for (size_t i = 0; i < length; i++)
-            d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        return UString::Rep::create(d, static_cast<int>(length));
-    }
+    // UStringImpl::empty() does not construct its static string in a threadsafe fashion,
+    // so ensure it has been initialized from here.
+    UStringImpl::empty();
 
+    UString::s_nullRep = new UStringImpl(0, 0, UStringImpl::ConstructStaticString);
+    UString::s_nullUString = new UString;
 }
 
 UString::UString(const char* c)
-    : m_rep(createRep(c))
-{
-}
-
-UString::UString(const UChar* c, int length)
+    : m_rep(Rep::create(c))
 {
-    if (length == 0) 
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(c, length);
 }
 
-UString::UString(UChar* c, int length, bool copy)
+UString::UString(const char* c, unsigned length)
+    : m_rep(Rep::create(c, length))
 {
-    if (length == 0)
-        m_rep = &Rep::empty();
-    else if (copy)
-        m_rep = Rep::createCopying(c, length);
-    else
-        m_rep = Rep::create(c, length);
 }
 
-UString::UString(const Vector<UChar>& buffer)
+UString::UString(const UChar* c, unsigned length)
+    : m_rep(Rep::create(c, length))
 {
-    if (!buffer.size())
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(buffer.data(), buffer.size());
-}
-
-static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
-{
-    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
-
-    const int plusLength = plusOne ? 1 : 0;
-    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
-        CRASH();
-
-    return currentCapacity + extendLength + plusLength;
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (tSize == 0) {
-        // t is empty
-    } else if (thisSize == 0) {
-        // this is empty
-        rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            copyChars(d + thisSize, tData, tSize);
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const char* t)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int tSize = static_cast<int>(strlen(t));
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        rep = createRep(t);
-    } else if (tSize == 0) {
-        // t is empty, we'll just return *this below.
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
-{
-    a->checkConsistency();
-    b->checkConsistency();
-
-    int aSize = a->size();
-    int bSize = b->size();
-    int aOffset = a->offset;
-
-    // possible cases:
-
-    UString::BaseString* aBase = a->baseString();
-    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
-        // b is a single character (common fast case)
-        ++aBase->usedCapacity;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, aSize + 1);
-    }
-
-    // a is empty
-    if (aSize == 0)
-        return b;
-    // b is empty
-    if (bSize == 0)
-        return a;
-
-    int bOffset = b->offset;
-    int length = aSize + bSize;
-
-    UString::BaseString* bBase = b->baseString();
-    if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
-        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
-        // - a reaches the end of its buffer so it qualifies for shared append
-        // - also, it's at least a quarter the length of b - appending to a much shorter
-        //   string does more harm than good
-        // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
-        
-        UString x(a);
-        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
-        if (!a->data() || !x.data())
-            return 0;
-        copyChars(a->data() + aSize, b->data(), bSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(a, 0, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
-    }
-
-    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
-        // - b reaches the beginning of its buffer so it qualifies for shared prepend
-        // - also, it's at least a quarter the length of a - prepending to a much shorter
-        //   string does more harm than good
-        UString y(b);
-        y.expandPreCapacity(-bOffset + aSize);
-        if (!b->data() || !y.data())
-            return 0;
-        copyChars(b->data() - aSize, a->data(), aSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(b, -aSize, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
-    }
-
-    // a does not qualify for append, and b does not qualify for prepend, gotta make a whole new string
-    size_t newCapacity = expandedSize(length, 0);
-    UChar* d;
-    if (!allocChars(newCapacity).getValue(d))
-        return 0;
-    copyChars(d, a->data(), aSize);
-    copyChars(d + aSize, b->data(), bSize);
-    PassRefPtr<UString::Rep> result = UString::Rep::create(d, length);
-    result->baseString()->capacity = newCapacity;
-
-    a->checkConsistency();
-    b->checkConsistency();
-    result->checkConsistency();
-
-    return result;
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, int i)
-{
-    UChar buf[1 + sizeof(i) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
-    UChar* p = end;
-  
-    if (i == 0)
-        *--p = '0';
-    else if (i == INT_MIN) {
-        char minBuf[1 + sizeof(i) * 3];
-        sprintf(minBuf, "%d", INT_MIN);
-        return concatenate(rep, minBuf);
-    } else {
-        bool negative = false;
-        if (i < 0) {
-            negative = true;
-            i = -i;
-        }
-        while (i) {
-            *--p = static_cast<unsigned short>((i % 10) + '0');
-            i /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return concatenate(rep, p, static_cast<int>(end - p));
-
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
-{
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return concatenate(rep, "NaN");
-
-    if (d == 0.0) // stringify -0 as 0
-        d = 0.0;
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return concatenate(rep, buf);
 }
 
 UString UString::from(int i)
@@ -919,7 +180,7 @@ UString UString::from(int i)
     UChar buf[1 + sizeof(i) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
     UChar* p = end;
-  
+
     if (i == 0)
         *--p = '0';
     else if (i == INT_MIN) {
@@ -940,7 +201,7 @@ UString UString::from(int i)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
 UString UString::from(long long i)
@@ -953,7 +214,7 @@ UString UString::from(long long i)
         *--p = '0';
     else if (i == std::numeric_limits<long long>::min()) {
         char minBuf[1 + sizeof(i) * 3];
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
         snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", std::numeric_limits<long long>::min());
 #else
         snprintf(minBuf, sizeof(minBuf) - 1, "%lld", std::numeric_limits<long long>::min());
@@ -973,15 +234,15 @@ UString UString::from(long long i)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
-UString UString::from(unsigned int u)
+UString UString::from(unsigned u)
 {
     UChar buf[sizeof(u) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
     UChar* p = end;
-    
+
     if (u == 0)
         *--p = '0';
     else {
@@ -990,8 +251,8 @@ UString UString::from(unsigned int u)
             u /= 10;
         }
     }
-    
-    return UString(p, static_cast<int>(end - p));
+
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
 UString UString::from(long l)
@@ -1020,264 +281,21 @@ UString UString::from(long l)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, end - p);
 }
 
 UString UString::from(double d)
 {
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return "NaN";
-    if (!d)
-        return "0"; // -0 -> "0"
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-    
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return UString(buf);
-}
-
-UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
-{
-    m_rep->checkConsistency();
-
-    if (rangeCount == 1 && separatorCount == 0) {
-        int thisSize = size();
-        int position = substringRanges[0].position;
-        int length = substringRanges[0].length;
-        if (position <= 0 && length >= thisSize)
-            return *this;
-        return UString::Rep::create(m_rep, max(0, position), min(thisSize, length));
-    }
-
-    int totalLength = 0;
-    for (int i = 0; i < rangeCount; i++)
-        totalLength += substringRanges[i].length;
-    for (int i = 0; i < separatorCount; i++)
-        totalLength += separators[i].size();
-
-    if (totalLength == 0)
-        return "";
-
-    UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
-        return null();
-
-    int maxCount = max(rangeCount, separatorCount);
-    int bufferPos = 0;
-    for (int i = 0; i < maxCount; i++) {
-        if (i < rangeCount) {
-            copyChars(buffer + bufferPos, data() + substringRanges[i].position, substringRanges[i].length);
-            bufferPos += substringRanges[i].length;
-        }
-        if (i < separatorCount) {
-            copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
-            bufferPos += separators[i].size();
-        }
-    }
-
-    return UString::Rep::create(buffer, totalLength);
-}
-
-UString UString::replaceRange(int rangeStart, int rangeLength, const UString& replacement) const
-{
-    m_rep->checkConsistency();
-
-    int replacementLength = replacement.size();
-    int totalLength = size() - rangeLength + replacementLength;
-    if (totalLength == 0)
-        return "";
-
-    UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
-        return null();
-
-    copyChars(buffer, data(), rangeStart);
-    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
-    int rangeEnd = rangeStart + rangeLength;
-    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
-
-    return UString::Rep::create(buffer, totalLength);
-}
-
-
-UString& UString::append(const UString &t)
-{
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    int thisSize = size();
-    int thisOffset = m_rep->offset;
-    int tSize = t.size();
-    int length = thisSize + tSize;
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        *this = t;
-    } else if (tSize == 0) {
-        // t is empty
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep->len = length;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep = Rep::create(m_rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), thisSize);
-            copyChars(d + thisSize, t.data(), tSize);
-            m_rep = Rep::create(d, length);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    return *this;
-}
-
-UString& UString::append(const UChar* tData, int tSize)
-{
-    m_rep = concatenate(m_rep.release(), tData, tSize);
-    return *this;
-}
-
-UString& UString::append(const char* t)
-{
-    m_rep = concatenate(m_rep.release(), t);
-    return *this;
-}
-
-UString& UString::append(UChar c)
-{
-    m_rep->checkConsistency();
-
-    int thisOffset = m_rep->offset;
-    int length = size();
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (length == 0) {
-        // this is empty - must make a new m_rep because we don't want to pollute the shared empty one 
-        size_t newCapacity = expandedSize(1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            d[0] = c;
-            m_rep = Rep::create(d, 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep->len = length + 1;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the string - extend it and share
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep = Rep::create(m_rep, 0, length + 1);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length + 1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), length);
-            d[length] = c;
-            m_rep = Rep::create(d, length + 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-
-    return *this;
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(d, buffer, &length);
+    return UString(buffer, length);
 }
 
 bool UString::getCString(CStringBuffer& buffer) const
 {
-    int length = size();
-    int neededSize = length + 1;
+    unsigned length = size();
+    unsigned neededSize = length + 1;
     buffer.resize(neededSize);
     char* buf = buffer.data();
 
@@ -1299,13 +317,15 @@ bool UString::getCString(CStringBuffer& buffer) const
 
 char* UString::ascii() const
 {
-    int length = size();
-    int neededSize = length + 1;
-    delete[] statBuffer;
-    statBuffer = new char[neededSize];
+    static char* asciiBuffer = 0;
+
+    unsigned length = size();
+    unsigned neededSize = length + 1;
+    delete[] asciiBuffer;
+    asciiBuffer = new char[neededSize];
 
     const UChar* p = data();
-    char* q = statBuffer;
+    char* q = asciiBuffer;
     const UChar* limit = p + length;
     while (p != limit) {
         *q = static_cast<char>(p[0]);
@@ -1314,39 +334,7 @@ char* UString::ascii() const
     }
     *q = '\0';
 
-    return statBuffer;
-}
-
-UString& UString::operator=(const char* c)
-{
-    if (!c) {
-        m_rep = &Rep::null();
-        return *this;
-    }
-
-    if (!c[0]) {
-        m_rep = &Rep::empty();
-        return *this;
-    }
-
-    int l = static_cast<int>(strlen(c));
-    UChar* d;
-    BaseString* base = m_rep->baseString();
-    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
-        d = base->buf;
-        m_rep->_hash = 0;
-        m_rep->len = l;
-    } else {
-        if (!allocChars(l).getValue(d)) {
-            makeNull();
-            return *this;
-        }
-        m_rep = Rep::create(d, l);
-    }
-    for (int i = 0; i < l; i++)
-        d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-
-    return *this;
+    return asciiBuffer;
 }
 
 bool UString::is8Bit() const
@@ -1362,7 +350,7 @@ bool UString::is8Bit() const
     return true;
 }
 
-UChar UString::operator[](int pos) const
+UChar UString::operator[](unsigned pos) const
 {
     if (pos >= size())
         return '\0';
@@ -1502,10 +490,10 @@ uint32_t UString::toStrictUInt32(bool* ok) const
         *ok = false;
 
     // Empty string is not OK.
-    int len = m_rep->len;
+    unsigned len = m_rep->length();
     if (len == 0)
         return 0;
-    const UChar* p = m_rep->data();
+    const UChar* p = m_rep->characters();
     unsigned short c = p[0];
 
     // If the first digit is 0, only 0 itself is OK.
@@ -1546,102 +534,92 @@ uint32_t UString::toStrictUInt32(bool* ok) const
     }
 }
 
-int UString::find(const UString& f, int pos) const
+unsigned UString::find(const UString& f, unsigned pos) const
 {
-    int fsz = f.size();
-
-    if (pos < 0)
-        pos = 0;
+    unsigned fsz = f.size();
 
     if (fsz == 1) {
         UChar ch = f[0];
         const UChar* end = data() + size();
         for (const UChar* c = data() + pos; c < end; c++) {
             if (*c == ch)
-                return static_cast<int>(c - data());
+                return static_cast<unsigned>(c - data());
         }
-        return -1;
+        return NotFound;
     }
 
-    int sz = size();
+    unsigned sz = size();
     if (sz < fsz)
-        return -1;
+        return NotFound;
     if (fsz == 0)
         return pos;
     const UChar* end = data() + sz - fsz;
-    int fsizeminusone = (fsz - 1) * sizeof(UChar);
+    unsigned fsizeminusone = (fsz - 1) * sizeof(UChar);
     const UChar* fdata = f.data();
     unsigned short fchar = fdata[0];
     ++fdata;
     for (const UChar* c = data() + pos; c <= end; c++) {
         if (c[0] == fchar && !memcmp(c + 1, fdata, fsizeminusone))
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-int UString::find(UChar ch, int pos) const
+unsigned UString::find(UChar ch, unsigned pos) const
 {
-    if (pos < 0)
-        pos = 0;
     const UChar* end = data() + size();
     for (const UChar* c = data() + pos; c < end; c++) {
         if (*c == ch)
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
-    
-    return -1;
+
+    return NotFound;
 }
 
-int UString::rfind(const UString& f, int pos) const
+unsigned UString::rfind(const UString& f, unsigned pos) const
 {
-    int sz = size();
-    int fsz = f.size();
+    unsigned sz = size();
+    unsigned fsz = f.size();
     if (sz < fsz)
-        return -1;
-    if (pos < 0)
-        pos = 0;
+        return NotFound;
     if (pos > sz - fsz)
         pos = sz - fsz;
     if (fsz == 0)
         return pos;
-    int fsizeminusone = (fsz - 1) * sizeof(UChar);
+    unsigned fsizeminusone = (fsz - 1) * sizeof(UChar);
     const UChar* fdata = f.data();
     for (const UChar* c = data() + pos; c >= data(); c--) {
         if (*c == *fdata && !memcmp(c + 1, fdata + 1, fsizeminusone))
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-int UString::rfind(UChar ch, int pos) const
+unsigned UString::rfind(UChar ch, unsigned pos) const
 {
     if (isEmpty())
-        return -1;
+        return NotFound;
     if (pos + 1 >= size())
         pos = size() - 1;
     for (const UChar* c = data() + pos; c >= data(); c--) {
         if (*c == ch)
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-UString UString::substr(int pos, int len) const
+UString UString::substr(unsigned pos, unsigned len) const
 {
-    int s = size();
+    unsigned s = size();
 
-    if (pos < 0)
-        pos = 0;
-    else if (pos >= s)
+    if (pos >= s)
         pos = s;
-    if (len < 0)
-        len = s;
-    if (pos + len >= s)
-        len = s - pos;
+    unsigned limit = s - pos;
+    if (len > limit)
+        len = limit;
 
     if (pos == 0 && len == s)
         return *this;
@@ -1668,12 +646,12 @@ bool operator==(const UString& s1, const char *s2)
 
 bool operator<(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1687,12 +665,12 @@ bool operator<(const UString& s1, const UString& s2)
 
 bool operator>(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1706,12 +684,12 @@ bool operator>(const UString& s1, const UString& s2)
 
 int compare(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1729,12 +707,12 @@ int compare(const UString& s1, const UString& s2)
 
 bool equal(const UString::Rep* r, const UString::Rep* b)
 {
-    int length = r->len;
-    if (length != b->len)
+    unsigned length = r->length();
+    if (length != b->length())
         return false;
-    const UChar* d = r->data();
-    const UChar* s = b->data();
-    for (int i = 0; i != length; ++i) {
+    const UChar* d = r->characters();
+    const UChar* s = b->characters();
+    for (unsigned i = 0; i != length; ++i) {
         if (d[i] != s[i])
             return false;
     }
@@ -1744,7 +722,7 @@ bool equal(const UString::Rep* r, const UString::Rep* b)
 CString UString::UTF8String(bool strict) const
 {
     // Allocate a buffer big enough to hold all the characters.
-    const int length = size();
+    const unsigned length = size();
     Vector<char, 1024> buffer(length * 3);
 
     // Convert to runs of 8-bit characters.
@@ -1757,16 +735,4 @@ CString UString::UTF8String(bool strict) const
     return CString(buffer.data(), p - buffer.data());
 }
 
-// For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
-NEVER_INLINE void UString::makeNull()
-{
-    m_rep = &Rep::null();
-}
-
-// For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
-NEVER_INLINE UString::Rep* UString::nullRep()
-{
-    return &Rep::null();
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index c4dad2a..e616201 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -24,13 +24,13 @@
 #define UString_h
 
 #include "Collector.h"
+#include "UStringImpl.h"
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/CrossThreadRefCounted.h>
 #include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
@@ -40,8 +40,6 @@ namespace JSC {
     using WTF::PlacementNewAdoptType;
     using WTF::PlacementNewAdopt;
 
-    class IdentifierTable;
-  
     class CString {
     public:
         CString()
@@ -71,223 +69,50 @@ namespace JSC {
         char* m_data;
     };
 
+    bool operator==(const CString&, const CString&);
+
     typedef Vector<char, 32> CStringBuffer;
 
     class UString {
         friend class JIT;
 
     public:
-        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
-        struct BaseString;
-        struct Rep : Noncopyable {
-            friend class JIT;
-
-            static PassRefPtr<Rep> create(UChar* buffer, int length)
-            {
-                return adoptRef(new BaseString(buffer, length));
-            }
-
-            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
-            {
-                // Guard against integer overflow
-                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
-                    void* buf = 0;
-                    if (tryFastMalloc(size * sizeof(UChar)).getValue(buf))
-                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
-                }
-                return adoptRef(new BaseString(0, 0, 0));
-            }
-
-            static PassRefPtr<Rep> createCopying(const UChar*, int);
-            static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
-
-            // Constructs a string from a UTF-8 string, using strict conversion (see comments in UTF8.h).
-            // Returns UString::Rep::null for null input or conversion failure.
-            static PassRefPtr<Rep> createFromUTF8(const char*);
-
-            // Uses SharedUChar to have joint ownership over the UChar*.
-            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
-
-            SharedUChar* sharedBuffer();
-            void destroy();
-
-            bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
-            UChar* data() const;
-            int size() const { return len; }
-
-            unsigned hash() const { if (_hash == 0) _hash = computeHash(data(), len); return _hash; }
-            unsigned computedHash() const { ASSERT(_hash); return _hash; } // fast path for Identifiers
-
-            static unsigned computeHash(const UChar*, int length);
-            static unsigned computeHash(const char*, int length);
-            static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
-
-            IdentifierTable* identifierTable() const { return m_identifierTableAndFlags.get(); }
-            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTableAndFlags.set(table); }
-
-            bool isStatic() const { return m_identifierTableAndFlags.isFlagSet(StaticFlag); }
-            void setStatic(bool);
-            void setBaseString(PassRefPtr<BaseString>);
-            BaseString* baseString();
-            const BaseString* baseString() const;
-
-            Rep* ref() { ++rc; return this; }
-            ALWAYS_INLINE void deref() { if (--rc == 0) destroy(); }
-
-            void checkConsistency() const;
-            enum UStringFlags {
-                StaticFlag,
-                BaseStringFlag
-            };
-
-            // unshared data
-            int offset;
-            int len;
-            int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
-            mutable unsigned _hash;
-            PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
-
-            static BaseString& null() { return *nullBaseString; }
-            static BaseString& empty() { return *emptyBaseString; }
-
-            bool reserveCapacity(int capacity);
-
-        protected:
-            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
-            Rep(int length)
-                : offset(0)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(0)
-            {
-            }
-
-            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
-                : offset(offsetInBase)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(base.releaseRef())
-            {
-                checkConsistency();
-            }
-
-            union {
-                // If !baseIsSelf()
-                BaseString* m_baseString;
-                // If baseIsSelf()
-                SharedUChar* m_sharedBuffer;
-            };
-
-        private:
-            // For SmallStringStorage which allocates an array and does initialization manually.
-            Rep() { }
-
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-            JS_EXPORTDATA static BaseString* nullBaseString;
-            JS_EXPORTDATA static BaseString* emptyBaseString;
-        };
-
-
-        struct BaseString : public Rep {
-            bool isShared() { return rc != 1 || isBufferReadOnly(); }
-            void setSharedBuffer(PassRefPtr<SharedUChar>);
-
-            bool isBufferReadOnly()
-            {
-                if (!m_sharedBuffer)
-                    return false;
-                return slowIsBufferReadOnly();
-            }
-
-            // potentially shared data.
-            UChar* buf;
-            int preCapacity;
-            int usedPreCapacity;
-            int capacity;
-            int usedCapacity;
-
-            size_t reportedCost;
-
-        private:
-            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
-                : Rep(length)
-                , buf(buffer)
-                , preCapacity(0)
-                , usedPreCapacity(0)
-                , capacity(length + additionalCapacity)
-                , usedCapacity(length)
-                , reportedCost(0)
-            {
-                m_identifierTableAndFlags.setFlag(BaseStringFlag);
-                checkConsistency();
-            }
-
-            SharedUChar* sharedBuffer();
-            bool slowIsBufferReadOnly();
-
-            friend struct Rep;
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-        };
-
+        typedef UStringImpl Rep;
+    
     public:
         UString();
-        UString(const char*);
-        UString(const UChar*, int length);
-        UString(UChar*, int length, bool copy);
+        UString(const char*); // Constructor for null-terminated string.
+        UString(const char*, unsigned length);
+        UString(const UChar*, unsigned length);
+        UString(const Vector<UChar>& buffer);
 
         UString(const UString& s)
             : m_rep(s.m_rep)
         {
         }
 
-        UString(const Vector<UChar>& buffer);
+        // Special constructor for cases where we overwrite an object in place.
+        UString(PlacementNewAdoptType)
+            : m_rep(PlacementNewAdopt)
+        {
+        }
 
         ~UString()
         {
         }
 
-        // Special constructor for cases where we overwrite an object in place.
-        UString(PlacementNewAdoptType)
-            : m_rep(PlacementNewAdopt)
+        template<size_t inlineCapacity>
+        static PassRefPtr<UStringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
         {
+            return Rep::adopt(vector);
         }
 
         static UString from(int);
         static UString from(long long);
-        static UString from(unsigned int);
+        static UString from(unsigned);
         static UString from(long);
         static UString from(double);
 
-        struct Range {
-        public:
-            Range(int pos, int len)
-                : position(pos)
-                , length(len)
-            {
-            }
-
-            Range()
-            {
-            }
-
-            int position;
-            int length;
-        };
-
-        UString spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const;
-
-        UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
-
-        UString& append(const UString&);
-        UString& append(const char*);
-        UString& append(UChar);
-        UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
-        UString& append(const UChar*, int size);
-
         bool getCString(CStringBuffer&) const;
 
         // NOTE: This method should only be used for *debugging* purposes as it
@@ -304,21 +129,16 @@ namespace JSC {
          */
         CString UTF8String(bool strict = false) const;
 
-        UString& operator=(const char*c);
-
-        UString& operator+=(const UString& s) { return append(s); }
-        UString& operator+=(const char* s) { return append(s); }
-
-        const UChar* data() const { return m_rep->data(); }
+        const UChar* data() const { return m_rep->characters(); }
 
-        bool isNull() const { return (m_rep == &Rep::null()); }
-        bool isEmpty() const { return (!m_rep->len); }
+        bool isNull() const { return m_rep == s_nullRep; }
+        bool isEmpty() const { return !m_rep->length(); }
 
         bool is8Bit() const;
 
-        int size() const { return m_rep->size(); }
+        unsigned size() const { return m_rep->length(); }
 
-        UChar operator[](int pos) const;
+        UChar operator[](unsigned pos) const;
 
         double toDouble(bool tolerateTrailingJunk, bool tolerateEmptyString) const;
         double toDouble(bool tolerateTrailingJunk) const;
@@ -330,17 +150,17 @@ namespace JSC {
 
         unsigned toArrayIndex(bool* ok = 0) const;
 
-        int find(const UString& f, int pos = 0) const;
-        int find(UChar, int pos = 0) const;
-        int rfind(const UString& f, int pos) const;
-        int rfind(UChar, int pos) const;
+        static const unsigned NotFound = 0xFFFFFFFFu;
+        unsigned find(const UString& f, unsigned pos = 0) const;
+        unsigned find(UChar, unsigned pos = 0) const;
+        unsigned rfind(const UString& f, unsigned pos) const;
+        unsigned rfind(UChar, unsigned pos) const;
 
-        UString substr(int pos = 0, int len = -1) const;
+        UString substr(unsigned pos = 0, unsigned len = 0xFFFFFFFF) const;
 
-        static const UString& null() { return *nullUString; }
+        static const UString& null() { return *s_nullUString; }
 
         Rep* rep() const { return m_rep.get(); }
-        static Rep* nullRep();
 
         UString(PassRefPtr<Rep> r)
             : m_rep(r)
@@ -348,38 +168,21 @@ namespace JSC {
             ASSERT(m_rep);
         }
 
-        size_t cost() const;
-
-        // Attempt to grow this string such that it can grow to a total length of 'capacity'
-        // without reallocation.  This may fail a number of reasons - if the BasicString is
-        // shared and another string is using part of the capacity beyond our end point, if
-        // the realloc fails, or if this string is empty and has no storage.
-        //
-        // This method returns a boolean indicating success.
-        bool reserveCapacity(int capacity)
-        {
-            return m_rep->reserveCapacity(capacity);
-        }
+        size_t cost() const { return m_rep->cost(); }
 
     private:
-        void expandCapacity(int requiredLength);
-        void expandPreCapacity(int requiredPreCap);
-        void makeNull();
-
         RefPtr<Rep> m_rep;
-        static UString* nullUString;
+
+        JS_EXPORTDATA static Rep* s_nullRep;
+        static UString* s_nullUString;
 
         friend void initializeUString();
         friend bool operator==(const UString&, const UString&);
-        friend PassRefPtr<Rep> concatenate(Rep*, Rep*); // returns 0 if out of memory
     };
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, UString::Rep*);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
-    inline bool operator==(const UString& s1, const UString& s2)
+    ALWAYS_INLINE bool operator==(const UString& s1, const UString& s2)
     {
-        int size = s1.size();
+        unsigned size = s1.size();
         switch (size) {
         case 0:
             return !s2.size();
@@ -423,117 +226,428 @@ namespace JSC {
         return !JSC::operator==(s1, s2);
     }
 
-    bool operator==(const CString&, const CString&);
+    int compare(const UString&, const UString&);
 
-    inline UString operator+(const UString& s1, const UString& s2)
+    inline UString::UString()
+        : m_rep(s_nullRep)
     {
-        RefPtr<UString::Rep> result = concatenate(s1.rep(), s2.rep());
-        return UString(result ? result.release() : UString::nullRep());
     }
 
-    int compare(const UString&, const UString&);
+    // Rule from ECMA 15.2 about what an array index is.
+    // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
+    inline unsigned UString::toArrayIndex(bool* ok) const
+    {
+        unsigned i = toStrictUInt32(ok);
+        if (ok && i >= 0xFFFFFFFFU)
+            *ok = false;
+        return i;
+    }
 
-    bool equal(const UString::Rep*, const UString::Rep*);
+    // We'd rather not do shared substring append for small strings, since
+    // this runs too much risk of a tiny initial string holding down a
+    // huge buffer.
+    static const unsigned minShareSize = Heap::minExtraCost / sizeof(UChar);
 
-    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
-    {
-        ASSERT(rep);
-        rep->checkConsistency();
+    struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
+        static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->existingHash(); }
+        static unsigned hash(JSC::UString::Rep* key) { return key->existingHash(); }
+    };
 
-        int repOffset = rep->offset;
+    void initializeUString();
 
-        PassRefPtr<BaseString> base = rep->baseString();
+    template<typename StringType>
+    class StringTypeAdapter {
+    };
 
-        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
-        ASSERT(offset + repOffset + length <= base->usedCapacity);
+    template<>
+    class StringTypeAdapter<char*> {
+    public:
+        StringTypeAdapter<char*>(char* buffer)
+            : m_buffer((unsigned char*)buffer)
+            , m_length(strlen(buffer))
+        {
+        }
 
-        // Steal the single reference this Rep was created with.
-        return adoptRef(new Rep(base, repOffset + offset, length));
-    }
+        unsigned length() { return m_length; }
+
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_buffer[i];
+        }
+
+    private:
+        const unsigned char* m_buffer;
+        unsigned m_length;
+    };
+
+    template<>
+    class StringTypeAdapter<const char*> {
+    public:
+        StringTypeAdapter<const char*>(const char* buffer)
+            : m_buffer((unsigned char*)buffer)
+            , m_length(strlen(buffer))
+        {
+        }
+
+        unsigned length() { return m_length; }
 
-    inline UChar* UString::Rep::data() const
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_buffer[i];
+        }
+
+    private:
+        const unsigned char* m_buffer;
+        unsigned m_length;
+    };
+
+    template<>
+    class StringTypeAdapter<UString> {
+    public:
+        StringTypeAdapter<UString>(UString& string)
+            : m_data(string.data())
+            , m_length(string.size())
+        {
+        }
+
+        unsigned length() { return m_length; }
+
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_data[i];
+        }
+
+    private:
+        const UChar* m_data;
+        unsigned m_length;
+    };
+
+    inline void sumWithOverflow(unsigned& total, unsigned addend, bool& overflow)
     {
-        const BaseString* base = baseString();
-        return base->buf + base->preCapacity + offset;
+        unsigned oldTotal = total;
+        total = oldTotal + addend;
+        if (total < oldTotal)
+            overflow = true;
     }
 
-    inline void UString::Rep::setStatic(bool v)
+    template<typename StringType1, typename StringType2>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     {
-        ASSERT(!identifierTable());
-        if (v)
-            m_identifierTableAndFlags.setFlag(StaticFlag);
-        else
-            m_identifierTableAndFlags.clearFlag(StaticFlag);
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
+    template<typename StringType1, typename StringType2, typename StringType3>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3)
     {
-        ASSERT(base != this);
-        ASSERT(!baseIsSelf());
-        m_baseString = base.releaseRef();
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline UString::BaseString* UString::Rep::baseString()
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
     {
-        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline const UString::BaseString* UString::Rep::baseString() const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
     {
-        return const_cast<Rep*>(this)->baseString();
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+
+        return resultImpl;
     }
 
-#ifdef NDEBUG
-    inline void UString::Rep::checkConsistency() const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
     {
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+
+        return resultImpl;
     }
-#endif
 
-    inline UString::UString()
-        : m_rep(&Rep::null())
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
     {
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+        StringTypeAdapter<StringType7> adapter7(string7);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        sumWithOverflow(length, adapter7.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+        result += adapter6.length();
+        adapter7.writeTo(result);
+
+        return resultImpl;
     }
 
-    // Rule from ECMA 15.2 about what an array index is.
-    // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
-    inline unsigned UString::toArrayIndex(bool* ok) const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
     {
-        unsigned i = toStrictUInt32(ok);
-        if (ok && i >= 0xFFFFFFFFU)
-            *ok = false;
-        return i;
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+        StringTypeAdapter<StringType7> adapter7(string7);
+        StringTypeAdapter<StringType8> adapter8(string8);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        sumWithOverflow(length, adapter7.length(), overflow);
+        sumWithOverflow(length, adapter8.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+        result += adapter6.length();
+        adapter7.writeTo(result);
+        result += adapter7.length();
+        adapter8.writeTo(result);
+
+        return resultImpl;
     }
 
-    // We'd rather not do shared substring append for small strings, since
-    // this runs too much risk of a tiny initial string holding down a
-    // huge buffer.
-    // FIXME: this should be size_t but that would cause warnings until we
-    // fix UString sizes to be size_t instead of int
-    static const int minShareSize = Heap::minExtraCostSize / sizeof(UChar);
+    template<typename StringType1, typename StringType2>
+    UString makeString(StringType1 string1, StringType2 string2)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-    inline size_t UString::cost() const
+    template<typename StringType1, typename StringType2, typename StringType3>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3)
     {
-        BaseString* base = m_rep->baseString();
-        size_t capacity = (base->capacity + base->preCapacity) * sizeof(UChar);
-        size_t reportedCost = base->reportedCost;
-        ASSERT(capacity >= reportedCost);
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        size_t capacityDelta = capacity - reportedCost;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        if (capacityDelta < static_cast<size_t>(minShareSize))
-            return 0;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        base->reportedCost = capacity;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        return capacityDelta;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
     }
 
-    struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
-        static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->computedHash(); }
-        static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
-    };
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-    void initializeUString();
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp
new file mode 100644
index 0000000..aba63ad
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UStringImpl.h"
+
+#include "Identifier.h"
+#include "StdLibExtras.h"
+#include "UString.h"
+#include <wtf/unicode/UTF8.h>
+
+using namespace WTF::Unicode;
+using namespace std;
+
+namespace JSC {
+
+static const unsigned minLengthToShare = 20;
+
+UStringImpl::~UStringImpl()
+{
+    ASSERT(!isStatic());
+
+    if (isIdentifier())
+        Identifier::remove(this);
+
+    BufferOwnership ownership = bufferOwnership();
+    if (ownership != BufferInternal) {
+        if (ownership == BufferOwned) {
+            ASSERT(!m_sharedBuffer);
+            ASSERT(m_data);
+            fastFree(const_cast<UChar*>(m_data));
+        } else if (ownership == BufferSubstring) {
+            ASSERT(m_substringBuffer);
+            m_substringBuffer->deref();
+        } else {
+            ASSERT(ownership == BufferShared);
+            ASSERT(m_sharedBuffer);
+            m_sharedBuffer->deref();
+        }
+    }
+}
+
+UStringImpl* UStringImpl::empty()
+{
+    // FIXME: This works around a bug in our port of PCRE, that a regular expression
+    // run on the empty string may still perform a read from the first element, and
+    // as such we need this to be a valid pointer. No code should ever be reading
+    // from a zero length string, so this should be able to be a non-null pointer
+    // into the zero-page.
+    // Replace this with 'reinterpret_cast<UChar*>(static_cast<intptr_t>(1))' once
+    // PCRE goes away.
+    static UChar emptyUCharData = 0;
+    DEFINE_STATIC_LOCAL(UStringImpl, emptyString, (&emptyUCharData, 0, ConstructStaticString));
+    return &emptyString;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::createUninitialized(unsigned length, UChar*& data)
+{
+    if (!length) {
+        data = 0;
+        return empty();
+    }
+
+    // Allocate a single buffer large enough to contain the StringImpl
+    // struct as well as the data which it contains. This removes one 
+    // heap allocation from this call.
+    if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+        CRASH();
+    size_t size = sizeof(UStringImpl) + length * sizeof(UChar);
+    UStringImpl* string = static_cast<UStringImpl*>(fastMalloc(size));
+
+    data = reinterpret_cast<UChar*>(string + 1);
+    return adoptRef(new (string) UStringImpl(length));
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const UChar* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<UStringImpl> string = createUninitialized(length, data);
+    memcpy(data, characters, length * sizeof(UChar));
+    return string;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const char* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<UStringImpl> string = createUninitialized(length, data);
+    for (unsigned i = 0; i != length; ++i) {
+        unsigned char c = characters[i];
+        data[i] = c;
+    }
+    return string;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const char* string)
+{
+    if (!string)
+        return empty();
+    return create(string, strlen(string));
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(PassRefPtr<SharedUChar> sharedBuffer, const UChar* buffer, unsigned length)
+{
+    if (!length)
+        return empty();
+    return adoptRef(new UStringImpl(buffer, length, sharedBuffer));
+}
+
+SharedUChar* UStringImpl::sharedBuffer()
+{
+    if (m_length < minLengthToShare)
+        return 0;
+    // All static strings are smaller that the minimim length to share.
+    ASSERT(!isStatic());
+
+    BufferOwnership ownership = bufferOwnership();
+
+    if (ownership == BufferInternal)
+        return 0;
+    if (ownership == BufferSubstring)
+        return m_substringBuffer->sharedBuffer();
+    if (ownership == BufferOwned) {
+        ASSERT(!m_sharedBuffer);
+        m_sharedBuffer = SharedUChar::create(new SharableUChar(m_data)).releaseRef();
+        m_refCountAndFlags = (m_refCountAndFlags & ~s_refCountMaskBufferOwnership) | BufferShared;
+    }
+
+    ASSERT(bufferOwnership() == BufferShared);
+    ASSERT(m_sharedBuffer);
+    return m_sharedBuffer;
+}
+
+void URopeImpl::derefFibersNonRecursive(Vector<URopeImpl*, 32>& workQueue)
+{
+    unsigned length = fiberCount();
+    for (unsigned i = 0; i < length; ++i) {
+        Fiber& fiber = fibers(i);
+        if (fiber->isRope()) {
+            URopeImpl* nextRope = static_cast<URopeImpl*>(fiber);
+            if (nextRope->hasOneRef())
+                workQueue.append(nextRope);
+            else
+                nextRope->deref();
+        } else
+            static_cast<UStringImpl*>(fiber)->deref();
+    }
+}
+
+void URopeImpl::destructNonRecursive()
+{
+    Vector<URopeImpl*, 32> workQueue;
+
+    derefFibersNonRecursive(workQueue);
+    delete this;
+
+    while (!workQueue.isEmpty()) {
+        URopeImpl* rope = workQueue.last();
+        workQueue.removeLast();
+        rope->derefFibersNonRecursive(workQueue);
+        delete rope;
+    }
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h
new file mode 100644
index 0000000..065443a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h
@@ -0,0 +1,343 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef UStringImpl_h
+#define UStringImpl_h
+
+#include <limits>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
+#include <wtf/PossiblyNull.h>
+#include <wtf/StringHashFunctions.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace JSC {
+
+class IdentifierTable;
+
+typedef OwnFastMallocPtr<const UChar> SharableUChar;
+typedef CrossThreadRefCounted<SharableUChar> SharedUChar;
+
+class UStringOrRopeImpl : public Noncopyable {
+public:
+    bool isRope() { return (m_refCountAndFlags & s_refCountIsRope) == s_refCountIsRope; }
+    unsigned length() const { return m_length; }
+
+    void ref() { m_refCountAndFlags += s_refCountIncrement; }
+    inline void deref();
+
+protected:
+    enum BufferOwnership {
+        BufferInternal,
+        BufferOwned,
+        BufferSubstring,
+        BufferShared,
+    };
+
+    using Noncopyable::operator new;
+
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringOrRopeImpl() { }
+
+    UStringOrRopeImpl(unsigned length, BufferOwnership ownership)
+        : m_refCountAndFlags(s_refCountIncrement | s_refCountFlagShouldReportedCost | ownership)
+        , m_length(length)
+    {
+        ASSERT(!isRope());
+    }
+
+    enum StaticStringConstructType { ConstructStaticString };
+    UStringOrRopeImpl(unsigned length, StaticStringConstructType)
+        : m_refCountAndFlags(s_refCountFlagStatic | s_refCountFlagIsIdentifier | BufferOwned)
+        , m_length(length)
+    {
+        ASSERT(!isRope());
+    }
+
+    enum RopeConstructType { ConstructRope };
+    UStringOrRopeImpl(RopeConstructType)
+        : m_refCountAndFlags(s_refCountIncrement | s_refCountIsRope)
+        , m_length(0)
+    {
+        ASSERT(isRope());
+    }
+
+    // The bottom 5 bits hold flags, the top 27 bits hold the ref count.
+    // When dereferencing UStringImpls we check for the ref count AND the
+    // static bit both being zero - static strings are never deleted.
+    static const unsigned s_refCountMask = 0xFFFFFFE0;
+    static const unsigned s_refCountIncrement = 0x20;
+    static const unsigned s_refCountFlagStatic = 0x10;
+    static const unsigned s_refCountFlagShouldReportedCost = 0x8;
+    static const unsigned s_refCountFlagIsIdentifier = 0x4;
+    static const unsigned s_refCountMaskBufferOwnership = 0x3;
+    // Use an otherwise invalid permutation of flags (static & shouldReportedCost -
+    // static strings do not set shouldReportedCost in the constructor, and this bit
+    // is only ever cleared, not set) to identify objects that are ropes.
+    static const unsigned s_refCountIsRope = s_refCountFlagStatic | s_refCountFlagShouldReportedCost;
+
+    unsigned m_refCountAndFlags;
+    unsigned m_length;
+};
+
+class UStringImpl : public UStringOrRopeImpl {
+    friend class CStringTranslator;
+    friend class UCharBufferTranslator;
+    friend class JIT;
+    friend class SmallStringsStorage;
+    friend class UStringOrRopeImpl;
+    friend void initializeUString();
+private:
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringImpl() { }
+
+    // Used to construct static strings, which have an special refCount that can never hit zero.
+    // This means that the static string will never be destroyed, which is important because
+    // static strings will be shared across threads & ref-counted in a non-threadsafe manner.
+    UStringImpl(const UChar* characters, unsigned length, StaticStringConstructType)
+        : UStringOrRopeImpl(length, ConstructStaticString)
+        , m_data(characters)
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        hash();
+    }
+
+    // Create a normal string with internal storage (BufferInternal)
+    UStringImpl(unsigned length)
+        : UStringOrRopeImpl(length, BufferInternal)
+        , m_data(reinterpret_cast<UChar*>(this + 1))
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Create a UStringImpl adopting ownership of the provided buffer (BufferOwned)
+    UStringImpl(const UChar* characters, unsigned length)
+        : UStringOrRopeImpl(length, BufferOwned)
+        , m_data(characters)
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Used to create new strings that are a substring of an existing UStringImpl (BufferSubstring)
+    UStringImpl(const UChar* characters, unsigned length, PassRefPtr<UStringImpl> base)
+        : UStringOrRopeImpl(length, BufferSubstring)
+        , m_data(characters)
+        , m_substringBuffer(base.releaseRef())
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+        ASSERT(m_substringBuffer->bufferOwnership() != BufferSubstring);
+    }
+
+    // Used to construct new strings sharing an existing SharedUChar (BufferShared)
+    UStringImpl(const UChar* characters, unsigned length, PassRefPtr<SharedUChar> sharedBuffer)
+        : UStringOrRopeImpl(length, BufferShared)
+        , m_data(characters)
+        , m_sharedBuffer(sharedBuffer.releaseRef())
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // For use only by Identifier's XXXTranslator helpers.
+    void setHash(unsigned hash)
+    {
+        ASSERT(!isStatic());
+        ASSERT(!m_hash);
+        ASSERT(hash == computeHash(m_data, m_length));
+        m_hash = hash;
+    }
+
+public:
+    ~UStringImpl();
+
+    static PassRefPtr<UStringImpl> create(const UChar*, unsigned length);
+    static PassRefPtr<UStringImpl> create(const char*, unsigned length);
+    static PassRefPtr<UStringImpl> create(const char*);
+    static PassRefPtr<UStringImpl> create(PassRefPtr<SharedUChar>, const UChar*, unsigned length);
+    static PassRefPtr<UStringImpl> create(PassRefPtr<UStringImpl> rep, unsigned offset, unsigned length)
+    {
+        ASSERT(rep);
+        ASSERT(length <= rep->length());
+
+        if (!length)
+            return empty();
+
+        UStringImpl* ownerRep = (rep->bufferOwnership() == BufferSubstring) ? rep->m_substringBuffer : rep.get();
+        return adoptRef(new UStringImpl(rep->m_data + offset, length, ownerRep));
+    }
+
+    static PassRefPtr<UStringImpl> createUninitialized(unsigned length, UChar*& output);
+    static PassRefPtr<UStringImpl> tryCreateUninitialized(unsigned length, UChar*& output)
+    {
+        if (!length) {
+            output = 0;
+            return empty();
+        }
+
+        if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+            return 0;
+        UStringImpl* resultImpl;
+        if (!tryFastMalloc(sizeof(UChar) * length + sizeof(UStringImpl)).getValue(resultImpl))
+            return 0;
+        output = reinterpret_cast<UChar*>(resultImpl + 1);
+        return adoptRef(new(resultImpl) UStringImpl(length));
+    }
+
+    template<size_t inlineCapacity>
+    static PassRefPtr<UStringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
+    {
+        if (size_t size = vector.size()) {
+            ASSERT(vector.data());
+            return adoptRef(new UStringImpl(vector.releaseBuffer(), size));
+        }
+        return empty();
+    }
+
+    SharedUChar* sharedBuffer();
+    const UChar* characters() const { return m_data; }
+
+    size_t cost()
+    {
+        // For substrings, return the cost of the base string.
+        if (bufferOwnership() == BufferSubstring)
+            return m_substringBuffer->cost();
+
+        if (m_refCountAndFlags & s_refCountFlagShouldReportedCost) {
+            m_refCountAndFlags &= ~s_refCountFlagShouldReportedCost;
+            return m_length;
+        }
+        return 0;
+    }
+
+    bool isIdentifier() const { return m_refCountAndFlags & s_refCountFlagIsIdentifier; }
+    void setIsIdentifier(bool isIdentifier)
+    {
+        ASSERT(!isStatic());
+        if (isIdentifier)
+            m_refCountAndFlags |= s_refCountFlagIsIdentifier;
+        else
+            m_refCountAndFlags &= ~s_refCountFlagIsIdentifier;
+    }
+
+    unsigned hash() const { if (!m_hash) m_hash = computeHash(m_data, m_length); return m_hash; }
+    unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
+    static unsigned computeHash(const UChar* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data) { return WTF::stringHash(data); }
+
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic))) delete this; }
+
+    static UStringImpl* empty();
+
+    static void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
+    {
+        if (numCharacters <= s_copyCharsInlineCutOff) {
+            for (unsigned i = 0; i < numCharacters; ++i)
+                destination[i] = source[i];
+        } else
+            memcpy(destination, source, numCharacters * sizeof(UChar));
+    }
+
+private:
+    // This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+    static const unsigned s_copyCharsInlineCutOff = 20;
+
+    BufferOwnership bufferOwnership() const { return static_cast<BufferOwnership>(m_refCountAndFlags & s_refCountMaskBufferOwnership); }
+    bool isStatic() const { return m_refCountAndFlags & s_refCountFlagStatic; }
+
+    const UChar* m_data;
+    union {
+        void* m_buffer;
+        UStringImpl* m_substringBuffer;
+        SharedUChar* m_sharedBuffer;
+    };
+    mutable unsigned m_hash;
+};
+
+class URopeImpl : public UStringOrRopeImpl {
+    friend class UStringOrRopeImpl;
+public:
+    // A URopeImpl is composed from a set of smaller strings called Fibers.
+    // Each Fiber in a rope is either UStringImpl or another URopeImpl.
+    typedef UStringOrRopeImpl* Fiber;
+
+    // Creates a URopeImpl comprising of 'fiberCount' Fibers.
+    // The URopeImpl is constructed in an uninitialized state - initialize must be called for each Fiber in the URopeImpl.
+    static PassRefPtr<URopeImpl> tryCreateUninitialized(unsigned fiberCount)
+    {
+        void* allocation;
+        if (tryFastMalloc(sizeof(URopeImpl) + (fiberCount - 1) * sizeof(Fiber)).getValue(allocation))
+            return adoptRef(new (allocation) URopeImpl(fiberCount));
+        return 0;
+    }
+
+    void initializeFiber(unsigned &index, Fiber fiber)
+    {
+        m_fibers[index++] = fiber;
+        fiber->ref();
+        m_length += fiber->length();
+    }
+
+    unsigned fiberCount() { return m_fiberCount; }
+    Fiber& fibers(unsigned index) { return m_fibers[index]; }
+
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & s_refCountMask)) destructNonRecursive(); }
+
+private:
+    URopeImpl(unsigned fiberCount) : UStringOrRopeImpl(ConstructRope), m_fiberCount(fiberCount) {}
+
+    void destructNonRecursive();
+    void derefFibersNonRecursive(Vector<URopeImpl*, 32>& workQueue);
+
+    bool hasOneRef() { return (m_refCountAndFlags & s_refCountMask) == s_refCountIncrement; }
+
+    unsigned m_fiberCount;
+    Fiber m_fibers[1];
+};
+
+inline void UStringOrRopeImpl::deref()
+{
+    if (isRope())
+        static_cast<URopeImpl*>(this)->deref();
+    else
+        static_cast<UStringImpl*>(this)->deref();
+}
+
+bool equal(const UStringImpl*, const UStringImpl*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h
new file mode 100644
index 0000000..39a91c5
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakGCMap_h
+#define WeakGCMap_h
+
+#include "Collector.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class JSCell;
+
+// A HashMap whose get() function returns emptyValue() for cells awaiting destruction.
+template<typename KeyType, typename MappedType>
+class WeakGCMap : public FastAllocBase {
+    /*
+    Invariants:
+        * A value enters the WeakGCMap marked. (Guaranteed by set().)
+        * A value that becomes unmarked leaves the WeakGCMap before being recycled. (Guaranteed by the value's destructor removing it from the WeakGCMap.)
+        * A value that becomes unmarked leaves the WeakGCMap before becoming marked again. (Guaranteed by all destructors running before the mark phase begins.)
+        * During the mark phase, all values in the WeakGCMap are valid. (Guaranteed by all destructors running before the mark phase begins.)
+    */
+
+public:
+    typedef typename HashMap<KeyType, MappedType>::iterator iterator;
+    typedef typename HashMap<KeyType, MappedType>::const_iterator const_iterator;
+    
+    bool isEmpty() { return m_map.isEmpty(); }
+
+    MappedType get(const KeyType& key) const;
+    pair<iterator, bool> set(const KeyType&, const MappedType&); 
+    MappedType take(const KeyType& key);
+
+    // These unchecked functions provide access to a value even if the value's
+    // mark bit is not set. This is used, among other things, to retrieve values
+    // during the GC mark phase, which begins by clearing all mark bits.
+
+    MappedType uncheckedGet(const KeyType& key) const { return m_map.get(key); }
+    bool uncheckedRemove(const KeyType&, const MappedType&);
+
+    iterator uncheckedBegin() { return m_map.begin(); }
+    iterator uncheckedEnd() { return m_map.end(); }
+
+    const_iterator uncheckedBegin() const { return m_map.begin(); }
+    const_iterator uncheckedEnd() const { return m_map.end(); }
+
+private:
+    HashMap<KeyType, MappedType> m_map;
+};
+
+template<typename KeyType, typename MappedType>
+inline MappedType WeakGCMap<KeyType, MappedType>::get(const KeyType& key) const
+{
+    MappedType result = m_map.get(key);
+    if (result == HashTraits<MappedType>::emptyValue())
+        return result;
+    if (!Heap::isCellMarked(result))
+        return HashTraits<MappedType>::emptyValue();
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+MappedType WeakGCMap<KeyType, MappedType>::take(const KeyType& key)
+{
+    MappedType result = m_map.take(key);
+    if (result == HashTraits<MappedType>::emptyValue())
+        return result;
+    if (!Heap::isCellMarked(result))
+        return HashTraits<MappedType>::emptyValue();
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+pair<typename HashMap<KeyType, MappedType>::iterator, bool> WeakGCMap<KeyType, MappedType>::set(const KeyType& key, const MappedType& value)
+{
+    Heap::markCell(value); // If value is newly allocated, it's not marked, so mark it now.
+    pair<iterator, bool> result = m_map.add(key, value);
+    if (!result.second) { // pre-existing entry
+        result.second = !Heap::isCellMarked(result.first->second);
+        result.first->second = value;
+    }
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+bool WeakGCMap<KeyType, MappedType>::uncheckedRemove(const KeyType& key, const MappedType& value)
+{
+    iterator it = m_map.find(key);
+    if (it == m_map.end())
+        return false;
+    if (it->second != value)
+        return false;
+    m_map.remove(it);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // WeakGCMap_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h
new file mode 100644
index 0000000..5f58374
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakGCPtr_h
+#define WeakGCPtr_h
+
+#include "Collector.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+// A smart pointer whose get() function returns 0 for cells awaiting destruction.
+template <typename T> class WeakGCPtr : Noncopyable {
+public:
+    WeakGCPtr() : m_ptr(0) { }
+    WeakGCPtr(T* ptr) { assign(ptr); }
+
+    T* get() const
+    {
+        if (!m_ptr || !Heap::isCellMarked(m_ptr))
+            return 0;
+        return m_ptr;
+    }
+    
+    void clear(JSCell* ptr)
+    {
+        if (ptr == m_ptr)
+            m_ptr = 0;
+    }
+
+    T& operator*() const { return *get(); }
+    T* operator->() const { return get(); }
+    
+    bool operator!() const { return !get(); }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+#if COMPILER(WINSCW)
+    operator bool() const { return m_ptr; }
+#else
+    typedef T* WeakGCPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return get() ? &WeakGCPtr::m_ptr : 0; }
+#endif
+
+    WeakGCPtr& operator=(T*);
+
+#if !ASSERT_DISABLED
+    bool hasDeadObject() const { return !!m_ptr; }
+#endif
+
+private:
+    void assign(T* ptr)
+    {
+        if (ptr)
+            Heap::markCell(ptr);
+        m_ptr = ptr;
+    }
+
+    T* m_ptr;
+};
+
+template <typename T> inline WeakGCPtr<T>& WeakGCPtr<T>::operator=(T* optr)
+{
+    assign(optr);
+    return *this;
+}
+
+template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
+{ 
+    return a.get() == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const WeakGCPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
+{ 
+    return a.get() != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const WeakGCPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T, typename U> inline WeakGCPtr<T> static_pointer_cast(const WeakGCPtr<U>& p)
+{ 
+    return WeakGCPtr<T>(static_cast<T*>(p.get())); 
+}
+
+template <typename T, typename U> inline WeakGCPtr<T> const_pointer_cast(const WeakGCPtr<U>& p)
+{ 
+    return WeakGCPtr<T>(const_cast<T*>(p.get())); 
+}
+
+template <typename T> inline T* getPtr(const WeakGCPtr<T>& p)
+{
+    return p.get();
+}
+
+} // namespace JSC
+
+#endif // WeakGCPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h
new file mode 100644
index 0000000..ff3995e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ *
+ * Copyright (c) 2009 Ian C. Bullard
+ * 
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ * 
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef WeakRandom_h
+#define WeakRandom_h
+
+#include <limits.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class WeakRandom {
+public:
+    WeakRandom(unsigned seed)
+        : m_low(seed ^ 0x49616E42)
+        , m_high(seed)
+    {
+    }
+
+    double get()
+    {
+        return advance() / (UINT_MAX + 1.0);
+    }
+
+private:
+    unsigned advance()
+    {
+        m_high = (m_high << 16) + (m_high >> 16);
+        m_high += m_low;
+        m_low += m_high;
+        return m_high;
+    }
+
+    unsigned m_low;
+    unsigned m_high;
+};
+
+} // namespace JSC
+
+#endif // WeakRandom_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp
deleted file mode 100644
index e3f12f2..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "CharacterClass.h"
-
-#if ENABLE(WREC)
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-const CharacterClass& CharacterClass::newline() {
-    static const UChar asciiNewlines[2] = { '\n', '\r' };
-    static const UChar unicodeNewlines[2] = { 0x2028, 0x2029 };
-    static const CharacterClass charClass = {
-        asciiNewlines, 2,
-        0, 0,
-        unicodeNewlines, 2,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::digits() {
-    static const CharacterRange asciiDigitsRange[1] = { { '0', '9' } };
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiDigitsRange, 1,
-        0, 0,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::spaces() {
-    static const UChar asciiSpaces[1] = { ' ' };
-    static const CharacterRange asciiSpacesRange[1] = { { '\t', '\r' } };
-    static const UChar unicodeSpaces[8] = { 0x00a0, 0x1680, 0x180e, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000 };
-    static const CharacterRange unicodeSpacesRange[1] = { { 0x2000, 0x200a } };
-    static const CharacterClass charClass = {
-        asciiSpaces, 1,
-        asciiSpacesRange, 1,
-        unicodeSpaces, 8,
-        unicodeSpacesRange, 1,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::wordchar() {
-    static const UChar asciiWordchar[1] = { '_' };
-    static const CharacterRange asciiWordcharRange[3] = { { '0', '9' }, { 'A', 'Z' }, { 'a', 'z' } };
-    static const CharacterClass charClass = {
-        asciiWordchar, 1,
-        asciiWordcharRange, 3,
-        0, 0,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nondigits() {
-    static const CharacterRange asciiNondigitsRange[2] = { { 0, '0' - 1 }, { '9' + 1, 0x7f } };
-    static const CharacterRange unicodeNondigitsRange[1] = { { 0x0080, 0xffff } };
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiNondigitsRange, 2,
-        0, 0,
-        unicodeNondigitsRange, 1,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nonspaces() {
-    static const CharacterRange asciiNonspacesRange[3] = { { 0, '\t' - 1 }, { '\r' + 1, ' ' - 1 }, { ' ' + 1, 0x7f } }; 
-    static const CharacterRange unicodeNonspacesRange[9] = {
-        { 0x0080, 0x009f },
-        { 0x00a1, 0x167f },
-        { 0x1681, 0x180d },
-        { 0x180f, 0x1fff },
-        { 0x200b, 0x2027 },
-        { 0x202a, 0x202e },
-        { 0x2030, 0x205e },
-        { 0x2060, 0x2fff },
-        { 0x3001, 0xffff }
-    }; 
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiNonspacesRange, 3,
-        0, 0,
-        unicodeNonspacesRange, 9,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nonwordchar() {
-    static const UChar asciiNonwordchar[1] = { '`' };
-    static const CharacterRange asciiNonwordcharRange[4] = { { 0, '0' - 1 }, { '9' + 1, 'A' - 1 }, { 'Z' + 1, '_' - 1 }, { 'z' + 1, 0x7f } };
-    static const CharacterRange unicodeNonwordcharRange[1] = { { 0x0080, 0xffff } };
-    static const CharacterClass charClass = {
-        asciiNonwordchar, 1,
-        asciiNonwordcharRange, 4,
-        0, 0,
-        unicodeNonwordcharRange, 1,
-    };
-    
-    return charClass;
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h
deleted file mode 100644
index 8a9d2fc..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterClass_h
-#define CharacterClass_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterRange {
-        UChar begin;
-        UChar end;
-    };
-
-    struct CharacterClass {
-        static const CharacterClass& newline();
-        static const CharacterClass& digits();
-        static const CharacterClass& spaces();
-        static const CharacterClass& wordchar();
-        static const CharacterClass& nondigits();
-        static const CharacterClass& nonspaces();
-        static const CharacterClass& nonwordchar();
-
-        const UChar* matches;
-        unsigned numMatches;
-
-        const CharacterRange* ranges;
-        unsigned numRanges;
-
-        const UChar* matchesUnicode;
-        unsigned numMatchesUnicode;
-
-        const CharacterRange* rangesUnicode;
-        unsigned numRangesUnicode;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // CharacterClass_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp
deleted file mode 100644
index 06f4262..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "CharacterClassConstructor.h"
-
-#if ENABLE(WREC)
-
-#include "pcre_internal.h"
-#include <wtf/ASCIICType.h>
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void CharacterClassConstructor::addSorted(Vector<UChar>& matches, UChar ch)
-{
-    unsigned pos = 0;
-    unsigned range = matches.size();
-
-    // binary chop, find position to insert char.
-    while (range) {
-        unsigned index = range >> 1;
-
-        int val = matches[pos+index] - ch;
-        if (!val)
-            return;
-        else if (val > 0)
-            range = index;
-        else {
-            pos += (index+1);
-            range -= (index+1);
-        }
-    }
-    
-    if (pos == matches.size())
-        matches.append(ch);
-    else
-        matches.insert(pos, ch);
-}
-
-void CharacterClassConstructor::addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi)
-{
-    unsigned end = ranges.size();
-    
-    // Simple linear scan - I doubt there are that many ranges anyway...
-    // feel free to fix this with something faster (eg binary chop).
-    for (unsigned i = 0; i < end; ++i) {
-        // does the new range fall before the current position in the array
-        if (hi < ranges[i].begin) {
-            // optional optimization: concatenate appending ranges? - may not be worthwhile.
-            if (hi == (ranges[i].begin - 1)) {
-                ranges[i].begin = lo;
-                return;
-            }
-            CharacterRange r = {lo, hi};
-            ranges.insert(i, r);
-            return;
-        }
-        // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
-        // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
-        // end of the last range they concatenate, which is just as good.
-        if (lo <= (ranges[i].end + 1)) {
-            // found an intersect! we'll replace this entry in the array.
-            ranges[i].begin = std::min(ranges[i].begin, lo);
-            ranges[i].end = std::max(ranges[i].end, hi);
-
-            // now check if the new range can subsume any subsequent ranges.
-            unsigned next = i+1;
-            // each iteration of the loop we will either remove something from the list, or break the loop.
-            while (next < ranges.size()) {
-                if (ranges[next].begin <= (ranges[i].end + 1)) {
-                    // the next entry now overlaps / concatenates this one.
-                    ranges[i].end = std::max(ranges[i].end, ranges[next].end);
-                    ranges.remove(next);
-                } else
-                    break;
-            }
-            
-            return;
-        }
-    }
-
-    // CharacterRange comes after all existing ranges.
-    CharacterRange r = {lo, hi};
-    ranges.append(r);
-}
-
-void CharacterClassConstructor::put(UChar ch)
-{
-    // Parsing a regular expression like [a-z], we start in an initial empty state:
-    //     ((m_charBuffer == -1) && !m_isPendingDash)
-    // When buffer the 'a' sice it may be (and is in this case) part of a range:
-    //     ((m_charBuffer != -1) && !m_isPendingDash)
-    // Having parsed the hyphen we then record that the dash is also pending:
-    //     ((m_charBuffer != -1) && m_isPendingDash)
-    // The next change will always take us back to the initial state - either because
-    // a complete range has been parsed (such as [a-z]), or because a flush is forced,
-    // due to an early end in the regexp ([a-]), or a character class escape being added
-    // ([a-\s]).  The fourth permutation of m_charBuffer and m_isPendingDash is not permitted.
-    ASSERT(!((m_charBuffer == -1) && m_isPendingDash));
-
-    if (m_charBuffer != -1) {
-        if (m_isPendingDash) {
-            // EXAMPLE: parsing [-a-c], the 'c' reaches this case - we have buffered a previous character and seen a hyphen, so this is a range.
-            UChar lo = m_charBuffer;
-            UChar hi = ch;
-            // Reset back to the inital state.
-            m_charBuffer = -1;
-            m_isPendingDash = false;
-            
-            // This is an error, detected lazily.  Do not proceed.
-            if (lo > hi) {
-                m_isUpsideDown = true;
-                return;
-            }
-            
-            if (lo <= 0x7f) {
-                char asciiLo = lo;
-                char asciiHi = std::min(hi, (UChar)0x7f);
-                addSortedRange(m_ranges, lo, asciiHi);
-                
-                if (m_isCaseInsensitive) {
-                    if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
-                        addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
-                    if ((asciiLo <= 'z') && (asciiHi >= 'a'))
-                        addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
-                }
-            }
-            if (hi >= 0x80) {
-                UChar unicodeCurr = std::max(lo, (UChar)0x80);
-                addSortedRange(m_rangesUnicode, unicodeCurr, hi);
-                
-                if (m_isCaseInsensitive) {
-                    // we're going to scan along, updating the start of the range
-                    while (unicodeCurr <= hi) {
-                        // Spin forwards over any characters that don't have two cases.
-                        for (; jsc_pcre_ucp_othercase(unicodeCurr) == -1; ++unicodeCurr) {
-                            // if this was the last character in the range, we're done.
-                            if (unicodeCurr == hi)
-                                return;
-                        }
-                        // if we fall through to here, unicodeCurr <= hi & has another case. Get the other case.
-                        UChar rangeStart = unicodeCurr;
-                        UChar otherCurr = jsc_pcre_ucp_othercase(unicodeCurr);
-                        
-                        // If unicodeCurr is not yet hi, check the next char in the range.  If it also has another case,
-                        // and if it's other case value is one greater then the othercase value for the current last
-                        // character included in the range, we can include next into the range.
-                        while ((unicodeCurr < hi) && (jsc_pcre_ucp_othercase(unicodeCurr + 1) == (otherCurr + 1))) {
-                            // increment unicodeCurr; it points to the end of the range.
-                            // increment otherCurr, due to the check above other for next must be 1 greater than the currrent other value.
-                            ++unicodeCurr;
-                            ++otherCurr;
-                        }
-                        
-                        // otherChar is the last in the range of other case chars, calculate offset to get back to the start.
-                        addSortedRange(m_rangesUnicode, otherCurr-(unicodeCurr-rangeStart), otherCurr);
-                        
-                        // unicodeCurr has been added, move on to the next char.
-                        ++unicodeCurr;
-                    }
-                }
-            }
-        } else if (ch == '-')
-            // EXAMPLE: parsing [-a-c], the second '-' reaches this case - the hyphen is treated as potentially indicating a range.
-            m_isPendingDash = true;
-        else {
-            // EXAMPLE: Parsing [-a-c], the 'a' reaches this case - we repace the previously buffered char with the 'a'.
-            flush();
-            m_charBuffer = ch;
-        }
-    } else
-        // EXAMPLE: Parsing [-a-c], the first hyphen reaches this case - there is no buffered character
-        // (the hyphen not treated as a special character in this case, same handling for any char).
-        m_charBuffer = ch;
-}
-
-// When a character is added to the set we do not immediately add it to the arrays, in case it is actually defining a range.
-// When we have determined the character is not used in specifing a range it is added, in a sorted fashion, to the appropriate
-// array (either ascii or unicode).
-// If the pattern is case insensitive we add entries for both cases.
-void CharacterClassConstructor::flush()
-{
-    if (m_charBuffer != -1) {
-        if (m_charBuffer <= 0x7f) {
-            if (m_isCaseInsensitive && isASCIILower(m_charBuffer))
-                addSorted(m_matches, toASCIIUpper(m_charBuffer));
-            addSorted(m_matches, m_charBuffer);
-            if (m_isCaseInsensitive && isASCIIUpper(m_charBuffer))
-                addSorted(m_matches, toASCIILower(m_charBuffer));
-        } else {
-            addSorted(m_matchesUnicode, m_charBuffer);
-            if (m_isCaseInsensitive) {
-                int other = jsc_pcre_ucp_othercase(m_charBuffer);
-                if (other != -1)
-                    addSorted(m_matchesUnicode, other);
-            }
-        }
-        m_charBuffer = -1;
-    }
-    
-    if (m_isPendingDash) {
-        addSorted(m_matches, '-');
-        m_isPendingDash = false;
-    }
-}
-
-void CharacterClassConstructor::append(const CharacterClass& other)
-{
-    // [x-\s] will add, 'x', '-', and all unicode spaces to new class (same as [x\s-]).
-    // Need to check the spec, really, but think this matches PCRE behaviour.
-    flush();
-    
-    if (other.numMatches) {
-        for (size_t i = 0; i < other.numMatches; ++i)
-            addSorted(m_matches, other.matches[i]);
-    }
-    if (other.numRanges) {
-        for (size_t i = 0; i < other.numRanges; ++i)
-            addSortedRange(m_ranges, other.ranges[i].begin, other.ranges[i].end);
-    }
-    if (other.numMatchesUnicode) {
-        for (size_t i = 0; i < other.numMatchesUnicode; ++i)
-            addSorted(m_matchesUnicode, other.matchesUnicode[i]);
-    }
-    if (other.numRangesUnicode) {
-        for (size_t i = 0; i < other.numRangesUnicode; ++i)
-            addSortedRange(m_rangesUnicode, other.rangesUnicode[i].begin, other.rangesUnicode[i].end);
-    }
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h
deleted file mode 100644
index 581733d..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterClassConstructor_h
-#define CharacterClassConstructor_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "CharacterClass.h"
-#include <wtf/AlwaysInline.h>
-#include <wtf/Vector.h>
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    class CharacterClassConstructor {
-    public:
-        CharacterClassConstructor(bool isCaseInsensitive)
-            : m_charBuffer(-1)
-            , m_isPendingDash(false)
-            , m_isCaseInsensitive(isCaseInsensitive)
-            , m_isUpsideDown(false)
-        {
-        }
-
-        void flush();
-        
-        // We need to flush prior to an escaped hyphen to prevent it as being treated as indicating
-        // a range, e.g. [a\-c] we flush prior to adding the hyphen so that this is not treated as
-        // [a-c].  However, we do not want to flush if we have already seen a non escaped hyphen -
-        // e.g. [+-\-] should be treated the same as [+--], producing a range that will also match
-        // a comma.
-        void flushBeforeEscapedHyphen()
-        {
-            if (!m_isPendingDash)
-                flush();
-        }
-        
-        void put(UChar ch);
-        void append(const CharacterClass& other);
-
-        bool isUpsideDown() { return m_isUpsideDown; }
-
-        ALWAYS_INLINE CharacterClass charClass()
-        {
-            CharacterClass newCharClass = {
-                m_matches.begin(), m_matches.size(),
-                m_ranges.begin(), m_ranges.size(),
-                m_matchesUnicode.begin(), m_matchesUnicode.size(),
-                m_rangesUnicode.begin(), m_rangesUnicode.size(),
-            };
-
-            return newCharClass;
-        }
-
-    private:
-        void addSorted(Vector<UChar>& matches, UChar ch);
-        void addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi);
-
-        int m_charBuffer;
-        bool m_isPendingDash;
-        bool m_isCaseInsensitive;
-        bool m_isUpsideDown;
-
-        Vector<UChar> m_matches;
-        Vector<CharacterRange> m_ranges;
-        Vector<UChar> m_matchesUnicode;
-        Vector<CharacterRange> m_rangesUnicode;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // CharacterClassConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h b/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h
deleted file mode 100644
index 16c1d6f..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Escapes_h
-#define Escapes_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/Assertions.h>
-
-namespace JSC { namespace WREC {
-
-    class CharacterClass;
-
-    class Escape {
-    public:
-        enum Type {
-            PatternCharacter,
-            CharacterClass,
-            Backreference,
-            WordBoundaryAssertion,
-            Error,
-        };
-        
-        Escape(Type type)
-            : m_type(type)
-        {
-        }
-
-        Type type() const { return m_type; }
-
-    private:
-        Type m_type;
-        
-    protected:
-        // Used by subclasses to store data.
-        union {
-            int i;
-            const WREC::CharacterClass* c;
-        } m_u;
-        bool m_invert;
-    };
-
-    class PatternCharacterEscape : public Escape {
-    public:
-        static const PatternCharacterEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == PatternCharacter);
-            return static_cast<const PatternCharacterEscape&>(escape);
-        }
-        
-        PatternCharacterEscape(int character)
-            : Escape(PatternCharacter)
-        {
-            m_u.i = character;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        int character() const { return m_u.i; }
-    };
-
-    class CharacterClassEscape : public Escape {
-    public:
-        static const CharacterClassEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == CharacterClass);
-            return static_cast<const CharacterClassEscape&>(escape);
-        }
-        
-        CharacterClassEscape(const WREC::CharacterClass& characterClass, bool invert)
-            : Escape(CharacterClass)
-        {
-            m_u.c = &characterClass;
-            m_invert = invert;
-        }
-        
-        operator Escape() { return *this; }
-        
-        const WREC::CharacterClass& characterClass() const { return *m_u.c; }
-        bool invert() const { return m_invert; }
-    };
-
-    class BackreferenceEscape : public Escape {
-    public:
-        static const BackreferenceEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == Backreference);
-            return static_cast<const BackreferenceEscape&>(escape);
-        }
-        
-        BackreferenceEscape(int subpatternId)
-            : Escape(Backreference)
-        {
-            m_u.i = subpatternId;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        int subpatternId() const { return m_u.i; }
-    };
-
-    class WordBoundaryAssertionEscape : public Escape {
-    public:
-        static const WordBoundaryAssertionEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == WordBoundaryAssertion);
-            return static_cast<const WordBoundaryAssertionEscape&>(escape);
-        }
-        
-        WordBoundaryAssertionEscape(bool invert)
-            : Escape(WordBoundaryAssertion)
-        {
-            m_invert = invert;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        bool invert() const { return m_invert; }
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Escapes_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h b/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h
deleted file mode 100644
index 3da74cd..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Quantifier_h
-#define Quantifier_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/Assertions.h>
-#include <limits.h>
-
-namespace JSC { namespace WREC {
-
-    struct Quantifier {
-        enum Type {
-            None,
-            Greedy,
-            NonGreedy,
-            Error,
-        };
-
-        Quantifier(Type type = None, unsigned min = 0, unsigned max = Infinity)
-            : type(type)
-            , min(min)
-            , max(max)
-        {
-            ASSERT(min <= max);
-        }
-
-        Type type;
-
-        unsigned min;
-        unsigned max;
-
-        static const unsigned Infinity = UINT_MAX;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Quantifier_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
deleted file mode 100644
index 145a1ce..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WREC.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "Interpreter.h"
-#include "JSGlobalObject.h"
-#include "RegisterFile.h"
-#include "WRECFunctors.h"
-#include "WRECParser.h"
-#include "pcre_internal.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase, bool multiline)
-{
-    if (pattern.size() > MAX_PATTERN_SIZE) {
-        *error_ptr = "regular expression too large";
-        return 0;
-    }
-
-    Parser parser(pattern, ignoreCase, multiline);
-    Generator& generator = parser.generator();
-    MacroAssembler::JumpList failures;
-    MacroAssembler::Jump endOfInput;
-
-    generator.generateEnter();
-    generator.generateSaveIndex();
-
-    Label beginPattern(&generator);
-    parser.parsePattern(failures);
-    generator.generateReturnSuccess();
-
-    failures.link(&generator);
-    generator.generateIncrementIndex(&endOfInput);
-    parser.parsePattern(failures);
-    generator.generateReturnSuccess();
-
-    failures.link(&generator);
-    generator.generateIncrementIndex();
-    generator.generateJumpIfNotEndOfInput(beginPattern);
-    
-    endOfInput.link(&generator);
-    generator.generateReturnFailure();
-
-    if (parser.error()) {
-        *error_ptr = parser.syntaxError(); // NULL in the case of patterns that WREC doesn't support yet.
-        return 0;
-    }
-
-    *numSubpatterns_ptr = parser.numSubpatterns();
-    pool = globalData->executableAllocator.poolForSize(generator.size());
-    return reinterpret_cast<CompiledRegExp>(generator.copyCode(pool.get()));
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h
deleted file mode 100644
index 483dce0..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef WREC_h
-#define WREC_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/unicode/Unicode.h>
-
-#if COMPILER(GCC) && PLATFORM(X86)
-#define WREC_CALL __attribute__ ((regparm (3)))
-#else
-#define WREC_CALL
-#endif
-
-namespace JSC {
-    class Interpreter;
-    class UString;
-}
-
-namespace JSC { namespace WREC {
-
-    typedef int (*CompiledRegExp)(const UChar* input, unsigned start, unsigned length, int* output) WREC_CALL;
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // WREC_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp
deleted file mode 100644
index 5f1674e..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WRECFunctors.h"
-
-#if ENABLE(WREC)
-
-#include "WRECGenerator.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void GeneratePatternCharacterFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generatePatternCharacter(failures, m_ch);
-}
-
-void GeneratePatternCharacterFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrack1();
-}
-
-void GenerateCharacterClassFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateCharacterClass(failures, *m_charClass, m_invert);
-}
-
-void GenerateCharacterClassFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrack1();
-}
-
-void GenerateBackreferenceFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateBackreference(failures, m_subpatternId);
-}
-
-void GenerateBackreferenceFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrackBackreference(m_subpatternId);
-}
-
-void GenerateParenthesesNonGreedyFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateParenthesesNonGreedy(failures, m_start, m_success, m_fail);
-}
-
-void GenerateParenthesesNonGreedyFunctor::backtrack(Generator*)
-{
-    // FIXME: do something about this.
-    CRASH();
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h
deleted file mode 100644
index 610ce55..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "WRECGenerator.h"
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterClass;
-
-    class GenerateAtomFunctor {
-    public:
-        virtual ~GenerateAtomFunctor() {}
-
-        virtual void generateAtom(Generator*, Generator::JumpList&) = 0;
-        virtual void backtrack(Generator*) = 0;
-    };
-
-    class GeneratePatternCharacterFunctor : public GenerateAtomFunctor {
-    public:
-        GeneratePatternCharacterFunctor(const UChar ch)
-            : m_ch(ch)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        const UChar m_ch;
-    };
-
-    class GenerateCharacterClassFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateCharacterClassFunctor(const CharacterClass* charClass, bool invert)
-            : m_charClass(charClass)
-            , m_invert(invert)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        const CharacterClass* m_charClass;
-        bool m_invert;
-    };
-
-    class GenerateBackreferenceFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateBackreferenceFunctor(unsigned subpatternId)
-            : m_subpatternId(subpatternId)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        unsigned m_subpatternId;
-    };
-
-    class GenerateParenthesesNonGreedyFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateParenthesesNonGreedyFunctor(Generator::Label start, Generator::Jump success, Generator::Jump fail)
-            : m_start(start)
-            , m_success(success)
-            , m_fail(fail)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        Generator::Label m_start;
-        Generator::Jump m_success;
-        Generator::Jump m_fail;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
deleted file mode 100644
index e62add3..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
+++ /dev/null
@@ -1,653 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WREC.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "Interpreter.h"
-#include "WRECFunctors.h"
-#include "WRECParser.h"
-#include "pcre_internal.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void Generator::generateEnter()
-{
-#if PLATFORM(X86)
-    // On x86 edi & esi are callee preserved registers.
-    push(X86Registers::edi);
-    push(X86Registers::esi);
-    
-#if COMPILER(MSVC)
-    // Move the arguments into registers.
-    peek(input, 3);
-    peek(index, 4);
-    peek(length, 5);
-    peek(output, 6);
-#else
-    // On gcc the function is regparm(3), so the input, index, and length registers
-    // (eax, edx, and ecx respectively) already contain the appropriate values.
-    // Just load the fourth argument (output) into edi
-    peek(output, 3);
-#endif
-#endif
-}
-
-void Generator::generateReturnSuccess()
-{
-    ASSERT(returnRegister != index);
-    ASSERT(returnRegister != output);
-
-    // Set return value.
-    pop(returnRegister); // match begin
-    store32(returnRegister, output);
-    store32(index, Address(output, 4)); // match end
-    
-    // Restore callee save registers.
-#if PLATFORM(X86)
-    pop(X86Registers::esi);
-    pop(X86Registers::edi);
-#endif
-    ret();
-}
-
-void Generator::generateSaveIndex()
-{
-    push(index);
-}
-
-void Generator::generateIncrementIndex(Jump* failure)
-{
-    peek(index);
-    if (failure)
-        *failure = branch32(Equal, length, index);
-    add32(Imm32(1), index);
-    poke(index);
-}
-
-void Generator::generateLoadCharacter(JumpList& failures)
-{
-    failures.append(branch32(Equal, length, index));
-    load16(BaseIndex(input, index, TimesTwo), character);
-}
-
-// For the sake of end-of-line assertions, we treat one-past-the-end as if it
-// were part of the input string.
-void Generator::generateJumpIfNotEndOfInput(Label target)
-{
-    branch32(LessThanOrEqual, index, length, target);
-}
-
-void Generator::generateReturnFailure()
-{
-    pop();
-    move(Imm32(-1), returnRegister);
-
-#if PLATFORM(X86)
-    pop(X86Registers::esi);
-    pop(X86Registers::edi);
-#endif
-    ret();
-}
-
-void Generator::generateBacktrack1()
-{
-    sub32(Imm32(1), index);
-}
-
-void Generator::generateBacktrackBackreference(unsigned subpatternId)
-{
-    sub32(Address(output, (2 * subpatternId + 1) * sizeof(int)), index);
-    add32(Address(output, (2 * subpatternId) * sizeof(int)), index);
-}
-
-void Generator::generateBackreferenceQuantifier(JumpList& failures, Quantifier::Type quantifierType, unsigned subpatternId, unsigned min, unsigned max)
-{
-    GenerateBackreferenceFunctor functor(subpatternId);
-
-    load32(Address(output, (2 * subpatternId) * sizeof(int)), character);
-    Jump skipIfEmpty = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
-
-    ASSERT(quantifierType == Quantifier::Greedy || quantifierType == Quantifier::NonGreedy);
-    if (quantifierType == Quantifier::Greedy)
-        generateGreedyQuantifier(failures, functor, min, max);
-    else
-        generateNonGreedyQuantifier(failures, functor, min, max);
-
-    skipIfEmpty.link(this);
-}
-
-void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max)
-{
-    JumpList atomFailedList;
-    JumpList alternativeFailedList;
-
-    // (0) Setup: Save, then init repeatCount.
-    push(repeatCount);
-    move(Imm32(0), repeatCount);
-    Jump start = jump();
-
-    // (4) Quantifier failed: No more atom reading possible.
-    Label quantifierFailed(this);
-    pop(repeatCount);
-    failures.append(jump()); 
-
-    // (3) Alternative failed: If we can, read another atom, then fall through to (2) to try again.
-    Label alternativeFailed(this);
-    pop(index);
-    if (max != Quantifier::Infinity)
-        branch32(Equal, repeatCount, Imm32(max), quantifierFailed);
-
-    // (1) Read an atom.
-    if (min)
-        start.link(this);
-    Label readAtom(this);
-    functor.generateAtom(this, atomFailedList);
-    atomFailedList.linkTo(quantifierFailed, this);
-    add32(Imm32(1), repeatCount);
-    
-    // (2) Keep reading if we're under the minimum.
-    if (min > 1)
-        branch32(LessThan, repeatCount, Imm32(min), readAtom);
-
-    // (3) Test the rest of the alternative.
-    if (!min)
-        start.link(this);
-    push(index);
-    m_parser.parseAlternative(alternativeFailedList);
-    alternativeFailedList.linkTo(alternativeFailed, this);
-
-    pop();
-    pop(repeatCount);
-}
-
-void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max)
-{
-    if (!max)
-        return;
-
-    JumpList doneReadingAtomsList;
-    JumpList alternativeFailedList;
-
-    // (0) Setup: Save, then init repeatCount.
-    push(repeatCount);
-    move(Imm32(0), repeatCount);
-
-    // (1) Greedily read as many copies of the atom as possible, then jump to (2).
-    Label readAtom(this);
-    functor.generateAtom(this, doneReadingAtomsList);
-    add32(Imm32(1), repeatCount);
-    if (max == Quantifier::Infinity)
-        jump(readAtom);
-    else if (max == 1)
-        doneReadingAtomsList.append(jump());
-    else {
-        branch32(NotEqual, repeatCount, Imm32(max), readAtom);
-        doneReadingAtomsList.append(jump());
-    }
-
-    // (5) Quantifier failed: No more backtracking possible.
-    Label quantifierFailed(this);
-    pop(repeatCount);
-    failures.append(jump()); 
-
-    // (4) Alternative failed: Backtrack, then fall through to (2) to try again.
-    Label alternativeFailed(this);
-    pop(index);
-    functor.backtrack(this);
-    sub32(Imm32(1), repeatCount);
-
-    // (2) Verify that we have enough atoms.
-    doneReadingAtomsList.link(this);
-    branch32(LessThan, repeatCount, Imm32(min), quantifierFailed);
-
-    // (3) Test the rest of the alternative.
-    push(index);
-    m_parser.parseAlternative(alternativeFailedList);
-    alternativeFailedList.linkTo(alternativeFailed, this);
-
-    pop();
-    pop(repeatCount);
-}
-
-void Generator::generatePatternCharacterSequence(JumpList& failures, int* sequence, size_t count)
-{
-    for (size_t i = 0; i < count;) {
-        if (i < count - 1) {
-            if (generatePatternCharacterPair(failures, sequence[i], sequence[i + 1])) {
-                i += 2;
-                continue;
-            }
-        }
-
-        generatePatternCharacter(failures, sequence[i]);
-        ++i;
-    }
-}
-
-bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch2)
-{
-    if (m_parser.ignoreCase()) {
-        // Non-trivial case folding requires more than one test, so we can't
-        // test as a pair with an adjacent character.
-        if (!isASCII(ch1) && Unicode::toLower(ch1) != Unicode::toUpper(ch1))
-            return false;
-        if (!isASCII(ch2) && Unicode::toLower(ch2) != Unicode::toUpper(ch2))
-            return false;
-    }
-
-    // Optimistically consume 2 characters.
-    add32(Imm32(2), index);
-    failures.append(branch32(GreaterThan, index, length));
-
-    // Load the characters we just consumed, offset -2 characters from index.
-    load32(BaseIndex(input, index, TimesTwo, -2 * 2), character);
-
-    if (m_parser.ignoreCase()) {
-        // Convert ASCII alphabet characters to upper case before testing for
-        // equality. (ASCII non-alphabet characters don't require upper-casing
-        // because they have no uppercase equivalents. Unicode characters don't
-        // require upper-casing because we only handle Unicode characters whose
-        // upper and lower cases are equal.)
-        int ch1Mask = 0;
-        if (isASCIIAlpha(ch1)) {
-            ch1 |= 32;
-            ch1Mask = 32;
-        }
-
-        int ch2Mask = 0;
-        if (isASCIIAlpha(ch2)) {
-            ch2 |= 32;
-            ch2Mask = 32;
-        }
-
-        int mask = ch1Mask | (ch2Mask << 16);
-        if (mask)
-            or32(Imm32(mask), character);
-    }
-    int pair = ch1 | (ch2 << 16);
-
-    failures.append(branch32(NotEqual, character, Imm32(pair)));
-    return true;
-}
-
-void Generator::generatePatternCharacter(JumpList& failures, int ch)
-{
-    generateLoadCharacter(failures);
-
-    // used for unicode case insensitive
-    bool hasUpper = false;
-    Jump isUpper;
-    
-    // if case insensitive match
-    if (m_parser.ignoreCase()) {
-        UChar lower, upper;
-        
-        // check for ascii case sensitive characters
-        if (isASCIIAlpha(ch)) {
-            or32(Imm32(32), character);
-            ch |= 32;
-        } else if (!isASCII(ch) && ((lower = Unicode::toLower(ch)) != (upper = Unicode::toUpper(ch)))) {
-            // handle unicode case sentitive characters - branch to success on upper
-            isUpper = branch32(Equal, character, Imm32(upper));
-            hasUpper = true;
-            ch = lower;
-        }
-    }
-    
-    // checks for ch, or lower case version of ch, if insensitive
-    failures.append(branch32(NotEqual, character, Imm32((unsigned short)ch)));
-
-    if (m_parser.ignoreCase() && hasUpper) {
-        // for unicode case insensitive matches, branch here if upper matches.
-        isUpper.link(this);
-    }
-    
-    // on success consume the char
-    add32(Imm32(1), index);
-}
-
-void Generator::generateCharacterClassInvertedRange(JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount)
-{
-    do {
-        // pick which range we're going to generate
-        int which = count >> 1;
-        char lo = ranges[which].begin;
-        char hi = ranges[which].end;
-        
-        // check if there are any ranges or matches below lo.  If not, just jl to failure -
-        // if there is anything else to check, check that first, if it falls through jmp to failure.
-        if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
-            
-            // generate code for all ranges before this one
-            if (which)
-                generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
-            
-            while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-                matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
-                ++*matchIndex;
-            }
-            failures.append(jump());
-
-            loOrAbove.link(this);
-        } else if (which) {
-            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
-
-            generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
-            failures.append(jump());
-
-            loOrAbove.link(this);
-        } else
-            failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
-
-        while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
-            ++*matchIndex;
-
-        matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
-        // fall through to here, the value is above hi.
-
-        // shuffle along & loop around if there are any more matches to handle.
-        unsigned next = which + 1;
-        ranges += next;
-        count -= next;
-    } while (count);
-}
-
-void Generator::generateCharacterClassInverted(JumpList& matchDest, const CharacterClass& charClass)
-{
-    Jump unicodeFail;
-    if (charClass.numMatchesUnicode || charClass.numRangesUnicode) {
-        Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
-    
-        if (charClass.numMatchesUnicode) {
-            for (unsigned i = 0; i < charClass.numMatchesUnicode; ++i) {
-                UChar ch = charClass.matchesUnicode[i];
-                matchDest.append(branch32(Equal, character, Imm32(ch)));
-            }
-        }
-        
-        if (charClass.numRangesUnicode) {
-            for (unsigned i = 0; i < charClass.numRangesUnicode; ++i) {
-                UChar lo = charClass.rangesUnicode[i].begin;
-                UChar hi = charClass.rangesUnicode[i].end;
-                
-                Jump below = branch32(LessThan, character, Imm32(lo));
-                matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
-                below.link(this);
-            }
-        }
-
-        unicodeFail = jump();
-        isAscii.link(this);
-    }
-
-    if (charClass.numRanges) {
-        unsigned matchIndex = 0;
-        JumpList failures; 
-        generateCharacterClassInvertedRange(failures, matchDest, charClass.ranges, charClass.numRanges, &matchIndex, charClass.matches, charClass.numMatches);
-        while (matchIndex < charClass.numMatches)
-            matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass.matches[matchIndex++])));
-
-        failures.link(this);
-    } else if (charClass.numMatches) {
-        // optimization: gather 'a','A' etc back together, can mask & test once.
-        Vector<char> matchesAZaz;
-
-        for (unsigned i = 0; i < charClass.numMatches; ++i) {
-            char ch = charClass.matches[i];
-            if (m_parser.ignoreCase()) {
-                if (isASCIILower(ch)) {
-                    matchesAZaz.append(ch);
-                    continue;
-                }
-                if (isASCIIUpper(ch))
-                    continue;
-            }
-            matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
-        }
-
-        if (unsigned countAZaz = matchesAZaz.size()) {
-            or32(Imm32(32), character);
-            for (unsigned i = 0; i < countAZaz; ++i)
-                matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
-        }
-    }
-
-    if (charClass.numMatchesUnicode || charClass.numRangesUnicode)
-        unicodeFail.link(this);
-}
-
-void Generator::generateCharacterClass(JumpList& failures, const CharacterClass& charClass, bool invert)
-{
-    generateLoadCharacter(failures);
-
-    if (invert)
-        generateCharacterClassInverted(failures, charClass);
-    else {
-        JumpList successes;
-        generateCharacterClassInverted(successes, charClass);
-        failures.append(jump());
-        successes.link(this);
-    }
-    
-    add32(Imm32(1), index);
-}
-
-void Generator::generateParenthesesAssertion(JumpList& failures)
-{
-    JumpList disjunctionFailed;
-
-    push(index);
-    m_parser.parseDisjunction(disjunctionFailed);
-    Jump success = jump();
-
-    disjunctionFailed.link(this);
-    pop(index);
-    failures.append(jump());
-
-    success.link(this);
-    pop(index);
-}
-
-void Generator::generateParenthesesInvertedAssertion(JumpList& failures)
-{
-    JumpList disjunctionFailed;
-
-    push(index);
-    m_parser.parseDisjunction(disjunctionFailed);
-
-    // If the disjunction succeeded, the inverted assertion failed.
-    pop(index);
-    failures.append(jump());
-
-    // If the disjunction failed, the inverted assertion succeeded.
-    disjunctionFailed.link(this);
-    pop(index);
-}
-
-void Generator::generateParenthesesNonGreedy(JumpList& failures, Label start, Jump success, Jump fail)
-{
-    jump(start);
-    success.link(this);
-    failures.append(fail);
-}
-
-Generator::Jump Generator::generateParenthesesResetTrampoline(JumpList& newFailures, unsigned subpatternIdBefore, unsigned subpatternIdAfter)
-{
-    Jump skip = jump();
-    newFailures.link(this);
-    for (unsigned i = subpatternIdBefore + 1; i <= subpatternIdAfter; ++i) {
-        store32(Imm32(-1), Address(output, (2 * i) * sizeof(int)));
-        store32(Imm32(-1), Address(output, (2 * i + 1) * sizeof(int)));
-    }
-    
-    Jump newFailJump = jump();
-    skip.link(this);
-    
-    return newFailJump;
-}
-
-void Generator::generateAssertionBOL(JumpList& failures)
-{
-    if (m_parser.multiline()) {
-        JumpList previousIsNewline;
-
-        // begin of input == success
-        previousIsNewline.append(branch32(Equal, index, Imm32(0)));
-
-        // now check prev char against newline characters.
-        load16(BaseIndex(input, index, TimesTwo, -2), character);
-        generateCharacterClassInverted(previousIsNewline, CharacterClass::newline());
-
-        failures.append(jump());
-
-        previousIsNewline.link(this);
-    } else
-        failures.append(branch32(NotEqual, index, Imm32(0)));
-}
-
-void Generator::generateAssertionEOL(JumpList& failures)
-{
-    if (m_parser.multiline()) {
-        JumpList nextIsNewline;
-
-        generateLoadCharacter(nextIsNewline); // end of input == success
-        generateCharacterClassInverted(nextIsNewline, CharacterClass::newline());
-        failures.append(jump());
-        nextIsNewline.link(this);
-    } else {
-        failures.append(branch32(NotEqual, length, index));
-    }
-}
-
-void Generator::generateAssertionWordBoundary(JumpList& failures, bool invert)
-{
-    JumpList wordBoundary;
-    JumpList notWordBoundary;
-
-    // (1) Check if the previous value was a word char
-
-    // (1.1) check for begin of input
-    Jump atBegin = branch32(Equal, index, Imm32(0));
-    // (1.2) load the last char, and chck if is word character
-    load16(BaseIndex(input, index, TimesTwo, -2), character);
-    JumpList previousIsWord;
-    generateCharacterClassInverted(previousIsWord, CharacterClass::wordchar());
-    // (1.3) if we get here, previous is not a word char
-    atBegin.link(this);
-
-    // (2) Handle situation where previous was NOT a \w
-
-    generateLoadCharacter(notWordBoundary);
-    generateCharacterClassInverted(wordBoundary, CharacterClass::wordchar());
-    // (2.1) If we get here, neither chars are word chars
-    notWordBoundary.append(jump());
-
-    // (3) Handle situation where previous was a \w
-
-    // (3.0) link success in first match to here
-    previousIsWord.link(this);
-    generateLoadCharacter(wordBoundary);
-    generateCharacterClassInverted(notWordBoundary, CharacterClass::wordchar());
-    // (3.1) If we get here, this is an end of a word, within the input.
-    
-    // (4) Link everything up
-    
-    if (invert) {
-        // handle the fall through case
-        wordBoundary.append(jump());
-    
-        // looking for non word boundaries, so link boundary fails to here.
-        notWordBoundary.link(this);
-
-        failures.append(wordBoundary);
-    } else {
-        // looking for word boundaries, so link successes here.
-        wordBoundary.link(this);
-        
-        failures.append(notWordBoundary);
-    }
-}
-
-void Generator::generateBackreference(JumpList& failures, unsigned subpatternId)
-{
-    push(index);
-    push(repeatCount);
-
-    // get the start pos of the backref into repeatCount (multipurpose!)
-    load32(Address(output, (2 * subpatternId) * sizeof(int)), repeatCount);
-
-    Jump skipIncrement = jump();
-    Label topOfLoop(this);
-
-    add32(Imm32(1), index);
-    add32(Imm32(1), repeatCount);
-    skipIncrement.link(this);
-
-    // check if we're at the end of backref (if we are, success!)
-    Jump endOfBackRef = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
-
-    load16(BaseIndex(input, repeatCount, MacroAssembler::TimesTwo), character);
-
-    // check if we've run out of input (this would be a can o'fail)
-    Jump endOfInput = branch32(Equal, length, index);
-
-    branch16(Equal, BaseIndex(input, index, TimesTwo), character, topOfLoop);
-
-    endOfInput.link(this);
-
-    // Failure
-    pop(repeatCount);
-    pop(index);
-    failures.append(jump());
-
-    // Success
-    endOfBackRef.link(this);
-    pop(repeatCount);
-    pop();
-}
-
-void Generator::terminateAlternative(JumpList& successes, JumpList& failures)
-{
-    successes.append(jump());
-    
-    failures.link(this);
-    peek(index);
-}
-
-void Generator::terminateDisjunction(JumpList& successes)
-{
-    successes.link(this);
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
deleted file mode 100644
index 294c3d0..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef WRECGenerator_h
-#define WRECGenerator_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "Quantifier.h"
-#include "MacroAssembler.h"
-#include <wtf/ASCIICType.h>
-#include <wtf/unicode/Unicode.h>
-#include "WREC.h"
-
-namespace JSC { 
-
-    class JSGlobalData;
-
-    namespace WREC {
-
-    class CharacterRange;
-    class GenerateAtomFunctor;
-    class Parser;
-    struct CharacterClass;
-
-    class Generator : private MacroAssembler {
-    public:
-        using MacroAssembler::Jump;
-        using MacroAssembler::JumpList;
-        using MacroAssembler::Label;
-
-        enum ParenthesesType { Capturing, NonCapturing, Assertion, InvertedAssertion, Error };
-
-        static CompiledRegExp compileRegExp(JSGlobalData*, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase = false, bool multiline = false);
-    
-        Generator(Parser& parser)
-            : m_parser(parser)
-        {
-        }
-
-#if PLATFORM(X86)
-        static const RegisterID input = X86Registers::eax;
-        static const RegisterID index = X86Registers::edx;
-        static const RegisterID length = X86Registers::ecx;
-        static const RegisterID output = X86Registers::edi;
-
-        static const RegisterID character = X86Registers::esi;
-        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
-
-        static const RegisterID returnRegister = X86Registers::eax;
-#endif
-#if PLATFORM(X86_64)
-        static const RegisterID input = X86Registers::edi;
-        static const RegisterID index = X86Registers::esi;
-        static const RegisterID length = X86Registers::edx;
-        static const RegisterID output = X86Registers::ecx;
-
-        static const RegisterID character = X86Registers::eax;
-        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
-
-        static const RegisterID returnRegister = X86Registers::eax;
-#endif
-
-        void generateEnter();
-        void generateSaveIndex();
-        void generateIncrementIndex(Jump* failure = 0);
-        void generateLoadCharacter(JumpList& failures);
-        void generateJumpIfNotEndOfInput(Label);
-        void generateReturnSuccess();
-        void generateReturnFailure();
-
-        void generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max);
-        void generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max);
-        void generateBacktrack1();
-        void generateBacktrackBackreference(unsigned subpatternId);
-        void generateCharacterClass(JumpList& failures, const CharacterClass& charClass, bool invert);
-        void generateCharacterClassInverted(JumpList& failures, const CharacterClass& charClass);
-        void generateCharacterClassInvertedRange(JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount);
-        void generatePatternCharacter(JumpList& failures, int ch);
-        void generatePatternCharacterSequence(JumpList& failures, int* sequence, size_t count);
-        void generateAssertionWordBoundary(JumpList& failures, bool invert);
-        void generateAssertionBOL(JumpList& failures);
-        void generateAssertionEOL(JumpList& failures);
-        void generateBackreference(JumpList& failures, unsigned subpatternID);
-        void generateBackreferenceQuantifier(JumpList& failures, Quantifier::Type quantifierType, unsigned subpatternId, unsigned min, unsigned max);
-        void generateParenthesesAssertion(JumpList& failures);
-        void generateParenthesesInvertedAssertion(JumpList& failures);
-        Jump generateParenthesesResetTrampoline(JumpList& newFailures, unsigned subpatternIdBefore, unsigned subpatternIdAfter);
-        void generateParenthesesNonGreedy(JumpList& failures, Label start, Jump success, Jump fail);
-
-        void terminateAlternative(JumpList& successes, JumpList& failures);
-        void terminateDisjunction(JumpList& successes);
-
-    private:
-        bool generatePatternCharacterPair(JumpList& failures, int ch1, int ch2);
-
-        Parser& m_parser;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // WRECGenerator_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
deleted file mode 100644
index 1709bf9..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
+++ /dev/null
@@ -1,643 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WRECParser.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "WRECFunctors.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-// These error messages match the error messages used by PCRE.
-const char* Parser::QuantifierOutOfOrder = "numbers out of order in {} quantifier";
-const char* Parser::QuantifierWithoutAtom = "nothing to repeat";
-const char* Parser::ParenthesesUnmatched = "unmatched parentheses";
-const char* Parser::ParenthesesTypeInvalid = "unrecognized character after (?";
-const char* Parser::ParenthesesNotSupported = ""; // Not a user-visible syntax error -- just signals a syntax that WREC doesn't support yet.
-const char* Parser::CharacterClassUnmatched = "missing terminating ] for character class";
-const char* Parser::CharacterClassOutOfOrder = "range out of order in character class";
-const char* Parser::EscapeUnterminated = "\\ at end of pattern";
-
-class PatternCharacterSequence {
-typedef Generator::JumpList JumpList;
-
-public:
-    PatternCharacterSequence(Generator& generator, JumpList& failures)
-        : m_generator(generator)
-        , m_failures(failures)
-    {
-    }
-    
-    size_t size() { return m_sequence.size(); }
-    
-    void append(int ch)
-    {
-        m_sequence.append(ch);
-    }
-    
-    void flush()
-    {
-        if (!m_sequence.size())
-            return;
-
-        m_generator.generatePatternCharacterSequence(m_failures, m_sequence.begin(), m_sequence.size());
-        m_sequence.clear();
-    }
-
-    void flush(const Quantifier& quantifier)
-    {
-        if (!m_sequence.size())
-            return;
-
-        m_generator.generatePatternCharacterSequence(m_failures, m_sequence.begin(), m_sequence.size() - 1);
-
-        switch (quantifier.type) {
-        case Quantifier::None:
-        case Quantifier::Error:
-            ASSERT_NOT_REACHED();
-            break;
-
-        case Quantifier::Greedy: {
-            GeneratePatternCharacterFunctor functor(m_sequence.last());
-            m_generator.generateGreedyQuantifier(m_failures, functor, quantifier.min, quantifier.max);
-            break;
-        }
-        
-        case Quantifier::NonGreedy: {
-            GeneratePatternCharacterFunctor functor(m_sequence.last());
-            m_generator.generateNonGreedyQuantifier(m_failures, functor, quantifier.min, quantifier.max);
-            break;
-        }
-        }
-        
-        m_sequence.clear();
-    }
-
-private:
-    Generator& m_generator;
-    JumpList& m_failures;
-    Vector<int, 8> m_sequence;
-};
-
-ALWAYS_INLINE Quantifier Parser::consumeGreedyQuantifier()
-{
-    switch (peek()) {
-        case '?':
-            consume();
-            return Quantifier(Quantifier::Greedy, 0, 1);
-
-        case '*':
-            consume();
-            return Quantifier(Quantifier::Greedy, 0);
-
-        case '+':
-            consume();
-            return Quantifier(Quantifier::Greedy, 1);
-
-        case '{': {
-            SavedState state(*this);
-            consume();
-
-            // Accept: {n}, {n,}, {n,m}.
-            // Reject: {n,m} where n > m.
-            // Ignore: Anything else, such as {n, m}.
-
-            if (!peekIsDigit()) {
-                state.restore();
-                return Quantifier();
-            }
-
-            unsigned min = consumeNumber();
-            unsigned max = min;
-
-            if (peek() == ',') {
-                consume();
-                max = peekIsDigit() ? consumeNumber() : Quantifier::Infinity;
-            }
-
-            if (peek() != '}') {
-                state.restore();
-                return Quantifier();
-            }
-            consume();
- 
-            if (min > max) {
-                setError(QuantifierOutOfOrder);
-                return Quantifier(Quantifier::Error);
-            }
-
-            return Quantifier(Quantifier::Greedy, min, max);
-         }
-
-         default:
-            return Quantifier(); // No quantifier.
-    }
-}
-
-Quantifier Parser::consumeQuantifier()
-{
-    Quantifier q = consumeGreedyQuantifier();
-    
-    if ((q.type == Quantifier::Greedy) && (peek() == '?')) {
-        consume();
-        q.type = Quantifier::NonGreedy;
-    }
-    
-    return q;
-}
-
-bool Parser::parseCharacterClassQuantifier(JumpList& failures, const CharacterClass& charClass, bool invert)
-{
-    Quantifier q = consumeQuantifier();
-
-    switch (q.type) {
-    case Quantifier::None: {
-        m_generator.generateCharacterClass(failures, charClass, invert);
-        break;
-    }
-
-    case Quantifier::Greedy: {
-        GenerateCharacterClassFunctor functor(&charClass, invert);
-        m_generator.generateGreedyQuantifier(failures, functor, q.min, q.max);
-        break;
-    }
-
-    case Quantifier::NonGreedy: {
-        GenerateCharacterClassFunctor functor(&charClass, invert);
-        m_generator.generateNonGreedyQuantifier(failures, functor, q.min, q.max);
-        break;
-    }
-
-    case Quantifier::Error:
-        return false;
-    }
-    
-    return true;
-}
-
-bool Parser::parseBackreferenceQuantifier(JumpList& failures, unsigned subpatternId)
-{
-    Quantifier q = consumeQuantifier();
-
-    switch (q.type) {
-    case Quantifier::None: {
-        m_generator.generateBackreference(failures, subpatternId);
-        break;
-    }
-
-    case Quantifier::Greedy:
-    case Quantifier::NonGreedy:
-        m_generator.generateBackreferenceQuantifier(failures, q.type, subpatternId, q.min, q.max);
-        return true;
-
-    case Quantifier::Error:
-        return false;
-    }
-    
-    return true;
-}
-
-bool Parser::parseParentheses(JumpList& failures)
-{
-    ParenthesesType type = consumeParenthesesType();
-
-    // FIXME: WREC originally failed to backtrack correctly in cases such as
-    // "c".match(/(.*)c/). Now, most parentheses handling is disabled. For
-    // unsupported parentheses, we fall back on PCRE.
-
-    switch (type) {
-        case Generator::Assertion: {
-            m_generator.generateParenthesesAssertion(failures);
-
-            if (consume() != ')') {
-                setError(ParenthesesUnmatched);
-                return false;
-            }
-
-            Quantifier quantifier = consumeQuantifier();
-            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
-                setError(ParenthesesNotSupported);
-                return false;
-            }
-
-            return true;
-        }
-        case Generator::InvertedAssertion: {
-            m_generator.generateParenthesesInvertedAssertion(failures);
-
-            if (consume() != ')') {
-                setError(ParenthesesUnmatched);
-                return false;
-            }
-
-            Quantifier quantifier = consumeQuantifier();
-            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
-                setError(ParenthesesNotSupported);
-                return false;
-            }
-
-            return true;
-        }
-        default:
-            setError(ParenthesesNotSupported);
-            return false;
-    }
-}
-
-bool Parser::parseCharacterClass(JumpList& failures)
-{
-    bool invert = false;
-    if (peek() == '^') {
-        consume();
-        invert = true;
-    }
-
-    CharacterClassConstructor constructor(m_ignoreCase);
-
-    int ch;
-    while ((ch = peek()) != ']') {
-        switch (ch) {
-        case EndOfPattern:
-            setError(CharacterClassUnmatched);
-            return false;
-
-        case '\\': {
-            consume();
-            Escape escape = consumeEscape(true);
-
-            switch (escape.type()) {
-                case Escape::PatternCharacter: {
-                    int character = PatternCharacterEscape::cast(escape).character();
-                    if (character == '-')
-                        constructor.flushBeforeEscapedHyphen();
-                    constructor.put(character);
-                    break;
-                }
-                case Escape::CharacterClass: {
-                    const CharacterClassEscape& characterClassEscape = CharacterClassEscape::cast(escape);
-                    ASSERT(!characterClassEscape.invert());
-                    constructor.append(characterClassEscape.characterClass());
-                    break;
-                }
-                case Escape::Error:
-                    return false;
-                case Escape::Backreference:
-                case Escape::WordBoundaryAssertion: {
-                    ASSERT_NOT_REACHED();
-                    break;
-                }
-            }
-            break;
-        }
-
-        default:
-            consume();
-            constructor.put(ch);
-        }
-    }
-    consume();
-
-    // lazily catch reversed ranges ([z-a])in character classes
-    if (constructor.isUpsideDown()) {
-        setError(CharacterClassOutOfOrder);
-        return false;
-    }
-
-    constructor.flush();
-    CharacterClass charClass = constructor.charClass();
-    return parseCharacterClassQuantifier(failures, charClass, invert);
-}
-
-bool Parser::parseNonCharacterEscape(JumpList& failures, const Escape& escape)
-{
-    switch (escape.type()) {
-        case Escape::PatternCharacter:
-            ASSERT_NOT_REACHED();
-            return false;
-
-        case Escape::CharacterClass:
-            return parseCharacterClassQuantifier(failures, CharacterClassEscape::cast(escape).characterClass(), CharacterClassEscape::cast(escape).invert());
-
-        case Escape::Backreference:
-            return parseBackreferenceQuantifier(failures, BackreferenceEscape::cast(escape).subpatternId());
-
-        case Escape::WordBoundaryAssertion:
-            m_generator.generateAssertionWordBoundary(failures, WordBoundaryAssertionEscape::cast(escape).invert());
-            return true;
-
-        case Escape::Error:
-            return false;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-Escape Parser::consumeEscape(bool inCharacterClass)
-{
-    switch (peek()) {
-    case EndOfPattern:
-        setError(EscapeUnterminated);
-        return Escape(Escape::Error);
-
-    // Assertions
-    case 'b':
-        consume();
-        if (inCharacterClass)
-            return PatternCharacterEscape('\b');
-        return WordBoundaryAssertionEscape(false); // do not invert
-    case 'B':
-        consume();
-        if (inCharacterClass)
-            return PatternCharacterEscape('B');
-        return WordBoundaryAssertionEscape(true); // invert
-
-    // CharacterClassEscape
-    case 'd':
-        consume();
-        return CharacterClassEscape(CharacterClass::digits(), false);
-    case 's':
-        consume();
-        return CharacterClassEscape(CharacterClass::spaces(), false);
-    case 'w':
-        consume();
-        return CharacterClassEscape(CharacterClass::wordchar(), false);
-    case 'D':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nondigits(), false)
-            : CharacterClassEscape(CharacterClass::digits(), true);
-    case 'S':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nonspaces(), false)
-            : CharacterClassEscape(CharacterClass::spaces(), true);
-    case 'W':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nonwordchar(), false)
-            : CharacterClassEscape(CharacterClass::wordchar(), true);
-
-    // DecimalEscape
-    case '1':
-    case '2':
-    case '3':
-    case '4':
-    case '5':
-    case '6':
-    case '7':
-    case '8':
-    case '9': {
-        if (peekDigit() > m_numSubpatterns || inCharacterClass) {
-            // To match Firefox, we parse an invalid backreference in the range [1-7]
-            // as an octal escape.
-            return peekDigit() > 7 ? PatternCharacterEscape('\\') : PatternCharacterEscape(consumeOctal());
-        }
-
-        int value = 0;
-        do {
-            unsigned newValue = value * 10 + peekDigit();
-            if (newValue > m_numSubpatterns)
-                break;
-            value = newValue;
-            consume();
-        } while (peekIsDigit());
-
-        return BackreferenceEscape(value);
-    }
-
-    // Octal escape
-    case '0':
-        consume();
-        return PatternCharacterEscape(consumeOctal());
-
-    // ControlEscape
-    case 'f':
-        consume();
-        return PatternCharacterEscape('\f');
-    case 'n':
-        consume();
-        return PatternCharacterEscape('\n');
-    case 'r':
-        consume();
-        return PatternCharacterEscape('\r');
-    case 't':
-        consume();
-        return PatternCharacterEscape('\t');
-    case 'v':
-        consume();
-        return PatternCharacterEscape('\v');
-
-    // ControlLetter
-    case 'c': {
-        SavedState state(*this);
-        consume();
-        
-        int control = consume();
-        // To match Firefox, inside a character class, we also accept numbers
-        // and '_' as control characters.
-        if ((!inCharacterClass && !isASCIIAlpha(control)) || (!isASCIIAlphanumeric(control) && control != '_')) {
-            state.restore();
-            return PatternCharacterEscape('\\');
-        }
-        return PatternCharacterEscape(control & 31);
-    }
-
-    // HexEscape
-    case 'x': {
-        consume();
-
-        SavedState state(*this);
-        int x = consumeHex(2);
-        if (x == -1) {
-            state.restore();
-            return PatternCharacterEscape('x');
-        }
-        return PatternCharacterEscape(x);
-    }
-
-    // UnicodeEscape
-    case 'u': {
-        consume();
-
-        SavedState state(*this);
-        int x = consumeHex(4);
-        if (x == -1) {
-            state.restore();
-            return PatternCharacterEscape('u');
-        }
-        return PatternCharacterEscape(x);
-    }
-
-    // IdentityEscape
-    default:
-        return PatternCharacterEscape(consume());
-    }
-}
-
-void Parser::parseAlternative(JumpList& failures)
-{
-    PatternCharacterSequence sequence(m_generator, failures);
-
-    while (1) {
-        switch (peek()) {
-        case EndOfPattern:
-        case '|':
-        case ')':
-            sequence.flush();
-            return;
-
-        case '*':
-        case '+':
-        case '?':
-        case '{': {
-            Quantifier q = consumeQuantifier();
-
-            if (q.type == Quantifier::None) {
-                sequence.append(consume());
-                continue;
-            }
-
-            if (q.type == Quantifier::Error)
-                return;
-
-            if (!sequence.size()) {
-                setError(QuantifierWithoutAtom);
-                return;
-            }
-
-            sequence.flush(q);
-            continue;
-        }
-
-        case '^':
-            consume();
-
-            sequence.flush();
-            m_generator.generateAssertionBOL(failures);
-            continue;
-
-        case '$':
-            consume();
-
-            sequence.flush();
-            m_generator.generateAssertionEOL(failures);
-            continue;
-
-        case '.':
-            consume();
-
-            sequence.flush();
-            if (!parseCharacterClassQuantifier(failures, CharacterClass::newline(), true))
-                return;
-            continue;
-
-        case '[':
-            consume();
-
-            sequence.flush();
-            if (!parseCharacterClass(failures))
-                return;
-            continue;
-
-        case '(':
-            consume();
-
-            sequence.flush();
-            if (!parseParentheses(failures))
-                return;
-            continue;
-
-        case '\\': {
-            consume();
-
-            Escape escape = consumeEscape(false);
-            if (escape.type() == Escape::PatternCharacter) {
-                sequence.append(PatternCharacterEscape::cast(escape).character());
-                continue;
-            }
-
-            sequence.flush();
-            if (!parseNonCharacterEscape(failures, escape))
-                return;
-            continue;
-        }
-
-        default:
-            sequence.append(consume());
-            continue;
-        }
-    }
-}
-
-/*
-  TOS holds index.
-*/
-void Parser::parseDisjunction(JumpList& failures)
-{
-    parseAlternative(failures);
-    if (peek() != '|')
-        return;
-
-    JumpList successes;
-    do {
-        consume();
-        m_generator.terminateAlternative(successes, failures);
-        parseAlternative(failures);
-    } while (peek() == '|');
-
-    m_generator.terminateDisjunction(successes);
-}
-
-Generator::ParenthesesType Parser::consumeParenthesesType()
-{
-    if (peek() != '?')
-        return Generator::Capturing;
-    consume();
-
-    switch (consume()) {
-    case ':':
-        return Generator::NonCapturing;
-    
-    case '=':
-        return Generator::Assertion;
-
-    case '!':
-        return Generator::InvertedAssertion;
-
-    default:
-        setError(ParenthesesTypeInvalid);
-        return Generator::Error;
-    }
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h
deleted file mode 100644
index a3e151b..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Parser_h
-#define Parser_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "Escapes.h"
-#include "Quantifier.h"
-#include "UString.h"
-#include "WRECGenerator.h"
-#include <wtf/ASCIICType.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterClass;
-
-    class Parser {
-    typedef Generator::JumpList JumpList;
-    typedef Generator::ParenthesesType ParenthesesType;
-
-    friend class SavedState;
-
-    public:
-        Parser(const UString& pattern, bool ignoreCase, bool multiline)
-            : m_generator(*this)
-            , m_data(pattern.data())
-            , m_size(pattern.size())
-            , m_ignoreCase(ignoreCase)
-            , m_multiline(multiline)
-        {
-            reset();
-        }
-        
-        Generator& generator() { return m_generator; }
-
-        bool ignoreCase() const { return m_ignoreCase; }
-        bool multiline() const { return m_multiline; }
-
-        void recordSubpattern() { ++m_numSubpatterns; }
-        unsigned numSubpatterns() const { return m_numSubpatterns; }
-        
-        const char* error() const { return m_error; }
-        const char* syntaxError() const { return m_error == ParenthesesNotSupported ? 0 : m_error; }
-        
-        void parsePattern(JumpList& failures)
-        {
-            reset();
-
-            parseDisjunction(failures);
-
-            if (peek() != EndOfPattern)
-                setError(ParenthesesUnmatched); // Parsing the pattern should fully consume it.
-        }
-
-        void parseDisjunction(JumpList& failures);
-        void parseAlternative(JumpList& failures);
-        bool parseTerm(JumpList& failures);
-        bool parseNonCharacterEscape(JumpList& failures, const Escape&);
-        bool parseParentheses(JumpList& failures);
-        bool parseCharacterClass(JumpList& failures);
-        bool parseCharacterClassQuantifier(JumpList& failures, const CharacterClass& charClass, bool invert);
-        bool parseBackreferenceQuantifier(JumpList& failures, unsigned subpatternId);
-
-    private:
-        class SavedState {
-        public:
-            SavedState(Parser& parser)
-                : m_parser(parser)
-                , m_index(parser.m_index)
-            {
-            }
-            
-            void restore()
-            {
-                m_parser.m_index = m_index;
-            }
-
-        private:
-            Parser& m_parser;
-            unsigned m_index;
-        };
-
-        void reset()
-        {
-            m_index = 0;
-            m_numSubpatterns = 0;
-            m_error = 0;
-        }
-
-        void setError(const char* error)
-        {
-            if (m_error)
-                return;
-            m_error = error;
-        }
-
-        int peek()
-        {
-            if (m_index >= m_size)
-                return EndOfPattern;
-            return m_data[m_index];
-        }
-
-        int consume()
-        {
-            if (m_index >= m_size)
-                return EndOfPattern;
-            return m_data[m_index++];
-        }
-
-        bool peekIsDigit()
-        {
-            return WTF::isASCIIDigit(peek());
-        }
-
-        unsigned peekDigit()
-        {
-            ASSERT(peekIsDigit());
-            return peek() - '0';
-        }
-
-        unsigned consumeDigit()
-        {
-            ASSERT(peekIsDigit());
-            return consume() - '0';
-        }
-
-        unsigned consumeNumber()
-        {
-            int n = consumeDigit();
-            while (peekIsDigit()) {
-                n *= 10;
-                n += consumeDigit();
-            }
-            return n;
-        }
-
-        int consumeHex(int count)
-        {
-            int n = 0;
-            while (count--) {
-                if (!WTF::isASCIIHexDigit(peek()))
-                    return -1;
-                n = (n << 4) | WTF::toASCIIHexValue(consume());
-            }
-            return n;
-        }
-
-        unsigned consumeOctal()
-        {
-            unsigned n = 0;
-            while (n < 32 && WTF::isASCIIOctalDigit(peek()))
-                n = n * 8 + consumeDigit();
-            return n;
-        }
-        
-        ALWAYS_INLINE Quantifier consumeGreedyQuantifier();
-        Quantifier consumeQuantifier();
-        Escape consumeEscape(bool inCharacterClass);
-        ParenthesesType consumeParenthesesType();
-
-        static const int EndOfPattern = -1;
-
-        // Error messages.
-        static const char* QuantifierOutOfOrder;
-        static const char* QuantifierWithoutAtom;
-        static const char* ParenthesesUnmatched;
-        static const char* ParenthesesTypeInvalid;
-        static const char* ParenthesesNotSupported;
-        static const char* CharacterClassUnmatched;
-        static const char* CharacterClassOutOfOrder;
-        static const char* EscapeUnterminated;
-
-        Generator m_generator;
-        const UChar* m_data;
-        unsigned m_size;
-        unsigned m_index;
-        bool m_ignoreCase;
-        bool m_multiline;
-        unsigned m_numSubpatterns;
-        const char* m_error;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Parser_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wscript b/src/3rdparty/webkit/JavaScriptCore/wscript
index 7a5ba1b..61ad1fb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wscript
+++ b/src/3rdparty/webkit/JavaScriptCore/wscript
@@ -29,18 +29,19 @@ import commands
 
 from settings import *
 
-jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
-jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
+jscore_excludes = ['jsc.cpp', 'ucptable.cpp']
+jscore_excludes.extend(get_excludes(jscore_dir, ['*Brew.cpp', '*CF.cpp', '*Symbian.cpp']))
 
 sources = []
 
-jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp', '*None.cpp']))
+jscore_excludes.extend(get_excludes(jscore_dir, ['*None.cpp']))
 
 if building_on_win32:
-    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp']
+    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp', 'ThreadingPthreads.cpp']
     sources += ['jit/ExecutableAllocatorWin.cpp', 'runtime/MarkStackWin.cpp']
 else:
     jscore_excludes.append('JSStringRefBSTR.cpp')
+    jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp']))
 
 def generate_jscore_derived_sources():
     # build the derived sources
@@ -71,11 +72,13 @@ def build(bld):
     full_dirs = get_dirs_for_features(jscore_dir, features=[build_port], dirs=jscore_dirs)
 
     includes = common_includes + full_dirs
+    if sys.platform.startswith('darwin'):
+        includes.append(os.path.join(jscore_dir, 'icu'))
 
     # 1. A simple program
     jscore = bld.new_task_gen(
         features = 'cxx cstaticlib',
-        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        includes = '. .. assembler DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = sources,
         target = 'jscore',
         uselib = 'WX ICU ' + get_config(),
@@ -86,7 +89,7 @@ def build(bld):
         
     obj = bld.new_task_gen(
         features = 'cxx cprogram',
-        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        includes = '. .. assembler DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = 'jsc.cpp',
         target = 'jsc',
         uselib = 'WX ICU ' + get_config(),
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
index 0c3c29f..b43bb37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
@@ -30,7 +30,6 @@
 #define WTF_ASCIICType_h
 
 #include <wtf/Assertions.h>
-#include <wtf/Platform.h>
 
 // The behavior of many of the functions in the <ctype.h> header is dependent
 // on the current locale. But in the WebKit project, all uses of those functions
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
index 64fdd99..ce27df6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
@@ -23,7 +23,7 @@
 #ifndef ALWAYS_INLINE
 #if COMPILER(GCC) && defined(NDEBUG) && !COMPILER(MINGW)
 #define ALWAYS_INLINE inline __attribute__((__always_inline__))
-#elif COMPILER(MSVC) && defined(NDEBUG)
+#elif (COMPILER(MSVC) || COMPILER(RVCT)) && defined(NDEBUG)
 #define ALWAYS_INLINE __forceinline
 #else
 #define ALWAYS_INLINE inline
@@ -33,6 +33,8 @@
 #ifndef NEVER_INLINE
 #if COMPILER(GCC)
 #define NEVER_INLINE __attribute__((__noinline__))
+#elif COMPILER(RVCT)
+#define NEVER_INLINE __declspec(noinline)
 #else
 #define NEVER_INLINE
 #endif
@@ -57,6 +59,8 @@
 #ifndef NO_RETURN
 #if COMPILER(GCC)
 #define NO_RETURN __attribute((__noreturn__))
+#elif COMPILER(RVCT)
+#define NO_RETURN __declspec(noreturn)
 #else
 #define NO_RETURN
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
index 6c5e2e3..cadbc91 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
@@ -35,7 +35,7 @@
 #include <CoreFoundation/CFString.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
 #ifndef WINVER
 #define WINVER 0x0500
 #endif
@@ -46,7 +46,7 @@
 #include <crtdbg.h>
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <winbase.h>
 #endif
 
@@ -82,7 +82,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
                 break;
 
             if (_vsnprintf(buffer, size, format, args) != -1) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
                 // WinCE only supports wide chars
                 wchar_t* wideBuffer = (wchar_t*)malloc(size * sizeof(wchar_t));
                 if (wideBuffer == NULL)
@@ -105,7 +105,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
         } while (size > 1024);
     }
 #endif
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     vfprintf(stdout, format, args);
 #else
     vfprintf(stderr, format, args);
@@ -123,7 +123,7 @@ static void printf_stderr_common(const char* format, ...)
 
 static void printCallSite(const char* file, int line, const char* function)
 {
-#if PLATFORM(WIN) && !PLATFORM(WINCE) && defined _DEBUG
+#if OS(WIN) && !OS(WINCE) && defined _DEBUG
     _CrtDbgReport(_CRT_WARN, file, line, NULL, "%s\n", function);
 #else
     printf_stderr_common("(%s:%d %s)\n", file, line, function);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index aa72e5a..8b6d09a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -50,7 +50,7 @@
 #include <inttypes.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <e32def.h>
 #include <e32debug.h>
 #endif
@@ -61,24 +61,50 @@
 #define ASSERTIONS_DISABLED_DEFAULT 0
 #endif
 
+#if COMPILER(MSVC7_OR_LOWER) || COMPILER(WINSCW)
+#define HAVE_VARIADIC_MACRO 0
+#else
+#define HAVE_VARIADIC_MACRO 1
+#endif
+
 #ifndef ASSERT_DISABLED
 #define ASSERT_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
 
+#ifndef ASSERT_MSG_DISABLED
+#if HAVE(VARIADIC_MACRO)
+#define ASSERT_MSG_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define ASSERT_MSG_DISABLED 1
+#endif
+#endif
+
 #ifndef ASSERT_ARG_DISABLED
 #define ASSERT_ARG_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
 
 #ifndef FATAL_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define FATAL_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define FATAL_DISABLED 1
+#endif
 #endif
 
 #ifndef ERROR_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define ERROR_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define ERROR_DISABLED 1
+#endif
 #endif
 
 #ifndef LOG_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define LOG_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define LOG_DISABLED 1
+#endif
 #endif
 
 #if COMPILER(GCC)
@@ -125,7 +151,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 /* CRASH -- gets us into the debugger or the crash reporter -- signals are ignored by the crash reporter so we must do better */
 
 #ifndef CRASH
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #define CRASH() do { \
     __DEBUGGER(); \
     User::Panic(_L("Webkit CRASH"),0); \
@@ -138,9 +164,9 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #endif
 #endif
 
-/* ASSERT, ASSERT_WITH_MESSAGE, ASSERT_NOT_REACHED */
+/* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED */
 
-#if PLATFORM(WINCE) && !PLATFORM(TORCHMOBILE)
+#if OS(WINCE) && !PLATFORM(TORCHMOBILE)
 /* FIXME: We include this here only to avoid a conflict with the ASSERT macro. */
 #include <windows.h>
 #undef min
@@ -148,21 +174,22 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #undef ERROR
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN)
 /* FIXME: Change to use something other than ASSERT to avoid this conflict with the underlying platform */
 #undef ASSERT
 #endif
 
+#if PLATFORM(BREWMP)
+/* FIXME: We include this here only to avoid a conflict with the COMPILE_ASSERT macro. */
+#include <AEEClassIDs.h>
+
+/* FIXME: Change to use something other than COMPILE_ASSERT to avoid this conflict with the underlying platform */
+#undef COMPILE_ASSERT
+#endif
+
 #if ASSERT_DISABLED
 
 #define ASSERT(assertion) ((void)0)
-#if COMPILER(MSVC7)
-#define ASSERT_WITH_MESSAGE(assertion) ((void)0)
-#elif COMPILER(WINSCW)
-#define ASSERT_WITH_MESSAGE(assertion, arg...) ((void)0)
-#else
-#define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
-#endif /* COMPILER(MSVC7) */
 #define ASSERT_NOT_REACHED() ((void)0)
 #define ASSERT_UNUSED(variable, assertion) ((void)variable)
 
@@ -174,10 +201,24 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
         CRASH(); \
     } \
 while (0)
-#if COMPILER(MSVC7)
+
+#define ASSERT_NOT_REACHED() do { \
+    WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 0); \
+    CRASH(); \
+} while (0)
+
+#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
+
+#endif
+
+/* ASSERT_WITH_MESSAGE */
+
+#if COMPILER(MSVC7_OR_LOWER)
 #define ASSERT_WITH_MESSAGE(assertion) ((void)0)
 #elif COMPILER(WINSCW)
 #define ASSERT_WITH_MESSAGE(assertion, arg...) ((void)0)
+#elif ASSERT_MSG_DISABLED
+#define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
 #else
 #define ASSERT_WITH_MESSAGE(assertion, ...) do \
     if (!(assertion)) { \
@@ -185,16 +226,9 @@ while (0)
         CRASH(); \
     } \
 while (0)
-#endif /* COMPILER(MSVC7) */
-#define ASSERT_NOT_REACHED() do { \
-    WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 0); \
-    CRASH(); \
-} while (0)
-
-#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
-
 #endif
-
+                        
+                        
 /* ASSERT_ARG */
 
 #if ASSERT_ARG_DISABLED
@@ -219,12 +253,12 @@ while (0)
 
 /* FATAL */
 
-#if FATAL_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define FATAL(...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7_OR_LOWER)
 #define FATAL() ((void)0)
 #elif COMPILER(WINSCW)
-#define FATAL(args...) ((void)0)
+#define FATAL(arg...) ((void)0)
+#elif FATAL_DISABLED
+#define FATAL(...) ((void)0)
 #else
 #define FATAL(...) do { \
     WTFReportFatalError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__); \
@@ -234,24 +268,24 @@ while (0)
 
 /* LOG_ERROR */
 
-#if ERROR_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG_ERROR(...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7_OR_LOWER)
 #define LOG_ERROR() ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG_ERROR(arg...)  ((void)0)
+#elif ERROR_DISABLED
+#define LOG_ERROR(...) ((void)0)
 #else
 #define LOG_ERROR(...) WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__)
 #endif
 
 /* LOG */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7_OR_LOWER)
 #define LOG() ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG(arg...) ((void)0)
+#elif LOG_DISABLED
+#define LOG(channel, ...) ((void)0)
 #else
 #define LOG(channel, ...) WTFLog(&JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #define JOIN_LOG_CHANNEL_WITH_PREFIX(prefix, channel) JOIN_LOG_CHANNEL_WITH_PREFIX_LEVEL_2(prefix, channel)
@@ -260,12 +294,12 @@ while (0)
 
 /* LOG_VERBOSE */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG_VERBOSE(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7_OR_LOWER)
 #define LOG_VERBOSE(channel) ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG_VERBOSE(channel, arg...) ((void)0)
+#elif LOG_DISABLED
+#define LOG_VERBOSE(channel, ...) ((void)0)
 #else
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h
new file mode 100644
index 0000000..cfd1d20
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Complex_h
+#define Complex_h
+
+#include <complex>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+typedef std::complex<double> Complex;
+
+inline Complex complexFromMagnitudePhase(double magnitude, double phase)
+{
+    return Complex(magnitude * cos(phase), magnitude * sin(phase));
+}
+
+} // namespace WebCore
+
+#endif // Complex_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
index b36cae5..30ca7c3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -33,7 +33,7 @@
 #include "config.h"
 #include "CurrentTime.h"
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 // Windows is first since we want to use hires timers, despite PLATFORM(CF)
 // being defined.
@@ -45,7 +45,7 @@
 #include <time.h>
 
 #if USE(QUERY_PERFORMANCE_COUNTER)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" time_t mktime(struct tm *t);
 #else
 #include <sys/timeb.h>
@@ -59,6 +59,8 @@ extern "C" time_t mktime(struct tm *t);
 #include <glib.h>
 #elif PLATFORM(WX)
 #include <wx/datetime.h>
+#elif PLATFORM(BREWMP)
+#include <AEEStdLib.h>
 #else // Posix systems relying on the gettimeofday()
 #include <sys/time.h>
 #endif
@@ -71,7 +73,7 @@ namespace WTF {
 
 const double msPerSecond = 1000.0;
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 #if USE(QUERY_PERFORMANCE_COUNTER)
 
@@ -123,7 +125,7 @@ static double highResUpTime()
 
 static double lowResUTCTime()
 {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     SYSTEMTIME systemTime;
     GetSystemTime(&systemTime);
     struct tm tmtime;
@@ -277,6 +279,20 @@ double currentTime()
     return (double)now.GetTicks() + (double)(now.GetMillisecond() / 1000.0);
 }
 
+#elif PLATFORM(BREWMP)
+
+// GETUTCSECONDS returns the number of seconds since 1980/01/06 00:00:00 UTC,
+// and GETTIMEMS returns the number of milliseconds that have elapsed since the last
+// occurrence of 00:00:00 local time.
+// We can combine GETUTCSECONDS and GETTIMEMS to calculate the number of milliseconds
+// since 1970/01/01 00:00:00 UTC.
+double currentTime()
+{
+    // diffSeconds is the number of seconds from 1970/01/01 to 1980/01/06
+    const unsigned diffSeconds = 315964800;
+    return static_cast<double>(diffSeconds + GETUTCSECONDS() + ((GETTIMEMS() % 1000) / msPerSecond));
+}
+
 #else // Other Posix systems rely on the gettimeofday().
 
 double currentTime()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
index 31f1ec8..dcb1f6c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
@@ -32,16 +32,36 @@
 #ifndef CurrentTime_h
 #define CurrentTime_h
 
+#include <time.h>
+
 namespace WTF {
 
-    // Returns the current system (UTC) time in seconds, starting January 1, 1970.
-    // Precision varies depending on a platform but usually is as good or better 
+    // Returns the current UTC time in seconds, counted from January 1, 1970.
+    // Precision varies depending on platform but is usually as good or better 
     // than a millisecond.
     double currentTime();
 
+    // Same thing, in milliseconds.
+    inline double currentTimeMS()
+    {
+        return currentTime() * 1000.0; 
+    }
+
+    inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+    {
+    #if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW) || OS(WINCE)
+        *localTM = *localtime(localTime);
+    #elif COMPILER(MSVC)
+        localtime_s(localTM, localTime);
+    #else
+        localtime_r(localTime, localTM);
+    #endif
+    }
+
 } // namespace WTF
 
 using WTF::currentTime;
+using WTF::getLocalTime;
 
 #endif // CurrentTime_h
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
index 2110432..b9a0207 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
@@ -39,6 +39,33 @@
  * other provisions required by the MPL or the GPL, as the case may be.
  * If you do not delete the provisions above, a recipient may use your
  * version of this file under any of the LGPL, the MPL or the GPL.
+
+ * Copyright 2006-2008 the V8 project authors. All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -61,11 +88,7 @@
 #include <errno.h>
 #endif
 
-#if PLATFORM(DARWIN)
-#include <notify.h>
-#endif
-
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t);
 extern "C" struct tm * localtime(const time_t *timer);
 #endif
@@ -78,8 +101,14 @@ extern "C" struct tm * localtime(const time_t *timer);
 #include <sys/timeb.h>
 #endif
 
+#if USE(JSC)
+#include "CallFrame.h"
+#endif
+
 #define NaN std::numeric_limits<double>::quiet_NaN()
 
+using namespace WTF;
+
 namespace WTF {
 
 /* Constants */
@@ -91,6 +120,10 @@ static const double secondsPerYear = 24.0 * 60.0 * 60.0 * 365.0;
 static const double usecPerSec = 1000000.0;
 
 static const double maxUnixTime = 2145859200.0; // 12/31/2037
+// ECMAScript asks not to support for a date of which total
+// millisecond value is larger than the following value.
+// See 15.9.1.14 of ECMA-262 5th edition.
+static const double maxECMAScriptTime = 8.64E15;
 
 // Day of year for the first day of each month, where index 0 is January, and day 0 is January 1.
 // First for non-leap years, then for leap years.
@@ -139,7 +172,7 @@ static inline double msToDays(double ms)
     return floor(ms / msPerDay);
 }
 
-static inline int msToYear(double ms)
+int msToYear(double ms)
 {
     int approxYear = static_cast<int>(floor(ms / (msPerDay * 365.2425)) + 1970);
     double msFromApproxYearTo1970 = msPerDay * daysFrom1970ToYear(approxYear);
@@ -150,7 +183,7 @@ static inline int msToYear(double ms)
     return approxYear;
 }
 
-static inline int dayInYear(double ms, int year)
+int dayInYear(double ms, int year)
 {
     return static_cast<int>(msToDays(ms) - daysFrom1970ToYear(year));
 }
@@ -196,7 +229,7 @@ static inline int msToHours(double ms)
     return static_cast<int>(result);
 }
 
-static inline int monthFromDayInYear(int dayInYear, bool leapYear)
+int monthFromDayInYear(int dayInYear, bool leapYear)
 {
     const int d = dayInYear;
     int step;
@@ -234,7 +267,7 @@ static inline bool checkMonth(int dayInYear, int& startDayOfThisMonth, int& star
     return (dayInYear <= startDayOfNextMonth);
 }
 
-static inline int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
+int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
 {
     const int d = dayInYear;
     int step;
@@ -277,7 +310,7 @@ static inline double timeToMS(double hour, double min, double sec, double ms)
     return (((hour * minutesPerHour + min) * secondsPerMinute + sec) * msPerSecond + ms);
 }
 
-static int dateToDayInYear(int year, int month, int day)
+double dateToDaysFrom1970(int year, int month, int day)
 {
     year += month / 12;
 
@@ -287,34 +320,13 @@ static int dateToDayInYear(int year, int month, int day)
         --year;
     }
 
-    int yearday = static_cast<int>(floor(daysFrom1970ToYear(year)));
+    double yearday = floor(daysFrom1970ToYear(year));
+    ASSERT((year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0));
     int monthday = monthToDayInYear(month, isLeapYear(year));
 
     return yearday + monthday + day - 1;
 }
 
-double getCurrentUTCTime()
-{
-    return floor(getCurrentUTCTimeWithMicroseconds());
-}
-
-// Returns current time in milliseconds since 1 Jan 1970.
-double getCurrentUTCTimeWithMicroseconds()
-{
-    return currentTime() * 1000.0; 
-}
-
-void getLocalTime(const time_t* localTime, struct tm* localTM)
-{
-#if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WINCE)
-    *localTM = *localtime(localTime);
-#elif COMPILER(MSVC)
-    localtime_s(localTM, localTime);
-#else
-    localtime_r(localTime, localTM);
-#endif
-}
-
 // There is a hard limit at 2038 that we currently do not have a workaround
 // for (rdar://problem/5052975).
 static inline int maximumYearForDST()
@@ -328,7 +340,7 @@ static inline int minimumYearForDST()
     // greater than the max year minus 27 (2010), we want to use the max year
     // minus 27 instead, to ensure there is a range of 28 years that all years
     // can map to.
-    return std::min(msToYear(getCurrentUTCTime()), maximumYearForDST() - 27) ;
+    return std::min(msToYear(jsCurrentTime()), maximumYearForDST() - 27) ;
 }
 
 /*
@@ -367,7 +379,11 @@ int equivalentYearForDST(int year)
 
 static int32_t calculateUTCOffset()
 {
+#if PLATFORM(BREWMP)
+    time_t localTime = static_cast<time_t>(currentTime());
+#else
     time_t localTime = time(0);
+#endif
     tm localt;
     getLocalTime(&localTime, &localt);
 
@@ -399,44 +415,10 @@ static int32_t calculateUTCOffset()
     return static_cast<int32_t>(utcOffset * 1000);
 }
 
-#if PLATFORM(DARWIN)
-static int32_t s_cachedUTCOffset; // In milliseconds. An assumption here is that access to an int32_t variable is atomic on platforms that take this code path.
-static bool s_haveCachedUTCOffset;
-static int s_notificationToken;
-#endif
-
-/*
- * Get the difference in milliseconds between this time zone and UTC (GMT)
- * NOT including DST.
- */
-double getUTCOffset()
-{
-#if PLATFORM(DARWIN)
-    if (s_haveCachedUTCOffset) {
-        int notified;
-        uint32_t status = notify_check(s_notificationToken, &notified);
-        if (status == NOTIFY_STATUS_OK && !notified)
-            return s_cachedUTCOffset;
-    }
-#endif
-
-    int32_t utcOffset = calculateUTCOffset();
-
-#if PLATFORM(DARWIN)
-    // Theoretically, it is possible that several threads will be executing this code at once, in which case we will have a race condition,
-    // and a newer value may be overwritten. In practice, time zones don't change that often.
-    s_cachedUTCOffset = utcOffset;
-#endif
-
-    return utcOffset;
-}
-
 /*
- * Get the DST offset for the time passed in.  Takes
- * seconds (not milliseconds) and cannot handle dates before 1970
- * on some OS'
+ * Get the DST offset for the time passed in.
  */
-static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
+static double calculateDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 {
     if (localTimeSeconds > maxUnixTime)
         localTimeSeconds = maxUnixTime;
@@ -465,9 +447,9 @@ static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 }
 
 // Get the DST offset, given a time in UTC
-static double getDSTOffset(double ms, double utcOffset)
+static double calculateDSTOffset(double ms, double utcOffset)
 {
-    // On Mac OS X, the call to localtime (see getDSTOffsetSimple) will return historically accurate
+    // On Mac OS X, the call to localtime (see calculateDSTOffsetSimple) will return historically accurate
     // DST information (e.g. New Zealand did not have DST from 1946 to 1974) however the JavaScript
     // standard explicitly dictates that historical information should not be considered when
     // determining DST. For this reason we shift away from years that localtime can handle but would
@@ -479,69 +461,22 @@ static double getDSTOffset(double ms, double utcOffset)
         int dayInYearLocal = dayInYear(ms, year);
         int dayInMonth = dayInMonthFromDayInYear(dayInYearLocal, leapYear);
         int month = monthFromDayInYear(dayInYearLocal, leapYear);
-        int day = dateToDayInYear(equivalentYear, month, dayInMonth);
+        double day = dateToDaysFrom1970(equivalentYear, month, dayInMonth);
         ms = (day * msPerDay) + msToMilliseconds(ms);
     }
 
-    return getDSTOffsetSimple(ms / msPerSecond, utcOffset);
-}
-
-double gregorianDateTimeToMS(const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
-{
-    int day = dateToDayInYear(t.year + 1900, t.month, t.monthDay);
-    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
-    double result = (day * msPerDay) + ms;
-
-    if (!inputIsUTC) { // convert to UTC
-        double utcOffset = getUTCOffset();
-        result -= utcOffset;
-        result -= getDSTOffset(result, utcOffset);
-    }
-
-    return result;
-}
-
-// input is UTC
-void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
-{
-    double dstOff = 0.0;
-    double utcOff = 0.0;
-    if (!outputIsUTC) {
-        utcOff = getUTCOffset();
-        dstOff = getDSTOffset(ms, utcOff);
-        ms += dstOff + utcOff;
-    }
-
-    const int year = msToYear(ms);
-    tm.second   =  msToSeconds(ms);
-    tm.minute   =  msToMinutes(ms);
-    tm.hour     =  msToHours(ms);
-    tm.weekDay  =  msToWeekDay(ms);
-    tm.yearDay  =  dayInYear(ms, year);
-    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.year     =  year - 1900;
-    tm.isDST    =  dstOff != 0.0;
-    tm.utcOffset = static_cast<long>((dstOff + utcOff) / msPerSecond);
-    tm.timeZone = NULL;
+    return calculateDSTOffsetSimple(ms / msPerSecond, utcOffset);
 }
 
 void initializeDates()
 {
 #ifndef NDEBUG
     static bool alreadyInitialized;
-    ASSERT(!alreadyInitialized++);
+    ASSERT(!alreadyInitialized);
+    alreadyInitialized = true;
 #endif
 
     equivalentYearForDST(2000); // Need to call once to initialize a static used in this function.
-#if PLATFORM(DARWIN)
-    // Register for a notification whenever the time zone changes.
-    uint32_t status = notify_register_check("com.apple.system.timezone", &s_notificationToken);
-    if (status == NOTIFY_STATUS_OK) {
-        s_cachedUTCOffset = calculateUTCOffset();
-        s_haveCachedUTCOffset = true;
-    }
-#endif
 }
 
 static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int minute, int second)
@@ -557,7 +492,7 @@ static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int
 // We follow the recommendation of RFC 2822 to consider all
 // obsolete time zones not listed here equivalent to "-0000".
 static const struct KnownZone {
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
     const
 #endif
         char tzName[4];
@@ -622,8 +557,12 @@ static bool parseLong(const char* string, char** stopPosition, int base, long* r
     return true;
 }
 
-double parseDateFromNullTerminatedCharacters(const char* dateString)
+// Odd case where 'exec' is allowed to be 0, to accomodate a caller in WebCore.
+static double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveTZ, int& offset)
 {
+    haveTZ = false;
+    offset = 0;
+
     // This parses a date in the form:
     //     Tuesday, 09-Nov-99 23:12:40 GMT
     // or
@@ -824,9 +763,6 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         }
     }
 
-    bool haveTZ = false;
-    int offset = 0;
-
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
     if (*dateString) {
@@ -889,33 +825,172 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         else
             year += 1900;
     }
+    
+    return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
+}
+
+double parseDateFromNullTerminatedCharacters(const char* dateString)
+{
+    bool haveTZ;
+    int offset;
+    double ms = parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
 
     // fall back to local timezone
     if (!haveTZ) {
-        GregorianDateTime t;
-        t.monthDay = day;
-        t.month = month;
-        t.year = year - 1900;
-        t.isDST = -1;
-        t.second = second;
-        t.minute = minute;
-        t.hour = hour;
-
-        // Use our gregorianDateTimeToMS() rather than mktime() as the latter can't handle the full year range.
-        return gregorianDateTimeToMS(t, 0, false);
+        double utcOffset = calculateUTCOffset();
+        double dstOffset = calculateDSTOffset(ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / msPerMinute);
     }
-
-    return (ymdhmsToSeconds(year, month + 1, day, hour, minute, second) - (offset * 60.0)) * msPerSecond;
+    return ms - (offset * msPerMinute);
 }
 
 double timeClip(double t)
 {
     if (!isfinite(t))
         return NaN;
-    if (fabs(t) > 8.64E15)
+    if (fabs(t) > maxECMAScriptTime)
         return NaN;
     return trunc(t);
 }
+} // namespace WTF
 
+#if USE(JSC)
+namespace JSC {
+
+// Get the DST offset for the time passed in.
+//
+// NOTE: The implementation relies on the fact that no time zones have
+// more than one daylight savings offset change per month.
+// If this function is called with NaN it returns NaN.
+static double getDSTOffset(ExecState* exec, double ms, double utcOffset)
+{
+    DSTOffsetCache& cache = exec->globalData().dstOffsetCache;
+    double start = cache.start;
+    double end = cache.end;
+
+    if (start <= ms) {
+        // If the time fits in the cached interval, return the cached offset.
+        if (ms <= end) return cache.offset;
+
+        // Compute a possible new interval end.
+        double newEnd = end + cache.increment;
+
+        if (ms <= newEnd) {
+            double endOffset = calculateDSTOffset(newEnd, utcOffset);
+            if (cache.offset == endOffset) {
+                // If the offset at the end of the new interval still matches
+                // the offset in the cache, we grow the cached time interval
+                // and return the offset.
+                cache.end = newEnd;
+                cache.increment = msPerMonth;
+                return endOffset;
+            } else {
+                double offset = calculateDSTOffset(ms, utcOffset);
+                if (offset == endOffset) {
+                    // The offset at the given time is equal to the offset at the
+                    // new end of the interval, so that means that we've just skipped
+                    // the point in time where the DST offset change occurred. Updated
+                    // the interval to reflect this and reset the increment.
+                    cache.start = ms;
+                    cache.end = newEnd;
+                    cache.increment = msPerMonth;
+                } else {
+                    // The interval contains a DST offset change and the given time is
+                    // before it. Adjust the increment to avoid a linear search for
+                    // the offset change point and change the end of the interval.
+                    cache.increment /= 3;
+                    cache.end = ms;
+                }
+                // Update the offset in the cache and return it.
+                cache.offset = offset;
+                return offset;
+            }
+        }
+    }
 
-} // namespace WTF
+    // Compute the DST offset for the time and shrink the cache interval
+    // to only contain the time. This allows fast repeated DST offset
+    // computations for the same time.
+    double offset = calculateDSTOffset(ms, utcOffset);
+    cache.offset = offset;
+    cache.start = ms;
+    cache.end = ms;
+    cache.increment = msPerMonth;
+    return offset;
+}
+
+/*
+ * Get the difference in milliseconds between this time zone and UTC (GMT)
+ * NOT including DST.
+ */
+double getUTCOffset(ExecState* exec)
+{
+    double utcOffset = exec->globalData().cachedUTCOffset;
+    if (!isnan(utcOffset))
+        return utcOffset;
+    exec->globalData().cachedUTCOffset = calculateUTCOffset();
+    return exec->globalData().cachedUTCOffset;
+}
+
+double gregorianDateTimeToMS(ExecState* exec, const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
+{
+    double day = dateToDaysFrom1970(t.year + 1900, t.month, t.monthDay);
+    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
+    double result = (day * WTF::msPerDay) + ms;
+
+    if (!inputIsUTC) { // convert to UTC
+        double utcOffset = getUTCOffset(exec);
+        result -= utcOffset;
+        result -= getDSTOffset(exec, result, utcOffset);
+    }
+
+    return result;
+}
+
+// input is UTC
+void msToGregorianDateTime(ExecState* exec, double ms, bool outputIsUTC, GregorianDateTime& tm)
+{
+    double dstOff = 0.0;
+    double utcOff = 0.0;
+    if (!outputIsUTC) {
+        utcOff = getUTCOffset(exec);
+        dstOff = getDSTOffset(exec, ms, utcOff);
+        ms += dstOff + utcOff;
+    }
+
+    const int year = msToYear(ms);
+    tm.second   =  msToSeconds(ms);
+    tm.minute   =  msToMinutes(ms);
+    tm.hour     =  msToHours(ms);
+    tm.weekDay  =  msToWeekDay(ms);
+    tm.yearDay  =  dayInYear(ms, year);
+    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.year     =  year - 1900;
+    tm.isDST    =  dstOff != 0.0;
+    tm.utcOffset = static_cast<long>((dstOff + utcOff) / WTF::msPerSecond);
+    tm.timeZone = NULL;
+}
+
+double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateString)
+{
+    ASSERT(exec);
+    bool haveTZ;
+    int offset;
+    double ms = WTF::parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
+
+    // fall back to local timezone
+    if (!haveTZ) {
+        double utcOffset = getUTCOffset(exec);
+        double dstOffset = getDSTOffset(exec, ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / WTF::msPerMinute);
+    }
+    return ms - (offset * WTF::msPerMinute);
+}
+
+} // namespace JSC
+#endif // USE(JSC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
index 6110f76..033d25e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
@@ -42,27 +42,27 @@
 #ifndef DateMath_h
 #define DateMath_h
 
-#include <time.h>
+#include <math.h>
 #include <string.h>
+#include <time.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
 
 namespace WTF {
-
-struct GregorianDateTime;
-
 void initializeDates();
-void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&);
-double gregorianDateTimeToMS(const GregorianDateTime&, double, bool inputIsUTC);
-double getUTCOffset();
 int equivalentYearForDST(int year);
-double getCurrentUTCTime();
-double getCurrentUTCTimeWithMicroseconds();
-void getLocalTime(const time_t*, tm*);
 
 // Not really math related, but this is currently the only shared place to put these.  
-double parseDateFromNullTerminatedCharacters(const char*);
+double parseDateFromNullTerminatedCharacters(const char* dateString);
 double timeClip(double);
 
+inline double jsCurrentTime()
+{
+    // JavaScript doesn't recognize fractions of a millisecond.
+    return floor(WTF::currentTimeMS());
+}
+
 const char * const weekdayName[7] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
 const char * const monthName[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
 
@@ -74,9 +74,39 @@ const double msPerSecond = 1000.0;
 const double msPerMinute = 60.0 * 1000.0;
 const double msPerHour = 60.0 * 60.0 * 1000.0;
 const double msPerDay = 24.0 * 60.0 * 60.0 * 1000.0;
+const double msPerMonth = 2592000000.0;
 
-// Intentionally overridding the default tm of the system
-// Tee members of tm differ on various operating systems.
+// Returns the number of days from 1970-01-01 to the specified date.
+double dateToDaysFrom1970(int year, int month, int day);
+int msToYear(double ms);
+int dayInYear(double ms, int year);
+int monthFromDayInYear(int dayInYear, bool leapYear);
+int dayInMonthFromDayInYear(int dayInYear, bool leapYear);
+
+} // namespace WTF
+
+using WTF::dateToDaysFrom1970;
+using WTF::dayInMonthFromDayInYear;
+using WTF::dayInYear;
+using WTF::minutesPerHour;
+using WTF::monthFromDayInYear;
+using WTF::msPerDay;
+using WTF::msPerSecond;
+using WTF::msToYear;
+using WTF::secondsPerMinute;
+
+#if USE(JSC)
+namespace JSC {
+class ExecState;
+struct GregorianDateTime;
+
+void msToGregorianDateTime(ExecState*, double, bool outputIsUTC, GregorianDateTime&);
+double gregorianDateTimeToMS(ExecState*, const GregorianDateTime&, double, bool inputIsUTC);
+double getUTCOffset(ExecState*);
+double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString);
+
+// Intentionally overridding the default tm of the system.
+// The members of tm differ on various operating systems.
 struct GregorianDateTime : Noncopyable {
     GregorianDateTime()
         : second(0)
@@ -98,7 +128,7 @@ struct GregorianDateTime : Noncopyable {
         delete [] timeZone;
     }
 
-    GregorianDateTime(const tm& inTm)
+    GregorianDateTime(ExecState* exec, const tm& inTm)
         : second(inTm.tm_sec)
         , minute(inTm.tm_min)
         , hour(inTm.tm_hour)
@@ -109,10 +139,11 @@ struct GregorianDateTime : Noncopyable {
         , year(inTm.tm_year)
         , isDST(inTm.tm_isdst)
     {
+        UNUSED_PARAM(exec);
 #if HAVE(TM_GMTOFF)
         utcOffset = static_cast<int>(inTm.tm_gmtoff);
 #else
-        utcOffset = static_cast<int>(getUTCOffset() / msPerSecond + (isDST ? secondsPerHour : 0));
+        utcOffset = static_cast<int>(getUTCOffset(exec) / WTF::msPerSecond + (isDST ? WTF::secondsPerHour : 0));
 #endif
 
 #if HAVE(TM_ZONE)
@@ -186,7 +217,7 @@ static inline int gmtoffset(const GregorianDateTime& t)
 {
     return t.utcOffset;
 }
-
-} // namespace WTF
+} // namespace JSC
+#endif // USE(JSC)
 
 #endif // DateMath_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index 6cd8ef0..e7d9efa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -114,11 +114,13 @@ static void initializeIsForbiddenKey()
   pthread_key_create(&isForbiddenKey, 0);
 }
 
+#if !ASSERT_DISABLED
 static bool isForbidden()
 {
     pthread_once(&isForbiddenKeyOnce, initializeIsForbiddenKey);
     return !!pthread_getspecific(isForbiddenKey);
 }
+#endif
 
 void fastMallocForbid()
 {
@@ -177,6 +179,17 @@ void* fastZeroedMalloc(size_t n)
     memset(result, 0, n);
     return result;
 }
+
+char* fastStrDup(const char* src)
+{
+    int len = strlen(src) + 1;
+    char* dup = static_cast<char*>(fastMalloc(len));
+
+    if (dup)
+        memcpy(dup, src, len);
+
+    return dup;
+}
     
 TryMallocReturnValue tryFastZeroedMalloc(size_t n) 
 {
@@ -191,11 +204,14 @@ TryMallocReturnValue tryFastZeroedMalloc(size_t n)
 
 #if FORCE_SYSTEM_MALLOC
 
-#include <stdlib.h>
-#if !PLATFORM(WIN_OS)
-    #include <pthread.h>
-#else
-    #include "windows.h"
+#if PLATFORM(BREWMP)
+#include "brew/SystemMallocBrew.h"
+#endif
+
+#if OS(DARWIN)
+#include <malloc/malloc.h>
+#elif COMPILER(MSVC)
+#include <malloc.h>
 #endif
 
 namespace WTF {
@@ -233,8 +249,16 @@ void* fastMalloc(size_t n)
     void* result = malloc(n);
 #endif
 
-    if (!result)
+    if (!result) {
+#if PLATFORM(BREWMP)
+        // The behavior of malloc(0) is implementation defined.
+        // To make sure that fastMalloc never returns 0, retry with fastMalloc(1).
+        if (!n)
+            return fastMalloc(1);
+#endif
         CRASH();
+    }
+
     return result;
 }
 
@@ -273,8 +297,16 @@ void* fastCalloc(size_t n_elements, size_t element_size)
     void* result = calloc(n_elements, element_size);
 #endif
 
-    if (!result)
+    if (!result) {
+#if PLATFORM(BREWMP)
+        // If either n_elements or element_size is 0, the behavior of calloc is implementation defined.
+        // To make sure that fastCalloc never returns 0, retry with fastCalloc(1, 1).
+        if (!n_elements || !element_size)
+            return fastCalloc(1, 1);
+#endif
         CRASH();
+    }
+
     return result;
 }
 
@@ -343,13 +375,24 @@ void releaseFastMallocFreeMemory() { }
     
 FastMallocStatistics fastMallocStatistics()
 {
-    FastMallocStatistics statistics = { 0, 0, 0, 0 };
+    FastMallocStatistics statistics = { 0, 0, 0 };
     return statistics;
 }
 
+size_t fastMallocSize(const void* p)
+{
+#if OS(DARWIN)
+    return malloc_size(p);
+#elif COMPILER(MSVC)
+    return _msize(const_cast<void*>(p));
+#else
+    return 1;
+#endif
+}
+
 } // namespace WTF
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 // This symbol is present in the JavaScriptCore exports file even when FastMalloc is disabled.
 // It will never be used in this case, so it's type and value are less interesting than its presence.
 extern "C" const int jscore_fastmalloc_introspection = 0;
@@ -374,12 +417,11 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <algorithm>
 #include <errno.h>
 #include <limits>
-#include <new>
 #include <pthread.h>
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <unistd.h>
 #endif
 #if COMPILER(MSVC)
@@ -389,13 +431,17 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <windows.h>
 #endif
 
-#if WTF_CHANGES
+#ifdef WTF_CHANGES
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include "MallocZoneSupport.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 #endif
+#if HAVE(DISPATCH_H)
+#include <dispatch/dispatch.h>
+#endif
+
 
 #ifndef PRIuS
 #define PRIuS "zu"
@@ -405,7 +451,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 // call to the function on Mac OS X, and it's used in performance-critical code. So we
 // use a function pointer. But that's not necessarily faster on other platforms, and we had
 // problems with this technique on Windows, so we'll do this only on Mac OS X.
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 static void* (*pthread_getspecific_function_pointer)(pthread_key_t) = pthread_getspecific;
 #define pthread_getspecific(key) pthread_getspecific_function_pointer(key)
 #endif
@@ -433,8 +479,8 @@ namespace WTF {
 #define MESSAGE LOG_ERROR
 #define CHECK_CONDITION ASSERT
 
-#if PLATFORM(DARWIN)
-class Span;
+#if OS(DARWIN)
+struct Span;
 class TCMalloc_Central_FreeListPadded;
 class TCMalloc_PageHeap;
 class TCMalloc_ThreadCache;
@@ -990,7 +1036,7 @@ class PageHeapAllocator {
 
   int inuse() const { return inuse_; }
 
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
   template <class Recorder>
   void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
   {
@@ -1172,7 +1218,7 @@ template <int BITS> class MapSelector {
 };
 
 #if defined(WTF_CHANGES)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 // On all known X86-64 platforms, the upper 16 bits are always unused and therefore 
 // can be excluded from the PageMap key.
 // See http://en.wikipedia.org/wiki/X86-64#Virtual_address_space_details
@@ -1206,29 +1252,30 @@ template <> class MapSelector<32> {
 // -------------------------------------------------------------------------
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-// The central page heap collects spans of memory that have been deleted but are still committed until they are released
-// back to the system.  We use a background thread to periodically scan the list of free spans and release some back to the
-// system.  Every 5 seconds, the background thread wakes up and does the following:
-// - Check if we needed to commit memory in the last 5 seconds.  If so, skip this scavenge because it's a sign that we are short
-// of free committed pages and so we should not release them back to the system yet.
-// - Otherwise, go through the list of free spans (from largest to smallest) and release up to a fraction of the free committed pages
-// back to the system.
-// - If the number of free committed pages reaches kMinimumFreeCommittedPageCount, we can stop the scavenging and block the
-// scavenging thread until the number of free committed pages goes above kMinimumFreeCommittedPageCount.
-
-// Background thread wakes up every 5 seconds to scavenge as long as there is memory available to return to the system.
-static const int kScavengeTimerDelayInSeconds = 5;
+// The page heap maintains a free list for spans that are no longer in use by
+// the central cache or any thread caches. We use a background thread to
+// periodically scan the free list and release a percentage of it back to the OS.
+
+// If free_committed_pages_ exceeds kMinimumFreeCommittedPageCount, the
+// background thread:
+//     - wakes up
+//     - pauses for kScavengeDelayInSeconds
+//     - returns to the OS a percentage of the memory that remained unused during
+//       that pause (kScavengePercentage * min_free_committed_pages_since_last_scavenge_)
+// The goal of this strategy is to reduce memory pressure in a timely fashion
+// while avoiding thrashing the OS allocator.
+
+// Time delay before the page heap scavenger will consider returning pages to
+// the OS.
+static const int kScavengeDelayInSeconds = 2;
+
+// Approximate percentage of free committed pages to return to the OS in one
+// scavenge.
+static const float kScavengePercentage = .5f;
 
 // Number of free committed pages that we want to keep around.
 static const size_t kMinimumFreeCommittedPageCount = 512;
 
-// During a scavenge, we'll release up to a fraction of the free committed pages.
-#if PLATFORM(WIN)
-// We are slightly less aggressive in releasing memory on Windows due to performance reasons.
-static const int kMaxScavengeAmountFactor = 3;
-#else
-static const int kMaxScavengeAmountFactor = 2;
-#endif
 #endif
 
 class TCMalloc_PageHeap {
@@ -1334,8 +1381,9 @@ class TCMalloc_PageHeap {
   // Number of pages kept in free lists that are still committed.
   Length free_committed_pages_;
 
-  // Number of pages that we committed in the last scavenge wait interval.
-  Length pages_committed_since_last_scavenge_;
+  // Minimum number of free committed pages since last scavenge. (Can be 0 if
+  // we've committed new pages since the last scavenge.)
+  Length min_free_committed_pages_since_last_scavenge_;
 #endif
 
   bool GrowHeap(Length n);
@@ -1372,26 +1420,34 @@ class TCMalloc_PageHeap {
   // Index of last free list we scavenged
   size_t scavenge_index_;
   
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
   friend class FastMallocZone;
 #endif
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-  static NO_RETURN void* runScavengerThread(void*);
+  void initializeScavenger();
+  ALWAYS_INLINE void signalScavenger();
+  void scavenge();
+  ALWAYS_INLINE bool shouldScavenge() const;
 
+#if !HAVE(DISPATCH_H)
+  static NO_RETURN void* runScavengerThread(void*);
   NO_RETURN void scavengerThread();
 
-  void scavenge();
-
-  inline bool shouldContinueScavenging() const;
+  // Keeps track of whether the background thread is actively scavenging memory every kScavengeDelayInSeconds, or
+  // it's blocked waiting for more pages to be deleted.
+  bool m_scavengeThreadActive;
 
   pthread_mutex_t m_scavengeMutex;
-
   pthread_cond_t m_scavengeCondition;
+#else // !HAVE(DISPATCH_H)
+  void periodicScavenge();
+
+  dispatch_queue_t m_scavengeQueue;
+  dispatch_source_t m_scavengeTimer;
+  bool m_scavengingScheduled;
+#endif
 
-  // Keeps track of whether the background thread is actively scavenging memory every kScavengeTimerDelayInSeconds, or
-  // it's blocked waiting for more pages to be deleted.
-  bool m_scavengeThreadActive;
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 };
 
@@ -1404,7 +1460,7 @@ void TCMalloc_PageHeap::init()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
   free_committed_pages_ = 0;
-  pages_committed_since_last_scavenge_ = 0;
+  min_free_committed_pages_since_last_scavenge_ = 0;
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 
   scavenge_counter_ = 0;
@@ -1419,15 +1475,23 @@ void TCMalloc_PageHeap::init()
   }
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  initializeScavenger();
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+}
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+
+#if !HAVE(DISPATCH_H)
+
+void TCMalloc_PageHeap::initializeScavenger()
+{
   pthread_mutex_init(&m_scavengeMutex, 0);
   pthread_cond_init(&m_scavengeCondition, 0);
   m_scavengeThreadActive = true;
   pthread_t thread;
   pthread_create(&thread, 0, runScavengerThread, this);
-#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 }
 
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 void* TCMalloc_PageHeap::runScavengerThread(void* context)
 {
   static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
@@ -1437,42 +1501,60 @@ void* TCMalloc_PageHeap::runScavengerThread(void* context)
 #endif
 }
 
-void TCMalloc_PageHeap::scavenge() 
+ALWAYS_INLINE void TCMalloc_PageHeap::signalScavenger()
 {
-    // If we have to commit memory in the last 5 seconds, it means we don't have enough free committed pages
-    // for the amount of allocations that we do.  So hold off on releasing memory back to the system.
-    if (pages_committed_since_last_scavenge_ > 0) {
-        pages_committed_since_last_scavenge_ = 0;
-        return;
-    }
-    Length pagesDecommitted = 0;
-    for (int i = kMaxPages; i >= 0; i--) {
+  if (!m_scavengeThreadActive && shouldScavenge())
+    pthread_cond_signal(&m_scavengeCondition);
+}
+
+#else // !HAVE(DISPATCH_H)
+
+void TCMalloc_PageHeap::initializeScavenger()
+{
+  m_scavengeQueue = dispatch_queue_create("com.apple.JavaScriptCore.FastMallocSavenger", NULL);
+  m_scavengeTimer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, m_scavengeQueue);
+  dispatch_time_t startTime = dispatch_time(DISPATCH_TIME_NOW, kScavengeDelayInSeconds * NSEC_PER_SEC);
+  dispatch_source_set_timer(m_scavengeTimer, startTime, kScavengeDelayInSeconds * NSEC_PER_SEC, 1000 * NSEC_PER_USEC);
+  dispatch_source_set_event_handler(m_scavengeTimer, ^{ periodicScavenge(); });
+  m_scavengingScheduled = false;
+}
+
+ALWAYS_INLINE void TCMalloc_PageHeap::signalScavenger()
+{
+  if (!m_scavengingScheduled && shouldScavenge()) {
+    m_scavengingScheduled = true;
+    dispatch_resume(m_scavengeTimer);
+  }
+}
+
+#endif
+
+void TCMalloc_PageHeap::scavenge()
+{
+    size_t pagesToRelease = min_free_committed_pages_since_last_scavenge_ * kScavengePercentage;
+    size_t targetPageCount = std::max<size_t>(kMinimumFreeCommittedPageCount, free_committed_pages_ - pagesToRelease);
+
+    for (int i = kMaxPages; i >= 0 && free_committed_pages_ > targetPageCount; i--) {
         SpanList* slist = (static_cast<size_t>(i) == kMaxPages) ? &large_ : &free_[i];
-        if (!DLL_IsEmpty(&slist->normal)) {
-            // Release the last span on the normal portion of this list
+        while (!DLL_IsEmpty(&slist->normal) && free_committed_pages_ > targetPageCount) {
             Span* s = slist->normal.prev; 
-            // Only decommit up to a fraction of the free committed pages if pages_allocated_since_last_scavenge_ > 0.
-            if ((pagesDecommitted + s->length) * kMaxScavengeAmountFactor > free_committed_pages_)
-                continue;
             DLL_Remove(s);
-            TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
-                                   static_cast<size_t>(s->length << kPageShift));
+            ASSERT(!s->decommitted);
             if (!s->decommitted) {
-                pagesDecommitted += s->length;
+                TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
+                                       static_cast<size_t>(s->length << kPageShift));
+                ASSERT(free_committed_pages_ >= s->length);
+                free_committed_pages_ -= s->length;
                 s->decommitted = true;
             }
             DLL_Prepend(&slist->returned, s);
-            // We can stop scavenging if the number of free committed pages left is less than or equal to the minimum number we want to keep around.
-            if (free_committed_pages_ <= kMinimumFreeCommittedPageCount + pagesDecommitted)
-                break;
         }
     }
-    pages_committed_since_last_scavenge_ = 0;
-    ASSERT(free_committed_pages_ >= pagesDecommitted);
-    free_committed_pages_ -= pagesDecommitted;
+
+    min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
 }
 
-inline bool TCMalloc_PageHeap::shouldContinueScavenging() const 
+ALWAYS_INLINE bool TCMalloc_PageHeap::shouldScavenge() const 
 {
     return free_committed_pages_ > kMinimumFreeCommittedPageCount; 
 }
@@ -1504,9 +1586,6 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
     if (result->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(result->start << kPageShift), static_cast<size_t>(n << kPageShift));
         result->decommitted = false;
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-        pages_committed_since_last_scavenge_ += n;
-#endif
     }
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     else {
@@ -1514,6 +1593,8 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
         // free committed pages count.
         ASSERT(free_committed_pages_ >= n);
         free_committed_pages_ -= n;
+        if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
     }
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
@@ -1575,9 +1656,6 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
     if (best->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(best->start << kPageShift), static_cast<size_t>(n << kPageShift));
         best->decommitted = false;
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-        pages_committed_since_last_scavenge_ += n;
-#endif
     }
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     else {
@@ -1585,6 +1663,8 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
         // free committed pages count.
         ASSERT(free_committed_pages_ >= n);
         free_committed_pages_ -= n;
+        if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
     }
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
@@ -1728,14 +1808,15 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
       // If the merged span is decommitted, that means we decommitted any neighboring spans that were
       // committed.  Update the free committed pages count.
       free_committed_pages_ -= neighboringCommittedSpansLength;
+      if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
   } else {
       // If the merged span remains committed, add the deleted span's size to the free committed pages count.
       free_committed_pages_ += n;
   }
 
   // Make sure the scavenge thread becomes active if we have enough freed pages to release some back to the system.
-  if (!m_scavengeThreadActive && shouldContinueScavenging())
-      pthread_cond_signal(&m_scavengeCondition);
+  signalScavenger();
 #else
   IncrementalScavenge(n);
 #endif
@@ -1893,10 +1974,6 @@ bool TCMalloc_PageHeap::GrowHeap(Length n) {
   }
   ask = actual_size >> kPageShift;
 
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-  pages_committed_since_last_scavenge_ += ask;
-#endif
-
   uint64_t old_system_bytes = system_bytes_;
   system_bytes_ += (ask << kPageShift);
   const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
@@ -2278,7 +2355,9 @@ static inline TCMalloc_PageHeap* getPageHeap()
 #define pageheap getPageHeap()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-#if PLATFORM(WIN_OS)
+
+#if !HAVE(DISPATCH_H)
+#if OS(WINDOWS)
 static void sleep(unsigned seconds)
 {
     ::Sleep(seconds * 1000);
@@ -2292,21 +2371,38 @@ void TCMalloc_PageHeap::scavengerThread()
 #endif
 
   while (1) {
-      if (!shouldContinueScavenging()) {
+      if (!shouldScavenge()) {
           pthread_mutex_lock(&m_scavengeMutex);
           m_scavengeThreadActive = false;
-          // Block until there are enough freed pages to release back to the system.
+          // Block until there are enough free committed pages to release back to the system.
           pthread_cond_wait(&m_scavengeCondition, &m_scavengeMutex);
           m_scavengeThreadActive = true;
           pthread_mutex_unlock(&m_scavengeMutex);
       }
-      sleep(kScavengeTimerDelayInSeconds);
+      sleep(kScavengeDelayInSeconds);
       {
           SpinLockHolder h(&pageheap_lock);
           pageheap->scavenge();
       }
   }
 }
+
+#else
+
+void TCMalloc_PageHeap::periodicScavenge()
+{
+  {
+    SpinLockHolder h(&pageheap_lock);
+    pageheap->scavenge();
+  }
+
+  if (!shouldScavenge()) {
+    m_scavengingScheduled = false;
+    dispatch_suspend(m_scavengeTimer);
+  }
+}
+#endif // HAVE(DISPATCH_H)
+
 #endif
 
 // If TLS is available, we also store a copy
@@ -2816,7 +2912,7 @@ void TCMalloc_ThreadCache::InitModule() {
     }
     pageheap->init();
     phinited = 1;
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
     FastMallocZone::init();
 #endif
   }
@@ -3795,7 +3891,7 @@ void* realloc(void* old_ptr, size_t new_size) {
     return new_ptr;
   } else {
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    old_ptr = pByte + sizeof(AllocAlignmentInteger);  // Set old_ptr back to the user pointer.
+    old_ptr = static_cast<AllocAlignmentInteger*>(old_ptr) + 1; // Set old_ptr back to the user pointer.
 #endif
     return old_ptr;
   }
@@ -3845,6 +3941,8 @@ static inline void* cpp_alloc(size_t size, bool nothrow) {
   }
 }
 
+#if ENABLE(GLOBAL_FASTMALLOC_NEW)
+
 void* operator new(size_t size) {
   void* p = cpp_alloc(size, false);
   // We keep this next instruction out of cpp_alloc for a reason: when
@@ -3899,6 +3997,8 @@ void operator delete[](void* p, const std::nothrow_t&) __THROW {
   do_free(p);
 }
 
+#endif
+
 extern "C" void* memalign(size_t align, size_t size) __THROW {
   void* result = do_memalign(align, size);
   MallocHook::InvokeNewHook(result, size);
@@ -4014,7 +4114,62 @@ void *(*__memalign_hook)(size_t, size_t, const void *) = MemalignOverride;
 
 #endif
 
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#ifdef WTF_CHANGES
+void releaseFastMallocFreeMemory()
+{
+    // Flush free pages in the current thread cache back to the page heap.
+    // Low watermark mechanism in Scavenge() prevents full return on the first pass.
+    // The second pass flushes everything.
+    if (TCMalloc_ThreadCache* threadCache = TCMalloc_ThreadCache::GetCacheIfPresent()) {
+        threadCache->Scavenge();
+        threadCache->Scavenge();
+    }
+
+    SpinLockHolder h(&pageheap_lock);
+    pageheap->ReleaseFreePages();
+}
+    
+FastMallocStatistics fastMallocStatistics()
+{
+    FastMallocStatistics statistics;
+
+    SpinLockHolder lockHolder(&pageheap_lock);
+    statistics.reservedVMBytes = static_cast<size_t>(pageheap->SystemBytes());
+    statistics.committedVMBytes = statistics.reservedVMBytes - pageheap->ReturnedBytes();
+
+    statistics.freeListBytes = 0;
+    for (unsigned cl = 0; cl < kNumClasses; ++cl) {
+        const int length = central_cache[cl].length();
+        const int tc_length = central_cache[cl].tc_length();
+
+        statistics.freeListBytes += ByteSizeForClass(cl) * (length + tc_length);
+    }
+    for (TCMalloc_ThreadCache* threadCache = thread_heaps; threadCache ; threadCache = threadCache->next_)
+        statistics.freeListBytes += threadCache->Size();
+
+    return statistics;
+}
+
+size_t fastMallocSize(const void* ptr)
+{
+    const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
+    Span* span = pageheap->GetDescriptorEnsureSafe(p);
+
+    if (!span || span->free)
+        return 0;
+
+    for (void* free = span->objects; free != NULL; free = *((void**) free)) {
+        if (ptr == free)
+            return 0;
+    }
+
+    if (size_t cl = span->sizeclass)
+        return ByteSizeForClass(cl);
+
+    return span->length << kPageShift;
+}
+
+#if OS(DARWIN)
 
 class FreeObjectFinder {
     const RemoteMemoryReader& m_reader;
@@ -4297,7 +4452,7 @@ extern "C" {
 malloc_introspection_t jscore_fastmalloc_introspection = { &FastMallocZone::enumerate, &FastMallocZone::goodSize, &FastMallocZone::check, &FastMallocZone::print,
     &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IPHONE_OS)
     , 0 // zone_locked will not be called on the zone unless it advertises itself as version five or higher.
 #endif
 
@@ -4331,44 +4486,9 @@ void FastMallocZone::init()
     static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache), &span_allocator, &threadheap_allocator);
 }
 
-#endif
-
-#if WTF_CHANGES
-void releaseFastMallocFreeMemory()
-{
-    // Flush free pages in the current thread cache back to the page heap.
-    // Low watermark mechanism in Scavenge() prevents full return on the first pass.
-    // The second pass flushes everything.
-    if (TCMalloc_ThreadCache* threadCache = TCMalloc_ThreadCache::GetCacheIfPresent()) {
-        threadCache->Scavenge();
-        threadCache->Scavenge();
-    }
-
-    SpinLockHolder h(&pageheap_lock);
-    pageheap->ReleaseFreePages();
-}
-    
-FastMallocStatistics fastMallocStatistics()
-{
-    FastMallocStatistics statistics;
-    {
-        SpinLockHolder lockHolder(&pageheap_lock);
-        statistics.heapSize = static_cast<size_t>(pageheap->SystemBytes());
-        statistics.freeSizeInHeap = static_cast<size_t>(pageheap->FreeBytes());
-        statistics.returnedSize = pageheap->ReturnedBytes();
-        statistics.freeSizeInCaches = 0;
-        for (TCMalloc_ThreadCache* threadCache = thread_heaps; threadCache ; threadCache = threadCache->next_)
-            statistics.freeSizeInCaches += threadCache->Size();
-    }
-    for (unsigned cl = 0; cl < kNumClasses; ++cl) {
-        const int length = central_cache[cl].length();
-        const int tc_length = central_cache[cl].tc_length();
-        statistics.freeSizeInCaches += ByteSizeForClass(cl) * (length + tc_length);
-    }
-    return statistics;
-}
+#endif // OS(DARWIN)
 
 } // namespace WTF
-#endif
+#endif // WTF_CHANGES
 
 #endif // FORCE_SYSTEM_MALLOC
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index 541b05d..9f82275 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -26,19 +26,15 @@
 #include <stdlib.h>
 #include <new>
 
-#if COMPILER(GCC)
-#define WTF_FAST_MALLOC_EXPORT __attribute__((visibility("default")))
-#else
-#define WTF_FAST_MALLOC_EXPORT
-#endif
-
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastMalloc(size_t);
     void* fastZeroedMalloc(size_t);
-    void* fastCalloc(size_t numElements, size_t elementSize) WTF_FAST_MALLOC_EXPORT;
-    void* fastRealloc(void*, size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastCalloc(size_t numElements, size_t elementSize);
+    void* fastRealloc(void*, size_t);
+    char* fastStrDup(const char*);
+    size_t fastMallocSize(const void*);
 
     struct TryMallocReturnValue {
         TryMallocReturnValue(void* data)
@@ -77,7 +73,7 @@ namespace WTF {
     TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
     TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void*) WTF_FAST_MALLOC_EXPORT;
+    void fastFree(void*);
 
 #ifndef NDEBUG    
     void fastMallocForbid();
@@ -87,10 +83,9 @@ namespace WTF {
     void releaseFastMallocFreeMemory();
     
     struct FastMallocStatistics {
-        size_t heapSize;
-        size_t freeSizeInHeap;
-        size_t freeSizeInCaches;
-        size_t returnedSize;
+        size_t reservedVMBytes;
+        size_t committedVMBytes;
+        size_t freeListBytes;
     };
     FastMallocStatistics fastMallocStatistics();
 
@@ -194,17 +189,18 @@ using WTF::tryFastZeroedMalloc;
 using WTF::tryFastCalloc;
 using WTF::tryFastRealloc;
 using WTF::fastFree;
+using WTF::fastStrDup;
 
 #ifndef NDEBUG    
 using WTF::fastMallocForbid;
 using WTF::fastMallocAllow;
 #endif
 
-#if COMPILER(GCC) && PLATFORM(DARWIN)
+#if COMPILER(GCC) && OS(DARWIN)
 #define WTF_PRIVATE_INLINE __private_extern__ inline __attribute__((always_inline))
 #elif COMPILER(GCC)
 #define WTF_PRIVATE_INLINE inline __attribute__((always_inline))
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) || COMPILER(RVCT)
 #define WTF_PRIVATE_INLINE __forceinline
 #else
 #define WTF_PRIVATE_INLINE inline
@@ -219,17 +215,23 @@ using WTF::fastMallocAllow;
 // debug-only code to make sure we don't use the system malloc via the default operator
 // new by accident.
 
-// We musn't customize the global operator new and delete for the Qt port.
-#if !PLATFORM(QT)
+#if ENABLE(GLOBAL_FASTMALLOC_NEW)
 
-WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4290) // Disable the C++ exception specification ignored warning.
+#endif
+WTF_PRIVATE_INLINE void* operator new(size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete(void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete(void* p, const std::nothrow_t&) throw() { fastFree(p); }
-WTF_PRIVATE_INLINE void* operator new[](size_t size) { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void* operator new[](size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new[](size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete[](void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete[](void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw() { fastFree(p); }
+#if COMPILER(MSVC)
+#pragma warning(pop)
+#endif
 
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
deleted file mode 100644
index 432885f..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2008 Collabora Ltd.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "GOwnPtr.h"
-
-namespace WTF {
-
-template <> void freeOwnedGPtr<GError>(GError* ptr)
-{
-    if (ptr)
-        g_error_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GList>(GList* ptr)
-{
-    g_list_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GCond>(GCond* ptr)
-{
-    if (ptr)
-        g_cond_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GMutex>(GMutex* ptr)
-{
-    if (ptr)
-        g_mutex_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GPatternSpec>(GPatternSpec* ptr)
-{
-    if (ptr)
-        g_pattern_spec_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GDir>(GDir* ptr)
-{
-    if (ptr)
-        g_dir_close(ptr);
-}
-
-template <> void freeOwnedGPtr<GHashTable>(GHashTable* ptr)
-{
-    if (ptr)
-        g_hash_table_unref(ptr);
-}
-
-} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
deleted file mode 100644
index 4993348..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- *  Copyright (C) 2008 Collabora Ltd.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef GOwnPtr_h
-#define GOwnPtr_h
-
-#include <algorithm>
-#include <glib.h>
-#include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
-
-namespace WTF {
-    template <typename T> inline void freeOwnedGPtr(T* ptr) { g_free(reinterpret_cast<void*>(ptr)); }
-    template<> void freeOwnedGPtr<GError>(GError*);
-    template<> void freeOwnedGPtr<GList>(GList*);
-    template<> void freeOwnedGPtr<GCond>(GCond*);
-    template<> void freeOwnedGPtr<GMutex>(GMutex*);
-    template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
-    template<> void freeOwnedGPtr<GDir>(GDir*);
-    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
-
-    template <typename T> class GOwnPtr : public Noncopyable {
-    public:
-        explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
-        ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
-
-        T* get() const { return m_ptr; }
-        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
-        T*& outPtr() { ASSERT(!m_ptr); return m_ptr; }
-
-        void set(T* ptr) { ASSERT(!ptr || m_ptr != ptr); freeOwnedGPtr(m_ptr); m_ptr = ptr; }
-        void clear() { freeOwnedGPtr(m_ptr); m_ptr = 0; }
-
-        T& operator*() const { ASSERT(m_ptr); return *m_ptr; }
-        T* operator->() const { ASSERT(m_ptr); return m_ptr; }
-
-        bool operator!() const { return !m_ptr; }
-
-        // This conversion operator allows implicit conversion to bool but not to other integer types.
-        typedef T* GOwnPtr::*UnspecifiedBoolType;
-        operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
-
-        void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
-
-    private:
-        T* m_ptr;
-    };
-    
-    template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b) { a.swap(b); }
-
-    template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
-    { 
-        return a.get() == b; 
-    }
-    
-    template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
-    {
-        return a == b.get(); 
-    }
-
-    template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
-    {
-        return a.get() != b; 
-    }
-
-    template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
-    { 
-        return a != b.get(); 
-    }
-    
-    template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
-    {
-        return p.get();
-    }
-
-} // namespace WTF
-
-using WTF::GOwnPtr;
-
-#endif // GOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
index 165eb41..4ed75c5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
@@ -43,7 +43,7 @@ namespace WTF {
         int capacity() const;
         bool isEmpty() const;
         
-        // iterators iterate over pairs of values and counts
+        // Iterators iterate over pairs of values and counts.
         iterator begin();
         iterator end();
         const_iterator begin() const;
@@ -54,21 +54,21 @@ namespace WTF {
         bool contains(const ValueType&) const;
         unsigned count(const ValueType&) const;
 
-        // increases the count if an equal value is already present
-        // the return value is a pair of an interator to the new value's location, 
-        // and a bool that is true if an new entry was added
+        // Increases the count if an equal value is already present
+        // the return value is a pair of an interator to the new value's 
+        // location, and a bool that is true if an new entry was added.
         std::pair<iterator, bool> add(const ValueType&);
         
-        // reduces the count of the value, and removes it if count
-        // goes down to zero
-        void remove(const ValueType&);
-        void remove(iterator);
+        // Reduces the count of the value, and removes it if count
+        // goes down to zero, returns true if the value is removed.
+        bool remove(const ValueType&);
+        bool remove(iterator);
  
-        // removes the value, regardless of its count
+        // Removes the value, regardless of its count.
         void removeAll(iterator);
         void removeAll(const ValueType&);
 
-        // clears the whole set
+        // Clears the whole set.
         void clear();
 
     private:
@@ -150,24 +150,27 @@ namespace WTF {
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::remove(const ValueType& value)
+    inline bool HashCountedSet<Value, HashFunctions, Traits>::remove(const ValueType& value)
     {
-        remove(find(value));
+        return remove(find(value));
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::remove(iterator it)
+    inline bool HashCountedSet<Value, HashFunctions, Traits>::remove(iterator it)
     {
         if (it == end())
-            return;
+            return false;
 
         unsigned oldVal = it->second;
-        ASSERT(oldVal != 0);
+        ASSERT(oldVal);
         unsigned newVal = oldVal - 1;
-        if (newVal == 0)
-            m_impl.remove(it);
-        else
+        if (newVal) {
             it->second = newVal;
+            return false;
+        }
+
+        m_impl.remove(it);
+        return true;
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
index 13afb72..2c66a2d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
@@ -173,9 +173,6 @@ namespace WTF {
     template<typename P> struct DefaultHash<RefPtr<P> > { typedef PtrHash<RefPtr<P> > Hash; };
 
     template<typename T, typename U> struct DefaultHash<std::pair<T, U> > { typedef PairHash<T, U> Hash; };
-    
-    // Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-    static const unsigned stringHashingStartValue = 0x9e3779b9U;
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index 3de5ee6..4631055 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -83,6 +83,25 @@ namespace WTF {
 
         MappedType take(const KeyType&); // efficient combination of get with remove
 
+        // An alternate version of find() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion. HashTranslator
+        // must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        template<typename TYPE, typename HashTranslator> iterator find(const TYPE&);
+        template<typename TYPE, typename HashTranslator> const_iterator find(const TYPE&) const;
+        template<typename TYPE, typename HashTranslator> bool contains(const TYPE&) const;
+
+        // An alternate version of add() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion if the object is already
+        // in the table. HashTranslator must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        //   static translate(ValueType&, const T&, unsigned hashCode);
+        template<typename TYPE, typename HashTranslator> pair<iterator, bool> add(const TYPE&, const MappedType&);
+
+        void checkConsistency() const;
+
     private:
         pair<iterator, bool> inlineAdd(const KeyType&, const MappedType&);
 
@@ -107,6 +126,20 @@ namespace WTF {
         }
     };
 
+    template<typename ValueType, typename ValueTraits, typename T, typename Translator>
+    struct HashMapTranslatorAdapter {
+        typedef typename ValueType::first_type KeyType;
+        typedef typename ValueType::second_type MappedType;
+
+        static unsigned hash(const T& key) { return Translator::hash(key); }
+        static bool equal(const KeyType& a, const T& b) { return Translator::equal(a, b); }
+        static void translate(ValueType& location, const T& key, const MappedType& mapped, unsigned hashCode)
+        {
+            Translator::translate(location.first, key, hashCode);
+            location.second = mapped;
+        }
+    };
+
     template<typename T, typename U, typename V, typename W, typename X>
     inline void HashMap<T, U, V, W, X>::swap(HashMap& other)
     {
@@ -174,6 +207,33 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::iterator
+    HashMap<T, U, V, W, X>::find(const TYPE& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::const_iterator 
+    HashMap<T, U, V, W, X>::find(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline bool
+    HashMap<T, U, V, W, X>::contains(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template contains<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     inline pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
     {
@@ -194,6 +254,15 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    pair<typename HashMap<T, U, V, W, X>::iterator, bool>
+    HashMap<T, U, V, W, X>::add(const TYPE& key, const MappedType& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template addPassingHashCode<TYPE, MappedType, Adapter>(key, value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::add(const KeyType& key, const MappedType& mapped)
     {
@@ -215,7 +284,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
@@ -245,6 +314,13 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    inline void HashMap<T, U, V, W, X>::checkConsistency() const
+    {
+        m_impl.checkTableConsistency();
+    }
+
+
+    template<typename T, typename U, typename V, typename W, typename X>
     bool operator==(const HashMap<T, U, V, W, X>& a, const HashMap<T, U, V, W, X>& b)
     {
         if (a.size() != b.size())
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
index f4e2cf7..4429490 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
@@ -81,7 +81,7 @@ namespace WTF {
 
         // An alternate version of add() that finds the object by hashing and comparing
         // with some other type, to avoid the cost of type conversion if the object is already
-        // in the table. HashTranslator must have the following methods:
+        // in the table. HashTranslator must have the following function members:
         //   static unsigned hash(const T&);
         //   static bool equal(const ValueType&, const T&);
         //   static translate(ValueType&, const T&, unsigned hashCode);
@@ -224,7 +224,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
index 3b283f8..ceb8963 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
@@ -24,12 +24,14 @@
 
 #include "FastMalloc.h"
 #include "HashTraits.h"
+#include "ValueCheck.h"
 #include <wtf/Assertions.h>
 #include <wtf/Threading.h>
 
 namespace WTF {
 
 #define DUMP_HASHTABLE_STATS 0
+// Enables internal WTF consistency checks that are invoked automatically. Non-WTF callers can call checkTableConsistency() even if internal checks are disabled.
 #define CHECK_HASHTABLE_CONSISTENCY 0
 
 #ifdef NDEBUG
@@ -197,7 +199,7 @@ namespace WTF {
         void checkValidity(const const_iterator& other) const
         {
             ASSERT(m_table);
-            ASSERT(other.m_table);
+            ASSERT_UNUSED(other, other.m_table);
             ASSERT(m_table == other.m_table);
         }
 #else
@@ -340,11 +342,18 @@ namespace WTF {
         ValueType* lookup(const Key& key) { return lookup<Key, IdentityTranslatorType>(key); }
         template<typename T, typename HashTranslator> ValueType* lookup(const T&);
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
         void checkTableConsistency() const;
 #else
         static void checkTableConsistency() { }
 #endif
+#if CHECK_HASHTABLE_CONSISTENCY
+        void internalCheckTableConsistency() const { checkTableConsistency(); }
+        void internalCheckTableConsistencyExceptSize() const { checkTableConsistencyExceptSize(); }
+#else
+        static void internalCheckTableConsistencyExceptSize() { }
+        static void internalCheckTableConsistency() { }
+#endif
 
     private:
         static ValueType* allocateTable(int size);
@@ -383,7 +392,7 @@ namespace WTF {
         iterator makeKnownGoodIterator(ValueType* pos) { return iterator(this, pos, m_table + m_tableSize, HashItemKnownGood); }
         const_iterator makeKnownGoodConstIterator(ValueType* pos) const { return const_iterator(this, pos, m_table + m_tableSize, HashItemKnownGood); }
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
         void checkTableConsistencyExceptSize() const;
 #else
         static void checkTableConsistencyExceptSize() { }
@@ -624,7 +633,7 @@ namespace WTF {
         if (!m_table)
             expand();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         ASSERT(m_table);
 
@@ -693,7 +702,7 @@ namespace WTF {
             return p;
         }
         
-        checkTableConsistency();
+        internalCheckTableConsistency();
         
         return std::make_pair(makeKnownGoodIterator(entry), true);
     }
@@ -709,7 +718,7 @@ namespace WTF {
         if (!m_table)
             expand();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         FullLookupType lookupResult = fullLookupForWriting<T, HashTranslator>(key);
 
@@ -738,7 +747,7 @@ namespace WTF {
             return p;
         }
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         return std::make_pair(makeKnownGoodIterator(entry), true);
     }
@@ -805,7 +814,7 @@ namespace WTF {
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::removeAndInvalidate(ValueType* pos)
     {
         invalidateIterators();
-        checkTableConsistency();
+        internalCheckTableConsistency();
         remove(pos);
     }
 
@@ -823,7 +832,7 @@ namespace WTF {
         if (shouldShrink())
             shrink();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
@@ -892,7 +901,7 @@ namespace WTF {
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::rehash(int newTableSize)
     {
-        checkTableConsistencyExceptSize();
+        internalCheckTableConsistencyExceptSize();
 
         int oldTableSize = m_tableSize;
         ValueType* oldTable = m_table;
@@ -914,7 +923,7 @@ namespace WTF {
 
         deallocateTable(oldTable, oldTableSize);
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
@@ -981,13 +990,13 @@ namespace WTF {
         return *this;
     }
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkTableConsistency() const
     {
         checkTableConsistencyExceptSize();
-        ASSERT(!shouldExpand());
+        ASSERT(!m_table || !shouldExpand());
         ASSERT(!shouldShrink());
     }
 
@@ -1012,6 +1021,8 @@ namespace WTF {
             const_iterator it = find(Extractor::extract(*entry));
             ASSERT(entry == it.m_position);
             ++count;
+
+            ValueCheck<Key>::checkConsistency(it->first);
         }
 
         ASSERT(count == m_keyCount);
@@ -1021,7 +1032,7 @@ namespace WTF {
         ASSERT(m_tableSize == m_tableSizeMask + 1);
     }
 
-#endif // CHECK_HASHTABLE_CONSISTENCY
+#endif // ASSERT_DISABLED
 
 #if CHECK_HASHTABLE_ITERATORS
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
index 38cc998..09355ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
@@ -37,27 +37,27 @@ namespace WTF {
     // and an append that moves the element to the end even if already present,
     // but unclear yet if these are needed.
 
-    template<typename Value, typename HashFunctions> class ListHashSet;
+    template<typename Value, size_t inlineCapacity, typename HashFunctions> class ListHashSet;
 
     template<typename T> struct IdentityExtractor;
 
-    template<typename Value, typename HashFunctions>
-    void deleteAllValues(const ListHashSet<Value, HashFunctions>&);
+    template<typename Value, size_t inlineCapacity, typename HashFunctions>
+    void deleteAllValues(const ListHashSet<Value, inlineCapacity, HashFunctions>&);
 
-    template<typename ValueArg, typename HashArg> class ListHashSetIterator;
-    template<typename ValueArg, typename HashArg> class ListHashSetConstIterator;
+    template<typename ValueArg, size_t inlineCapacity, typename HashArg> class ListHashSetIterator;
+    template<typename ValueArg, size_t inlineCapacity, typename HashArg> class ListHashSetConstIterator;
 
-    template<typename ValueArg> struct ListHashSetNode;
-    template<typename ValueArg> struct ListHashSetNodeAllocator;
-    template<typename ValueArg, typename HashArg> struct ListHashSetNodeHashFunctions;
+    template<typename ValueArg, size_t inlineCapacity> struct ListHashSetNode;
+    template<typename ValueArg, size_t inlineCapacity> struct ListHashSetNodeAllocator;
+    template<typename ValueArg, size_t inlineCapacity, typename HashArg> struct ListHashSetNodeHashFunctions;
 
-    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet {
+    template<typename ValueArg, size_t inlineCapacity = 256, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet : public FastAllocBase {
     private:
-        typedef ListHashSetNode<ValueArg> Node;
-        typedef ListHashSetNodeAllocator<ValueArg> NodeAllocator;
+        typedef ListHashSetNode<ValueArg, inlineCapacity> Node;
+        typedef ListHashSetNodeAllocator<ValueArg, inlineCapacity> NodeAllocator;
 
         typedef HashTraits<Node*> NodeTraits;
-        typedef ListHashSetNodeHashFunctions<ValueArg, HashArg> NodeHash;
+        typedef ListHashSetNodeHashFunctions<ValueArg, inlineCapacity, HashArg> NodeHash;
 
         typedef HashTable<Node*, Node*, IdentityExtractor<Node*>, NodeHash, NodeTraits, NodeTraits> ImplType;
         typedef HashTableIterator<Node*, Node*, IdentityExtractor<Node*>, NodeHash, NodeTraits, NodeTraits> ImplTypeIterator;
@@ -67,10 +67,10 @@ namespace WTF {
 
     public:
         typedef ValueArg ValueType;
-        typedef ListHashSetIterator<ValueType, HashArg> iterator;
-        typedef ListHashSetConstIterator<ValueType, HashArg> const_iterator;
+        typedef ListHashSetIterator<ValueType, inlineCapacity, HashArg> iterator;
+        typedef ListHashSetConstIterator<ValueType, inlineCapacity, HashArg> const_iterator;
 
-        friend class ListHashSetConstIterator<ValueType, HashArg>;
+        friend class ListHashSetConstIterator<ValueType, inlineCapacity, HashArg>;
 
         ListHashSet();
         ListHashSet(const ListHashSet&);
@@ -119,9 +119,9 @@ namespace WTF {
         OwnPtr<NodeAllocator> m_allocator;
     };
 
-    template<typename ValueArg> struct ListHashSetNodeAllocator {
-        typedef ListHashSetNode<ValueArg> Node;
-        typedef ListHashSetNodeAllocator<ValueArg> NodeAllocator;
+    template<typename ValueArg, size_t inlineCapacity> struct ListHashSetNodeAllocator {
+        typedef ListHashSetNode<ValueArg, inlineCapacity> Node;
+        typedef ListHashSetNodeAllocator<ValueArg, inlineCapacity> NodeAllocator;
 
         ListHashSetNodeAllocator() 
             : m_freeList(pool())
@@ -181,15 +181,15 @@ namespace WTF {
 
         Node* m_freeList;
         bool m_isDoneWithInitialFreeList;
-        static const size_t m_poolSize = 256;
+        static const size_t m_poolSize = inlineCapacity;
         union {
             char pool[sizeof(Node) * m_poolSize];
             double forAlignment;
         } m_pool;
     };
 
-    template<typename ValueArg> struct ListHashSetNode {
-        typedef ListHashSetNodeAllocator<ValueArg> NodeAllocator;
+    template<typename ValueArg, size_t inlineCapacity> struct ListHashSetNode {
+        typedef ListHashSetNodeAllocator<ValueArg, inlineCapacity> NodeAllocator;
 
         ListHashSetNode(ValueArg value)
             : m_value(value)
@@ -220,25 +220,25 @@ namespace WTF {
 #endif
     };
 
-    template<typename ValueArg, typename HashArg> struct ListHashSetNodeHashFunctions {
-        typedef ListHashSetNode<ValueArg> Node;
+    template<typename ValueArg, size_t inlineCapacity, typename HashArg> struct ListHashSetNodeHashFunctions {
+        typedef ListHashSetNode<ValueArg, inlineCapacity> Node;
         
         static unsigned hash(Node* const& key) { return HashArg::hash(key->m_value); }
         static bool equal(Node* const& a, Node* const& b) { return HashArg::equal(a->m_value, b->m_value); }
         static const bool safeToCompareToEmptyOrDeleted = false;
     };
 
-    template<typename ValueArg, typename HashArg> class ListHashSetIterator {
+    template<typename ValueArg, size_t inlineCapacity, typename HashArg> class ListHashSetIterator {
     private:
-        typedef ListHashSet<ValueArg, HashArg> ListHashSetType;
-        typedef ListHashSetIterator<ValueArg, HashArg> iterator;
-        typedef ListHashSetConstIterator<ValueArg, HashArg> const_iterator;
-        typedef ListHashSetNode<ValueArg> Node;
+        typedef ListHashSet<ValueArg, inlineCapacity, HashArg> ListHashSetType;
+        typedef ListHashSetIterator<ValueArg, inlineCapacity, HashArg> iterator;
+        typedef ListHashSetConstIterator<ValueArg, inlineCapacity, HashArg> const_iterator;
+        typedef ListHashSetNode<ValueArg, inlineCapacity> Node;
         typedef ValueArg ValueType;
         typedef ValueType& ReferenceType;
         typedef ValueType* PointerType;
 
-        friend class ListHashSet<ValueArg, HashArg>;
+        friend class ListHashSet<ValueArg, inlineCapacity, HashArg>;
 
         ListHashSetIterator(const ListHashSetType* set, Node* position) : m_iterator(set, position) { }
 
@@ -271,18 +271,18 @@ namespace WTF {
         const_iterator m_iterator;
     };
 
-    template<typename ValueArg, typename HashArg> class ListHashSetConstIterator {
+    template<typename ValueArg, size_t inlineCapacity, typename HashArg> class ListHashSetConstIterator {
     private:
-        typedef ListHashSet<ValueArg, HashArg> ListHashSetType;
-        typedef ListHashSetIterator<ValueArg, HashArg> iterator;
-        typedef ListHashSetConstIterator<ValueArg, HashArg> const_iterator;
-        typedef ListHashSetNode<ValueArg> Node;
+        typedef ListHashSet<ValueArg, inlineCapacity, HashArg> ListHashSetType;
+        typedef ListHashSetIterator<ValueArg, inlineCapacity, HashArg> iterator;
+        typedef ListHashSetConstIterator<ValueArg, inlineCapacity, HashArg> const_iterator;
+        typedef ListHashSetNode<ValueArg, inlineCapacity> Node;
         typedef ValueArg ValueType;
         typedef const ValueType& ReferenceType;
         typedef const ValueType* PointerType;
 
-        friend class ListHashSet<ValueArg, HashArg>;
-        friend class ListHashSetIterator<ValueArg, HashArg>;
+        friend class ListHashSet<ValueArg, inlineCapacity, HashArg>;
+        friend class ListHashSetIterator<ValueArg, inlineCapacity, HashArg>;
 
         ListHashSetConstIterator(const ListHashSetType* set, Node* position)
             : m_set(set)
@@ -341,11 +341,11 @@ namespace WTF {
     };
 
 
-    template<typename ValueType, typename HashFunctions>
+    template<typename ValueType, size_t inlineCapacity, typename HashFunctions>
     struct ListHashSetTranslator {
     private:
-        typedef ListHashSetNode<ValueType> Node;
-        typedef ListHashSetNodeAllocator<ValueType> NodeAllocator;
+        typedef ListHashSetNode<ValueType, inlineCapacity> Node;
+        typedef ListHashSetNodeAllocator<ValueType, inlineCapacity> NodeAllocator;
     public:
         static unsigned hash(const ValueType& key) { return HashFunctions::hash(key); }
         static bool equal(Node* const& a, const ValueType& b) { return HashFunctions::equal(a->m_value, b); }
@@ -355,16 +355,16 @@ namespace WTF {
         }
     };
 
-    template<typename T, typename U>
-    inline ListHashSet<T, U>::ListHashSet()
+    template<typename T, size_t inlineCapacity, typename U>
+    inline ListHashSet<T, inlineCapacity, U>::ListHashSet()
         : m_head(0)
         , m_tail(0)
         , m_allocator(new NodeAllocator)
     {
     }
 
-    template<typename T, typename U>
-    inline ListHashSet<T, U>::ListHashSet(const ListHashSet& other)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline ListHashSet<T, inlineCapacity, U>::ListHashSet(const ListHashSet& other)
         : m_head(0)
         , m_tail(0)
         , m_allocator(new NodeAllocator)
@@ -374,16 +374,16 @@ namespace WTF {
             add(*it);
     }
 
-    template<typename T, typename U>
-    inline ListHashSet<T, U>& ListHashSet<T, U>::operator=(const ListHashSet& other)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline ListHashSet<T, inlineCapacity, U>& ListHashSet<T, inlineCapacity, U>::operator=(const ListHashSet& other)
     {
         ListHashSet tmp(other);
         swap(tmp);
         return *this;
     }
 
-    template<typename T, typename U>
-    inline void ListHashSet<T, U>::swap(ListHashSet& other)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline void ListHashSet<T, inlineCapacity, U>::swap(ListHashSet& other)
     {
         m_impl.swap(other.m_impl);
         std::swap(m_head, other.m_head);
@@ -391,95 +391,95 @@ namespace WTF {
         m_allocator.swap(other.m_allocator);
     }
 
-    template<typename T, typename U>
-    inline ListHashSet<T, U>::~ListHashSet()
+    template<typename T, size_t inlineCapacity, typename U>
+    inline ListHashSet<T, inlineCapacity, U>::~ListHashSet()
     {
         deleteAllNodes();
     }
 
-    template<typename T, typename U>
-    inline int ListHashSet<T, U>::size() const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline int ListHashSet<T, inlineCapacity, U>::size() const
     {
         return m_impl.size(); 
     }
 
-    template<typename T, typename U>
-    inline int ListHashSet<T, U>::capacity() const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline int ListHashSet<T, inlineCapacity, U>::capacity() const
     {
         return m_impl.capacity(); 
     }
 
-    template<typename T, typename U>
-    inline bool ListHashSet<T, U>::isEmpty() const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline bool ListHashSet<T, inlineCapacity, U>::isEmpty() const
     {
         return m_impl.isEmpty(); 
     }
 
-    template<typename T, typename U>
-    inline typename ListHashSet<T, U>::iterator ListHashSet<T, U>::begin()
+    template<typename T, size_t inlineCapacity, typename U>
+    inline typename ListHashSet<T, inlineCapacity, U>::iterator ListHashSet<T, inlineCapacity, U>::begin()
     {
         return makeIterator(m_head); 
     }
 
-    template<typename T, typename U>
-    inline typename ListHashSet<T, U>::iterator ListHashSet<T, U>::end()
+    template<typename T, size_t inlineCapacity, typename U>
+    inline typename ListHashSet<T, inlineCapacity, U>::iterator ListHashSet<T, inlineCapacity, U>::end()
     {
         return makeIterator(0);
     }
 
-    template<typename T, typename U>
-    inline typename ListHashSet<T, U>::const_iterator ListHashSet<T, U>::begin() const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline typename ListHashSet<T, inlineCapacity, U>::const_iterator ListHashSet<T, inlineCapacity, U>::begin() const
     {
         return makeConstIterator(m_head); 
     }
 
-    template<typename T, typename U>
-    inline typename ListHashSet<T, U>::const_iterator ListHashSet<T, U>::end() const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline typename ListHashSet<T, inlineCapacity, U>::const_iterator ListHashSet<T, inlineCapacity, U>::end() const
     {
         return makeConstIterator(0); 
     }
 
-    template<typename T, typename U>
-    inline typename ListHashSet<T, U>::iterator ListHashSet<T, U>::find(const ValueType& value)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline typename ListHashSet<T, inlineCapacity, U>::iterator ListHashSet<T, inlineCapacity, U>::find(const ValueType& value)
     {
-        typedef ListHashSetTranslator<ValueType, HashFunctions> Translator;
+        typedef ListHashSetTranslator<ValueType, inlineCapacity, HashFunctions> Translator;
         ImplTypeIterator it = m_impl.template find<ValueType, Translator>(value);
         if (it == m_impl.end())
             return end();
         return makeIterator(*it); 
     }
 
-    template<typename T, typename U>
-    inline typename ListHashSet<T, U>::const_iterator ListHashSet<T, U>::find(const ValueType& value) const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline typename ListHashSet<T, inlineCapacity, U>::const_iterator ListHashSet<T, inlineCapacity, U>::find(const ValueType& value) const
     {
-        typedef ListHashSetTranslator<ValueType, HashFunctions> Translator;
+        typedef ListHashSetTranslator<ValueType, inlineCapacity, HashFunctions> Translator;
         ImplTypeConstIterator it = m_impl.template find<ValueType, Translator>(value);
         if (it == m_impl.end())
             return end();
         return makeConstIterator(*it);
     }
 
-    template<typename T, typename U>
-    inline bool ListHashSet<T, U>::contains(const ValueType& value) const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline bool ListHashSet<T, inlineCapacity, U>::contains(const ValueType& value) const
     {
-        typedef ListHashSetTranslator<ValueType, HashFunctions> Translator;
+        typedef ListHashSetTranslator<ValueType, inlineCapacity, HashFunctions> Translator;
         return m_impl.template contains<ValueType, Translator>(value);
     }
 
-    template<typename T, typename U>
-    pair<typename ListHashSet<T, U>::iterator, bool> ListHashSet<T, U>::add(const ValueType &value)
+    template<typename T, size_t inlineCapacity, typename U>
+    pair<typename ListHashSet<T, inlineCapacity, U>::iterator, bool> ListHashSet<T, inlineCapacity, U>::add(const ValueType &value)
     {
-        typedef ListHashSetTranslator<ValueType, HashFunctions> Translator;
+        typedef ListHashSetTranslator<ValueType, inlineCapacity, HashFunctions> Translator;
         pair<typename ImplType::iterator, bool> result = m_impl.template add<ValueType, NodeAllocator*, Translator>(value, m_allocator.get());
         if (result.second)
             appendNode(*result.first);
         return std::make_pair(makeIterator(*result.first), result.second);
     }
 
-    template<typename T, typename U>
-    pair<typename ListHashSet<T, U>::iterator, bool> ListHashSet<T, U>::insertBefore(iterator it, const ValueType& newValue)
+    template<typename T, size_t inlineCapacity, typename U>
+    pair<typename ListHashSet<T, inlineCapacity, U>::iterator, bool> ListHashSet<T, inlineCapacity, U>::insertBefore(iterator it, const ValueType& newValue)
     {
-        typedef ListHashSetTranslator<ValueType, HashFunctions> Translator;
+        typedef ListHashSetTranslator<ValueType, inlineCapacity, HashFunctions> Translator;
         pair<typename ImplType::iterator, bool> result = m_impl.template add<ValueType, NodeAllocator*, Translator>(newValue, m_allocator.get());
         if (result.second)
             insertNodeBefore(it.node(), *result.first);
@@ -487,14 +487,14 @@ namespace WTF {
 
     }
 
-    template<typename T, typename U>
-    pair<typename ListHashSet<T, U>::iterator, bool> ListHashSet<T, U>::insertBefore(const ValueType& beforeValue, const ValueType& newValue)
+    template<typename T, size_t inlineCapacity, typename U>
+    pair<typename ListHashSet<T, inlineCapacity, U>::iterator, bool> ListHashSet<T, inlineCapacity, U>::insertBefore(const ValueType& beforeValue, const ValueType& newValue)
     {
         return insertBefore(find(beforeValue), newValue); 
     }
 
-    template<typename T, typename U>
-    inline void ListHashSet<T, U>::remove(iterator it)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline void ListHashSet<T, inlineCapacity, U>::remove(iterator it)
     {
         if (it == end())
             return;
@@ -502,14 +502,14 @@ namespace WTF {
         unlinkAndDelete(it.node());
     }
 
-    template<typename T, typename U>
-    inline void ListHashSet<T, U>::remove(const ValueType& value)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline void ListHashSet<T, inlineCapacity, U>::remove(const ValueType& value)
     {
         remove(find(value));
     }
 
-    template<typename T, typename U>
-    inline void ListHashSet<T, U>::clear()
+    template<typename T, size_t inlineCapacity, typename U>
+    inline void ListHashSet<T, inlineCapacity, U>::clear()
     {
         deleteAllNodes();
         m_impl.clear(); 
@@ -517,8 +517,8 @@ namespace WTF {
         m_tail = 0;
     }
 
-    template<typename T, typename U>
-    void ListHashSet<T, U>::unlinkAndDelete(Node* node)
+    template<typename T, size_t inlineCapacity, typename U>
+    void ListHashSet<T, inlineCapacity, U>::unlinkAndDelete(Node* node)
     {
         if (!node->m_prev) {
             ASSERT(node == m_head);
@@ -539,8 +539,8 @@ namespace WTF {
         node->destroy(m_allocator.get());
     }
 
-    template<typename T, typename U>
-    void ListHashSet<T, U>::appendNode(Node* node)
+    template<typename T, size_t inlineCapacity, typename U>
+    void ListHashSet<T, inlineCapacity, U>::appendNode(Node* node)
     {
         node->m_prev = m_tail;
         node->m_next = 0;
@@ -556,8 +556,8 @@ namespace WTF {
         m_tail = node;
     }
 
-    template<typename T, typename U>
-    void ListHashSet<T, U>::insertNodeBefore(Node* beforeNode, Node* newNode)
+    template<typename T, size_t inlineCapacity, typename U>
+    void ListHashSet<T, inlineCapacity, U>::insertNodeBefore(Node* beforeNode, Node* newNode)
     {
         if (!beforeNode)
             return appendNode(newNode);
@@ -572,8 +572,8 @@ namespace WTF {
             m_head = newNode;
     }
 
-    template<typename T, typename U>
-    void ListHashSet<T, U>::deleteAllNodes()
+    template<typename T, size_t inlineCapacity, typename U>
+    void ListHashSet<T, inlineCapacity, U>::deleteAllNodes()
     {
         if (!m_head)
             return;
@@ -582,16 +582,16 @@ namespace WTF {
             node->destroy(m_allocator.get());
     }
 
-    template<typename T, typename U>
-    inline ListHashSetIterator<T, U> ListHashSet<T, U>::makeIterator(Node* position) 
+    template<typename T, size_t inlineCapacity, typename U>
+    inline ListHashSetIterator<T, inlineCapacity, U> ListHashSet<T, inlineCapacity, U>::makeIterator(Node* position) 
     {
-        return ListHashSetIterator<T, U>(this, position); 
+        return ListHashSetIterator<T, inlineCapacity, U>(this, position); 
     }
 
-    template<typename T, typename U>
-    inline ListHashSetConstIterator<T, U> ListHashSet<T, U>::makeConstIterator(Node* position) const
+    template<typename T, size_t inlineCapacity, typename U>
+    inline ListHashSetConstIterator<T, inlineCapacity, U> ListHashSet<T, inlineCapacity, U>::makeConstIterator(Node* position) const
     { 
-        return ListHashSetConstIterator<T, U>(this, position); 
+        return ListHashSetConstIterator<T, inlineCapacity, U>(this, position); 
     }
 
     template<bool, typename ValueType, typename HashTableType>
@@ -603,10 +603,10 @@ namespace WTF {
             delete (*it)->m_value;
     }
 
-    template<typename T, typename U>
-    inline void deleteAllValues(const ListHashSet<T, U>& collection)
+    template<typename T, size_t inlineCapacity, typename U>
+    inline void deleteAllValues(const ListHashSet<T, inlineCapacity, U>& collection)
     {
-        deleteAllValues<true, typename ListHashSet<T, U>::ValueType>(collection.m_impl);
+        deleteAllValues<true, typename ListHashSet<T, inlineCapacity, U>::ValueType>(collection.m_impl);
     }
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
index e999094..40a4ae5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
@@ -39,10 +39,12 @@ namespace WTF {
 struct FunctionWithContext {
     MainThreadFunction* function;
     void* context;
+    ThreadCondition* syncFlag;
 
-    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0)
+    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0, ThreadCondition* syncFlag = 0)
         : function(function)
         , context(context)
+        , syncFlag(syncFlag)
     { 
     }
 };
@@ -92,6 +94,8 @@ void dispatchFunctionsFromMainThread()
         }
 
         invocation.function(invocation.context);
+        if (invocation.syncFlag)
+            invocation.syncFlag->signal();
 
         // If we are running accumulated functions for too long so UI may become unresponsive, we need to
         // yield so the user input can be processed. Otherwise user may not be able to even close the window.
@@ -117,6 +121,24 @@ void callOnMainThread(MainThreadFunction* function, void* context)
         scheduleDispatchFunctionsOnMainThread();
 }
 
+void callOnMainThreadAndWait(MainThreadFunction* function, void* context)
+{
+    ASSERT(function);
+
+    if (isMainThread()) {
+        function(context);
+        return;
+    }
+
+    ThreadCondition syncFlag;
+    Mutex& functionQueueMutex = mainThreadFunctionQueueMutex();
+    MutexLocker locker(functionQueueMutex);
+    functionQueue().append(FunctionWithContext(function, context, &syncFlag));
+    if (functionQueue().size() == 1)
+        scheduleDispatchFunctionsOnMainThread();
+    syncFlag.wait(functionQueueMutex);
+}
+
 void setMainThreadCallbacksPaused(bool paused)
 {
     ASSERT(isMainThread());
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
index 01ce804..8c0275b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
@@ -38,6 +38,9 @@ typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
 
+// Blocks the thread until the call finishes on the main thread. Misusing this can easily cause deadlocks.
+void callOnMainThreadAndWait(MainThreadFunction*, void* context);
+
 void setMainThreadCallbacksPaused(bool paused);
 
 // Must be called from the main thread (Darwin is an exception to this rule).
@@ -52,6 +55,7 @@ void dispatchFunctionsFromMainThread();
 } // namespace WTF
 
 using WTF::callOnMainThread;
+using WTF::callOnMainThreadAndWait;
 using WTF::setMainThreadCallbacksPaused;
 
 #endif // MainThread_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
index 556230e..f8bace4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,28 +26,24 @@
 #ifndef WTF_MathExtras_h
 #define WTF_MathExtras_h
 
-#include <math.h>
+#include <cmath>
+#include <float.h>
 #include <stdlib.h>
 
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 #include <ieeefp.h>
 #endif
 
-#if PLATFORM(OPENBSD)
+#if OS(OPENBSD)
 #include <sys/types.h>
 #include <machine/ieee.h>
 #endif
 
 #if COMPILER(MSVC)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <stdlib.h>
 #endif
 #include <limits>
-
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 #endif
 
 #ifndef M_PI
@@ -66,7 +62,7 @@ const double piOverFourDouble = M_PI_4;
 const float piOverFourFloat = static_cast<float>(M_PI_4);
 #endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 // Work around a bug in the Mac OS X libc where ceil(-0.1) return +0.
 inline double wtf_ceil(double x) { return copysign(ceil(x), x); }
@@ -75,7 +71,7 @@ inline double wtf_ceil(double x) { return copysign(ceil(x), x); }
 
 #endif
 
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 
 #ifndef isfinite
 inline bool isfinite(double x) { return finite(x) && !isnand(x); }
@@ -89,7 +85,7 @@ inline bool signbit(double x) { return x < 0.0; } // FIXME: Wrong for negative 0
 
 #endif
 
-#if PLATFORM(OPENBSD)
+#if OS(OPENBSD)
 
 #ifndef isfinite
 inline bool isfinite(double x) { return finite(x); }
@@ -102,17 +98,34 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
-inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
-inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
-inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
-inline float roundf(float num) { return num > 0 ? floorf(num + 0.5f) : ceilf(num - 0.5f); }
+// We must not do 'num + 0.5' or 'num - 0.5' because they can cause precision loss.
+static double round(double num)
+{
+    double integer = ceil(num);
+    if (num > 0)
+        return integer - num > 0.5 ? integer - 1.0 : integer;
+    return integer - num >= 0.5 ? integer - 1.0 : integer;
+}
+static float roundf(float num)
+{
+    float integer = ceilf(num);
+    if (num > 0)
+        return integer - num > 0.5f ? integer - 1.0f : integer;
+    return integer - num >= 0.5f ? integer - 1.0f : integer;
+}
+inline long long llround(double num) { return static_cast<long long>(round(num)); }
+inline long long llroundf(float num) { return static_cast<long long>(roundf(num)); }
+inline long lround(double num) { return static_cast<long>(round(num)); }
+inline long lroundf(float num) { return static_cast<long>(roundf(num)); }
 inline double trunc(double num) { return num > 0 ? floor(num) : ceil(num); }
 
 #endif
 
 #if COMPILER(MSVC)
+// The 64bit version of abs() is already defined in stdlib.h which comes with VC10
+#if COMPILER(MSVC9_OR_LOWER)
+inline long long abs(long long num) { return _abs64(num); }
+#endif
 
 inline bool isinf(double num) { return !_finite(num) && !_isnan(num); }
 inline bool isnan(double num) { return !!_isnan(num); }
@@ -177,4 +190,11 @@ inline float deg2turn(float d) { return d / 360.0f; }
 inline float rad2grad(float r) { return r * 200.0f / piFloat; }
 inline float grad2rad(float g) { return g * piFloat / 200.0f; }
 
+#if !COMPILER(MSVC) && !COMPILER(RVCT) && !OS(ANDROID) && !COMPILER(WINSCW)
+using std::isfinite;
+using std::isinf;
+using std::isnan;
+using std::signbit;
+#endif
+
 #endif // #ifndef WTF_MathExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 9c9a4a7..48bd10a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -44,23 +44,27 @@ namespace WTF {
         MessageQueueMessageReceived,  // A message was successfully received and returned.
     };
 
+    // The queue takes ownership of messages and transfer it to the new owner
+    // when messages are fetched from the queue.
+    // Essentially, MessageQueue acts as a queue of OwnPtr<DataType>.
     template<typename DataType>
     class MessageQueue : public Noncopyable {
     public:
         MessageQueue() : m_killed(false) { }
-        
-        void append(const DataType&);
-        bool appendAndCheckEmpty(const DataType&);
-        void prepend(const DataType&);
-        bool waitForMessage(DataType&);
+        ~MessageQueue();
+
+        void append(PassOwnPtr<DataType>);
+        bool appendAndCheckEmpty(PassOwnPtr<DataType>);
+        void prepend(PassOwnPtr<DataType>);
+
+        PassOwnPtr<DataType> waitForMessage();
+        PassOwnPtr<DataType> tryGetMessage();
         template<typename Predicate>
-        MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
+        PassOwnPtr<DataType> waitForMessageFilteredWithTimeout(MessageQueueWaitResult&, Predicate&, double absoluteTime);
 
         template<typename Predicate>
         void removeIf(Predicate&);
 
-        bool tryGetMessage(DataType&);
-
         void kill();
         bool killed() const;
 
@@ -70,86 +74,98 @@ namespace WTF {
         static double infiniteTime() { return std::numeric_limits<double>::max(); }
 
     private:
-        static bool alwaysTruePredicate(DataType&) { return true; }
+        static bool alwaysTruePredicate(DataType*) { return true; }
 
         mutable Mutex m_mutex;
         ThreadCondition m_condition;
-        Deque<DataType> m_queue;
+        Deque<DataType*> m_queue;
         bool m_killed;
     };
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::append(const DataType& message)
+    MessageQueue<DataType>::~MessageQueue()
+    {
+        deleteAllValues(m_queue);
+    }
+
+    template<typename DataType>
+    inline void MessageQueue<DataType>::append(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
     }
 
     // Returns true if the queue was empty before the item was added.
     template<typename DataType>
-    inline bool MessageQueue<DataType>::appendAndCheckEmpty(const DataType& message)
+    inline bool MessageQueue<DataType>::appendAndCheckEmpty(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
         bool wasEmpty = m_queue.isEmpty();
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
         return wasEmpty;
     }
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::prepend(const DataType& message)
+    inline void MessageQueue<DataType>::prepend(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.prepend(message);
+        m_queue.prepend(message.release());
         m_condition.signal();
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::waitForMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessage()
     {
-        MessageQueueWaitResult exitReason = waitForMessageFilteredWithTimeout(result, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
+        MessageQueueWaitResult exitReason; 
+        PassOwnPtr<DataType> result = waitForMessageFilteredWithTimeout(exitReason, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
         ASSERT(exitReason == MessageQueueTerminated || exitReason == MessageQueueMessageReceived);
-        return exitReason == MessageQueueMessageReceived;
+        return result;
     }
 
     template<typename DataType>
     template<typename Predicate>
-    inline MessageQueueWaitResult MessageQueue<DataType>::waitForMessageFilteredWithTimeout(DataType& result, Predicate& predicate, double absoluteTime)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessageFilteredWithTimeout(MessageQueueWaitResult& result, Predicate& predicate, double absoluteTime)
     {
         MutexLocker lock(m_mutex);
         bool timedOut = false;
 
-        DequeConstIterator<DataType> found = m_queue.end();
+        DequeConstIterator<DataType*> found = m_queue.end();
         while (!m_killed && !timedOut && (found = m_queue.findIf(predicate)) == m_queue.end())
             timedOut = !m_condition.timedWait(m_mutex, absoluteTime);
 
         ASSERT(!timedOut || absoluteTime != infiniteTime());
 
-        if (m_killed)
-            return MessageQueueTerminated;
+        if (m_killed) {
+            result = MessageQueueTerminated;
+            return 0;
+        }
 
-        if (timedOut)
-            return MessageQueueTimeout;
+        if (timedOut) {
+            result = MessageQueueTimeout;
+            return 0;
+        }
 
         ASSERT(found != m_queue.end());
-        result = *found;
+        DataType* message = *found;
         m_queue.remove(found);
-        return MessageQueueMessageReceived;
+        result = MessageQueueMessageReceived;
+        return message;
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::tryGetMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::tryGetMessage()
     {
         MutexLocker lock(m_mutex);
         if (m_killed)
-            return false;
+            return 0;
         if (m_queue.isEmpty())
-            return false;
+            return 0;
 
-        result = m_queue.first();
+        DataType* message = m_queue.first();
         m_queue.removeFirst();
-        return true;
+        return message;
     }
 
     template<typename DataType>
@@ -157,9 +173,15 @@ namespace WTF {
     inline void MessageQueue<DataType>::removeIf(Predicate& predicate)
     {
         MutexLocker lock(m_mutex);
-        DequeConstIterator<DataType> found = m_queue.end();
-        while ((found = m_queue.findIf(predicate)) != m_queue.end()) {
+        // See bug 31657 for why this loop looks so weird
+        while (true) {
+            DequeConstIterator<DataType*> found = m_queue.findIf(predicate);
+            if (found == m_queue.end())
+                break;
+
+            DataType* message = *found;
             m_queue.remove(found);
+            delete message;
        }
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
index c88235a..8b6cbf4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -35,7 +35,7 @@ namespace WTF {
 
         ~OwnFastMallocPtr()
         {
-            fastFree(m_ptr);
+            fastFree(const_cast<void*>(static_cast<const void*>(const_cast<const T*>(m_ptr))));
         }
 
         T* get() const { return m_ptr; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
index b7e62b1..af1684b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
@@ -40,7 +40,6 @@ namespace WTF {
         typedef ValueType* PtrType;
 
         explicit OwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
-        OwnPtr(std::auto_ptr<ValueType> autoPtr) : m_ptr(autoPtr.release()) { }
         // See comment in PassOwnPtr.h for why this takes a const reference.
         template <typename U> OwnPtr(const PassOwnPtr<U>& o);
 
@@ -58,8 +57,6 @@ namespace WTF {
         // FIXME: This should be renamed to adopt. 
         void set(PtrType ptr) { ASSERT(!ptr || m_ptr != ptr); deleteOwnedPtr(m_ptr); m_ptr = ptr; }
 
-        void adopt(std::auto_ptr<ValueType> autoPtr) { ASSERT(!autoPtr.get() || m_ptr != autoPtr.get()); deleteOwnedPtr(m_ptr); m_ptr = autoPtr.release(); }
-
         void clear() { deleteOwnedPtr(m_ptr); m_ptr = 0; }
 
         ValueType& operator*() const { ASSERT(m_ptr); return *m_ptr; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp
new file mode 100644
index 0000000..c8384e1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Company 100 Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OwnPtr.h"
+
+#include <AEEBitmap.h>
+#include <AEEFile.h>
+#include <AEEStdLib.h>
+
+namespace WTF {
+
+void deleteOwnedPtr(IFileMgr* ptr)
+{
+    if (ptr)
+        IFILEMGR_Release(ptr);
+}
+
+void deleteOwnedPtr(IFile* ptr)
+{
+    if (ptr)
+        IFILE_Release(ptr);
+}
+
+void deleteOwnedPtr(IBitmap* ptr)
+{
+    if (ptr)
+        IBitmap_Release(ptr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
index 6d91a54..c59fdc5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile, Inc.
+ * Copyright (C) 2010 Company 100 Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,6 +38,14 @@ typedef struct HPEN__* HPEN;
 typedef struct HRGN__* HRGN;
 #endif
 
+#if PLATFORM(BREWMP)
+// Forward delcarations at this point avoid the need to include BREW includes
+// in WTF headers.
+typedef struct _IFileMgr IFileMgr;
+typedef struct _IFile IFile;
+typedef struct IBitmap IBitmap;
+#endif
+
 namespace WTF {
 
     template <typename T> inline void deleteOwnedPtr(T* ptr)
@@ -56,6 +65,12 @@ namespace WTF {
     void deleteOwnedPtr(HRGN);
 #endif
 
+#if PLATFORM(BREWMP)
+    void deleteOwnedPtr(IFileMgr*);
+    void deleteOwnedPtr(IFile*);
+    void deleteOwnedPtr(IBitmap*);
+#endif
+
 } // namespace WTF
 
 #endif // WTF_OwnPtrCommon_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
index f56bc10..9c6e44fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
@@ -28,28 +28,29 @@ namespace WTF {
     template<typename T> class RefPtr;
     template<typename T> class PassRefPtr;
     template <typename T> PassRefPtr<T> adoptRef(T*);
-    
-    // Remove inline for winscw compiler to prevent the compiler agressively resolving 
-    // T::deref(), which will fail compiling when PassRefPtr<T> is used as class member 
-    // or function arguments before T is defined.
-    template<typename T> 
+
+
+    // Remove inline for WINSCW compiler to prevent the compiler agressively resolving
+    // T::ref() and T::deref(), which will fail compiling when PassRefPtr<T> is used as
+    // a class member or function arguments before T is defined.
+    template<typename T>
 #if !COMPILER(WINSCW)
-    inline 
+    inline
 #endif
-    void derefIfNotNull(T* ptr)
+    void refIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
-            ptr->deref();
+            ptr->ref();
     }
 
-    template<typename T>
+    template<typename T> 
 #if !COMPILER(WINSCW)
-    inline
+    inline 
 #endif
-    void refIfNotNull(T* ptr)
+    void derefIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
-            ptr->ref();
+            ptr->deref();
     }
 
     template<typename T> class PassRefPtr {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 4a008cc..15f0ffc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -27,431 +27,520 @@
 #ifndef WTF_Platform_h
 #define WTF_Platform_h
 
-/* PLATFORM handles OS, operating environment, graphics API, and CPU */
+/* ==== PLATFORM handles OS, operating environment, graphics API, and
+   CPU. This macro will be phased out in favor of platform adaptation
+   macros, policy decision macros, and top-level port definitions. ==== */
 #define PLATFORM(WTF_FEATURE) (defined WTF_PLATFORM_##WTF_FEATURE  && WTF_PLATFORM_##WTF_FEATURE)
+
+
+/* ==== Platform adaptation macros: these describe properties of the target environment. ==== */
+
+/* COMPILER() - the compiler being used to build the project */
 #define COMPILER(WTF_FEATURE) (defined WTF_COMPILER_##WTF_FEATURE  && WTF_COMPILER_##WTF_FEATURE)
+/* CPU() - the target CPU architecture */
+#define CPU(WTF_FEATURE) (defined WTF_CPU_##WTF_FEATURE  && WTF_CPU_##WTF_FEATURE)
+/* HAVE() - specific system features (headers, functions or similar) that are present or not */
 #define HAVE(WTF_FEATURE) (defined HAVE_##WTF_FEATURE  && HAVE_##WTF_FEATURE)
-#define USE(WTF_FEATURE) (defined WTF_USE_##WTF_FEATURE  && WTF_USE_##WTF_FEATURE)
-#define ENABLE(WTF_FEATURE) (defined ENABLE_##WTF_FEATURE  && ENABLE_##WTF_FEATURE)
+/* OS() - underlying operating system; only to be used for mandated low-level services like 
+   virtual memory, not to choose a GUI toolkit */
+#define OS(WTF_FEATURE) (defined WTF_OS_##WTF_FEATURE  && WTF_OS_##WTF_FEATURE)
 
-/* Operating systems - low-level dependencies */
 
-/* PLATFORM(DARWIN) */
-/* Operating system level dependencies for Mac OS X / Darwin that should */
-/* be used regardless of operating environment */
-#ifdef __APPLE__
-#define WTF_PLATFORM_DARWIN 1
-#include <AvailabilityMacros.h>
-#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_TIGER 1
-#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
-#define BUILDING_ON_LEOPARD 1
-#endif
-#include <TargetConditionals.h>
-#endif
+/* ==== Policy decision macros: these define policy choices for a particular port. ==== */
 
-/* PLATFORM(WIN_OS) */
-/* Operating system level dependencies for Windows that should be used */
-/* regardless of operating environment */
-#if defined(WIN32) || defined(_WIN32)
-#define WTF_PLATFORM_WIN_OS 1
-#endif
+/* USE() - use a particular third-party library or optional OS service */
+#define USE(WTF_FEATURE) (defined WTF_USE_##WTF_FEATURE  && WTF_USE_##WTF_FEATURE)
+/* ENABLE() - turn on a specific feature of WebKit */
+#define ENABLE(WTF_FEATURE) (defined ENABLE_##WTF_FEATURE  && ENABLE_##WTF_FEATURE)
 
-/* PLATFORM(WINCE) */
-/* Operating system level dependencies for Windows CE that should be used */
-/* regardless of operating environment */
-/* Note that for this platform PLATFORM(WIN_OS) is also defined. */
-#if defined(_WIN32_WCE)
-#define WTF_PLATFORM_WINCE 1
-#endif
 
-/* PLATFORM(LINUX) */
-/* Operating system level dependencies for Linux-like systems that */
-/* should be used regardless of operating environment */
-#ifdef __linux__
-#define WTF_PLATFORM_LINUX 1
-#endif
 
-/* PLATFORM(FREEBSD) */
-/* Operating system level dependencies for FreeBSD-like systems that */
-/* should be used regardless of operating environment */
-#ifdef __FreeBSD__
-#define WTF_PLATFORM_FREEBSD 1
-#endif
+/* ==== COMPILER() - the compiler being used to build the project ==== */
 
-/* PLATFORM(OPENBSD) */
-/* Operating system level dependencies for OpenBSD systems that */
-/* should be used regardless of operating environment */
-#ifdef __OpenBSD__
-#define WTF_PLATFORM_OPENBSD 1
+/* COMPILER(MSVC) Microsoft Visual C++ */
+/* COMPILER(MSVC7_OR_LOWER) Microsoft Visual C++ 2003 or lower*/
+/* COMPILER(MSVC9_OR_LOWER) Microsoft Visual C++ 2008 or lower*/
+#if defined(_MSC_VER)
+#define WTF_COMPILER_MSVC 1
+#if _MSC_VER < 1400
+#define WTF_COMPILER_MSVC7_OR_LOWER 1
+#elif _MSC_VER < 1600
+#define WTF_COMPILER_MSVC9_OR_LOWER 1
 #endif
-
-/* PLATFORM(SOLARIS) */
-/* Operating system level dependencies for Solaris that should be used */
-/* regardless of operating environment */
-#if defined(sun) || defined(__sun)
-#define WTF_PLATFORM_SOLARIS 1
 #endif
 
-#if defined (__SYMBIAN32__)
-/* we are cross-compiling, it is not really windows */
-#undef WTF_PLATFORM_WIN_OS
-#undef WTF_PLATFORM_WIN
-#define WTF_PLATFORM_SYMBIAN 1
+/* COMPILER(RVCT)  - ARM RealView Compilation Tools */
+#if defined(__CC_ARM) || defined(__ARMCC__)
+#define WTF_COMPILER_RVCT 1
 #endif
 
-
-/* PLATFORM(NETBSD) */
-/* Operating system level dependencies for NetBSD that should be used */
-/* regardless of operating environment */
-#if defined(__NetBSD__)
-#define WTF_PLATFORM_NETBSD 1
+/* COMPILER(GCC) - GNU Compiler Collection */
+/* --gnu option of the RVCT compiler also defines __GNUC__ */
+#if defined(__GNUC__) && !COMPILER(RVCT)
+#define WTF_COMPILER_GCC 1
+#define GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
 #endif
 
-/* PLATFORM(QNX) */
-/* Operating system level dependencies for QNX that should be used */
-/* regardless of operating environment */
-#if defined(__QNXNTO__)
-#define WTF_PLATFORM_QNX 1
-#endif
+/* COMPILER(MINGW) - MinGW GCC */
+/* COMPILER(MINGW64) - mingw-w64 GCC - only used as additional check to exclude mingw.org specific functions */
+#if defined(__MINGW32__)
+#define WTF_COMPILER_MINGW 1
+#include <_mingw.h> /* private MinGW header */
+    #if defined(__MINGW64_VERSION_MAJOR) /* best way to check for mingw-w64 vs mingw.org */
+        #define WTF_COMPILER_MINGW64 1
+    #endif /* __MINGW64_VERSION_MAJOR */
+#endif /* __MINGW32__ */
 
-/* PLATFORM(UNIX) */
-/* Operating system level dependencies for Unix-like systems that */
-/* should be used regardless of operating environment */
-#if   PLATFORM(DARWIN)     \
-   || PLATFORM(FREEBSD)    \
-   || PLATFORM(SYMBIAN)    \
-   || PLATFORM(NETBSD)     \
-   || defined(unix)        \
-   || defined(__unix)      \
-   || defined(__unix__)    \
-   || defined(_AIX)        \
-   || defined(__HAIKU__)   \
-   || defined(__QNXNTO__)
-#define WTF_PLATFORM_UNIX 1
+/* COMPILER(WINSCW) - CodeWarrior for Symbian emulator */
+#if defined(__WINSCW__)
+#define WTF_COMPILER_WINSCW 1
+/* cross-compiling, it is not really windows */
+#undef WIN32
+#undef _WIN32
 #endif
 
-/* Operating environments */
-
-/* PLATFORM(CHROMIUM) */
-/* PLATFORM(QT) */
-/* PLATFORM(GTK) */
-/* PLATFORM(MAC) */
-/* PLATFORM(WIN) */
-#if defined(BUILDING_CHROMIUM__)
-#define WTF_PLATFORM_CHROMIUM 1
-#elif defined(BUILDING_QT__)
-#define WTF_PLATFORM_QT 1
-
-/* PLATFORM(KDE) */
-#if defined(BUILDING_KDE__)
-#define WTF_PLATFORM_KDE 1
+/* COMPILER(INTEL) - Intel C++ Compiler */
+#if defined(__INTEL_COMPILER)
+#define WTF_COMPILER_INTEL 1
 #endif
 
-#elif defined(BUILDING_WX__)
-#define WTF_PLATFORM_WX 1
-#elif defined(BUILDING_GTK__)
-#define WTF_PLATFORM_GTK 1
-#elif defined(BUILDING_HAIKU__)
-#define WTF_PLATFORM_HAIKU 1
-#elif PLATFORM(DARWIN)
-#define WTF_PLATFORM_MAC 1
-#elif PLATFORM(WIN_OS)
-#define WTF_PLATFORM_WIN 1
-#endif
+/* ==== CPU() - the target CPU architecture ==== */
 
-/* PLATFORM(IPHONE) */
-#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
-#define WTF_PLATFORM_IPHONE 1
-#endif
+/* This also defines CPU(BIG_ENDIAN) or CPU(MIDDLE_ENDIAN) or neither, as appropriate. */
 
-/* PLATFORM(IPHONE_SIMULATOR) */
-#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
-#define WTF_PLATFORM_IPHONE 1
-#define WTF_PLATFORM_IPHONE_SIMULATOR 1
-#else
-#define WTF_PLATFORM_IPHONE_SIMULATOR 0
+/* CPU(ALPHA) - DEC Alpha */
+#if defined(__alpha__)
+#define WTF_CPU_ALPHA 1
 #endif
 
-#if !defined(WTF_PLATFORM_IPHONE)
-#define WTF_PLATFORM_IPHONE 0
+/* CPU(IA64) - Itanium / IA-64 */
+#if defined(__ia64__)
+#define WTF_CPU_IA64 1
+/* 32-bit mode on Itanium */
+#if !defined(__LP64__)
+#define WTF_CPU_IA64_32 1
+#endif
+#endif
+
+/* CPU(MIPS) - MIPS 32-bit */
+/* Note: Only O32 ABI is tested, so we enable it for O32 ABI for now.  */
+#if (defined(mips) || defined(__mips__)) \
+    && defined(_ABIO32)
+#define WTF_CPU_MIPS 1
+#if defined(__MIPSEB__)
+#define WTF_CPU_BIG_ENDIAN 1
+#endif
+#define WTF_MIPS_PIC (defined __PIC__)
+#define WTF_MIPS_ARCH __mips
+#define WTF_MIPS_ISA(v) (defined WTF_MIPS_ARCH && WTF_MIPS_ARCH == v)
+#define WTF_MIPS_ISA_AT_LEAST(v) (defined WTF_MIPS_ARCH && WTF_MIPS_ARCH >= v)
+#define WTF_MIPS_ARCH_REV __mips_isa_rev
+#define WTF_MIPS_ISA_REV(v) (defined WTF_MIPS_ARCH_REV && WTF_MIPS_ARCH_REV == v)
+#define WTF_MIPS_DOUBLE_FLOAT (defined __mips_hard_float && !defined __mips_single_float)
+#endif /* MIPS */
+
+/* CPU(PPC) - PowerPC 32-bit */
+#if   defined(__ppc__)     \
+    || defined(__PPC__)     \
+    || defined(__powerpc__) \
+    || defined(__powerpc)   \
+    || defined(__POWERPC__) \
+    || defined(_M_PPC)      \
+    || defined(__PPC)
+#define WTF_CPU_PPC 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* Graphics engines */
-
-/* PLATFORM(CG) and PLATFORM(CI) */
-#if PLATFORM(MAC) || PLATFORM(IPHONE)
-#define WTF_PLATFORM_CG 1
-#endif
-#if PLATFORM(MAC) && !PLATFORM(IPHONE)
-#define WTF_PLATFORM_CI 1
+/* CPU(PPC64) - PowerPC 64-bit */
+#if   defined(__ppc64__) \
+    || defined(__PPC64__)
+#define WTF_CPU_PPC64 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
-#if PLATFORM(CHROMIUM)
-#if PLATFORM(DARWIN)
-#define WTF_PLATFORM_CG 1
-#define WTF_PLATFORM_CI 1
-#define WTF_USE_ATSUI 1
-#else
-#define WTF_PLATFORM_SKIA 1
-#endif
+/* CPU(SH4) - SuperH SH-4 */
+#if defined(__SH4__)
+#define WTF_CPU_SH4 1
 #endif
 
-/* Makes PLATFORM(WIN) default to PLATFORM(CAIRO) */
-/* FIXME: This should be changed from a blacklist to a whitelist */
-#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE) && !PLATFORM(HAIKU)
-#define WTF_PLATFORM_CAIRO 1
+/* CPU(SPARC32) - SPARC 32-bit */
+#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
+#define WTF_CPU_SPARC32 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* CPU */
-
-/* PLATFORM(PPC) */
-#if   defined(__ppc__)     \
-   || defined(__PPC__)     \
-   || defined(__powerpc__) \
-   || defined(__powerpc)   \
-   || defined(__POWERPC__) \
-   || defined(_M_PPC)      \
-   || defined(__PPC)
-#define WTF_PLATFORM_PPC 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(SPARC64) - SPARC 64-bit */
+#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
+#define WTF_CPU_SPARC64 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(SPARC32) */
-#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
-#define WTF_PLATFORM_SPARC32 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(SPARC) - any SPARC, true for CPU(SPARC32) and CPU(SPARC64) */
+#if CPU(SPARC32) || CPU(SPARC64)
+#define WTF_CPU_SPARC 1
 #endif
 
-#if PLATFORM(SPARC32) || PLATFORM(SPARC64)
-#define WTF_PLATFORM_SPARC
+/* CPU(X86) - i386 / x86 32-bit */
+#if   defined(__i386__) \
+    || defined(i386)     \
+    || defined(_M_IX86)  \
+    || defined(_X86_)    \
+    || defined(__THW_INTEL)
+#define WTF_CPU_X86 1
 #endif
 
-/* PLATFORM(PPC64) */
-#if   defined(__ppc64__) \
-   || defined(__PPC64__)
-#define WTF_PLATFORM_PPC64 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(X86_64) - AMD64 / Intel64 / x86_64 64-bit */
+#if   defined(__x86_64__) \
+    || defined(_M_X64)
+#define WTF_CPU_X86_64 1
 #endif
 
-/* PLATFORM(ARM) */
-#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
-
+/* CPU(ARM) - ARM, any version*/
 #if   defined(arm) \
-   || defined(__arm__)
-#define WTF_PLATFORM_ARM 1
+    || defined(__arm__)
+#define WTF_CPU_ARM 1
 
 #if defined(__ARMEB__)
-#define WTF_PLATFORM_BIG_ENDIAN 1
+#define WTF_CPU_BIG_ENDIAN 1
 
 #elif !defined(__ARM_EABI__) \
-   && !defined(__EABI__) \
-   && !defined(__VFP_FP__)
-#define WTF_PLATFORM_MIDDLE_ENDIAN 1
+    && !defined(__EABI__) \
+    && !defined(__VFP_FP__) \
+    && !defined(ANDROID)
+#define WTF_CPU_MIDDLE_ENDIAN 1
 
 #endif
 
-/* Set ARM_ARCH_VERSION */
+#define WTF_ARM_ARCH_AT_LEAST(N) (CPU(ARM) && WTF_ARM_ARCH_VERSION >= N)
+
+/* Set WTF_ARM_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4__) \
-   || defined(__ARM_ARCH_4T__) \
-   || defined(__MARM_ARMV4__) \
-   || defined(_ARMV4I_)
-#define ARM_ARCH_VERSION 4
+    || defined(__ARM_ARCH_4T__) \
+    || defined(__MARM_ARMV4__) \
+    || defined(_ARMV4I_)
+#define WTF_ARM_ARCH_VERSION 4
 
 #elif defined(__ARM_ARCH_5__) \
-   || defined(__ARM_ARCH_5T__) \
-   || defined(__ARM_ARCH_5E__) \
-   || defined(__ARM_ARCH_5TE__) \
-   || defined(__ARM_ARCH_5TEJ__) \
-   || defined(__MARM_ARMV5__)
-#define ARM_ARCH_VERSION 5
+    || defined(__ARM_ARCH_5T__) \
+    || defined(__ARM_ARCH_5E__) \
+    || defined(__ARM_ARCH_5TE__) \
+    || defined(__ARM_ARCH_5TEJ__) \
+    || defined(__MARM_ARMV5__)
+#define WTF_ARM_ARCH_VERSION 5
 
 #elif defined(__ARM_ARCH_6__) \
-   || defined(__ARM_ARCH_6J__) \
-   || defined(__ARM_ARCH_6K__) \
-   || defined(__ARM_ARCH_6Z__) \
-   || defined(__ARM_ARCH_6ZK__) \
-   || defined(__ARM_ARCH_6T2__) \
-   || defined(__ARMV6__)
-#define ARM_ARCH_VERSION 6
+    || defined(__ARM_ARCH_6J__) \
+    || defined(__ARM_ARCH_6K__) \
+    || defined(__ARM_ARCH_6Z__) \
+    || defined(__ARM_ARCH_6ZK__) \
+    || defined(__ARM_ARCH_6T2__) \
+    || defined(__ARMV6__)
+#define WTF_ARM_ARCH_VERSION 6
 
 #elif defined(__ARM_ARCH_7A__) \
-   || defined(__ARM_ARCH_7R__)
-#define ARM_ARCH_VERSION 7
+    || defined(__ARM_ARCH_7R__)
+#define WTF_ARM_ARCH_VERSION 7
 
 /* RVCT sets _TARGET_ARCH_ARM */
 #elif defined(__TARGET_ARCH_ARM)
-#define ARM_ARCH_VERSION __TARGET_ARCH_ARM
+#define WTF_ARM_ARCH_VERSION __TARGET_ARCH_ARM
 
 #else
-#define ARM_ARCH_VERSION 0
+#define WTF_ARM_ARCH_VERSION 0
 
 #endif
 
-/* Set THUMB_ARM_VERSION */
+/* Set WTF_THUMB_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4T__)
-#define THUMB_ARCH_VERSION 1
+#define WTF_THUMB_ARCH_VERSION 1
 
 #elif defined(__ARM_ARCH_5T__) \
-   || defined(__ARM_ARCH_5TE__) \
-   || defined(__ARM_ARCH_5TEJ__)
-#define THUMB_ARCH_VERSION 2
+    || defined(__ARM_ARCH_5TE__) \
+    || defined(__ARM_ARCH_5TEJ__)
+#define WTF_THUMB_ARCH_VERSION 2
 
 #elif defined(__ARM_ARCH_6J__) \
-   || defined(__ARM_ARCH_6K__) \
-   || defined(__ARM_ARCH_6Z__) \
-   || defined(__ARM_ARCH_6ZK__) \
-   || defined(__ARM_ARCH_6M__)
-#define THUMB_ARCH_VERSION 3
+    || defined(__ARM_ARCH_6K__) \
+    || defined(__ARM_ARCH_6Z__) \
+    || defined(__ARM_ARCH_6ZK__) \
+    || defined(__ARM_ARCH_6M__)
+#define WTF_THUMB_ARCH_VERSION 3
 
 #elif defined(__ARM_ARCH_6T2__) \
-   || defined(__ARM_ARCH_7__) \
-   || defined(__ARM_ARCH_7A__) \
-   || defined(__ARM_ARCH_7R__) \
-   || defined(__ARM_ARCH_7M__)
-#define THUMB_ARCH_VERSION 4
+    || defined(__ARM_ARCH_7__) \
+    || defined(__ARM_ARCH_7A__) \
+    || defined(__ARM_ARCH_7R__) \
+    || defined(__ARM_ARCH_7M__)
+#define WTF_THUMB_ARCH_VERSION 4
 
 /* RVCT sets __TARGET_ARCH_THUMB */
 #elif defined(__TARGET_ARCH_THUMB)
-#define THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
+#define WTF_THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
 
 #else
-#define THUMB_ARCH_VERSION 0
+#define WTF_THUMB_ARCH_VERSION 0
 #endif
 
-/* On ARMv5 and below the natural alignment is required. */
-#if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
-#define ARM_REQUIRE_NATURAL_ALIGNMENT 1
+
+/* CPU(ARMV5_OR_LOWER) - ARM instruction set v5 or earlier */
+/* On ARMv5 and below the natural alignment is required. 
+   And there are some other differences for v5 or earlier. */
+#if !defined(ARMV5_OR_LOWER) && !WTF_ARM_ARCH_AT_LEAST(6)
+#define WTF_CPU_ARMV5_OR_LOWER 1
 #endif
 
-/* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
-#if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
+
+/* CPU(ARM_TRADITIONAL) - Thumb2 is not available, only traditional ARM (v4 or greater) */
+/* CPU(ARM_THUMB2) - Thumb2 instruction set is available */
+/* Only one of these will be defined. */
+#if !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2)
 #  if defined(thumb2) || defined(__thumb2__) \
-  || ((defined(__thumb) || defined(__thumb__)) && THUMB_ARCH_VERSION == 4)
-#    define WTF_PLATFORM_ARM_TRADITIONAL 0
-#    define WTF_PLATFORM_ARM_THUMB2 1
-#  elif PLATFORM_ARM_ARCH(4)
-#    define WTF_PLATFORM_ARM_TRADITIONAL 1
-#    define WTF_PLATFORM_ARM_THUMB2 0
+    || ((defined(__thumb) || defined(__thumb__)) && WTF_THUMB_ARCH_VERSION == 4)
+#    define WTF_CPU_ARM_TRADITIONAL 0
+#    define WTF_CPU_ARM_THUMB2 1
+#  elif WTF_ARM_ARCH_AT_LEAST(4)
+#    define WTF_CPU_ARM_TRADITIONAL 1
+#    define WTF_CPU_ARM_THUMB2 0
 #  else
 #    error "Not supported ARM architecture"
 #  endif
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(ARM_THUMB2) /* Sanity Check */
-#  error "Cannot use both of WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2 platforms"
-#endif // !defined(ARM_TRADITIONAL) && !defined(ARM_THUMB2)
+#elif CPU(ARM_TRADITIONAL) && CPU(ARM_THUMB2) /* Sanity Check */
+#  error "Cannot use both of WTF_CPU_ARM_TRADITIONAL and WTF_CPU_ARM_THUMB2 platforms"
+#endif /* !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2) */
+
 #endif /* ARM */
 
-/* PLATFORM(X86) */
-#if   defined(__i386__) \
-   || defined(i386)     \
-   || defined(_M_IX86)  \
-   || defined(_X86_)    \
-   || defined(__THW_INTEL)
-#define WTF_PLATFORM_X86 1
+
+
+/* ==== OS() - underlying operating system; only to be used for mandated low-level services like 
+   virtual memory, not to choose a GUI toolkit ==== */
+
+/* OS(ANDROID) - Android */
+#ifdef ANDROID
+#define WTF_OS_ANDROID 1
 #endif
 
-/* PLATFORM(X86_64) */
-#if   defined(__x86_64__) \
-   || defined(_M_X64)
-#define WTF_PLATFORM_X86_64 1
+/* OS(AIX) - AIX */
+#ifdef _AIX
+#define WTF_OS_AIX 1
 #endif
 
-/* PLATFORM(IA64) */
-#if defined(__ia64__)
-#define WTF_PLATFORM_IA64 1
+/* OS(DARWIN) - Any Darwin-based OS, including Mac OS X and iPhone OS */
+#ifdef __APPLE__
+#define WTF_OS_DARWIN 1
+
+/* FIXME: BUILDING_ON_.., and TARGETING... macros should be folded into the OS() system */
+#include <AvailabilityMacros.h>
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
+#define BUILDING_ON_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
+#define BUILDING_ON_LEOPARD 1
+#elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
+#define BUILDING_ON_SNOW_LEOPARD 1
 #endif
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_5
+#define TARGETING_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
+#define TARGETING_LEOPARD 1
+#elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_7
+#define TARGETING_SNOW_LEOPARD 1
+#endif
+#include <TargetConditionals.h>
 
-/* PLATFORM(ALPHA) */
-#if defined(__alpha__)
-#define WTF_PLATFORM_ALPHA 1
 #endif
 
-/* PLATFORM(SH4) */
-#if defined(__SH4__)
-#define WTF_PLATFORM_SH4 1
+/* OS(IPHONE_OS) - iPhone OS */
+/* OS(MAC_OS_X) - Mac OS X (not including iPhone OS) */
+#if OS(DARWIN) && ((defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED)  \
+    || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)                   \
+    || (defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR))
+#define WTF_OS_IPHONE_OS 1
+#elif OS(DARWIN) && defined(TARGET_OS_MAC) && TARGET_OS_MAC
+#define WTF_OS_MAC_OS_X 1
 #endif
 
-/* PLATFORM(SPARC64) */
-#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
-#define WTF_PLATFORM_SPARC64 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* OS(FREEBSD) - FreeBSD */
+#ifdef __FreeBSD__
+#define WTF_OS_FREEBSD 1
 #endif
 
-/* PLATFORM(WINCE) && PLATFORM(QT)
-   We can not determine the endianess at compile time. For
-   Qt for Windows CE the endianess is specified in the
-   device specific makespec
-*/
-#if PLATFORM(WINCE) && PLATFORM(QT)
-#   include <QtGlobal>
-#   undef WTF_PLATFORM_BIG_ENDIAN
-#   undef WTF_PLATFORM_MIDDLE_ENDIAN
-#   if Q_BYTE_ORDER == Q_BIG_EDIAN
-#       define WTF_PLATFORM_BIG_ENDIAN 1
-#   endif
+/* OS(HAIKU) - Haiku */
+#ifdef __HAIKU__
+#define WTF_OS_HAIKU 1
+#endif
 
-#   include <ce_time.h>
+/* OS(LINUX) - Linux */
+#ifdef __linux__
+#define WTF_OS_LINUX 1
 #endif
 
-#if PLATFORM(WINCE) && PLATFORM(QT)
-#   include <ce_time.h>
+/* OS(NETBSD) - NetBSD */
+#if defined(__NetBSD__)
+#define WTF_PLATFORM_NETBSD 1
 #endif
 
-/* Compiler */
+/* OS(OPENBSD) - OpenBSD */
+#ifdef __OpenBSD__
+#define WTF_OS_OPENBSD 1
+#endif
 
-/* COMPILER(MSVC) */
-#if defined(_MSC_VER)
-#define WTF_COMPILER_MSVC 1
-#if _MSC_VER < 1400
-#define WTF_COMPILER_MSVC7 1
+/* OS(QNX) - QNX */
+#if defined(__QNXNTO__)
+#define WTF_OS_QNX 1
 #endif
+
+/* OS(SOLARIS) - Solaris */
+#if defined(sun) || defined(__sun)
+#define WTF_OS_SOLARIS 1
 #endif
 
-/* COMPILER(RVCT) */
-#if defined(__CC_ARM) || defined(__ARMCC__)
-#define WTF_COMPILER_RVCT 1
+/* OS(WINCE) - Windows CE; note that for this platform OS(WINDOWS) is also defined */
+#if defined(_WIN32_WCE)
+#define WTF_OS_WINCE 1
 #endif
 
-/* COMPILER(GCC) */
-/* --gnu option of the RVCT compiler also defines __GNUC__ */
-#if defined(__GNUC__) && !COMPILER(RVCT)
-#define WTF_COMPILER_GCC 1
-#define GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+/* OS(WINDOWS) - Any version of Windows */
+#if defined(WIN32) || defined(_WIN32)
+#define WTF_OS_WINDOWS 1
 #endif
 
-/* COMPILER(MINGW) */
-#if defined(MINGW) || defined(__MINGW32__)
-#define WTF_COMPILER_MINGW 1
+/* OS(SYMBIAN) - Symbian */
+#if defined (__SYMBIAN32__)
+#define WTF_OS_SYMBIAN 1
+#endif
+
+/* OS(UNIX) - Any Unix-like system */
+#if   OS(AIX)              \
+    || OS(ANDROID)          \
+    || OS(DARWIN)           \
+    || OS(FREEBSD)          \
+    || OS(HAIKU)            \
+    || OS(LINUX)            \
+    || OS(NETBSD)           \
+    || OS(OPENBSD)          \
+    || OS(QNX)              \
+    || OS(SOLARIS)          \
+    || OS(SYMBIAN)          \
+    || defined(unix)        \
+    || defined(__unix)      \
+    || defined(__unix__)
+#define WTF_OS_UNIX 1
+#endif
+
+/* Operating environments */
+
+/* FIXME: these are all mixes of OS, operating environment and policy choices. */
+/* PLATFORM(CHROMIUM) */
+/* PLATFORM(QT) */
+/* PLATFORM(WX) */
+/* PLATFORM(GTK) */
+/* PLATFORM(HAIKU) */
+/* PLATFORM(MAC) */
+/* PLATFORM(WIN) */
+#if defined(BUILDING_CHROMIUM__)
+#define WTF_PLATFORM_CHROMIUM 1
+#elif defined(BUILDING_QT__)
+#define WTF_PLATFORM_QT 1
+#elif defined(BUILDING_WX__)
+#define WTF_PLATFORM_WX 1
+#elif defined(BUILDING_GTK__)
+#define WTF_PLATFORM_GTK 1
+#elif defined(BUILDING_HAIKU__)
+#define WTF_PLATFORM_HAIKU 1
+#elif defined(BUILDING_BREWMP__)
+#define WTF_PLATFORM_BREWMP 1
+#if defined(AEE_SIMULATOR)
+#define WTF_PLATFORM_BREWMP_SIMULATOR 1
+#else
+#define WTF_PLATFORM_BREWMP_SIMULATOR 0
+#endif
+#undef WTF_OS_WINDOWS
+#undef WTF_PLATFORM_WIN
+#elif OS(DARWIN)
+#define WTF_PLATFORM_MAC 1
+#elif OS(WINDOWS)
+#define WTF_PLATFORM_WIN 1
 #endif
 
-/* COMPILER(BORLAND) */
-/* not really fully supported - is this relevant any more? */
-#if defined(__BORLANDC__)
-#define WTF_COMPILER_BORLAND 1
+/* PLATFORM(IPHONE) */
+/* FIXME: this is sometimes used as an OS switch and sometimes for higher-level things */
+#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
+#define WTF_PLATFORM_IPHONE 1
 #endif
 
-/* COMPILER(CYGWIN) */
-/* not really fully supported - is this relevant any more? */
-#if defined(__CYGWIN__)
-#define WTF_COMPILER_CYGWIN 1
+/* PLATFORM(IPHONE_SIMULATOR) */
+#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
+#define WTF_PLATFORM_IPHONE 1
+#define WTF_PLATFORM_IPHONE_SIMULATOR 1
+#else
+#define WTF_PLATFORM_IPHONE_SIMULATOR 0
 #endif
 
-/* COMPILER(WINSCW) */
-#if defined(__WINSCW__)
-#define WTF_COMPILER_WINSCW 1
+#if !defined(WTF_PLATFORM_IPHONE)
+#define WTF_PLATFORM_IPHONE 0
+#endif
+
+/* PLATFORM(ANDROID) */
+/* FIXME: this is sometimes used as an OS() switch, and other times to drive
+   policy choices */
+#if defined(ANDROID)
+#define WTF_PLATFORM_ANDROID 1
+#endif
+
+/* Graphics engines */
+
+/* PLATFORM(CG) and PLATFORM(CI) */
+#if PLATFORM(MAC) || PLATFORM(IPHONE)
+#define WTF_PLATFORM_CG 1
+#endif
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
+#define WTF_PLATFORM_CI 1
+#endif
+
+/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
+#if PLATFORM(CHROMIUM)
+#define ENABLE_HISTORY_ALWAYS_ASYNC 1
+#if OS(DARWIN)
+#define WTF_PLATFORM_CG 1
+#define WTF_PLATFORM_CI 1
+#define WTF_USE_ATSUI 1
+#define WTF_USE_CORE_TEXT 1
+#else
+#define WTF_PLATFORM_SKIA 1
+#endif
+#endif
+
+#if PLATFORM(GTK)
+#define WTF_PLATFORM_CAIRO 1
 #endif
 
-#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+
+/* OS(WINCE) && PLATFORM(QT)
+   We can not determine the endianess at compile time. For
+   Qt for Windows CE the endianess is specified in the
+   device specific makespec
+*/
+#if OS(WINCE) && PLATFORM(QT)
+#   include <QtGlobal>
+#   undef WTF_CPU_BIG_ENDIAN
+#   undef WTF_CPU_MIDDLE_ENDIAN
+#   if Q_BYTE_ORDER == Q_BIG_ENDIAN
+#       define WTF_CPU_BIG_ENDIAN 1
+#   endif
+
+#   include <ce_time.h>
+#endif
+
+#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
 /* On Windows, use QueryPerformanceCounter by default */
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #define WTF_USE_QUERY_PERFORMANCE_COUNTER  1
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 #undef ENABLE_JSC_MULTIPLE_THREADS
 #define ENABLE_JSC_MULTIPLE_THREADS        0
 #define USE_SYSTEM_MALLOC                  0
@@ -462,26 +551,28 @@
 #define ENABLE_WML                         1
 #define HAVE_ACCESSIBILITY                 0
 
-#define NOMINMAX       // Windows min and max conflict with standard macros
-#define NOSHLWAPI      // shlwapi.h not available on WinCe
+#define NOMINMAX       /* Windows min and max conflict with standard macros */
+#define NOSHLWAPI      /* shlwapi.h not available on WinCe */
 
-// MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file.
-#define __usp10__      // disable "usp10.h"
+/* MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file. */
+#define __usp10__      /* disable "usp10.h" */
 
-#define _INC_ASSERT    // disable "assert.h"
+#define _INC_ASSERT    /* disable "assert.h" */
 #define assert(x)
 
-// _countof is only included in CE6; for CE5 we need to define it ourself
+/* _countof is only included in CE6; for CE5 we need to define it ourself */
 #ifndef _countof
 #define _countof(x) (sizeof(x) / sizeof((x)[0]))
 #endif
 
-#endif  /* PLATFORM(WINCE) && !PLATFORM(QT) */
+#endif  /* OS(WINCE) && !PLATFORM(QT) */
 
-/* for Unicode, KDE uses Qt */
-#if PLATFORM(KDE) || PLATFORM(QT)
+#if PLATFORM(QT)
 #define WTF_USE_QT4_UNICODE 1
-#elif PLATFORM(WINCE)
+#if !defined(ENABLE_WIDGETS_10_SUPPORT)
+#define ENABLE_WIDGETS_10_SUPPORT 1
+#endif
+#elif OS(WINCE)
 #define WTF_USE_WINCE_UNICODE 1
 #elif PLATFORM(GTK)
 /* The GTK+ Unicode backend is configurable */
@@ -493,7 +584,7 @@
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
@@ -506,10 +597,19 @@
 #define HAVE_RUNLOOP_TIMER 1
 #endif /* PLATFORM(MAC) && !PLATFORM(IPHONE) */
 
-#if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
+#if PLATFORM(MAC)
+#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
+#endif
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
+#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
+#endif
+
+#if PLATFORM(QT) && OS(DARWIN)
+#define WTF_PLATFORM_CF 1
 #endif
 
 #if PLATFORM(IPHONE)
@@ -529,12 +629,28 @@
 #define HAVE_PTHREAD_RWLOCK 1
 #endif
 
+#if PLATFORM(ANDROID)
+#define WTF_USE_PTHREADS 1
+#define WTF_PLATFORM_SGL 1
+#define USE_SYSTEM_MALLOC 1
+#define ENABLE_MAC_JAVA_BRIDGE 1
+#define LOG_DISABLED 1
+/* Prevents Webkit from drawing the caret in textfields and textareas
+   This prevents unnecessary invals. */
+#define ENABLE_TEXT_CARET 1
+#define ENABLE_JAVASCRIPT_DEBUGGER 0
+#endif
+
 #if PLATFORM(WIN)
 #define WTF_USE_WININET 1
 #endif
 
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#if OS(DARWIN)
+#define WTF_PLATFORM_CF 1
+#endif
 #endif
 
 #if PLATFORM(GTK)
@@ -553,24 +669,29 @@
 #define ENABLE_NETSCAPE_PLUGIN_API 0
 #endif
 
+#if PLATFORM(BREWMP)
+#define USE_SYSTEM_MALLOC 1
+#endif
+
 #if !defined(HAVE_ACCESSIBILITY)
 #if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
 #endif
 #endif /* !defined(HAVE_ACCESSIBILITY) */
 
-#if PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+#if OS(UNIX) && !OS(SYMBIAN)
 #define HAVE_SIGNAL_H 1
 #endif
 
-#if !PLATFORM(WIN_OS) && !PLATFORM(SOLARIS) && !PLATFORM(QNX) \
-    && !PLATFORM(SYMBIAN) && !PLATFORM(HAIKU) && !COMPILER(RVCT)
+#if !OS(WINDOWS) && !OS(SOLARIS) && !OS(QNX) \
+    && !OS(SYMBIAN) && !OS(HAIKU) && !OS(RVCT) \
+    && !OS(ANDROID) && !PLATFORM(BREWMP)
 #define HAVE_TM_GMTOFF 1
 #define HAVE_TM_ZONE 1
 #define HAVE_TIMEGM 1
-#endif     
+#endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_LANGINFO_H 1
@@ -582,27 +703,32 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE) && !PLATFORM(QT)
+#if !defined(TARGETING_TIGER) && !defined(TARGETING_LEOPARD)
+
+#define HAVE_DISPATCH_H 1
+
+#if !PLATFORM(IPHONE)
 #define HAVE_MADV_FREE_REUSE 1
 #define HAVE_MADV_FREE 1
 #define HAVE_PTHREAD_SETNAME_NP 1
 #endif
 
+#endif
+
 #if PLATFORM(IPHONE)
 #define HAVE_MADV_FREE 1
 #endif
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 
-#define HAVE_FLOAT_H 1
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #define HAVE_ERRNO_H 0
 #else
 #define HAVE_SYS_TIMEB_H 1
 #endif
 #define HAVE_VIRTUALALLOC 1
 
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_MMAP 0
@@ -615,7 +741,11 @@
 #define HAVE_SYS_PARAM_H 1
 #endif
 
-#elif PLATFORM(QNX)
+#elif PLATFORM(BREWMP)
+
+#define HAVE_ERRNO_H 1
+
+#elif OS(QNX)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_MMAP 1
@@ -624,13 +754,23 @@
 #define HAVE_SYS_PARAM_H 1
 #define HAVE_SYS_TIME_H 1
 
+#elif OS(ANDROID)
+
+#define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 0
+#define HAVE_MMAP 1
+#define HAVE_SBRK 1
+#define HAVE_STRINGS_H 1
+#define HAVE_SYS_PARAM_H 1
+#define HAVE_SYS_TIME_H 1
+
 #else
 
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
 /* As long as Haiku doesn't have a complete support of locale this will be disabled. */
-#if !PLATFORM(HAIKU)
+#if !OS(HAIKU)
 #define HAVE_LANGINFO_H 1
 #endif
 #define HAVE_MMAP 1
@@ -643,6 +783,11 @@
 
 /* ENABLE macro defaults */
 
+#if PLATFORM(QT)
+// We musn't customize the global operator new and delete for the Qt port.
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#endif
+
 /* fastMalloc match validation allows for runtime verification that
    new is matched by delete, fastMalloc is matched by fastFree, etc. */
 #if !defined(ENABLE_FAST_MALLOC_MATCH_VALIDATION)
@@ -677,6 +822,10 @@
 #define ENABLE_DASHBOARD_SUPPORT 0
 #endif
 
+#if !defined(ENABLE_WIDGETS_10_SUPPORT)
+#define ENABLE_WIDGETS_10_SUPPORT 0
+#endif
+
 #if !defined(ENABLE_INSPECTOR)
 #define ENABLE_INSPECTOR 1
 #endif
@@ -701,6 +850,10 @@
 #define ENABLE_OPCODE_STATS 0
 #endif
 
+#if !defined(ENABLE_GLOBAL_FASTMALLOC_NEW)
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 1
+#endif
+
 #define ENABLE_SAMPLING_COUNTERS 0
 #define ENABLE_SAMPLING_FLAGS 0
 #define ENABLE_OPCODE_SAMPLING 0
@@ -729,11 +882,14 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if (PLATFORM(X86_64) && (PLATFORM(UNIX) || PLATFORM(WIN_OS))) || PLATFORM(IA64) || PLATFORM(ALPHA)
+#if (CPU(X86_64) && (OS(UNIX) || OS(WINDOWS))) \
+    || (CPU(IA64) && !CPU(IA64_32)) \
+    || CPU(ALPHA) \
+    || CPU(SPARC64)
 #define WTF_USE_JSVALUE64 1
-#elif PLATFORM(ARM) || PLATFORM(PPC64)
+#elif CPU(ARM) || CPU(PPC64) || CPU(MIPS)
 #define WTF_USE_JSVALUE32 1
-#elif PLATFORM(WIN_OS) && COMPILER(MINGW)
+#elif OS(WINDOWS) && COMPILER(MINGW)
 /* Using JSVALUE32_64 causes padding/alignement issues for JITStubArg
 on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_JSVALUE32 1
@@ -749,40 +905,53 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if !defined(ENABLE_JIT)
 
 /* The JIT is tested & working on x86_64 Mac */
-#if PLATFORM(X86_64) && PLATFORM(MAC)
+#if CPU(X86_64) && PLATFORM(MAC)
     #define ENABLE_JIT 1
 /* The JIT is tested & working on x86 Mac */
-#elif PLATFORM(X86) && PLATFORM(MAC)
+#elif CPU(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
+#elif CPU(ARM_THUMB2) && PLATFORM(IPHONE)
+    #define ENABLE_JIT 1
+/* The JIT is tested & working on Android */
+#elif CPU(ARM_THUMB2) && PLATFORM(ANDROID) && ENABLE(ANDROID_JSC_JIT)
     #define ENABLE_JIT 1
-    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
-#elif PLATFORM(X86) && PLATFORM(WIN)
+#elif CPU(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
 #endif
 
-#if PLATFORM(QT)
-#if PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+#if PLATFORM(QT) || PLATFORM(WX)
+#if CPU(X86_64) && OS(DARWIN)
+    #define ENABLE_JIT 1
+#elif CPU(X86) && OS(DARWIN)
+    #define ENABLE_JIT 1
+    #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)
+#elif CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-#elif PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100
+#elif CPU(X86) && OS(LINUX) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+#elif CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100
+    #define ENABLE_JIT 1
+#elif CPU(ARM_TRADITIONAL) && OS(LINUX)
     #define ENABLE_JIT 1
-    #if PLATFORM(ARM_THUMB2)
-        #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
-    #endif
 #endif
 #endif /* PLATFORM(QT) */
 
 #endif /* !defined(ENABLE_JIT) */
 
+/* CPU architecture specific optimizations */
+#if CPU(ARM_TRADITIONAL)
+#if ENABLE(JIT) && !defined(ENABLE_JIT_OPTIMIZE_MOD) && WTF_ARM_ARCH_AT_LEAST(5)
+#define ENABLE_JIT_OPTIMIZE_MOD 1
+#endif
+#endif
+
 #if ENABLE(JIT)
 #ifndef ENABLE_JIT_OPTIMIZE_CALL
 #define ENABLE_JIT_OPTIMIZE_CALL 1
@@ -796,11 +965,14 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #ifndef ENABLE_JIT_OPTIMIZE_METHOD_CALLS
 #define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
+#ifndef ENABLE_JIT_OPTIMIZE_MOD
+#define ENABLE_JIT_OPTIMIZE_MOD 0
+#endif
 #endif
 
-#if PLATFORM(X86) && COMPILER(MSVC)
+#if CPU(X86) && COMPILER(MSVC)
 #define JSC_HOST_CALL __fastcall
-#elif PLATFORM(X86) && COMPILER(GCC)
+#elif CPU(X86) && COMPILER(GCC)
 #define JSC_HOST_CALL __attribute__ ((fastcall))
 #else
 #define JSC_HOST_CALL
@@ -820,19 +992,26 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if !defined(ENABLE_YARR_JIT)
 
 /* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
-#if (PLATFORM(X86) && PLATFORM(MAC)) \
- || (PLATFORM(X86_64) && PLATFORM(MAC)) \
- || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)) \
- || (PLATFORM(X86) && PLATFORM(WIN))
+#if (CPU(X86) && PLATFORM(MAC)) \
+    || (CPU(X86_64) && PLATFORM(MAC)) \
+    || (CPU(ARM_THUMB2) && PLATFORM(IPHONE)) \
+    || (CPU(ARM_THUMB2) && PLATFORM(ANDROID) && ENABLE(ANDROID_JSC_JIT)) \
+    || (CPU(X86) && PLATFORM(WIN)) \
+    || (CPU(X86) && PLATFORM(WX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
 
 #if PLATFORM(QT)
-#if (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
- || (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)) \
- || (PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100) \
- || (PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX))
+#if (CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
+    || (CPU(X86_64) && OS(WINDOWS) && COMPILER(MINGW64) && GCC_VERSION >= 40100) \
+    || (CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)) \
+    || (CPU(X86) && OS(LINUX) && GCC_VERSION >= 40100) \
+    || (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100) \
+    || (CPU(ARM_TRADITIONAL) && OS(LINUX)) \
+    || (CPU(MIPS) && OS(LINUX)) \
+    || (CPU(X86) && OS(DARWIN)) \
+    || (CPU(X86_64) && OS(DARWIN))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
@@ -856,7 +1035,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
 #endif
 
-#if !defined(ENABLE_PAN_SCROLLING) && PLATFORM(WIN_OS)
+#if !defined(ENABLE_PAN_SCROLLING) && OS(WINDOWS)
 #define ENABLE_PAN_SCROLLING 1
 #endif
 
@@ -867,10 +1046,6 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_QXMLQUERY 1
 #endif
 
-#if !PLATFORM(QT)
-#define WTF_USE_FONT_FAST_PATH 1
-#endif
-
 /* Accelerated compositing */
 #if PLATFORM(MAC)
 #if !defined(BUILDING_ON_TIGER)
@@ -882,17 +1057,30 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+/* FIXME: Defining ENABLE_3D_RENDERING here isn't really right, but it's always used with
+   with WTF_USE_ACCELERATED_COMPOSITING, and it allows the feature to be turned on and
+   off in one place. */
+#if PLATFORM(WIN)
+#include "QuartzCorePresent.h"
+#if QUARTZCORE_PRESENT
+#define WTF_USE_ACCELERATED_COMPOSITING 1
+#define ENABLE_3D_RENDERING 1
+#endif
+#endif
+
 #if COMPILER(GCC)
 #define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
 #else
 #define WARN_UNUSED_RETURN
 #endif
 
-#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((PLATFORM(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((OS(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
 #define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
 #endif
 
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
+#define ENABLE_JSC_ZOMBIES 0
+
 #endif /* WTF_Platform_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
deleted file mode 100644
index 5d0bd2a..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef PtrAndFlags_h
-#define PtrAndFlags_h
-
-#include <wtf/Assertions.h>
-
-namespace WTF {
-    template<class T, typename FlagEnum> class PtrAndFlagsBase {
-    public:
-        bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
-        void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
-        void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
-        T* get() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
-        void set(T* ptr)
-        {
-            ASSERT(!(reinterpret_cast<intptr_t>(ptr) & 3));
-            m_ptrAndFlags = reinterpret_cast<intptr_t>(ptr) | (m_ptrAndFlags & 3);
-#ifndef NDEBUG
-            m_leaksPtr = ptr;
-#endif
-        }
-
-        bool operator!() const { return !get(); }
-        T* operator->() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
-
-    protected:
-        intptr_t m_ptrAndFlags;
-#ifndef NDEBUG
-        void* m_leaksPtr; // Only used to allow tools like leaks on OSX to detect that the memory is referenced.
-#endif
-    };
-
-    template<class T, typename FlagEnum> class PtrAndFlags : public PtrAndFlagsBase<T, FlagEnum> {
-    public:
-        PtrAndFlags()
-        {
-            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-        }
-        PtrAndFlags(T* ptr)
-        {
-            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-            set(ptr);
-        }
-    };
-} // namespace WTF
-
-using WTF::PtrAndFlagsBase;
-using WTF::PtrAndFlags;
-
-#endif // PtrAndFlags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index 52fb130..fc48263 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -34,12 +34,18 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" {
 #include "wince/mt19937ar.c"
 }
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEAppGen.h>
+#include <AEESource.h>
+#include <AEEStdLib.h>
+#endif
+
 namespace WTF {
 
 double weakRandomNumber()
@@ -47,6 +53,10 @@ double weakRandomNumber()
 #if COMPILER(MSVC) && defined(_CRT_RAND_S)
     // rand_s is incredibly slow on windows so we fall back on rand for Math.random
     return (rand() + (rand() / (RAND_MAX + 1.0))) / (RAND_MAX + 1.0);
+#elif PLATFORM(BREWMP)
+    uint32_t bits;
+    GETRAND(reinterpret_cast<byte*>(&bits), sizeof(uint32_t));
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
     return randomNumber();
 #endif
@@ -66,10 +76,10 @@ double randomNumber()
     uint32_t bits;
     rand_s(&bits);
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
     uint32_t bits = arc4random();
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     uint32_t part1 = random() & (RAND_MAX - 1);
     uint32_t part2 = random() & (RAND_MAX - 1);
     // random only provides 31 bits
@@ -80,9 +90,9 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     return genrand_res53();
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
     uint32_t part3 = rand() & (RAND_MAX - 1);
@@ -99,6 +109,16 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
+#elif PLATFORM(BREWMP)
+    uint32_t bits;
+    ISource* randomSource;
+
+    IShell* shell = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIShell;
+    ISHELL_CreateInstance(shell, AEECLSID_RANDOM, reinterpret_cast<void**>(&randomSource));
+    ISOURCE_Read(randomSource, reinterpret_cast<char*>(&bits), 4);
+    ISOURCE_Release(randomSource);
+
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
index a66433e..ae414c0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -33,12 +33,12 @@
 #include <sys/time.h>
 #endif
 
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <sys/types.h>
 #include <unistd.h>
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" {
 void init_by_array(unsigned long init_key[],int key_length);
 }
@@ -49,9 +49,9 @@ namespace WTF {
 
 inline void initializeRandomNumberGenerator()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // On Darwin we use arc4random which initialises itself.
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     // initialize rand()
     srand(static_cast<unsigned>(time(0)));
 
@@ -64,7 +64,7 @@ inline void initializeRandomNumberGenerator()
     init_by_array(initializationBuffer, 4);
 #elif COMPILER(MSVC) && defined(_CRT_RAND_S)
     // On Windows we use rand_s which initialises itself
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     // srandomdev is not guaranteed to exist on linux so we use this poor seed, this should be improved
     timeval time;
     gettimeofday(&time, 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
index 8388715..84e841c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
@@ -24,6 +24,7 @@
 #include <algorithm>
 #include "AlwaysInline.h"
 #include "FastAllocBase.h"
+#include "PassRefPtr.h"
 
 namespace WTF {
 
@@ -50,13 +51,13 @@ namespace WTF {
         RefPtr(HashTableDeletedValueType) : m_ptr(hashTableDeletedValue()) { }
         bool isHashTableDeletedValue() const { return m_ptr == hashTableDeletedValue(); }
 
-        ~RefPtr() { T* ptr = m_ptr; derefIfNotNull(ptr); }
+        ~RefPtr() { derefIfNotNull(m_ptr); }
         
-        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(static_cast<T*>(o.get())) { if (T* ptr = static_cast<T*>(m_ptr)) ptr->ref(); }
+        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { T* ptr = m_ptr; refIfNotNull(ptr); }
         
         T* get() const { return m_ptr; }
         
-        void clear() { T* ptr = m_ptr; derefIfNotNull(ptr); m_ptr = 0; }
+        void clear() { derefIfNotNull(m_ptr); m_ptr = 0; }
         PassRefPtr<T> release() { PassRefPtr<T> tmp = adoptRef(m_ptr); m_ptr = 0; return tmp; }
 
         T& operator*() const { return *m_ptr; }
@@ -65,12 +66,8 @@ namespace WTF {
         bool operator!() const { return !m_ptr; }
     
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-        operator bool() const { return m_ptr; }
-#else
-        typedef T* RefPtr::*UnspecifiedBoolType;
+        typedef T* (RefPtr::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_ptr ? &RefPtr::m_ptr : 0; }
-#endif
         
         RefPtr& operator=(const RefPtr&);
         RefPtr& operator=(T*);
@@ -139,8 +136,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
@@ -156,8 +152,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
index 9433025..7f6ebfe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
@@ -285,7 +285,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index c9b5742..96a929c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -26,7 +26,6 @@
 #ifndef WTF_StdLibExtras_h
 #define WTF_StdLibExtras_h
 
-#include <wtf/Platform.h>
 #include <wtf/Assertions.h>
 
 // Use these to declare and define a static local variable (static T;) so that
@@ -48,6 +47,10 @@
 // NULL can cause compiler problems, especially in cases of multiple inheritance.
 #define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
 
+// STRINGIZE: Can convert any value to quoted string, even expandable macros
+#define STRINGIZE(exp) #exp
+#define STRINGIZE_VALUE_OF(exp) STRINGIZE(exp)
+
 namespace WTF {
 
     /*
@@ -65,6 +68,14 @@ namespace WTF {
         return u.to;
     }
 
+    // Returns a count of the number of bits set in 'bits'.
+    inline size_t bitCount(unsigned bits)
+    {
+        bits = bits - ((bits >> 1) & 0x55555555);
+        bits = (bits & 0x33333333) + ((bits >> 2) & 0x33333333);
+        return (((bits + (bits >> 4)) & 0xF0F0F0F) * 0x1010101) >> 24;
+    }
+
 } // namespace WTF
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp
new file mode 100644
index 0000000..1b96417
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if COMPILER(RVCT) && __ARMCC_VERSION < 400000
+
+#include "StringExtras.h"
+
+#include "ASCIICType.h"
+
+int strcasecmp(const char* s1, const char* s2)
+{
+    while (toASCIIUpper(*s1) == toASCIIUpper(*s2)) {
+        if (*s1 == '\0')
+            return 0;
+        s1++;
+        s2++;
+    }
+
+    return toASCIIUpper(*s1) - toASCIIUpper(*s2);
+}
+
+int strncasecmp(const char* s1, const char* s2, size_t len)
+{
+    while (len > 0 && toASCIIUpper(*s1) == toASCIIUpper(*s2)) {
+        if (*s1 == '\0')
+            return 0;
+        s1++;
+        s2++;
+        len--;
+    }
+
+    if (!len)
+        return 0;
+
+    return toASCIIUpper(*s1) - toASCIIUpper(*s2);
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 1120d65..28e80b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -34,6 +34,7 @@
 #endif 
 
 #if COMPILER(MSVC)
+// FIXME: why a COMPILER check instead of OS? also, these should be HAVE checks
 
 inline int snprintf(char* buffer, size_t count, const char* format, ...) 
 {
@@ -45,7 +46,7 @@ inline int snprintf(char* buffer, size_t count, const char* format, ...)
     return result;
 }
 
-#if COMPILER(MSVC7) || PLATFORM(WINCE)
+#if COMPILER(MSVC7_OR_LOWER) || OS(WINCE)
 
 inline int vsnprintf(char* buffer, size_t count, const char* format, va_list args)
 {
@@ -54,7 +55,7 @@ inline int vsnprintf(char* buffer, size_t count, const char* format, va_list arg
 
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 
 inline int strnicmp(const char* string1, const char* string2, size_t count)
 {
@@ -85,7 +86,8 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+#if OS(WINDOWS) || OS(LINUX) || OS(SOLARIS)
+// FIXME: should check HAVE_STRNSTR
 
 inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
 {
@@ -101,4 +103,11 @@ inline char* strnstr(const char* buffer, const char* target, size_t bufferLength
 
 #endif
 
+#if COMPILER(RVCT) && __ARMCC_VERSION < 400000
+
+int strcasecmp(const char* s1, const char* s2);
+int strncasecmp(const char* s1, const char* s2, size_t len);
+
+#endif
+
 #endif // WTF_StringExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h
new file mode 100644
index 0000000..07f117f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef WTF_StringHashFunctions_h
+#define WTF_StringHashFunctions_h
+
+#include <wtf/unicode/Unicode.h>
+
+namespace WTF {
+
+// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
+static const unsigned stringHashingStartValue = 0x9e3779b9U;
+
+// stringHash methods based on Paul Hsieh's SuperFastHash.
+// http://www.azillionmonkeys.com/qed/hash.html
+// char* data is interpreted as latin-encoded (zero extended to 16 bits).
+
+inline unsigned stringHash(const UChar* data, unsigned length)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+    unsigned rem = length & 1;
+    length >>= 1;
+
+    // Main loop
+    for (; length > 0; length--) {
+        hash += data[0];
+        unsigned tmp = (data[1] << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += data[0];
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+inline unsigned stringHash(const char* data, unsigned length)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+    unsigned rem = length & 1;
+    length >>= 1;
+
+    // Main loop
+    for (; length > 0; length--) {
+        hash += static_cast<unsigned char>(data[0]);
+        unsigned tmp = (static_cast<unsigned char>(data[1]) << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += static_cast<unsigned char>(data[0]);
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+inline unsigned stringHash(const char* data)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+
+    // Main loop
+    for (;;) {
+        unsigned char b0 = data[0];
+        if (!b0)
+            break;
+        unsigned char b1 = data[1];
+        if (!b1) {
+            hash += b0;
+            hash ^= hash << 11;
+            hash += hash >> 17;
+            break;
+        }
+        hash += b0;
+        unsigned tmp = (b1 << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Force "avalanching" of final 127 bits.
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // This avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked.
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+} // namespace WTF
+
+#endif // WTF_StringHashFunctions_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
index b8fce7e..8a73e13 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
@@ -33,13 +33,11 @@
 #ifndef TCMALLOC_INTERNAL_SPINLOCK_H__
 #define TCMALLOC_INTERNAL_SPINLOCK_H__
 
-#if (PLATFORM(X86) || PLATFORM(PPC)) && (COMPILER(GCC) || COMPILER(MSVC))
+#if (CPU(X86) || CPU(X86_64) || CPU(PPC)) && (COMPILER(GCC) || COMPILER(MSVC))
 
 #include <time.h>       /* For nanosleep() */
 
-#if !PLATFORM(WIN_OS)
 #include <sched.h>      /* For sched_yield() */
-#endif
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -49,7 +47,7 @@
 #include <sys/types.h>
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
@@ -64,7 +62,7 @@ struct TCMalloc_SpinLock {
   inline void Lock() {
     int r;
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("xchgl %0, %1"
        : "=r"(r), "=m"(lockword_)
@@ -94,7 +92,7 @@ struct TCMalloc_SpinLock {
 
   inline void Unlock() {
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("movl $0, %0"
        : "=m"(lockword_)
@@ -105,7 +103,7 @@ struct TCMalloc_SpinLock {
       ("isync\n\t"
        "eieio\n\t"
        "stw %1, %0"
-#if PLATFORM(DARWIN) || PLATFORM(PPC)
+#if OS(DARWIN) || CPU(PPC)
        : "=o" (lockword_)
 #else
        : "=m" (lockword_) 
@@ -136,15 +134,11 @@ struct TCMalloc_SpinLock {
 #define SPINLOCK_INITIALIZER { 0 }
 
 static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
-#if !PLATFORM(WIN_OS)
   sched_yield();        // Yield immediately since fast path failed
-#else
-  SwitchToThread();
-#endif
   while (true) {
     int r;
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("xchgl %0, %1"
        : "=r"(r), "=m"(*lockword)
@@ -184,7 +178,7 @@ static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
     // from taking 30 seconds to 16 seconds.
 
     // Sleep for a few milliseconds
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     Sleep(2);
 #else
     struct timespec tm;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 659bb0e..c46ff31 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -38,6 +38,7 @@
 #include "Assertions.h"
 #include "TCSpinLock.h"
 #include "UnusedParam.h"
+#include "VMTags.h"
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -47,7 +48,7 @@
 #include <sys/types.h>
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include "windows.h"
 #else
 #include <errno.h>
@@ -178,7 +179,7 @@ static void* TryMmap(size_t size, size_t *actual_size, size_t alignment) {
   void* result = mmap(NULL, size + extra,
                       PROT_READ | PROT_WRITE,
                       MAP_PRIVATE|MAP_ANONYMOUS,
-                      -1, 0);
+                      VM_TAG_FOR_TCMALLOC_MEMORY, 0);
   if (result == reinterpret_cast<void*>(MAP_FAILED)) {
     mmap_failure = true;
     return NULL;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
new file mode 100644
index 0000000..042d49e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(PTHREADS)
+
+#include "ThreadIdentifierDataPthreads.h"
+
+#include "Threading.h"
+
+namespace WTF {
+
+pthread_key_t ThreadIdentifierData::m_key;
+
+void clearPthreadHandleForIdentifier(ThreadIdentifier);
+
+ThreadIdentifierData::~ThreadIdentifierData()
+{
+    clearPthreadHandleForIdentifier(m_identifier);
+}
+
+ThreadIdentifier ThreadIdentifierData::identifier()
+{
+    initializeKeyOnce();
+    ThreadIdentifierData* threadIdentifierData = static_cast<ThreadIdentifierData*>(pthread_getspecific(m_key));
+
+    return threadIdentifierData ? threadIdentifierData->m_identifier : 0;
+}
+
+void ThreadIdentifierData::initialize(ThreadIdentifier id)
+{
+    ASSERT(!identifier());
+
+    initializeKeyOnce();
+    pthread_setspecific(m_key, new ThreadIdentifierData(id));
+}
+
+void ThreadIdentifierData::destruct(void* data)
+{
+    ThreadIdentifierData* threadIdentifierData = static_cast<ThreadIdentifierData*>(data);
+    ASSERT(threadIdentifierData);
+
+    if (threadIdentifierData->m_isDestroyedOnce) {
+        delete threadIdentifierData;
+        return;
+    }
+
+    threadIdentifierData->m_isDestroyedOnce = true;
+    // Re-setting the value for key causes another destruct() call after all other thread-specific destructors were called.
+    pthread_setspecific(m_key, threadIdentifierData);
+}
+
+void ThreadIdentifierData::initializeKeyOnceHelper()
+{
+    if (pthread_key_create(&m_key, destruct))
+        CRASH();
+}
+
+void ThreadIdentifierData::initializeKeyOnce()
+{
+    static pthread_once_t onceControl = PTHREAD_ONCE_INIT;
+    if (pthread_once(&onceControl, initializeKeyOnceHelper))
+        CRASH();
+}
+
+} // namespace WTF
+
+#endif // USE(PTHREADS)
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
new file mode 100644
index 0000000..3af87a8
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadIdentifierDataPthreads_h
+#define ThreadIdentifierDataPthreads_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/Threading.h>
+
+namespace WTF {
+
+// Holds ThreadIdentifier in the thread-specific storage and employs pthreads-specific 2-pass destruction to reliably remove
+// ThreadIdentifier from threadMap. It assumes regular ThreadSpecific types don't use multiple-pass destruction.
+class ThreadIdentifierData : public Noncopyable {
+public:
+    ~ThreadIdentifierData();
+
+    // Creates and puts an instance of ThreadIdentifierData into thread-specific storage.
+    static void initialize(ThreadIdentifier identifier);
+
+    // Returns 0 if thread-specific storage was not initialized.
+    static ThreadIdentifier identifier();
+
+private:
+    ThreadIdentifierData(ThreadIdentifier identifier)
+        : m_identifier(identifier)
+        , m_isDestroyedOnce(false)
+    {
+    }
+
+    // This thread-specific destructor is called 2 times when thread terminates:
+    // - first, when all the other thread-specific destructors are called, it simply remembers it was 'destroyed once'
+    // and re-sets itself into the thread-specific slot to make Pthreads to call it again later.
+    // - second, after all thread-specific destructors were invoked, it gets called again - this time, we remove the
+    // ThreadIdentifier from the threadMap, completing the cleanup.
+    static void destruct(void* data);
+
+    static void initializeKeyOnceHelper();
+    static void initializeKeyOnce();
+
+    ThreadIdentifier m_identifier;
+    bool m_isDestroyedOnce;
+    static pthread_key_t m_key;
+};
+
+} // namespace WTF
+
+#endif // ThreadIdentifierDataPthreads_h
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
index b6f5fd3..7e5679f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
@@ -47,13 +47,13 @@
 #include <pthread.h>
 #elif PLATFORM(QT)
 #include <QThreadStorage>
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #include <windows.h>
 #endif
 
 namespace WTF {
 
-#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && OS(WINDOWS)
 // ThreadSpecificThreadExit should be called each time when a thread is detached.
 // This is done automatically for threads created with WTF::createThread.
 void ThreadSpecificThreadExit();
@@ -68,7 +68,7 @@ public:
     ~ThreadSpecific();
 
 private:
-#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && OS(WINDOWS)
     friend void ThreadSpecificThreadExit();
 #endif
     
@@ -76,7 +76,7 @@ private:
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
+#if USE(PTHREADS) || PLATFORM(QT) || OS(WINDOWS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 #if PLATFORM(QT)
@@ -91,15 +91,44 @@ private:
     };
 #endif
 
+#if ENABLE(SINGLE_THREADED)
+    T* m_value;
+#else
 #if USE(PTHREADS)
     pthread_key_t m_key;
 #elif PLATFORM(QT)
     QThreadStorage<Data*> m_key;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     int m_index;
 #endif
+#endif
 };
 
+#if ENABLE(SINGLE_THREADED)
+template<typename T>
+inline ThreadSpecific<T>::ThreadSpecific()
+    : m_value(0)
+{
+}
+
+template<typename T>
+inline ThreadSpecific<T>::~ThreadSpecific()
+{
+}
+
+template<typename T>
+inline T* ThreadSpecific<T>::get()
+{
+    return m_value;
+}
+
+template<typename T>
+inline void ThreadSpecific<T>::set(T* ptr)
+{
+    ASSERT(!get());
+    m_value = ptr;
+}
+#else
 #if USE(PTHREADS)
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
@@ -157,7 +186,12 @@ inline void ThreadSpecific<T>::set(T* ptr)
     m_key.setLocalData(data);
 }
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
+
+// TLS_OUT_OF_INDEXES is not defined on WinCE.
+#ifndef TLS_OUT_OF_INDEXES
+#define TLS_OUT_OF_INDEXES 0xffffffff
+#endif
 
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
 // 1) Once the instance of ThreadSpecific<> is created, it will not be destructed until the program dies.
@@ -171,14 +205,14 @@ template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
 {
-    DWORD tls_key = TlsAlloc();
-    if (tls_key == TLS_OUT_OF_INDEXES)
+    DWORD tlsKey = TlsAlloc();
+    if (tlsKey == TLS_OUT_OF_INDEXES)
         CRASH();
 
     m_index = InterlockedIncrement(&tlsKeyCount()) - 1;
     if (m_index >= kMaxTlsKeySize)
         CRASH();
-    tlsKeys()[m_index] = tls_key;
+    tlsKeys()[m_index] = tlsKey;
 }
 
 template<typename T>
@@ -207,10 +241,12 @@ inline void ThreadSpecific<T>::set(T* ptr)
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
+#endif
 
 template<typename T>
 inline void ThreadSpecific<T>::destroy(void* ptr)
 {
+#if !ENABLE(SINGLE_THREADED)
     Data* data = static_cast<Data*>(ptr);
 
 #if USE(PTHREADS)
@@ -230,7 +266,7 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
     pthread_setspecific(data->owner->m_key, 0);
 #elif PLATFORM(QT)
     // Do nothing here
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
@@ -239,6 +275,7 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
 #if !PLATFORM(QT)
     delete data;
 #endif
+#endif
 }
 
 template<typename T>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
index 1d4185c..49de59e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
@@ -49,13 +49,14 @@ static void* threadEntryPoint(void* contextData)
 {
     NewThreadContext* context = reinterpret_cast<NewThreadContext*>(contextData);
 
-    setThreadNameInternal(context->name);
-
-    // Block until our creating thread has completed any extra setup work.
+    // Block until our creating thread has completed any extra setup work, including
+    // establishing ThreadIdentifier.
     {
         MutexLocker locker(context->creationMutex);
     }
 
+    initializeCurrentThreadInternal(context->name);
+
     // Grab the info that we need out of the context, then deallocate it.
     ThreadFunction entryPoint = context->entryPoint;
     void* data = context->data;
@@ -75,7 +76,7 @@ ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char*
 
     NewThreadContext* context = new NewThreadContext(entryPoint, data, name);
 
-    // Prevent the thread body from executing until we've established the thread identifier
+    // Prevent the thread body from executing until we've established the thread identifier.
     MutexLocker locker(context->creationMutex);
 
     return createThreadInternal(threadEntryPoint, context, name);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 71c9402..50e08bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -61,7 +61,7 @@
 
 #include "Platform.h"
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <windows.h>
 #endif
 
@@ -69,11 +69,13 @@
 #include <wtf/Locker.h>
 #include <wtf/Noncopyable.h>
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WINCE)
+#if OS(WINDOWS) && !OS(WINCE)
 #include <windows.h>
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
 #include <libkern/OSAtomic.h>
-#elif COMPILER(GCC)
+#elif OS(ANDROID)
+#include <cutils/atomic.h>
+#elif COMPILER(GCC) && !OS(SYMBIAN)
 #if (__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 2))
 #include <ext/atomicity.h>
 #else
@@ -84,7 +86,7 @@
 #if USE(PTHREADS)
 #include <pthread.h>
 #elif PLATFORM(GTK)
-#include <wtf/GOwnPtr.h>
+#include "GOwnPtr.h"
 typedef struct _GMutex GMutex;
 typedef struct _GCond GCond;
 #endif
@@ -119,7 +121,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char* threadN
 
 // Called in the thread during initialization.
 // Helpful for platforms where the thread name must be set from within the thread.
-void setThreadNameInternal(const char* threadName);
+void initializeCurrentThreadInternal(const char* threadName);
 
 ThreadIdentifier currentThread();
 bool isMainThread();
@@ -142,7 +144,7 @@ typedef GOwnPtr<GCond> PlatformCondition;
 typedef QT_PREPEND_NAMESPACE(QMutex)* PlatformMutex;
 typedef void* PlatformReadWriteLock; // FIXME: Implement.
 typedef QT_PREPEND_NAMESPACE(QWaitCondition)* PlatformCondition;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 struct PlatformMutex {
     CRITICAL_SECTION m_internalMutex;
     size_t m_recursionCount;
@@ -215,10 +217,10 @@ private:
     PlatformCondition m_condition;
 };
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-#if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WINCE)
+#if COMPILER(MINGW) || COMPILER(MSVC7_OR_LOWER) || OS(WINCE)
 inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
 inline int atomicDecrement(int* addend) { return InterlockedDecrement(reinterpret_cast<long*>(addend)); }
 #else
@@ -226,13 +228,18 @@ inline int atomicIncrement(int volatile* addend) { return InterlockedIncrement(r
 inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(reinterpret_cast<long volatile*>(addend)); }
 #endif
 
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
 
-#elif COMPILER(GCC) && !PLATFORM(SPARC64) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
+#elif OS(ANDROID)
+
+inline int atomicIncrement(int volatile* addend) { return android_atomic_inc(addend); }
+inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
+
+#elif COMPILER(GCC) && !CPU(SPARC64) && !OS(SYMBIAN) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
index 46f23d2..2e8a259 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
@@ -30,11 +30,13 @@
 #include "config.h"
 #include "Threading.h"
 
+#if ENABLE(SINGLE_THREADED)
+
 namespace WTF {
 
 void initializeThreading() { }
 ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return ThreadIdentifier(); }
-void setThreadNameInternal(const char*) { }
+void initializeCurrentThreadInternal(const char*) { }
 int waitForThreadCompletion(ThreadIdentifier, void**) { return 0; }
 void detachThread(ThreadIdentifier) { }
 ThreadIdentifier currentThread() { return ThreadIdentifier(); }
@@ -57,3 +59,5 @@ void lockAtomicallyInitializedStaticMutex() { }
 void unlockAtomicallyInitializedStaticMutex() { }
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index 6cad5e3..2feb808 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -37,6 +37,8 @@
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
 #include "StdLibExtras.h"
+#include "ThreadIdentifierDataPthreads.h"
+#include "ThreadSpecific.h"
 #include "UnusedParam.h"
 #include <errno.h>
 
@@ -45,7 +47,7 @@
 #include <sys/time.h>
 #endif
 
-#if PLATFORM(ANDROID)
+#if OS(ANDROID)
 #include "jni_utility.h"
 #endif
 
@@ -55,10 +57,12 @@ typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
 
 static Mutex* atomicallyInitializedStaticMutex;
 
-#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-static ThreadIdentifier mainThreadIdentifier; // The thread that was the first to call initializeThreading(), which must be the main thread.
+#if !OS(DARWIN) || PLATFORM(CHROMIUM) || USE(WEB_THREAD)
+static pthread_t mainThread; // The thread that was the first to call initializeThreading(), which must be the main thread.
 #endif
 
+void clearPthreadHandleForIdentifier(ThreadIdentifier);
+
 static Mutex& threadMapMutex()
 {
     DEFINE_STATIC_LOCAL(Mutex, mutex, ());
@@ -71,8 +75,8 @@ void initializeThreading()
         atomicallyInitializedStaticMutex = new Mutex;
         threadMapMutex();
         initializeRandomNumberGenerator();
-#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-        mainThreadIdentifier = currentThread();
+#if !OS(DARWIN) || PLATFORM(CHROMIUM) || USE(WEB_THREAD)
+        mainThread = pthread_self();
 #endif
         initializeMainThread();
     }
@@ -108,7 +112,7 @@ static ThreadIdentifier identifierByPthreadHandle(const pthread_t& pthreadHandle
     return 0;
 }
 
-static ThreadIdentifier establishIdentifierForPthreadHandle(pthread_t& pthreadHandle)
+static ThreadIdentifier establishIdentifierForPthreadHandle(const pthread_t& pthreadHandle)
 {
     ASSERT(!identifierByPthreadHandle(pthreadHandle));
 
@@ -128,7 +132,7 @@ static pthread_t pthreadHandleForIdentifier(ThreadIdentifier id)
     return threadMap().get(id);
 }
 
-static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
+void clearPthreadHandleForIdentifier(ThreadIdentifier id)
 {
     MutexLocker locker(threadMapMutex());
 
@@ -137,7 +141,7 @@ static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
     threadMap().remove(id);
 }
 
-#if PLATFORM(ANDROID)
+#if OS(ANDROID)
 // On the Android platform, threads must be registered with the VM before they run.
 struct ThreadData {
     ThreadFunction entryPoint;
@@ -185,13 +189,17 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 }
 #endif
 
-void setThreadNameInternal(const char* threadName)
+void initializeCurrentThreadInternal(const char* threadName)
 {
 #if HAVE(PTHREAD_SETNAME_NP)
     pthread_setname_np(threadName);
 #else
     UNUSED_PARAM(threadName);
 #endif
+
+    ThreadIdentifier id = identifierByPthreadHandle(pthread_self());
+    ASSERT(id);
+    ThreadIdentifierData::initialize(id);
 }
 
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
@@ -199,12 +207,13 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     ASSERT(threadID);
 
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
+    if (!pthreadHandle)
+        return 0;
 
     int joinResult = pthread_join(pthreadHandle, result);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
 
-    clearPthreadHandleForIdentifier(threadID);
     return joinResult;
 }
 
@@ -213,26 +222,30 @@ void detachThread(ThreadIdentifier threadID)
     ASSERT(threadID);
 
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
+    if (!pthreadHandle)
+        return;
 
     pthread_detach(pthreadHandle);
-
-    clearPthreadHandleForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
 {
-    pthread_t currentThread = pthread_self();
-    if (ThreadIdentifier id = identifierByPthreadHandle(currentThread))
+    ThreadIdentifier id = ThreadIdentifierData::identifier();
+    if (id)
         return id;
-    return establishIdentifierForPthreadHandle(currentThread);
+
+    // Not a WTF-created thread, ThreadIdentifier is not established yet.
+    id = establishIdentifierForPthreadHandle(pthread_self());
+    ThreadIdentifierData::initialize(id);
+    return id;
 }
 
 bool isMainThread()
 {
-#if PLATFORM(DARWIN) && !PLATFORM(CHROMIUM)
+#if OS(DARWIN) && !PLATFORM(CHROMIUM) && !USE(WEB_THREAD)
     return pthread_main_np();
 #else
-    return currentThread() == mainThreadIdentifier;
+    return pthread_equal(pthread_self(), mainThread);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
index cccbda1..73c3f0c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -87,10 +87,10 @@
 #include "Threading.h"
 
 #include "MainThread.h"
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && OS(WINDOWS)
 #include "ThreadSpecific.h"
 #endif
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
 #include <process.h>
 #endif
 #if HAVE(ERRNO_H)
@@ -118,7 +118,7 @@ typedef struct tagTHREADNAME_INFO {
 } THREADNAME_INFO;
 #pragma pack(pop)
 
-void setThreadNameInternal(const char* szThreadName)
+void initializeCurrentThreadInternal(const char* szThreadName)
 {
     THREADNAME_INFO info;
     info.dwType = 0x1000;
@@ -161,7 +161,7 @@ void initializeThreading()
         initializeRandomNumberGenerator();
         initializeMainThread();
         mainThreadIdentifier = currentThread();
-        setThreadNameInternal("Main Thread");
+        initializeCurrentThreadInternal("Main Thread");
     }
 }
 
@@ -205,7 +205,7 @@ static unsigned __stdcall wtfThreadEntryPoint(void* param)
 
     void* result = invocation.function(invocation.data);
 
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && OS(WINDOWS)
     // Do the TLS cleanup.
     ThreadSpecificThreadExit();
 #endif
@@ -218,7 +218,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     unsigned threadIdentifier = 0;
     ThreadIdentifier threadID = 0;
     ThreadFunctionInvocation* invocation = new ThreadFunctionInvocation(entryPoint, data);
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     // This is safe on WINCE, since CRT is in the core and innately multithreaded.
     // On desktop Windows, need to use _beginthreadex (not available on WinCE) if using any CRT functions
     HANDLE threadHandle = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)wtfThreadEntryPoint, invocation, 0, (LPDWORD)&threadIdentifier);
@@ -226,7 +226,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     HANDLE threadHandle = reinterpret_cast<HANDLE>(_beginthreadex(0, 0, wtfThreadEntryPoint, invocation, 0, &threadIdentifier));
 #endif
     if (!threadHandle) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         LOG_ERROR("Failed to create thread at entry point %p with data %p: %ld", entryPoint, data, ::GetLastError());
 #elif defined(NO_ERRNO)
         LOG_ERROR("Failed to create thread at entry point %p with data %p.", entryPoint, data);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
index 36fc6c6..9e51ad0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
@@ -1,6 +1,6 @@
  /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -101,6 +101,20 @@ COMPILE_ASSERT((!IsSameType<int, int*>::value), WTF_IsSameType_int_int_pointer_f
 COMPILE_ASSERT((!IsSameType<bool, const bool>::value), WTF_IsSameType_const_change_false);
 COMPILE_ASSERT((!IsSameType<bool, volatile bool>::value), WTF_IsSameType_volatile_change_false);
 
+template <typename T>
+class TestBaseClass {
+};
+
+class TestDerivedClass : public TestBaseClass<int> {
+};
+
+COMPILE_ASSERT((IsSubclass<TestDerivedClass, TestBaseClass<int> >::value), WTF_Test_IsSubclass_Derived_From_Base);
+COMPILE_ASSERT((!IsSubclass<TestBaseClass<int>, TestDerivedClass>::value), WTF_Test_IsSubclass_Base_From_Derived);
+COMPILE_ASSERT((IsSubclassOfTemplate<TestDerivedClass, TestBaseClass>::value), WTF_Test_IsSubclassOfTemplate_Base_From_Derived);
+COMPILE_ASSERT((IsSameType<RemoveTemplate<TestBaseClass<int>, TestBaseClass>::Type, int>::value), WTF_Test_RemoveTemplate);
+COMPILE_ASSERT((IsSameType<RemoveTemplate<int, TestBaseClass>::Type, int>::value), WTF_Test_RemoveTemplate_WithoutTemplate);
+
+
 COMPILE_ASSERT((IsSameType<bool, RemoveConst<const bool>::Type>::value), WTF_test_RemoveConst_const_bool);
 COMPILE_ASSERT((!IsSameType<bool, RemoveConst<volatile bool>::Type>::value), WTF_test_RemoveConst_volatile_bool);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
index 9e75e7a..62dbc49 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
@@ -1,6 +1,6 @@
  /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -104,6 +104,40 @@ namespace WTF {
         static const bool value = true;
     };
 
+    template <typename T, typename U> class IsSubclass {
+        typedef char YesType;
+        struct NoType {
+            char padding[8];
+        };
+
+        static YesType subclassCheck(U*);
+        static NoType subclassCheck(...);
+        static T* t;
+    public:
+        static const bool value = sizeof(subclassCheck(t)) == sizeof(YesType);
+    };
+
+    template <typename T, template<class V> class U> class IsSubclassOfTemplate {
+        typedef char YesType;
+        struct NoType {
+            char padding[8];
+        };
+
+        template<typename W> static YesType subclassCheck(U<W>*);
+        static NoType subclassCheck(...);
+        static T* t;
+    public:
+        static const bool value = sizeof(subclassCheck(t)) == sizeof(YesType);
+    };
+
+    template <typename T, template <class V> class OuterTemplate> struct RemoveTemplate {
+        typedef T Type;
+    };
+
+    template <typename T, template <class V> class OuterTemplate> struct RemoveTemplate<OuterTemplate<T>, OuterTemplate> {
+        typedef T Type;
+    };
+
     template <typename T> struct RemoveConst {
         typedef T Type;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
index 519f518..6600050 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
@@ -26,30 +26,65 @@
 #ifndef VMTags_h
 #define VMTags_h
 
-#include <wtf/Platform.h>
-
 // On Mac OS X, the VM subsystem allows tagging memory requested from mmap and vm_map
 // in order to aid tools that inspect system memory use. 
-#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#if OS(DARWIN)
 
 #include <mach/vm_statistics.h>
 
-#if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
-#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
-#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+#if !defined(TARGETING_TIGER)
+
+#if defined(VM_MEMORY_TCMALLOC)
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(VM_MEMORY_TCMALLOC)
+#else
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(53)
+#endif // defined(VM_MEMORY_TCMALLOC)
+
+#if defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 #define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 #else
-#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(63)
 #define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(64)
+#endif // defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+
+#if defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+#else
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
-#endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#endif // defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+
+#else // !defined(TARGETING_TIGER)
+
+// mmap on Tiger fails with tags that work on Leopard, so fall
+// back to Tiger-compatible tags (that also work on Leopard)
+// when targeting Tiger.
+#define VM_TAG_FOR_TCMALLOC_MEMORY -1
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
+#define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+
+#endif // !defined(TARGETING_TIGER)
+
+// Tags for vm_map and vm_allocate work on both Tiger and Leopard.
+
+#if defined(VM_MEMORY_JAVASCRIPT_CORE)
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
+#else
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(63)
+#endif // defined(VM_MEMORY_JAVASCRIPT_CORE)
+
+#if defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#else
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(69)
+#endif // defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
 
-#else // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#else // OS(DARWIN)
 
+#define VM_TAG_FOR_TCMALLOC_MEMORY -1
 #define VM_TAG_FOR_COLLECTOR_MEMORY -1
 #define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
 #define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY -1
 
-#endif // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#endif // OS(DARWIN)
 
 #endif // VMTags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h
new file mode 100644
index 0000000..2a86eb0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ValueCheck_h
+#define ValueCheck_h
+
+#include <wtf/FastMalloc.h>
+
+namespace WTF {
+
+template<typename T> struct ValueCheck {
+    typedef T TraitType;
+    static void checkConsistency(const T&) { }
+};
+
+#if !ASSERT_DISABLED
+template<typename P> struct ValueCheck<P*> {
+    typedef P* TraitType;
+    static void checkConsistency(const P* p)
+    {
+        if (!p)
+            return;
+        ASSERT(fastMallocSize(p));
+        ValueCheck<P>::checkConsistency(*p);
+    }
+};
+#endif
+
+}
+
+#endif // ValueCheck_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index e1fc5b4..c267050 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -24,6 +24,7 @@
 #include "FastAllocBase.h"
 #include "Noncopyable.h"
 #include "NotFound.h"
+#include "ValueCheck.h"
 #include "VectorTraits.h"
 #include <limits>
 #include <utility>
@@ -48,7 +49,7 @@ namespace WTF {
         #error WTF_ALIGN macros need alignment control.
     #endif
 
-    #if COMPILER(GCC) && (((__GNUC__ * 100) + __GNUC_MINOR__) >= 303)
+    #if COMPILER(GCC) && !COMPILER(INTEL) && (((__GNUC__ * 100) + __GNUC_MINOR__) >= 303)
         typedef char __attribute__((__may_alias__)) AlignedBufferChar; 
     #else
         typedef char AlignedBufferChar; 
@@ -71,7 +72,7 @@ namespace WTF {
     }
 
     template <bool needsDestruction, typename T>
-    class VectorDestructor;
+    struct VectorDestructor;
 
     template<typename T>
     struct VectorDestructor<false, T>
@@ -90,7 +91,7 @@ namespace WTF {
     };
 
     template <bool needsInitialization, bool canInitializeWithMemset, typename T>
-    class VectorInitializer;
+    struct VectorInitializer;
 
     template<bool ignore, typename T>
     struct VectorInitializer<false, ignore, T>
@@ -118,7 +119,7 @@ namespace WTF {
     };
 
     template <bool canMoveWithMemcpy, typename T>
-    class VectorMover;
+    struct VectorMover;
 
     template<typename T>
     struct VectorMover<false, T>
@@ -162,7 +163,7 @@ namespace WTF {
     };
 
     template <bool canCopyWithMemcpy, typename T>
-    class VectorCopier;
+    struct VectorCopier;
 
     template<typename T>
     struct VectorCopier<false, T>
@@ -187,7 +188,7 @@ namespace WTF {
     };
 
     template <bool canFillWithMemset, typename T>
-    class VectorFiller;
+    struct VectorFiller;
 
     template<typename T>
     struct VectorFiller<false, T>
@@ -212,7 +213,7 @@ namespace WTF {
     };
     
     template<bool canCompareWithMemcmp, typename T>
-    class VectorComparer;
+    struct VectorComparer;
     
     template<typename T>
     struct VectorComparer<false, T>
@@ -285,6 +286,20 @@ namespace WTF {
             m_buffer = static_cast<T*>(fastMalloc(newCapacity * sizeof(T)));
         }
 
+        bool tryAllocateBuffer(size_t newCapacity)
+        {
+            if (newCapacity > std::numeric_limits<size_t>::max() / sizeof(T))
+                return false;
+
+            T* newBuffer;
+            if (tryFastMalloc(newCapacity * sizeof(T)).getValue(newBuffer)) {
+                m_capacity = newCapacity;
+                m_buffer = newBuffer;
+                return true;
+            }
+            return false;
+        }
+
         void deallocateBuffer(T* bufferToDeallocate)
         {
             if (m_buffer == bufferToDeallocate) {
@@ -360,6 +375,7 @@ namespace WTF {
         void restoreInlineBufferIfNeeded() { }
 
         using Base::allocateBuffer;
+        using Base::tryAllocateBuffer;
         using Base::deallocateBuffer;
 
         using Base::buffer;
@@ -404,6 +420,15 @@ namespace WTF {
             }
         }
 
+        bool tryAllocateBuffer(size_t newCapacity)
+        {
+            if (newCapacity > inlineCapacity)
+                return Base::tryAllocateBuffer(newCapacity);
+            m_buffer = inlineBuffer();
+            m_capacity = inlineCapacity;
+            return true;
+        }
+
         void deallocateBuffer(T* bufferToDeallocate)
         {
             if (bufferToDeallocate == inlineBuffer())
@@ -537,6 +562,7 @@ namespace WTF {
         void grow(size_t size);
         void resize(size_t size);
         void reserveCapacity(size_t newCapacity);
+        bool tryReserveCapacity(size_t newCapacity);
         void reserveInitialCapacity(size_t initialCapacity);
         void shrinkCapacity(size_t newCapacity);
         void shrinkToFit() { shrinkCapacity(size()); }
@@ -547,6 +573,7 @@ namespace WTF {
         template<typename U> void append(const U&);
         template<typename U> void uncheckedAppend(const U& val);
         template<size_t otherCapacity> void append(const Vector<T, otherCapacity>&);
+        template<typename U> bool tryAppend(const U*, size_t);
 
         template<typename U> void insert(size_t position, const U*, size_t);
         template<typename U> void insert(size_t position, const U&);
@@ -586,9 +613,13 @@ namespace WTF {
             m_buffer.swap(other.m_buffer);
         }
 
+        void checkConsistency();
+
     private:
         void expandCapacity(size_t newMinCapacity);
         const T* expandCapacity(size_t newMinCapacity, const T*);
+        bool tryExpandCapacity(size_t newMinCapacity);
+        const T* tryExpandCapacity(size_t newMinCapacity, const T*);
         template<typename U> U* expandCapacity(size_t newMinCapacity, U*); 
 
         size_t m_size;
@@ -655,6 +686,12 @@ namespace WTF {
                 return *this;
         }
         
+// Works around an assert in VS2010. See https://connect.microsoft.com/VisualStudio/feedback/details/558044/std-copy-should-not-check-dest-when-first-last
+#if COMPILER(MSVC) && defined(_ITERATOR_DEBUG_LEVEL) && _ITERATOR_DEBUG_LEVEL
+        if (!begin())
+            return *this;
+#endif
+
         std::copy(other.begin(), other.begin() + size(), begin());
         TypeOperations::uninitializedCopy(other.begin() + size(), other.end(), end());
         m_size = other.size();
@@ -678,6 +715,12 @@ namespace WTF {
                 return *this;
         }
         
+// Works around an assert in VS2010. See https://connect.microsoft.com/VisualStudio/feedback/details/558044/std-copy-should-not-check-dest-when-first-last
+#if COMPILER(MSVC) && defined(_ITERATOR_DEBUG_LEVEL) && _ITERATOR_DEBUG_LEVEL
+        if (!begin())
+            return *this;
+#endif
+
         std::copy(other.begin(), other.begin() + size(), begin());
         TypeOperations::uninitializedCopy(other.begin() + size(), other.end(), end());
         m_size = other.size();
@@ -739,6 +782,26 @@ namespace WTF {
         return begin() + index;
     }
 
+    template<typename T, size_t inlineCapacity>
+    bool Vector<T, inlineCapacity>::tryExpandCapacity(size_t newMinCapacity)
+    {
+        return tryReserveCapacity(max(newMinCapacity, max(static_cast<size_t>(16), capacity() + capacity() / 4 + 1)));
+    }
+    
+    template<typename T, size_t inlineCapacity>
+    const T* Vector<T, inlineCapacity>::tryExpandCapacity(size_t newMinCapacity, const T* ptr)
+    {
+        if (ptr < begin() || ptr >= end()) {
+            if (!tryExpandCapacity(newMinCapacity))
+                return 0;
+            return ptr;
+        }
+        size_t index = ptr - begin();
+        if (!tryExpandCapacity(newMinCapacity))
+            return 0;
+        return begin() + index;
+    }
+
     template<typename T, size_t inlineCapacity> template<typename U>
     inline U* Vector<T, inlineCapacity>::expandCapacity(size_t newMinCapacity, U* ptr)
     {
@@ -794,6 +857,21 @@ namespace WTF {
     }
     
     template<typename T, size_t inlineCapacity>
+    bool Vector<T, inlineCapacity>::tryReserveCapacity(size_t newCapacity)
+    {
+        if (newCapacity <= capacity())
+            return true;
+        T* oldBuffer = begin();
+        T* oldEnd = end();
+        if (!m_buffer.tryAllocateBuffer(newCapacity))
+            return false;
+        ASSERT(begin());
+        TypeOperations::move(oldBuffer, oldEnd, begin());
+        m_buffer.deallocateBuffer(oldBuffer);
+        return true;
+    }
+    
+    template<typename T, size_t inlineCapacity>
     inline void Vector<T, inlineCapacity>::reserveInitialCapacity(size_t initialCapacity)
     {
         ASSERT(!m_size);
@@ -845,6 +923,25 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity> template<typename U>
+    bool Vector<T, inlineCapacity>::tryAppend(const U* data, size_t dataSize)
+    {
+        size_t newSize = m_size + dataSize;
+        if (newSize > capacity()) {
+            data = tryExpandCapacity(newSize, data);
+            if (!data)
+                return false;
+            ASSERT(begin());
+        }
+        if (newSize < m_size)
+            return false;
+        T* dest = end();
+        for (size_t i = 0; i < dataSize; ++i)
+            new (&dest[i]) T(data[i]);
+        m_size = newSize;
+        return true;
+    }
+
+    template<typename T, size_t inlineCapacity> template<typename U>
     ALWAYS_INLINE void Vector<T, inlineCapacity>::append(const U& val)
     {
         const U* ptr = &val;
@@ -854,7 +951,7 @@ namespace WTF {
                 return;
         }
             
-#if COMPILER(MSVC7)
+#if COMPILER(MSVC7_OR_LOWER)
         // FIXME: MSVC7 generates compilation errors when trying to assign
         // a pointer to a Vector of its base class (i.e. can't downcast). So far
         // I've been unable to determine any logical reason for this, so I can
@@ -987,6 +1084,15 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity>
+    inline void Vector<T, inlineCapacity>::checkConsistency()
+    {
+#if !ASSERT_DISABLED
+        for (size_t i = 0; i < size(); ++i)
+            ValueCheck<T>::checkConsistency(at(i));
+#endif
+    }
+
+    template<typename T, size_t inlineCapacity>
     void deleteAllValues(const Vector<T, inlineCapacity>& collection)
     {
         typedef typename Vector<T, inlineCapacity>::const_iterator iterator;
@@ -1016,6 +1122,15 @@ namespace WTF {
         return !(a == b);
     }
 
+#if !ASSERT_DISABLED
+    template<typename T> struct ValueCheck<Vector<T> > {
+        typedef Vector<T> TraitType;
+        static void checkConsistency(const Vector<T>& v)
+        {
+            v.checkConsistency();
+        }
+    };
+#endif
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h
new file mode 100644
index 0000000..3c40b61
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Vector3_h
+#define Vector3_h
+
+#include <math.h>
+
+namespace WebCore {
+
+class Vector3 {
+public:
+    Vector3()
+        : m_x(0.0)
+        , m_y(0.0)
+        , m_z(0.0)
+    {
+    }
+
+    Vector3(double x, double y, double z)
+        : m_x(x)
+        , m_y(y)
+        , m_z(z)
+    {
+    }
+
+    Vector3(const float p[3])
+        : m_x(p[0])
+        , m_y(p[1])
+        , m_z(p[2])
+    {
+    }
+
+    Vector3(const double p[3])
+        : m_x(p[0])
+        , m_y(p[1])
+        , m_z(p[2])
+    {
+    }
+
+    double abs() const
+    {
+        return sqrt(m_x * m_x + m_y * m_y + m_z * m_z);
+    }
+
+    bool isZero() const
+    {
+        return !m_x && !m_y && !m_z;
+    }
+
+    void normalize()
+    {
+        double absValue = abs();
+        if (!absValue)
+            return;
+
+        double k = 1.0 / absValue;
+        m_x *= k;
+        m_y *= k;
+        m_z *= k;
+    }
+
+    double x() const { return m_x; }
+    double y() const { return m_y; }
+    double z() const { return m_z; }
+
+private:
+    double m_x;
+    double m_y;
+    double m_z;
+};
+
+inline Vector3 operator+(const Vector3& v1, const Vector3& v2)
+{
+    return Vector3(v1.x() + v2.x(), v1.y() + v2.y(), v1.z() + v2.z());
+}
+
+inline Vector3 operator-(const Vector3& v1, const Vector3& v2)
+{
+    return Vector3(v1.x() - v2.x(), v1.y() - v2.y(), v1.z() - v2.z());
+}
+
+inline Vector3 operator*(double k, const Vector3& v)
+{
+    return Vector3(k * v.x(), k * v.y(), k * v.z());
+}
+
+inline Vector3 operator*(const Vector3& v, double k)
+{
+    return Vector3(k * v.x(), k * v.y(), k * v.z());
+}
+
+inline double dot(const Vector3& v1, const Vector3& v2)
+{
+    return v1.x() * v2.x() + v1.y() * v2.y() + v1.z() * v2.z();
+}
+
+inline Vector3 cross(const Vector3& v1, const Vector3& v2)
+{
+    double x3 = v1.y() * v2.z() - v1.z() * v2.y();
+    double y3 = v1.z() * v2.x() - v1.x() * v2.z();
+    double z3 = v1.x() * v2.y() - v1.y() * v2.x();
+    return Vector3(x3, y3, z3);
+}
+
+inline double distance(const Vector3& v1, const Vector3& v2)
+{
+    return (v1 - v2).abs();
+}
+
+} // WebCore
+
+#endif // Vector3_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
index eb4c279..3f33b29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
@@ -32,7 +32,7 @@ using std::pair;
 namespace WTF {
 
     template<bool isPod, typename T>
-    class VectorTraitsBase;
+    struct VectorTraitsBase;
 
     template<typename T>
     struct VectorTraitsBase<false, T>
@@ -80,9 +80,6 @@ namespace WTF {
     template<typename P>
     struct VectorTraits<OwnPtr<P> > : SimpleClassVectorTraits { };
 
-    template<typename P>
-    struct VectorTraits<std::auto_ptr<P> > : SimpleClassVectorTraits { };
-
     template<typename First, typename Second>
     struct VectorTraits<pair<First, Second> >
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
index d75c17a..6289d04 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
@@ -140,7 +140,6 @@
 #else
 #define NO_ERRNO
 #endif
-#include <float.h>
 #include <math.h>
 #include <stdint.h>
 #include <stdlib.h>
@@ -148,6 +147,7 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/Threading.h>
 
@@ -159,9 +159,9 @@
 #pragma warning(disable: 4554)
 #endif
 
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
 #define IEEE_MC68k
-#elif PLATFORM(MIDDLE_ENDIAN)
+#elif CPU(MIDDLE_ENDIAN)
 #define IEEE_ARM
 #else
 #define IEEE_8087
@@ -262,7 +262,8 @@ typedef union { double d; uint32_t L[2]; } U;
 #define Pack_32
 #endif
 
-#if PLATFORM(PPC64) || PLATFORM(X86_64)
+#if CPU(PPC64) || CPU(X86_64)
+// FIXME: should we enable this on all 64-bit CPUs?
 // 64-bit emulation provided by the compiler is likely to be slower than dtoa own code on 32-bit hardware.
 #define USE_LONG_LONG
 #endif
@@ -560,7 +561,7 @@ static void mult(BigInt& aRef, const BigInt& bRef)
     aRef = c;
 }
 
-struct P5Node {
+struct P5Node : Noncopyable {
     BigInt val;
     P5Node* next;
 };
@@ -1869,7 +1870,7 @@ static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
  *       calculation.
  */
 
-void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(DtoaBuffer result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1908,16 +1909,23 @@ void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rv
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(&u) && !(word0(&u) & 0xfffff))
+        if (!word1(&u) && !(word0(&u) & 0xfffff)) {
             strcpy(result, "Infinity");
-        else 
+            if (rve)
+                *rve = result + 8;
+        } else {
             strcpy(result, "NaN");
+            if (rve)
+                *rve = result + 3;
+        }
         return;
     }
     if (!dval(&u)) {
         *decpt = 1;
         result[0] = '0';
         result[1] = '\0';
+        if (rve)
+            *rve = result + 1;
         return;
     }
 
@@ -2376,4 +2384,83 @@ ret:
         *rve = s;
 }
 
+static ALWAYS_INLINE void append(char*& next, const char* src, unsigned size)
+{
+    for (unsigned i = 0; i < size; ++i)
+        *next++ = *src++;
+}
+
+void doubleToStringInJavaScriptFormat(double d, DtoaBuffer buffer, unsigned* resultLength)
+{
+    ASSERT(buffer);
+
+    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
+    if (isnan(d)) {
+        append(buffer, "NaN", 3);
+        if (resultLength)
+            *resultLength = 3;
+        return;
+    }
+    // -0 -> "0"
+    if (!d) {
+        buffer[0] = '0';
+        if (resultLength)
+            *resultLength = 1;
+        return;
+    }
+
+    int decimalPoint;
+    int sign;
+
+    DtoaBuffer result;
+    char* resultEnd = 0;
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, &resultEnd);
+    int length = resultEnd - result;
+
+    char* next = buffer;
+    if (sign)
+        *next++ = '-';
+
+    if (decimalPoint <= 0 && decimalPoint > -6) {
+        *next++ = '0';
+        *next++ = '.';
+        for (int j = decimalPoint; j < 0; j++)
+            *next++ = '0';
+        append(next, result, length);
+    } else if (decimalPoint <= 21 && decimalPoint > 0) {
+        if (length <= decimalPoint) {
+            append(next, result, length);
+            for (int j = 0; j < decimalPoint - length; j++)
+                *next++ = '0';
+        } else {
+            append(next, result, decimalPoint);
+            *next++ = '.';
+            append(next, result + decimalPoint, length - decimalPoint);
+        }
+    } else if (result[0] < '0' || result[0] > '9')
+        append(next, result, length);
+    else {
+        *next++ = result[0];
+        if (length > 1) {
+            *next++ = '.';
+            append(next, result + 1, length - 1);
+        }
+
+        *next++ = 'e';
+        *next++ = (decimalPoint >= 0) ? '+' : '-';
+        // decimalPoint can't be more than 3 digits decimal given the
+        // nature of float representation
+        int exponential = decimalPoint - 1;
+        if (exponential < 0)
+            exponential = -exponential;
+        if (exponential >= 100)
+            *next++ = static_cast<char>('0' + exponential / 100);
+        if (exponential >= 10)
+            *next++ = static_cast<char>('0' + (exponential % 100) / 10);
+        *next++ = static_cast<char>('0' + exponential % 10);
+    }
+    if (resultLength)
+        *resultLength = next - buffer;
+}
+
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
index cbec7c7..6127f53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,18 @@ namespace WTF {
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    typedef char DtoaBuffer[80];
+    void dtoa(DtoaBuffer result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    // dtoa() for ECMA-262 'ToString Applied to the Number Type.'
+    // The *resultLength will have the length of the resultant string in bufer.
+    // The resultant string isn't terminated by 0.
+    void doubleToStringInJavaScriptFormat(double, DtoaBuffer, unsigned* resultLength);
 
 } // namespace WTF
 
+using WTF::DtoaBuffer;
+using WTF::doubleToStringInJavaScriptFormat;
+
 #endif // WTF_dtoa_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
new file mode 100644
index 0000000..da0d839
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2008 Collabora Ltd.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GOwnPtr.h"
+
+#include <gio/gio.h>
+#include <glib.h>
+
+namespace WTF {
+
+template <> void freeOwnedGPtr<GError>(GError* ptr)
+{
+    if (ptr)
+        g_error_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GList>(GList* ptr)
+{
+    g_list_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GCond>(GCond* ptr)
+{
+    if (ptr)
+        g_cond_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GMutex>(GMutex* ptr)
+{
+    if (ptr)
+        g_mutex_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GPatternSpec>(GPatternSpec* ptr)
+{
+    if (ptr)
+        g_pattern_spec_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GDir>(GDir* ptr)
+{
+    if (ptr)
+        g_dir_close(ptr);
+}
+
+template <> void freeOwnedGPtr<GFile>(GFile* ptr)
+{
+    if (ptr)
+        g_object_unref(ptr);
+}
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h
new file mode 100644
index 0000000..1fc594c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h
@@ -0,0 +1,148 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef GOwnPtr_h
+#define GOwnPtr_h
+
+#include <algorithm>
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+
+// Forward delcarations at this point avoid the need to include GLib includes
+// in WTF headers.
+typedef struct _GError GError;
+typedef struct _GList GList;
+typedef struct _GCond GCond;
+typedef struct _GMutex GMutex;
+typedef struct _GPatternSpec GPatternSpec;
+typedef struct _GDir GDir;
+typedef struct _GHashTable GHashTable;
+typedef struct _GFile GFile;
+extern "C" void g_free(void*);
+
+namespace WTF {
+
+template <typename T> inline void freeOwnedGPtr(T* ptr);
+template<> void freeOwnedGPtr<GError>(GError*);
+template<> void freeOwnedGPtr<GList>(GList*);
+template<> void freeOwnedGPtr<GCond>(GCond*);
+template<> void freeOwnedGPtr<GMutex>(GMutex*);
+template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
+template<> void freeOwnedGPtr<GDir>(GDir*);
+template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
+template<> void freeOwnedGPtr<GFile>(GFile*);
+
+template <typename T> class GOwnPtr : public Noncopyable {
+public:
+    explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
+    ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
+
+    T* get() const { return m_ptr; }
+    T* release()
+    {
+        T* ptr = m_ptr;
+        m_ptr = 0;
+        return ptr;
+    }
+
+    T*& outPtr()
+    {
+        ASSERT(!m_ptr);
+        return m_ptr;
+    }
+
+    void set(T* ptr)
+    {
+        ASSERT(!ptr || m_ptr != ptr);
+        freeOwnedGPtr(m_ptr);
+        m_ptr = ptr;
+    }
+
+    void clear()
+    {
+        freeOwnedGPtr(m_ptr);
+        m_ptr = 0;
+    }
+
+    T& operator*() const
+    {
+        ASSERT(m_ptr);
+        return *m_ptr;
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_ptr);
+        return m_ptr;
+    }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GOwnPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
+
+    void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
+
+private:
+    T* m_ptr;
+};
+
+template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> inline void freeOwnedGPtr(T* ptr)
+{
+    g_free(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GOwnPtr;
+
+#endif // GOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp
new file mode 100644
index 0000000..e7cf34b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Martin Robinson
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GRefPtr.h"
+
+#include <glib.h>
+
+namespace WTF {
+
+template <> GHashTable* refGPtr(GHashTable* ptr)
+{
+    if (ptr)
+        g_hash_table_ref(ptr);
+    return ptr;
+}
+
+template <> void derefGPtr(GHashTable* ptr)
+{
+    g_hash_table_unref(ptr);
+}
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h
new file mode 100644
index 0000000..66739ef
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *  Copyright (C) 2009 Martin Robinson
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WTF_GRefPtr_h
+#define WTF_GRefPtr_h
+
+#include "AlwaysInline.h"
+#include <algorithm>
+
+typedef struct _GHashTable GHashTable;
+
+namespace WTF {
+
+enum GRefPtrAdoptType { GRefPtrAdopt };
+template <typename T> inline T* refGPtr(T*);
+template <typename T> inline void derefGPtr(T*);
+template <typename T> class GRefPtr;
+template <typename T> GRefPtr<T> adoptGRef(T*);
+template <> GHashTable* refGPtr(GHashTable* ptr);
+template <> void derefGPtr(GHashTable* ptr);
+
+template <typename T> class GRefPtr {
+public:
+    GRefPtr() : m_ptr(0) { }
+    GRefPtr(T* ptr) : m_ptr(ptr) { if (ptr) refGPtr(ptr); }
+    GRefPtr(const GRefPtr& o) : m_ptr(o.m_ptr) { if (T* ptr = m_ptr) refGPtr(ptr); }
+    template <typename U> GRefPtr(const GRefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) refGPtr(ptr); }
+
+    ~GRefPtr() { if (T* ptr = m_ptr) derefGPtr(ptr); }
+
+    void clear()
+    {
+        if (T* ptr = m_ptr)
+            derefGPtr(ptr);
+        m_ptr = 0;
+    }
+
+    T* get() const { return m_ptr; }
+    T& operator*() const { return *m_ptr; }
+    ALWAYS_INLINE T* operator->() const { return m_ptr; }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GRefPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GRefPtr::m_ptr : 0; }
+
+    GRefPtr& operator=(const GRefPtr&);
+    GRefPtr& operator=(T*);
+    template <typename U> GRefPtr& operator=(const GRefPtr<U>&);
+
+    void swap(GRefPtr&);
+    friend GRefPtr adoptGRef<T>(T*);
+
+private:
+    static T* hashTableDeletedValue() { return reinterpret_cast<T*>(-1); }
+    // Adopting constructor.
+    GRefPtr(T* ptr, GRefPtrAdoptType) : m_ptr(ptr) {}
+
+    T* m_ptr;
+};
+
+template <typename T> inline GRefPtr<T>& GRefPtr<T>::operator=(const GRefPtr<T>& o)
+{
+    T* optr = o.get();
+    if (optr)
+        refGPtr(optr);
+    T* ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        derefGPtr(ptr);
+    return *this;
+}
+
+template <typename T> inline GRefPtr<T>& GRefPtr<T>::operator=(T* optr)
+{
+    T* ptr = m_ptr;
+    if (optr)
+        refGPtr(optr);
+    m_ptr = optr;
+    if (ptr)
+        derefGPtr(ptr);
+    return *this;
+}
+
+template <class T> inline void GRefPtr<T>::swap(GRefPtr<T>& o)
+{
+    std::swap(m_ptr, o.m_ptr);
+}
+
+template <class T> inline void swap(GRefPtr<T>& a, GRefPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GRefPtr<T>& a, const GRefPtr<U>& b)
+{
+    return a.get() == b.get();
+}
+
+template <typename T, typename U> inline bool operator==(const GRefPtr<T>& a, U* b)
+{
+    return a.get() == b;
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GRefPtr<U>& b)
+{
+    return a == b.get();
+}
+
+template <typename T, typename U> inline bool operator!=(const GRefPtr<T>& a, const GRefPtr<U>& b)
+{
+    return a.get() != b.get();
+}
+
+template <typename T, typename U> inline bool operator!=(const GRefPtr<T>& a, U* b)
+{
+    return a.get() != b;
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GRefPtr<U>& b)
+{
+    return a != b.get();
+}
+
+template <typename T, typename U> inline GRefPtr<T> static_pointer_cast(const GRefPtr<U>& p)
+{
+    return GRefPtr<T>(static_cast<T*>(p.get()));
+}
+
+template <typename T, typename U> inline GRefPtr<T> const_pointer_cast(const GRefPtr<U>& p)
+{
+    return GRefPtr<T>(const_cast<T*>(p.get()));
+}
+
+template <typename T> inline T* getPtr(const GRefPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> GRefPtr<T> adoptGRef(T* p)
+{
+    return GRefPtr<T>(p, GRefPtrAdopt);
+}
+
+template <typename T> inline T* refGPtr(T* ptr)
+{
+    if (ptr)
+        g_object_ref_sink(ptr);
+    return ptr;
+}
+
+template <typename T> inline void derefGPtr(T* ptr)
+{
+    if (ptr)
+        g_object_unref(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GRefPtr;
+using WTF::refGPtr;
+using WTF::derefGPtr;
+using WTF::adoptGRef;
+using WTF::static_pointer_cast;
+using WTF::const_pointer_cast;
+
+#endif // WTF_GRefPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
index 1fdd2bb..dc04a68 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "Threading.h"
 
+#if !ENABLE(SINGLE_THREADED)
+
 #include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
@@ -64,6 +66,21 @@ void ThreadPrivate::run()
     m_returnValue = m_entryPoint(m_data);
 }
 
+class ThreadMonitor : public QObject {
+    Q_OBJECT
+public:
+    static ThreadMonitor * instance()
+    {
+        static ThreadMonitor *instance = new ThreadMonitor();
+        return instance;
+    }
+
+public Q_SLOTS:
+    void threadFinished()
+    {
+        sender()->deleteLater();
+    }
+};
 
 static Mutex* atomicallyInitializedStaticMutex;
 
@@ -155,6 +172,9 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
         LOG_ERROR("Failed to create thread at entry point %p with data %p", entryPoint, data);
         return 0;
     }
+
+    QObject::connect(thread, SIGNAL(finished()), ThreadMonitor::instance(), SLOT(threadFinished()));
+
     thread->start();
 
     QThread* threadRef = static_cast<QThread*>(thread);
@@ -162,7 +182,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     return establishIdentifierForThread(threadRef);
 }
 
-void setThreadNameInternal(const char*)
+void initializeCurrentThreadInternal(const char*)
 {
 }
 
@@ -181,8 +201,10 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     return !res;
 }
 
-void detachThread(ThreadIdentifier)
+void detachThread(ThreadIdentifier threadID)
 {
+    ASSERT(threadID);
+    clearThreadForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
@@ -267,3 +289,7 @@ void ThreadCondition::broadcast()
 }
 
 } // namespace WebCore
+
+#include "ThreadingQt.moc"
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
index cc8fd15..6a28e9e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 
 #include "BlockAllocatorSymbian.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp
new file mode 100644
index 0000000..baa7841
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if OS(SYMBIAN)
+
+#include "RegisterFileAllocatorSymbian.h"
+
+namespace WTF {
+
+/** Efficiently allocates memory pools of size poolSize.
+ * Primarily designed for JSC RegisterFile's needs.
+ * Not thread-safe.
+ */
+RegisterFileAllocator::RegisterFileAllocator(TUint32 reservationSize, TUint32 poolSize) :
+    m_reserved(reservationSize), m_poolSize(poolSize)
+{
+    // Get system's page size value.
+    SYMBIAN_PAGESIZE(m_pageSize);
+
+    // We only accept multiples of system page size for both initial reservation
+    // and the alignment/pool size
+    m_reserved = SYMBIAN_ROUNDUPTOMULTIPLE(m_reserved, m_pageSize);
+    __ASSERT_ALWAYS(SYMBIAN_ROUNDUPTOMULTIPLE(m_poolSize, m_pageSize),
+                    User::Panic(_L("RegisterFileAllocator1"), KErrArgument));
+
+    // Open a Symbian RChunk, and reserve requested virtual address range
+    // Any thread in this process can operate this RChunk due to EOwnerProcess access rights.
+    TInt ret = m_chunk.CreateDisconnectedLocal(0 , 0, (TInt)m_reserved , EOwnerProcess);
+    if (ret != KErrNone)
+        User::Panic(_L("RegisterFileAllocator2"), ret);
+
+    m_buffer = (void*)m_chunk.Base();
+    m_resEnd = (void*)(m_chunk.Base() + m_chunk.MaxSize());
+    m_comEnd = m_buffer;
+}
+
+RegisterFileAllocator::~RegisterFileAllocator()
+{
+    // release everything!
+    m_chunk.Decommit(0, m_chunk.MaxSize());
+    m_chunk.Close();
+}
+
+void* RegisterFileAllocator::buffer() const
+{
+    return m_buffer;
+}
+
+void RegisterFileAllocator::grow(void* newEnd)
+{
+    // trying to commit more memory than reserved!
+    if (newEnd > m_resEnd)
+        return;
+
+    if (newEnd > m_comEnd) {
+        TInt nBytes = (TInt)(newEnd) - (TInt)(m_comEnd);
+        nBytes = SYMBIAN_ROUNDUPTOMULTIPLE(nBytes, m_poolSize);
+        TInt offset = (TInt)m_comEnd - (TInt)m_buffer;
+
+        TInt ret = m_chunk.Commit(offset, nBytes);
+        if (ret == KErrNone)
+            m_comEnd = (void*)(m_chunk.Base() + m_chunk.Size());
+    }
+}
+
+void RegisterFileAllocator::shrink(void* newEnd)
+{
+    if (newEnd < m_comEnd) {
+        TInt nBytes = (TInt)newEnd - (TInt)m_comEnd;
+        if (nBytes >= m_poolSize) {
+            TInt offset = SYMBIAN_ROUNDUPTOMULTIPLE((TUint)newEnd, m_poolSize) - (TInt)m_buffer;
+            nBytes = (TInt)m_comEnd - offset - (TInt)m_buffer;
+            if (nBytes > 0) {
+                TInt ret = m_chunk.Decommit(offset, nBytes);
+                if (ret == KErrNone)
+                    m_comEnd = (void*)(m_chunk.Base() + m_chunk.Size());
+            }
+        }
+    }
+}
+
+} // end of namespace
+
+#endif // SYMBIAN
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.h b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.h
new file mode 100644
index 0000000..4cfc8c5
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RegisterFileAllocatorSymbian_h
+#define RegisterFileAllocatorSymbian_h
+
+#include "SymbianDefines.h"
+
+namespace WTF {
+
+/**
+ *  Allocates contiguous regions of size poolSize.
+ *  poolSize must be a multiple of system page size (typically 4K on Symbian/ARM)
+ *
+ *  @param reservationSize Virtual address range to be reserved upon creation of chunk (bytes).
+ *  @param poolSize Size of a single allocation.
+ */
+class RegisterFileAllocator {
+
+public:
+    RegisterFileAllocator(
+            TUint32 reservationSize, TUint32 poolSize = SYMBIAN_REGFILEALLOC_DEFAULTPOOLSIZE);
+    ~RegisterFileAllocator();
+    void* buffer() const;
+    void grow(void* newEnd);
+    void shrink(void* newEnd);
+
+private:
+    RChunk   m_chunk; // Symbian chunk that lets us reserve/commit/decommit
+
+    // all following values are in numbers of bytes
+    TInt     m_pageSize; // cached value of system page size, typically 4K on Symbian
+    TUint32  m_reserved; // total number of reserved bytes in virtual memory
+    TUint32  m_poolSize; // size of one memory pool, set by default to 64K in wtf/symbian/SymbianDefines.h
+
+    void* m_buffer; // pointer to base of the chunk
+    void* m_comEnd; // pointer to end of currently committed memory
+    void* m_resEnd; // pointer to end of reserved memory
+
+};
+
+} // end of namespace
+
+#endif // RegisterFileAllocatorSymbian_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/SymbianDefines.h b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/SymbianDefines.h
new file mode 100644
index 0000000..43e22b3
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/SymbianDefines.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SymbianDefines_h
+#define SymbianDefines_h
+
+#include <e32cmn.h>
+#include <e32std.h>
+#include <hal.h>
+
+#define SYMBIAN_PAGESIZE(x) (HAL::Get(HALData::EMemoryPageSize, x));
+#define SYMBIAN_FREERAM(x)  (HAL::Get(HALData::EMemoryRAMFree, x));
+#define SYMBIAN_ROUNDUPTOMULTIPLE(x, multipleof) ( (x + multipleof - 1) & ~(multipleof - 1) )
+
+#define SYMBIAN_REGFILEALLOC_DEFAULTPOOLSIZE 65536 // 64K
+
+#endif // SymbianDefines_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
index 51e8a06..fe6a809 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
@@ -29,8 +29,8 @@
 #ifndef WTF_Collator_h
 #define WTF_Collator_h
 
-#include <memory>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
@@ -47,7 +47,7 @@ namespace WTF {
         ~Collator();
         void setOrderLowerFirst(bool);
 
-        static std::auto_ptr<Collator> userDefault();
+        static PassOwnPtr<Collator> userDefault();
 
         Result collate(const ::UChar*, size_t, const ::UChar*, size_t) const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
index eddbe53..4e05432 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
@@ -45,9 +45,9 @@ void Collator::setOrderLowerFirst(bool)
 {
 }
 
-std::auto_ptr<Collator> Collator::userDefault()
+PassOwnPtr<Collator> Collator::userDefault()
 {
-    return std::auto_ptr<Collator>(new Collator(0));
+    return new Collator(0);
 }
 
 // A default implementation for platforms that lack Unicode-aware collation.
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
index 9e713fe..21d5856 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "UTF8.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index 7016a03..d59439d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -26,11 +26,7 @@
 #include <wtf/Assertions.h>
 
 #if USE(QT4_UNICODE)
-#if COMPILER(WINSCW) || COMPILER(RVCT)
-#include "wtf/unicode/qt4/UnicodeQt4.h"
-#else
 #include "qt4/UnicodeQt4.h"
-#endif
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
 #elif USE(GLIB_UNICODE)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
index a779b36..e20c376 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -19,6 +19,7 @@
  *
  */
 
+#include "config.h"
 #include "UnicodeGLib.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
index c03d3ec..46b00ea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -26,7 +26,7 @@
 #define UnicodeGLib_h
 
 #include "UnicodeMacrosFromICU.h"
-#include <wtf/GOwnPtr.h>
+#include "GOwnPtr.h"
 
 #include <glib.h>
 #include <pango/pango.h>
@@ -152,6 +152,11 @@ inline bool isArabicChar(UChar32 c)
     return c >= 0x0600 && c <= 0x06FF;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return g_unichar_isalnum(c);
+}
+
 inline bool isFormatChar(UChar32 c)
 {
     return g_unichar_type(c) == G_UNICODE_FORMAT;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
index 6376bb3..ecab5bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
@@ -36,7 +36,7 @@
 #include <unicode/ucol.h>
 #include <string.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include "RetainPtr.h"
 #include <CoreFoundation/CoreFoundation.h>
 #endif
@@ -57,11 +57,11 @@ Collator::Collator(const char* locale)
 {
 }
 
-std::auto_ptr<Collator> Collator::userDefault()
+PassOwnPtr<Collator> Collator::userDefault()
 {
-#if PLATFORM(DARWIN) && PLATFORM(CF)
+#if OS(DARWIN) && PLATFORM(CF)
     // Mac OS X doesn't set UNIX locale to match user-selected one, so ICU default doesn't work.
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IPHONE_OS)
     RetainPtr<CFLocaleRef> currentLocale(AdoptCF, CFLocaleCopyCurrent());
     CFStringRef collationOrder = (CFStringRef)CFLocaleGetValue(currentLocale.get(), kCFLocaleCollatorIdentifier);
 #else
@@ -71,11 +71,11 @@ std::auto_ptr<Collator> Collator::userDefault()
     char buf[256];
     if (collationOrder) {
         CFStringGetCString(collationOrder, buf, sizeof(buf), kCFStringEncodingASCII);
-        return std::auto_ptr<Collator>(new Collator(buf));
+        return new Collator(buf);
     } else
-        return std::auto_ptr<Collator>(new Collator(""));
+        return new Collator("");
 #else
-    return std::auto_ptr<Collator>(new Collator(0));
+    return new Collator(0);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index 35c6fbf..a2a5c0a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -164,6 +164,11 @@ inline bool isArabicChar(UChar32 c)
       return ublock_getCode(c) == UBLOCK_ARABIC;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return u_isalnum(c);
+}
+
 inline bool isSeparatorSpace(UChar32 c)
 {
     return u_charType(c) == U_SPACE_SEPARATOR;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index bdf2028..9b1754a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -30,7 +30,6 @@
 
 #include <stdint.h>
 
-#if QT_VERSION >= 0x040300
 QT_BEGIN_NAMESPACE
 namespace QUnicodeTables {
     struct Properties {
@@ -55,10 +54,9 @@ namespace QUnicodeTables {
     Q_CORE_EXPORT const Properties * QT_FASTCALL properties(ushort ucs2);
 }
 QT_END_NAMESPACE
-#endif
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
-#if defined(Q_OS_WIN) || COMPILER(WINSCW)
+#if defined(Q_OS_WIN) || COMPILER(WINSCW) || COMPILER(RVCT)
 typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
@@ -186,8 +184,6 @@ enum CharCategory {
 };
 
 
-#if QT_VERSION >= 0x040300
-
 // FIXME: handle surrogates correctly in all methods
 
 inline UChar32 toLower(UChar32 ch)
@@ -406,138 +402,6 @@ inline CharCategory category(UChar32 c)
     return (CharCategory) U_MASK(QChar::category(c));
 }
 
-#else
-
-inline UChar32 toLower(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toLower().unicode();
-}
-
-inline int toLower(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-  *error = false;
-  if (resultLength < srcLength) {
-    *error = true;
-    return srcLength;
-  }
-  for (int i = 0; i < srcLength; ++i)
-    result[i] = QChar(src[i]).toLower().unicode();
-  return srcLength;
-}
-
-inline UChar32 toUpper(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toUpper().unicode();
-}
-
-inline int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    *error = false;
-    if (resultLength < srcLength) {
-        *error = true;
-        return srcLength;
-    }
-    for (int i = 0; i < srcLength; ++i)
-        result[i] = QChar(src[i]).toUpper().unicode();
-    return srcLength;
-}
-
-inline int toTitleCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toUpper().unicode();
-}
-
-inline UChar32 foldCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toLower().unicode();
-}
-
-inline int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    return toLower(result, resultLength, src, srcLength, error);
-}
-
-inline bool isPrintableChar(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPrint();
-}
-
-inline bool isArabicChar(UChar32 c)
-{
-    return c >= 0x0600 && c <= 0x06FF;
-}
-
-inline bool isSeparatorSpace(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Separator_Space;
-}
-
-inline bool isPunct(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPunct();
-}
-
-inline bool isLower(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Letter_Lowercase;
-}
-
-inline UChar32 mirroredChar(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar(c).mirroredChar().unicode();
-}
-
-inline uint8_t combiningClass(UChar32 c)
-{
-    if (c > 0xffff)
-        return 0;
-    return QChar((unsigned short)c).combiningClass();
-}
-
-inline DecompositionType decompositionType(UChar32 c)
-{
-    if (c > 0xffff)
-        return DecompositionNone;
-    return (DecompositionType)QChar(c).decompositionTag();
-}
-
-inline int umemcasecmp(const UChar* a, const UChar* b, int len)
-{
-    for (int i = 0; i < len; ++i) {
-        QChar c1 = QChar(a[i]).toLower();
-        QChar c2 = QChar(b[i]).toLower();
-        if (c1 != c2)
-        return c1.unicode() - c2.unicode();
-    }
-    return 0;
-}
-
-inline Direction direction(UChar32 c)
-{
-    if (c > 0xffff)
-        return LeftToRight;
-    return (Direction)QChar(c).direction();
-}
-
-inline CharCategory category(UChar32 c)
-{
-    if (c > 0xffff)
-        return NoCategory;
-    return (CharCategory) U_MASK(QChar(c).category());
-}
-
-#endif
-
 } }
 
 #endif // WTF_UNICODE_QT4_H
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
index 966f2a1..2df44f8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
@@ -19,6 +19,7 @@
  *  Boston, MA 02110-1301, USA.
  */
 
+#include "config.h"
 #include "UnicodeWince.h"
 
 #include <wchar.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
index 93d9f75..37174f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
@@ -1,5 +1,4 @@
 /*
- *  This file is part of the KDE libraries
  *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved
  *
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
index b65b368..81d4f80 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
@@ -139,25 +139,25 @@ void* fastZeroedMalloc(size_t n)
     return p;
 }
 
-void* tryFastMalloc(size_t n)
+TryMallocReturnValue tryFastMalloc(size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastMalloc(n);
 }
 
-void* tryFastZeroedMalloc(size_t n)
+TryMallocReturnValue tryFastZeroedMalloc(size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastZeroedMalloc(n);
 }
 
-void* tryFastCalloc(size_t n_elements, size_t element_size)
+TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size)
 {
     MemoryAllocationCanFail canFail;
     return fastCalloc(n_elements, element_size);
 }
 
-void* tryFastRealloc(void* p, size_t n)
+TryMallocReturnValue tryFastRealloc(void* p, size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastRealloc(p, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
index c7b3c81..9cd3d12 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
@@ -708,7 +708,7 @@ const char* compileRegex(const UString& patternString, RegexPattern& pattern)
         unsigned numSubpatterns = pattern.m_numSubpatterns;
 
         constructor.reset();
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
         const char* error =
 #endif
             parse(constructor, patternString, numSubpatterns);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
index 3ed2be9..9d2443a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
@@ -26,13 +26,11 @@
 #ifndef RegexCompiler_h
 #define RegexCompiler_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
-#include <wtf/unicode/Unicode.h>
 #include "RegexParser.h"
 #include "RegexPattern.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
index d088086..647b20a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -280,20 +280,6 @@ public:
         return false;
     }
 
-    bool tryConsumeCharacter(int testChar)
-    {
-        if (input.atEnd())
-            return false;
-
-        int ch = input.read();
-
-        if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
-            input.next();
-            return true;
-        }
-        return false;
-    }
-
     bool checkCharacter(int testChar, int inputPosition)
     {
         return testChar == input.readChecked(inputPosition);
@@ -305,23 +291,6 @@ public:
         return (loChar == ch) || (hiChar == ch);
     }
 
-    bool tryConsumeCharacterClass(CharacterClass* characterClass, bool invert)
-    {
-        if (input.atEnd())
-            return false;
-
-        bool match = testCharacterClass(characterClass, input.read());
-
-        if (invert)
-            match = !match;
-
-        if (match) {
-            input.next();
-            return true;
-        }
-        return false;
-    }
-
     bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
     {
         bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
@@ -1585,7 +1554,7 @@ public:
                 }
 
                 case PatternTerm::TypeParentheticalAssertion: {
-                    unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+                    unsigned alternativeFrameLocation = term.frameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
 
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
                     emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
index 48c9a5e..e3c3122 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
@@ -26,13 +26,11 @@
 #ifndef RegexInterpreter_h
 #define RegexInterpreter_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
-#include <wtf/unicode/Unicode.h>
 #include "RegexParser.h"
 #include "RegexPattern.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index 5ce579a..271d453 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -44,7 +44,7 @@ namespace JSC { namespace Yarr {
 class RegexGenerator : private MacroAssembler {
     friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
 
-#if PLATFORM(ARM)
+#if CPU(ARM)
     static const RegisterID input = ARMRegisters::r0;
     static const RegisterID index = ARMRegisters::r1;
     static const RegisterID length = ARMRegisters::r2;
@@ -54,7 +54,17 @@ class RegexGenerator : private MacroAssembler {
     static const RegisterID regT1 = ARMRegisters::r6;
 
     static const RegisterID returnRegister = ARMRegisters::r0;
-#elif PLATFORM(X86)
+#elif CPU(MIPS)
+    static const RegisterID input = MIPSRegisters::a0;
+    static const RegisterID index = MIPSRegisters::a1;
+    static const RegisterID length = MIPSRegisters::a2;
+    static const RegisterID output = MIPSRegisters::a3;
+
+    static const RegisterID regT0 = MIPSRegisters::t4;
+    static const RegisterID regT1 = MIPSRegisters::t5;
+
+    static const RegisterID returnRegister = MIPSRegisters::v0;
+#elif CPU(X86)
     static const RegisterID input = X86Registers::eax;
     static const RegisterID index = X86Registers::edx;
     static const RegisterID length = X86Registers::ecx;
@@ -64,7 +74,7 @@ class RegexGenerator : private MacroAssembler {
     static const RegisterID regT1 = X86Registers::esi;
 
     static const RegisterID returnRegister = X86Registers::eax;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     static const RegisterID input = X86Registers::edi;
     static const RegisterID index = X86Registers::esi;
     static const RegisterID length = X86Registers::edx;
@@ -1288,11 +1298,11 @@ class RegexGenerator : private MacroAssembler {
 
     void generateEnter()
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         push(X86Registers::ebp);
         move(stackPointerRegister, X86Registers::ebp);
         push(X86Registers::ebx);
-#elif PLATFORM(X86)
+#elif CPU(X86)
         push(X86Registers::ebp);
         move(stackPointerRegister, X86Registers::ebp);
         // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
@@ -1308,28 +1318,32 @@ class RegexGenerator : private MacroAssembler {
     #else
         loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
         push(ARMRegisters::r4);
         push(ARMRegisters::r5);
         push(ARMRegisters::r6);
         move(ARMRegisters::r3, output);
+#elif CPU(MIPS)
+        // Do nothing.
 #endif
     }
 
     void generateReturn()
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         pop(X86Registers::ebx);
         pop(X86Registers::ebp);
-#elif PLATFORM(X86)
+#elif CPU(X86)
         pop(X86Registers::esi);
         pop(X86Registers::edi);
         pop(X86Registers::ebx);
         pop(X86Registers::ebp);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
         pop(ARMRegisters::r6);
         pop(ARMRegisters::r5);
         pop(ARMRegisters::r4);
+#elif CPU(MIPS)
+        // Do nothing
 #endif
         ret();
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
index 1872f21..fd765bc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -26,8 +26,6 @@
 #ifndef RegexJIT_h
 #define RegexJIT_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR_JIT)
 
 #include "MacroAssembler.h"
@@ -37,7 +35,7 @@
 #include <pcre.h>
 struct JSRegExp; // temporary, remove when fallback is removed.
 
-#if PLATFORM(X86) && !COMPILER(MSVC)
+#if CPU(X86) && !COMPILER(MSVC)
 #define YARR_CALL __attribute__ ((regparm (3)))
 #else
 #define YARR_CALL
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
index 64e8463..c946c2e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
@@ -26,14 +26,12 @@
 #ifndef RegexParser_h
 #define RegexParser_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
 #include <UString.h>
+#include <limits.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/unicode/Unicode.h>
-#include <limits.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
index a451131..2e8f468 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
@@ -26,7 +26,6 @@
 #ifndef RegexPattern_h
 #define RegexPattern_h
 
-#include <wtf/Platform.h>
 
 #if ENABLE(YARR)
 
@@ -137,7 +136,7 @@ struct PatternTerm {
 
     PatternTerm(unsigned spatternId)
         : type(TypeBackReference)
-        , invertOrCapture(invertOrCapture)
+        , invertOrCapture(false)
     {
         subpatternId = spatternId;
         quantityType = QuantifierFixedCount;
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7c85fcd..a270d56 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -2,10 +2,6 @@ This is a snapshot of the Qt port of WebKit from
 
         git://gitorious.org/qtwebkit/qtwebkit.git
 
-The commit imported was from the
-
-        qtwebkit/qtwebkit-4.6 branch/tag
-
 and has the sha1 checksum
 
-        bbff6182e525fcf58dbc7426a1fbbf8f31588214
+        6e15c3404d15a8ab72242152ec966e5e388161a2
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 3a9fce0..ac698e3 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,34889 +1,14525 @@
-2009-11-14  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] ASSERT failure while running DRT
-        https://bugs.webkit.org/show_bug.cgi?id=30978
-
-        Add needed Structure typeInfo flags to QtRuntimeObjectImpl and QtRuntimeMethod.
-        These flags are needed after r49649, where HasDefaultmark was changed to OverrideMarkChildren.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-
-2010-06-16  Dawit Alemayehu  <adawit@kde.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] QtWebKit crashes while initializing flash plugin 10.1.53.64.
-        https://bugs.webkit.org/show_bug.cgi?id=40567
-
-        Avoid preventable crashes by ensuring gtk_init() is called in the
-        flash viewer plugins before calling NP_Initialize.
-
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::load):
-
-2010-06-10  Raine Makelainen  <raine.makelainen@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Impossible to set input method hints based HTML5 input types
-        https://bugs.webkit.org/show_bug.cgi?id=40107
-
-        Helper methods for checking "tel", "number", "email",
-        and "url" input element types.
-
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::isTelephoneField):
-        (WebCore::HTMLInputElement::isNumberField):
-        (WebCore::HTMLInputElement::isEmailField):
-        (WebCore::HTMLInputElement::isUrlField):
-
-2010-04-22  Ray Rischpater  <Raymond.Rischpater@Nokia.com>
-
-        Reviewed by Darin Adler.
-
-        In HTMLInputElement.cpp, shouldUseInputMethod does not return true for
-        some text input types (TELEPHONE, NUMBER, URL, and EMAIL). Addressed
-        this by changing shouldUseInputMethod to use internal methods to 
-        check that the field is a text field that isn't a password field. 
-
-        No new tests.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=37719>
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::shouldUseInputMethod):
-
-2010-04-06  Abhinav Mithal <abhinav.mithal@nokia.com>
-
-        Reviewed by Laszlo Gombos.
-
-        [Qt] npapi header leaves XP_WIN flag defined even when __SYMBIAN32__ flag is found
-        https://bugs.webkit.org/show_bug.cgi?id=34614
-
-        Do not define XP_WIN if WebKit is compiled for Symbian.
-
-        No new tests as there is no new functionality.
-
-        * bridge/npapi.h:
-
-2010-05-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=39857
-        Make GIFs loop the correct number of times.  Previously, everyone looped
-        one time too few for non-infinitely-looping GIFs.
-
-        Modified a Qt manual test to be correct and moved it to the general
-        manual test directory.
-
-        * manual-tests/animated-gif-looping.html: Copied from WebCore/manual-tests/qt/qt-gif-test.html.
-        * manual-tests/qt/qt-10loop-anim.gif: Removed.
-        * manual-tests/qt/qt-anim.gif: Removed.
-        * manual-tests/qt/qt-gif-test.html: Removed.
-        * manual-tests/qt/qt-noanim.gif: Removed.
-        * manual-tests/resources/animated-10x.gif: Copied from WebCore/manual-tests/qt/qt-10loop-anim.gif and modified.
-        * manual-tests/resources/animated-infinite.gif: Copied from WebCore/manual-tests/qt/qt-anim.gif.
-        * manual-tests/resources/non-animated.gif: Copied from WebCore/manual-tests/qt/qt-noanim.gif.
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::internalAdvanceAnimation): For a loop count of n, show a total of n + 1 animation cycles.
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::repetitionCount):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::repetitionCount): Remove translation code now that WebCore matches Qt's internal handling of the loop count.  Qt itself may still have a bug here.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::repetitionCount):
-        * platform/image-decoders/gif/GIFImageReader.cpp:
-        (GIFImageReader::read): Translate loop count 0 to "loop infinitely" (by restoring one piece of the Mozilla code we'd removed).
-
-2010-06-08  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Unreviewed Buildbot fix.
-
-        Reset the Qt TextBreakIterator when reusing it.
-
-        * platform/text/qt/TextBreakIteratorQt.cpp:
-        (WebCore::setUpIterator):
-
-2010-06-08  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Antti Koivisto.
-
-        [Qt] TextBreakIterator Qt performance
-        https://bugs.webkit.org/show_bug.cgi?id=39958
-
-        Rework TextBreakIteratorQt to be more in line with the ICU version.
-
-        We now reuse iterators where ever possible. The string data is compared
-        with memcmp, which should be faster than using a hash, as you need
-        to traverse the full buffer in the case the strings don't match,
-        where as the compare would fail quickly.
-
-        * platform/text/qt/TextBreakIteratorQt.cpp:
-        (WebCore::TextBreakIterator::TextBreakIterator):
-        (WebCore::setUpIterator):
-        (WebCore::wordBreakIterator):
-        (WebCore::characterBreakIterator):
-        (WebCore::lineBreakIterator):
-        (WebCore::sentenceBreakIterator):
-
-2010-04-19  Balazs Kelemen  <kb@inf.u-szeged.hu>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Destroy SharedTimerQt before destruction of QCoreApplication.
-
-        To avoid unsafe situations caused by running WebCore code (through firing timers) when destruction of QCoreApplication
-        has been started, we should explicitly destroy the SharedTimerQt instance on application exit.
-        We can achieve that through installing a self-destroying slot for the QCoreApplication::aboutToQuit() signal
-        into the SharedTimerQt instance.
-
-        https://bugs.webkit.org/show_bug.cgi?id=36832
-
-        No functional change so no new tests.
-
-        * platform/qt/SharedTimerQt.cpp:
-        (WebCore::SharedTimerQt::SharedTimerQt):
-        (WebCore::SharedTimerQt::destroy):
-        (WebCore::SharedTimerQt::inst):
-
-2010-05-04  Tucker Jay  <jay.tucker@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Animated GIF images does not animate 10x as expected by default.
-        https://bugs.webkit.org/show_bug.cgi?id=36818
-
-        Added test case to existing manual test to test the
-        fixed functionality.
-
-        * manual-tests/qt/qt-10loop-anim.gif: Added.
-        * manual-tests/qt/qt-gif-test.html:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::repetitionCount):
-
-2010-04-21  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] startAnimation() is not needed to preceede nativeImageForCurrentFrame()
-        https://bugs.webkit.org/show_bug.cgi?id=37844
-
-        nativeImageForCurrentFrame() resets the m_decoder parameter under Qt,
-        which is required by startAnimation() to detect frame and repetition counts.
-        Hence, Image::drawTiled cannot start animations under Qt:
-        <html><body background="animated.gif"></body></html> does not work
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
-
-2010-03-10  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Non animated gifs are animated in QtWebKit
-        https://bugs.webkit.org/show_bug.cgi?id=35955
-
-        Properly map Qt animated and non-animated values to WebCore's
-        understanding of animated and non-animated images. Currently
-        we can not map anything to the cAnimationLoopNone value.
-
-        * manual-tests/qt/qt-anim.gif: Added.
-        * manual-tests/qt/qt-gif-test.html: Added.
-        * manual-tests/qt/qt-noanim.gif: Added.
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::repetitionCount):
-
-2010-04-26  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Fix compilation with RVCT 4
-        https://bugs.webkit.org/show_bug.cgi?id=37727
-
-        Swap extern and declspec to fix visibility of symbol imported from QtGui.
-
-        * page/qt/EventHandlerQt.cpp:
-
-2010-04-26  Markus Goetz  <Markus.Goetz@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] HTTP pipelining efficiency increase
-        https://bugs.webkit.org/show_bug.cgi?id=38062
-
-        Increase number of network requests that are fed into
-        QNetworkAccessManager.
-
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
-
-2009-11-03  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Allow a frame to go back to copy-on-scroll when it ceases being overlapped
-
-        The code was not testing slow-scrolling frames for overlappedness, thinking the answer
-        would not matter. That is not the case if the only reason for the slow-scrolling is
-        being overlapped.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped): Added. Returns whether there is any
-        reason besides being overlapped that the frame would need to fully repaint on scroll.
-        * page/FrameView.h:
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint): Use useSlowRepaintsIfNotOverlapped().
-
-2010-04-09  David Leong  <david.leong@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Symbian apps crash on exit due to a bad qObject_cast.
-
-        https://bugs.webkit.org/show_bug.cgi?id=37303
-
-        Added check for NULL to avoid the crash.
-
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::platformDestroy):
-
-2009-11-15  Dave Tapuska  <dtapuska@rim.com>
-
-        Reviewed by George Staikos.
-        
-        Compare UChars single unit at a time as opposed to the uint32_t
-        approach as casting to unaligned addresses may cause a bus failure
-        on ARMv5 and below. This change replicates the same defines that
-        exists in AtomicString.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=31475
-        
-        * platform/text/StringHash.h:
-        (WebCore::StringHash::equal):
-
-2010-03-25  yael aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Laszlo Gombos.
-
-        [Qt] Windowed netscape plugins don't work with QGraphicsWebView on Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=35112
-
-        Add a proxy widget when loading a QWidget based plugin in a QGraphicsWebView.
-
-        * plugins/symbian/PluginContainerSymbian.cpp:
-        (PluginContainerSymbian::PluginContainerSymbian):
-        (PluginContainerSymbian::focusInEvent):
-        * plugins/symbian/PluginContainerSymbian.h:
-        (WebCore::PluginContainerSymbian::proxy):
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-
-2010-03-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed for the Qt 4.6 branch by Simon Hausmann.
-
-        Accept XHTML-MP content type as XHTML content
-        https://bugs.webkit.org/show_bug.cgi?id=34262
-
-        Enable processing XHTML-MP mime type as an XHTML document
-        even if XHTML-MP support is not enabled.
-
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedNonImageMimeTypes):
-
-2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
+2010-09-24  Romain Pokrzywka  <romain@kdab.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Don't construct a QLineEdit every time when painting a text field
-        https://bugs.webkit.org/show_bug.cgi?id=36373
-
-        Instead, keep one instance per RenderTheme around.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::findFrameLineWidth):
-
-2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Laszlo Gombos.
-
-        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
-        https://bugs.webkit.org/show_bug.cgi?id=34081
-
-        Defining StringImpl instances as globals will cause a crash on process exit as 
-        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
-        constructing one exiting thread.
-
-        * config.h:
-
-2010-02-02  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=34076
-        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
-
-        Test: fast/forms/misplaced-img-form-registration.html
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
-        to vector again.
-        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
-        that's actually registered.
-
-        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
-        to insert the image element, then there will be no removed from tree notification either,
-        need to unregister right away.
-
-2010-01-25  Alexey Proskuryakov  <ap@apple.com>
-
-        Rubber-stamped by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=34076
-        An image remains accessible via form.property syntax after being removed from document.
-
-        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
-
-        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
-        assertions added in the previous patch - it's mot true that m_for is always a parent; table
-        parsing can reparent the image element, but m_form still needs to be set.
-
-2010-01-25  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=34076
-        An image remains accessible via form.property syntax after being removed from document.
-
-        Tests: fast/forms/removed-image-as-property.html
-               fast/forms/reparented-image-as-property.html
-
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
-        to make observable changes to DOM.
-        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
-        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
-        which happens during parsing.
-        (WebCore::HTMLImageElement::removedFromTree): Ditto.
-
-        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
-        and insertedIntoDocument to private section, as they shouldn't be called directly.
-
-2009-12-08  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
-        <rdar://problem/6856662> and https://webkit.org/b/32293
-
-        Test: fast/loader/input-element-page-cache-crash.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
-          callback after the new m_autocomplete setting has been stored so the unregistration actually
-          takes place.
-
-2009-12-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
-        handling misnested residual style tags
-
-        Test: fast/parser/residual-style-close-ref-clone.html
-
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
-        block stack a strong reference to the cloned residual style element. 
-
-2009-12-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7487164> First line of text cannot be selected
-        https://bugs.webkit.org/show_bug.cgi?id=32749
-
-        Test: fast/text/remove-zero-length-run.html
-
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
-            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
-            text boxes.
-        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
-
-2009-12-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
-        https://bugs.webkit.org/show_bug.cgi?id=31576
-
-        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
-        maintain it's lifetime more effectively.
-
-        Test: fast/parser/xhtml-close-while-parsing.xhtml
-
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::popCurrentNode):
-        * dom/XMLTokenizer.h:
-        (WebCore::XMLParserContext::context):
-        (WebCore::XMLParserContext::XMLParserContext):
-        (WebCore::XMLTokenizer::context):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLParserContext::createStringParser):
-        (WebCore::XMLParserContext::createMemoryParser):
-        (WebCore::XMLParserContext::~XMLParserContext):
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::doWrite):
-        (WebCore::XMLTokenizer::initializeParserContext):
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::lineNumber):
-        (WebCore::XMLTokenizer::columnNumber):
-        (WebCore::XMLTokenizer::stopParsing):
-        (WebCore::parseXMLDocumentFragment):
-        (WebCore::parseAttributes):
-
-2009-11-09  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler and Dan Bernstein.
-
-        <rdar://problem/7328395>
-        https://bugs.webkit.org/show_bug.cgi?id=31277
-
-        When an object tag's style changes (for example when child nodes are added/removed),
-        reuse its Frame (if it has one) instead of creating multiple Frames.
-
-        Test: fast/dom/HTMLObjectElement/children-changed.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::requestObject):
-
-2009-12-05  Adam Langley  <agl@google.com>
-
-        Reviewed by Adam Barth.
-
-        Check that a CSS format() argument is of a valid type.
+        [Qt] Fix the Wince build.
 
-        https://bugs.webkit.org/show_bug.cgi?id=31815
-        http://code.google.com/p/chromium/issues/detail?id=28582
+        * WebCore.pro: Apply msvc flags to wince, too.
 
-        Test: fast/css/url-format-non-string.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFontFaceSrc):
-
-2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
+2010-09-24  Anders Bakken  <agbakken@gmail.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Support for QT_LIBINFIX in Symbian builds
-
-        Configuring Qt with -qtlibinfix parameter will enable installing
-        an alternate version of Qt on devices that already have it on ROM.
-        This patch provides support for infixed builds of Webkit.
-
-        * WebCore.pro:
-
-2010-01-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Enable FAST_MOBILE_SCROLLING on Qt embedded platforms
-        https://bugs.webkit.org/show_bug.cgi?id=34168
+        [Qt] Enable building Qt/Webkit with debug symbols
 
-        Enable FAST_MOBILE_SCROLLING for Qt on Maemo 5, Linux embedded
-        and Symbian
+        With this patch one can configure with -webkit-debug to build Webkit
+        with debug symbols without having to manually edit WebCore.pro.
 
         * WebCore.pro:
 
-2010-01-19  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=33408
-
-        Implements an optimization to ignore fixed background images
-        (i.e. background-attachment: fixed) when a page does not contain
-        any fixed position elements so as to allow fast repaints (via bit
-        blit) when scrolling a page.
-
-        Currently, if a page has elements that specify either a fixed
-        background or a fixed position then we perform a slow repaint
-        (i.e disable blitting) so as to avoid rendering artifacts.
-        However, on low-powered/mobile devices slow repaints can cause
-        noticeable delays when scrolling a page with a fixed background
-        image. By sacrificing support for fixed background images when
-        there are no fixed elements on the page and with come care, we
-        don't need to force slow repaints and can avoid rendering artifacts.
-        Hence, on such devices we can improve the responsiveness of
-        scrolling a page with a fixed background image.
-
-        Note, this optimization is only enabled if the WebKit is built
-        with FAST_MOBILE_SCROLLING enabled.
-
-        Tests: fast/fast-mobile-scrolling/fixed-position-element.html
-               fast/fast-mobile-scrolling/no-fixed-position-elements.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        Disable fixed background attachment if we can blit on scroll.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange):
-
-2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Avoid double-buffering with Qt image decoders
-
-        Pass QIODevice::Unbuffered when opening the QBuffer that
-        wraps the image data, to hint to Qt that no extra buffering
-        is needed.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::setData):
-
-2010-01-14  Diego Gonzalez  <diego.gonzalez@openbossa.org>
-
-        Reviewed by Kenneth Christiansen.
-
-        [Qt] Missing fileSystemPath() method in Qt KURL implementation
-        https://bugs.webkit.org/show_bug.cgi?id=33614
-
-        No new tests.
-
-        * platform/qt/KURLQt.cpp:
-        (WebCore::KURL::fileSystemPath):
-
-2010-02-01  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
+2010-09-16  Thomas Zander <t.zander@nokia.com>
 
-        [Qt] In the StyledPainter determine the style from the Render and Scrollbar theme instead of from the paint device
-        https://bugs.webkit.org/show_bug.cgi?id=34054
+        Reviewed by Andreas Kling.
 
-        Getting the style from the painter's paint device is a hack that breaks when
-        the paint device's style is different than the style that is used when
-        calculating the metries earlier when there is no painter available.
+        https://bugs.webkit.org/show_bug.cgi?id=45878
 
-        This change moves us closer to always using the same style.
+        [Qt] Fixed incorrect Symbian scoping.
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::StylePainter::StylePainter):
-        (WebCore::StylePainter::init):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::paintMenuListButton):
-        (WebCore::RenderThemeQt::paintSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaMuteButton):
-        (WebCore::RenderThemeQt::paintMediaPlayButton):
-        (WebCore::RenderThemeQt::paintMediaSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaSliderThumb):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::paint):
-        (WebCore::ScrollbarThemeQt::hitTest):
-        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
-        (WebCore::ScrollbarThemeQt::scrollbarThickness):
-        (WebCore::ScrollbarThemeQt::thumbLength):
-        (WebCore::ScrollbarThemeQt::trackPosition):
-        (WebCore::ScrollbarThemeQt::trackLength):
-        (WebCore::ScrollbarThemeQt::paintScrollCorner):
-        (WebCore::ScrollbarThemeQt::style):
-        * platform/qt/ScrollbarThemeQt.h:
+        The missing install functionality is only true for mmp based systems.
 
-2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+        * WebCore.pro: limit functionality to mmp systems.
 
-        Reviewed by Kenneth Rohde Christiansen.
+2010-09-09  Kristian Amlie  <kristian.amlie@nokia.com>
 
-        [Qt] Use the fallback style on Maemo 5
+        Reviewed by Andreas Kling.
 
-        https://bugs.webkit.org/show_bug.cgi?id=34376
+        [Qt] Fixed incorrect Symbian scoping.
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::fallbackStyle):
-        (WebCore::RenderThemeQt::qStyle):
-        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
-        * platform/qt/RenderThemeQt.h:
-
-2010-01-29  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Speed up the WebCore::String -> QString conversion
-
-        Use QString(const QChar *, int len) constructor instead of QString::fromUtf16 to
-        avoid BOM checks and byteswapping.
-
-        * bridge/qt/qt_class.cpp:
-        (JSC::Bindings::QtClass::fieldNamed):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-
-2010-01-14  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Enable scrolling optimization for pages with embedded widgets
-
-        https://bugs.webkit.org/show_bug.cgi?id=33373
-
-        Added a basic manual test for scrolling of embedded QWidgets.
-
-        * manual-tests/qt/qtplugin-scrolling.html: Added.
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        (WebCore::ScrollView::setParent):
-        * platform/ScrollView.h:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::invalidateRect):
+        The missing install functionality is only true for mmp based systems.
 
-2010-01-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Turn off websocket support by default for Qt 4.6.x
-        https://bugs.webkit.org/show_bug.cgi?id=34284
+        https://bugs.webkit.org/show_bug.cgi?id=45268
 
         * WebCore.pro:
 
-2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-09-12  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] JavaScript prompt is currently broken.
-        https://bugs.webkit.org/show_bug.cgi?id=30914
-
-        Remove the manual test case in favor of an automated
-        test case in WebKit/qt/tests/qwebpage.
-
-        * manual-tests/qt/java-script-prompt.html: Removed.
-
-2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
+        [Qt] fix qt_webkit_version.pri install for in-Qt builds
 
-        Reviewed by Simon Hausmann.
+        Always add the target, even if building inside Qt - as opposed to the
+        headers and libraries, there are no rules for that coming from
+        qbase.pri.
 
-        [Qt] Phone backup support for QtWebkit for Symbian devices.
-        https://bugs.webkit.org/show_bug.cgi?id=34077
+        Task-number: QTBUG-13306
 
         * WebCore.pro:
 
-2010-01-21  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix incorrect dependency to QtXmlPatterns in generated include/QtWebKit/QtWebKit header
-
-        The generated file includes QtXmlPatterns/QtXmlPatterns, which is neither used/required by
-        the public QtWebKit API nor will it be available if Qt is configured with -no-xmlpatterns.
-
-        * WebCore.pro: Trick syncqt to believe that xmlpatterns is not a dependency, so that it's not
-        included in the generated file. It'll still be used and linked to with this trick.
-
-2010-01-17  Srinidhi Shreedhara  <srinidhi.shreedhara@nokia.com>
+2010-09-12  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] [Symbian] SetWindow call in npapi plugin does not happen when the cooridnates are negative
-        https://bugs.webkit.org/show_bug.cgi?id=33573
-
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded): Remove tests for negative
-        coordinates for early return.
-
-2010-01-14  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Laszlo Gombos.
+        [Qt] Let QtWebKit inject itself into the qt configuration
 
-        Platform Symbian specific:
-        Added time-based optimization (-Otime) and increased optimization level to -O3,
-        conditionally for RVCT compiler (for ARM), for increasing performance
-        (primarily affecting JavaScript execution).
-        Default settings are -Ospace and -O2.
+        i.e., don't explicitly deal with qt_webkit_version.pri outside of the
+        webkit source directory.
 
-        No new tests needed because no new funtionality is introduced,
-        only potential regression on existing tests needs to be evaluated.
+        Task-number: QTBUG-12379
 
         * WebCore.pro:
 
-2010-01-13  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-08-20  Girish Ramakrishnan  <girish@forwardbias.in>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Ariya Hidayat.
 
-        [Qt/Win] Flash in QGraphicsWebView does not process hover correctly.
+        [Qt] When using the raster graphics system on Maemo5, allow
+        Flash to render directly into the raster window surface.
+        wmode=transparent is now supported as a result of this change.
         
-        https://bugs.webkit.org/show_bug.cgi?id=33591
+        https://bugs.webkit.org/show_bug.cgi?id=44043
         
-        Mouse hover does not work as expected with the flash in some sites.
-        - http://www.bbc.co.uk/ Hover over the map
-        - http://www.barbie.com/ Hover over the menu items (Games, Videos)
-        The problem appears to be that Flash queries NPNVnetscapeWindow on every
-        mouse hover. I do not how flash uses this value but returning 0 when flash
-        is in windowless mode solves the problem (When using QGraphicsWebView we
-        inject wmode opaque, thereby putting the plugin in windowless mode).
-
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-
-2010-01-13  Miikka Heikkinen <miikka.heikkinen@digia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt/Symbian] Added missing vendor information to qtwebkit.sis
-
-        This information is necessary to Symbian sign the package.
-
-        http://bugreports.qt.nokia.com/browse/QTBUG-7290
-
-        * WebCore.pro:
-
-2010-01-12  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [Qt] XSL stylesheets can load documents from a different origin
-
-        https://bugs.webkit.org/show_bug.cgi?id=33423
-
-        * xml/XSLTProcessorQt.cpp:
-        (WebCore::XSLTUriResolver::XSLTUriResolver):
-        (WebCore::XSLTUriResolver::resolve):
-        (WebCore::XSLTProcessor::transformToString):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paintUsingImageSurfaceExtension):
 
-2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
+2010-08-18  Girish Ramakrishnan  <girish@forwardbias.in>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Allow the application to override online/offline network status
-        https://bugs.webkit.org/show_bug.cgi?id=32684
-
-        Added API to NetworkStateNotifier for forcing network status.
+        [Qt] Implement Maemo5 local rendering NPAPI extension. See 
+        https://wiki.mozilla.org/Plugins:NokiaMaemoImageSurface for details.
 
-        * platform/network/NetworkStateNotifier.h:
-        * platform/network/qt/NetworkStateNotifierPrivate.h:
-        * platform/network/qt/NetworkStateNotifierQt.cpp:
-        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
-        (WebCore::NetworkStateNotifierPrivate::networkAccessPermissionChanged):
-        (WebCore::NetworkStateNotifier::updateState):
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
+        With the local rendering extension, Flash will paint into a 16-bit surface.
+        For wmode=transparent, Flash expects the surface to contain the contents
+        beneath it. As it is tricky to implement the content propagation across all
+        graphics systems, transparent Flash is not supported. We just fill the surface 
+        with white and wmode=transparent behaves the same as wmode=opaque with a white 
+        background.
 
-2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Fix linkage against Qt mobility API bearer management module
-
-        Use the documented .pro file syntax to link against the correct
-        library and (more importantly) get the include paths correct.
+        https://bugs.webkit.org/show_bug.cgi?id=44043
 
         * WebCore.pro:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setValue):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintUsingImageSurfaceExtension):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformGetValueStatic):
 
-2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        [RVCT] ACID3 test crash
-        https://bugs.webkit.org/show_bug.cgi?id=33280
-
-        Workaround developed by Yongjun Zhang.
-
-        * dom/Element.cpp:
-        (WebCore::Element::setAttribute):
+2010-08-17  Girish Ramakrishnan  <girish@forwardbias.in>
 
-2010-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by Antonio Gomes.
 
-        Unreviewed trivial Qt build fix.
+        [Qt] On Maemo5, there is no libgdk-x11-2.0.so symlink. Look for 
+        libgdk-x11-2.0.so.0 instead on X11 and Maemo5.
 
-        Prefix the phonon includes with phonon/ to avoid conflicts with the S60
-        audio routing API ( http://wiki.forum.nokia.com/index.php/Audio_Routing_API ).
+        https://bugs.webkit.org/show_bug.cgi?id=44043
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::getPluginDisplay):
 
-2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-08-17  Girish Ramakrishnan  <girish@forwardbias.in>
 
         Reviewed by Kenneth Rohde Christiansen.
+        Set PluginQuirkRequiresDefaultScreenDepth for all Flash versions and not
+        just Flash 10.
 
-        Do not include Frame.h under WebCore/html/canvas
-        https://bugs.webkit.org/show_bug.cgi?id=33082
-
-        No new tests, as there is no new functionality.
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-
-2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Add support for Symbian def files
-
-        * WebCore.pro:
-
-2009-12-30  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Unreviewed Qt/Symbian build fix.
-
-        Don't build network state notifier support when building inside of Qt.
-        Otherwise the Qt build depends on an external module that itself depends
-        on Qt again.
+        https://bugs.webkit.org/show_bug.cgi?id=44043
 
-        * WebCore.pro:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
 
-2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-08-10  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Turn off DataGrid support by default.
-
-        No new tests, as there is no new functionality.
-
-        * WebCore.pro:
+        Make sure NPAPI plugins get an initial setNPWindow on Mac
 
-2009-12-17  Yael Aharon  <yael.aharon@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=43782
 
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] support navigator.onLine and ononline/onoffline events.
-        https://bugs.webkit.org/show_bug.cgi?id=32555
-
-        Hooked up Bearer Management to NetworkStateNotifier. This solution is available 
-        only if QtMobility's Bearer Management is installed.
-
-        * WebCore.pro:
-        * platform/network/NetworkStateNotifier.h:
-        * platform/network/qt/NetworkStateNotifierPrivate.h: Added.
-        * platform/network/qt/NetworkStateNotifierQt.cpp: Added.
-        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
-        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifier::updateState):
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        * plugins/mac/PluginViewMac.mm:
 
-2009-12-17  Simon Hausmann  <simon.hausmann@nokia.com>
+2010-06-14  Andreas Kling  <andreas.kling@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
 
-        [Qt] Symbian build fix: Don't include QtXml/qxmlstream.h but omit the prefix, to
-        make sure we pick up the header file from QtCore. That is where the implementation
-        is compiled.
+        [Qt] Stack overflow when converting navigator object to QVariant
+        https://bugs.webkit.org/show_bug.cgi?id=40572
 
-        * dom/XMLTokenizer.h:
+        Protect against infinite recursion in JSValue->QVariant conversion.
+        This fixes a crash when trying to convert MimeType objects (they
+        recurse infinitely and on-the-fly via the enabledPlugin property.)
 
-2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
 
-        [Qt] Add manual test for JavaScript prompt corner case
-        https://bugs.webkit.org/show_bug.cgi?id=30914
+2010-03-30  Kent Tamura  <tkent@chromium.org>
 
-        The patch is based on the work done by Gupta Manish.
+        Reviewed by Brady Eidson.
 
-        Verify behavior of the JavaScript prompt function. Currently
-        Qt is not behaving like other WebKit ports and Firefox in
-        regards to accepting the prompt but not entering a text.
+        REGRESSION (r56439) - Crash when a renderer for a file upload control
+        with a selected file is recreated
+        https://bugs.webkit.org/show_bug.cgi?id=36723
 
-        * manual-tests/qt/java-script-prompt.html: Added.
+        RenderFileUploadControl::chooseIconForFiles was called before
+        m_fileChooser was initialized.
 
-2009-12-21  Andreas Kling  <andreas.kling@nokia.com>
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser): Introduce m_isInitializing flag to
+          avoid FileChooserClient::repaint() call.
+        (WebCore::FileChooser::loadIcon):
+        (WebCore::FileChooser::iconLoaded):
+        * platform/FileChooser.h: Add a FielChooser parameter to
+          FileChooserClient::chooseIconForFiles().
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::chooseIconForFiles):
+        (WebCore::RenderFileUploadControl::paintObject): Add an assertion.
+        * rendering/RenderFileUploadControl.h:
 
-        Reviewed by Darin Adler.
+2010-07-06  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        Fix assertion failure when dragging an SVG image.
-        https://bugs.webkit.org/show_bug.cgi?id=32511
+        Reviewed by Dirk Schulze.
 
-        Test: fast/images/drag-svg-as-image.html
+        <use> on <font-face> causes crashes, if SVGUseElement gets detached
+        https://bugs.webkit.org/show_bug.cgi?id=41621
 
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::filenameExtension): Return "svg"
-        * svg/graphics/SVGImage.h:
+        Do not call removeFromMappedElementSheet() from the SVGFontFaceElement destructor,
+        as that can potentially cause the element to be reattached while destructing.
 
-2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+        In order to fix the crash in the testcase, the order of calling the base-class detach
+        method in SVGUseElement and the instance/shadow tree destruction has to be reversed,
+        matching the order in removedFromDocument().
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Test: svg/custom/use-font-face-crash.svg
 
-        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
-        the wrapped object died before the gc removed the instance.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::~SVGFontFaceElement): Remove removeFromMappedElementSheet() call.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::detach): Reverse order of calling base-class detach method and instance/shadow tree destruction.
 
-        https://bugs.webkit.org/show_bug.cgi?id=31681
+2010-07-06  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        Before using a cached instance, verify that its wrapped QObject is
-        still alive.
+        Reviewed by Darin Adler.
 
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::getQtInstance):
-        * bridge/qt/qt_instance.h:
-        (JSC::Bindings::QtInstance::hashKey):
+        <use> on <font-face> causes crashes, if SVGUseElement gets detached
+        https://bugs.webkit.org/show_bug.cgi?id=41621
 
-2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        Do not call removeFromMappedElementSheet() from the destructor, as the call to document()->updateStyleSelector() that can potentially
+        cause the element to be reattached while destructing. It's not needed at all, because removedFromDocument() is called before destruction,
+        which already calls removeFromMappedElementSheet() - at this point it's still safe to update the style selector.
 
-        Reviewed by Simon Hausmann.
+        The crash is reproducable when using <use> on <font-face>.
 
-        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
+        Test: svg/custom/use-font-face-crash.svg
 
-        Fix inline assembly, don't dereference the function pointer twice.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::~SVGFontFaceElement):
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
+2010-07-05  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Adam Barth.
+        Memory corruption with SVG <use> element
+        https://bugs.webkit.org/show_bug.cgi?id=40994
 
-        [Qt] Remove the Referer header when redirecting to a non-secure site
-        https://bugs.webkit.org/show_bug.cgi?id=31785
+        Fix race condition in svgAttributeChanged. Never call svgAttributeChanged() from attributeChanged()
+        when we're synchronizing SVG attributes. It leads to either unnecessary extra work being done or
+        crashes. Especially together with <polyline>/<polygon> which always synchronize the SVGAnimatedPoints
+        datastructure with the points attribute, no matter if there are changes are not. This should be
+        furhter optimized, but this fix is sane and fixes the root of the evil races.
 
-        This makes Qt pass two tests introduced in r50226.
+        Test: svg/custom/use-property-synchronization-crash.svg
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::attributeChanged):
 
-2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+2010-06-11  Abhishek Arya  <inferno@chromium.org>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by David Hyatt.
 
-        [Qt] Normalize signal and slot signatures.
+        Don't process floats if parent node is not a RenderBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=40033
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        Test: svg/text/clear-floats-crash.svg
 
-2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
 
-        Reviewed by Simon Hausmann.
+2010-06-23  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        [Qt] WebKit crashes when loading certain SVG images
+        Reviewed by Eric Seidel.
 
-        Check if the familly exist before creating the PlatformData from it.
+        Reproducible crash in com.apple.WebCore 0x01ed3784 WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) + 36
+        https://bugs.webkit.org/show_bug.cgi?id=40953
 
-        https://bugs.webkit.org/show_bug.cgi?id=29443
+        REGRESSION (r58209-58231): Memory corruption with invalid SVG
+        https://bugs.webkit.org/show_bug.cgi?id=40173
 
-        Test: svg/text/text-font-invalid.html
+        Fix several crashes, all related to <foreignObject> and/or invalid SVG documents.
+        - Only allow <svg> nodes, as direct children of a <foreignObject>, not any other "partial" SVG content.
+        - Assure to create RenderSVGRoot objects for <svg> nodes in <foreignObject>, treat them as "outermost SVG elements".
+        - Never allow any partial SVG content to appear in any document. Only <svg> elements are allowed.
 
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::fontDataAt):
+        Tests: svg/custom/bug45331.svg
+               svg/foreignObject/disallowed-svg-nodes-as-direct-children.svg
+               svg/foreignObject/no-crash-with-svg-content-in-html-document.svg
+               svg/foreignObject/svg-document-as-direct-child.svg
+               svg/foreignObject/svg-document-in-html-document.svg
+               svg/foreignObject/text-tref-02-b.svg
 
-2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+        * dom/Element.cpp: Added childShouldCreateRenderer, with ENABLE(SVG) guards.
+        (WebCore::Element::childShouldCreateRenderer): Only create a renderer for a SVG child, if we're a SVG element, or if the child is a <svg> element.
+        * dom/Element.h: Added childShouldCreateRenderer, with ENABLE(SVG) guards.
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer): Disallow arbitary SVG content, only <svg> elements are allowed as direct children of a <foreignObject>
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::isOutermostSVG): Be sure to create RenderSVGRoot objects for <svg> elements inside <foreignObject>
 
-        Reviewed by Antti Koivisto.
+2010-06-10  Abhishek Arya  <inferno@chromium.org>
 
-        [Qt] Broken back/forward after using ErrorPageExtension to set error page
-        https://bugs.webkit.org/show_bug.cgi?id=30573
+        Reviewed by Dave Hyatt.
 
-        Make FrameLoader::checkLoadCompleteForThisFrame method
-        to check for any working DocumentLoader instance (through
-        activeDocumentLoader()) instead of only checking for
-        'm_provisionalDocumentLoader' in order to decide to if
-        it is going to reset of not the back and forward history.
-        after an error page has been loaded.
+        Do not render CSS Styles :first-letter and :first-line in a SVG text element context. 
+        https://bugs.webkit.org/show_bug.cgi?id=40031
 
-        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+        Test: svg/text/text-style-invalid.svg
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::firstLineBlock):
+        (WebCore::RenderSVGText::updateFirstLetter):
+        * rendering/RenderSVGText.h:
 
-2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-07-01  Justin Schuh  <jschuh@chromium.org>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Reviewed by Dan Bernstein.
 
-        [Qt] Few classes have virtual functions but non-virtual destructor
-        https://bugs.webkit.org/show_bug.cgi?id=31269
+        Prevent crash on counter destruction
+        https://bugs.webkit.org/show_bug.cgi?id=40032
 
-        No new tests as there is no functional change.
+        Added counter destruction to RenderWidget::destroy()
 
-        * platform/qt/QWebPageClient.h:
-        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+        Test: fast/css/counters/destroy-counter-crash.html
 
-2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
 
-        Reviewed by Kenneth Rohde Christiansen.
+2010-06-29  Dan Bernstein  <mitz@apple.com>
 
-        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
-        https://bugs.webkit.org/show_bug.cgi?id=31140
+        Reviewed by Darin Adler.
 
-        QtNetwork interprets null string as request to remove the header, not add it.
-        Replace null values with empty values before passing them to QtNetwork.
+        <rdar://problem/7975842> Certain text is repeated after using splitText()
 
-        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+        Tests: fast/text/setData-dirty-lines.html
+               fast/text/splitText-dirty-lines.html
 
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::setData): Call RenderText::setTextWithOffset() rather than
+        setText(), because only the former correctly dirties line boxes.
+        * dom/Text.cpp:
+        (WebCore::Text::splitText): Ditto.
 
-2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+2010-06-25  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Sam Weinig.
 
-        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
-        https://bugs.webkit.org/show_bug.cgi?id=31144
+        <rdar://problem/8000667> Certain text is repeated before and after a line break
 
-        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
-        documents that end prematurely but are not considered invalid by QXmlStream.
-        This is to stay compatible with the libxml2 implementation.
-        However, that code path would be also hit in situations when it should not,
-        i.e. the error would have already been caught and handled. As a result, the
-        same error would be reported twice.
+        Test: fast/text/bidi-explicit-embedding-past-end.html
 
-        No new tests, because the problem is already covered by
-        fast/parser/xml-declaration-missing-ending-mark.html.
+        * platform/text/BidiResolver.h:
+        (WebCore::::createBidiRunsForLine): Committing explicit embedding past the end of the range
+        creates BidiRuns up to the end of the range, so at that point, we can stop iterating.
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doEnd):
+2010-06-10  Tony Chang  <tony@chromium.org>
 
-2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+        Reviewed by Kent Tamura.
 
-        Reviewed by Eric Seidel.
+        crash when focus is changed while trying to focus next element
+        https://bugs.webkit.org/show_bug.cgi?id=40407
 
-        Fix ASSERT(currentStyle = renderStyle()).
-        https://bugs.webkit.org/show_bug.cgi?id=31152
+        Test: fast/events/focus-change-crash.html
 
         * dom/Element.cpp:
-        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+        (WebCore::Element::focus):
 
-2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
 
-        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
-        https://bugs.webkit.org/show_bug.cgi?id=31077
+        [Qt] Clamp color stops passed to QGradient to 1.0
+        [https://bugs.webkit.org/show_bug.cgi?id=41484
 
-        Allow sending the response body under the same conditions that we
-        allow it to finish without reporting an error.
+        Fixes an issue where color stops would be silently dropped from radial gradients.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-2009-11-03  Evan Martin  <evan@chromium.org>
+2010-07-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Fix an off-by-one in the CSS lexer that causes memory corruption in
-        hard-to-trigger circumstances.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30827
-
-        Test: fast/css/end-of-buffer-crash.html
-
-        * css/maketokenizer: Add comments, fix off-by-one.
-
-2009-11-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Crash due to double-destroy related to CSS run-in property
-        https://bugs.webkit.org/show_bug.cgi?id=31034
-        rdar://problem/7328458
-
-        Test: fast/css/run-in-crash.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::destroy): Reorder destruction so the
-        continuation is destroyed after anonymous children. See comment
-        in the code for more details of why this is right.
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::destroy): Ditto.
-
-2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Holger Hans Peter Freyther.
-
-        If the owner widget of the page has a palette set, we
-        should use that one. This was only working when the
-        owner was a QWebView. This patch fixes that.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-10-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Oliver Hunt.
-
-        [GTK] Threading problems with some of the tests
-        https://bugs.webkit.org/show_bug.cgi?id=30814
-
-        Create strings shared among threads with crossThreadString
-        constructor method.
-
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
-
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29381
-
-        * html/HTMLTokenizer.cpp: Change debug output to print the actual tokenizer delay
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        Clear the initial request when loading synchronously to prevent duplicate loads
-
-        MainResourceLoader uses the member m_initialRequest to store a request for future
-        deferred loads. When doing a synchronous load, in handleDataLoadNow(), we therefore
-        have to clear this request so that subsequent entries into the loader will not start
-        yet another load.
-
-        This can for example happen in setDefersLoading() as a result of a PageGroupLoadDeferrer
-        going out of scope when returning from Chrome::runJavaScriptAlert(), where the alert()
-        came from a script executed as part of the first/original load.
+        Prevent assertion/duplicate loads for non-deferred subtitute-data loads
 
         https://bugs.webkit.org/show_bug.cgi?id=30879
 
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::handleDataLoadNow): clear m_initialRequest
+        MainResourceLoader uses the member m_initialRequest to store requests for future
+        deferred loads. When doing the actual load in handleDataLoadNow(), we therefore
+        have to clear this request so that subsequent entries into the loader will not
+        start yet another load.
 
-2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        This can happen as a result of a PageGroupLoadDeferrer going out of scope when
+        returning from Chrome::runJavaScriptAlert(), which calls setDeferredLoading(false),
+        but only in the case of using both substitute-data and non-deferred main resource
+        load together. That's why two new DRT functions were added:
 
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Use a different method to identify the webkit port in
-        InspectorBackent::platform().
-        This corrects the inspector expected behavior with Qt on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=31116
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::platform):
-        (WebCore::InspectorBackend::port):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/InspectorControllerStub.js:
-        (.WebInspector.InspectorControllerStub.prototype.port):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-        (WebInspector.toolbarDragStart):
-
-2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Custom printing shrink factors
-        https://bugs.webkit.org/show_bug.cgi?id=29042
-
-        This reverts commit r49769. The public API for this needs to be reviewed
-        before its inclusion in Qt.
-
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::begin):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
-
-2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+         * queueLoadHTMLString()
+         * setDeferMainResourceLoad()
 
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
-        since adjustment of RW-section base address will be needed for all new symbian
-        tool chains, specifically for arm and gcc compilation targets.
-        Also, change target address to 0xE00000 to be sufficient for all targets.
+        The change adds DRT hooks for Mac, Win and Qt for these two functions. For Mac
+        and Win the hook uses new SPI in WebDataSource. For Qt a new static member was
+        added to the FrameLoaderClientQt and accessed though DumpRenderTreeSupportQt.
 
-        * WebCore.pro:
+        Test: fast/loader/non-deferred-substitute-load.html
 
-2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::handleDataLoadNow):
 
-        Reviewed by Eric Seidel.
+2010-07-16  Antonio Gomes  <tonikitoo@webkit.org>
 
-        [Qt] Make the default style background color valid.
-        Currently the color is transparent but invalid, this causes
-        list boxes in QtWebKit to be drawn with a black background
-        since r49242.
-        https://bugs.webkit.org/show_bug.cgi?id=31295
+        Reviewed by Simon Fraser.
 
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::initialBackgroundColor):
-        * rendering/style/StyleBackgroundData.cpp:
-        (WebCore::StyleBackgroundData::StyleBackgroundData):
+        Spatial navigation: do not consider outline for focusable element boundaries
+        https://bugs.webkit.org/show_bug.cgi?id=42474
 
-2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+        Test: fast/events/spatial-navigation/snav-zero-margin-content.html
 
-        Reviewed by Tor Arne Vestbø.
+        Currently in WebCore::renderRectRelativeToRootDocument function, we are calling
+        RenderObject::absoluteClippedOverflowRect to obtain the rect boundary of a given
+        renderer/element. This method deals with outline, which is out of elements boundary.
+        It makes spatial navigation to fail on common sites like google.gom: "Web, Images, Map, etc"
+        are inaccessible.
 
-        Introduce a function for querying the input method status
-        in QWebPageClient.
+        Patch replaces RenderObject::absoluteClippedOverflowRect by Node::getRect,
+        which returns only the absolute bounding box rect of the Element.
 
-        * platform/qt/QWebPageClient.h:
+        * page/SpatialNavigation.cpp:
+        (WebCore::renderRectRelativeToRootDocument):
+        (WebCore::checkNegativeCoordsForNode):
 
-2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+2010-07-21  Kristian Amlie <kristian.amlie@nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
-        https://bugs.webkit.org/show_bug.cgi?id=31208
-
-        After r42483, the credentials are no longer passed to the network request
-        in the URL of the request.
-        Pass the credentials from XMLHTTPRequest to the network request, the same
-        way that other ports do.
-
-        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
-
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::loadResourceSynchronously):
+        Added automatic sqlite extraction for Symbian to QtWebKit.
 
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+        Also added sqlite detection in case sqlite is not present in the SDK.
+        This is possible if WebKit is compiled standalone.
 
-        Unreviewed build fix for WebInspector with Qt build.
-
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Make QWebPluginDatabase private API for now.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30775
+        The inclusion part is a consequence of commit c578c6c1d6d in the Qt
+        repository. It will not work on Qt versions < 4.7.1, but that is ok,
+        since the only build system it will affect is marked as experimental
+        in the whole 4.7 series.
 
         * WebCore.pro:
 
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Extended the conversion of the WebCore ResourceRequest to the
-        QNetworkRequest with a mandatory originating object argument,
-        which is meant to be the QWebFrame the request belongs to.
+2010-05-14  Abhishek Arya  <inferno@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29975
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::start):
-        * platform/network/qt/ResourceRequest.h:
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
-
-2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Adam Barth.
-
-        QWebView crash fix.
-
-        The QWebView should not crash if the stop() method is called from
-        a function triggered by the loadProgress signal.
-
-        A null pointer protection was added in the ProgressTracker::incrementProgress.
-
-        New autotest was created.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29425
-
-        * loader/ProgressTracker.cpp:
-        (WebCore::ProgressTracker::incrementProgress):
-
-2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
-
-        Reviewed by Holger Freyther.
+        Reviewed by David Hyatt.
 
-        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
-        The implementation was buggy, and will visually break repeating
-        animations anyway.
+        Move the m_width(Length) and m_columns(RenderTable::ColumnStruct)
+        vector out-of-bounds check out of the ASSERT into the main code.
+        https://bugs.webkit.org/show_bug.cgi?id=38261
 
-        https://bugs.webkit.org/show_bug.cgi?id=31009
+        Test: fast/table/fixed-table-layout-large-colspan-crash.html
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
 
-2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+2010-05-21  Beth Dakin  <bdakin@apple.com>
 
         Reviewed by Darin Adler.
 
-        Don't add '/' to the URL path if the it does not include '/' after the protocol component
-        https://bugs.webkit.org/show_bug.cgi?id=30971
-
-        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
-
-        * platform/KURL.cpp:
-        (WebCore::KURL::parse):
-
-2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Fix for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 
+        while running MangleMe
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=39508
 
-        Reviewed by Holger Hans Peter Freyther.
+        The math was slightly off here, and we wound up trying to access an 
+        array at index -1 in some cases. We need to decrement numberShadow 
+        rather than subtracting one from the result of the modulo 
+        operation.
 
-        If the owner widget of the page has a palette set, we
-        should use that one. This was only working when the
-        owner was a QWebView. This patch fixes that.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toAlphabeticOrNumeric):
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
+2010-05-20  Dan Bernstein  <mitz@apple.com>
 
-2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Dave Hyatt.
 
-        Reviewed by Tor Arne Vestbø.
+        <rdar://problem/8007953> Textarea using custom font appears blank
 
-        [Qt] Implement DELETE HTTP method for XmlHttpRequest
-        https://bugs.webkit.org/show_bug.cgi?id=30894
+        Test: fast/css/font-face-in-shadow-DOM.html
 
-        No new tests as this functionality is already tested by the 
-        xmlhttprequest LayoutTests. As this patch depends on an unreleased
-        version of the dependent QtNetwork library and the tests will be
-        enabled later once the dependent library is released (and the
-        buildbot is updated).
+        When a remote font is loaded, CSSFontSelector forces a style recalc, which replaces all
+        RenderSyles that have FontFallbackLists referencing the placeholder font with fresh
+        RenderStyles. However, it does not descend into shadow DOM trees, so those may end up with
+        styles that still reference the placeholder font.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::start):
+        The fix is to add RenderObject::requiresForcedStyleRecalcPropagation() and have it return
+        true from renderers that maintain shadow DOM trees or otherwise keep their own RenderStyles.
 
-2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Rubber-stamped by Antti Koivisto.
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Check if forced style recalc needs to propagated.
+        * rendering/RenderButton.h:
+        (WebCore::RenderButton::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderListItem.h:
+        (WebCore::RenderListItem::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::RenderMenuList::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderSlider.h:
+        (WebCore::RenderSlider::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::requiresForcedStyleRecalcPropagation):
 
-        [Qt] Build fix for Windows CE
+2010-04-02  Justin Schuh  <jschuh@chromium.org>
 
-        * plugins/PluginDatabase.cpp:
+        Reviewed by Alexey Proskuryakov.
 
-2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        XHR allows arbitrary XSRF across domains 
+        https://bugs.webkit.org/show_bug.cgi?id=36843
 
-        Reviewed by Tor Arne Vestbø.
+        Added a one-line change to prevent bypassing the XDC check on
+        synchronous preflighted requests. Added layout tests to cover
+        variations of this problem.
 
-        [Qt] Fix Qt build on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30905
+        Tests: http/tests/xmlhttprequest/access-control-preflight-async-header-denied.html
+               http/tests/xmlhttprequest/access-control-preflight-async-method-denied.html
+               http/tests/xmlhttprequest/access-control-preflight-sync-header-denied.html
+               http/tests/xmlhttprequest/access-control-preflight-sync-method-denied.html
 
-        * WebCore.pro:
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::create):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::preflightFailure):
 
-2009-10-28  Adam Barth  <abarth@webkit.org>
+2010-04-28  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Alexey Proskuryakov.
 
-        Don't run JavaScript URLs in view source mode
-        https://bugs.webkit.org/show_bug.cgi?id=30881
+        [XHR] Cross-Origin synchronous request with credential raises NETWORK_ERR
+        https://bugs.webkit.org/show_bug.cgi?id=37781
+        <rdar://problem/7905150>
 
-        Just say no.
+        Tests: http/tests/xmlhttprequest/access-control-preflight-credential-async.html
+               http/tests/xmlhttprequest/access-control-preflight-credential-sync.html
 
-        Test: http/tests/security/view-source-no-javascript-url.html
+        Rolling the patch in as I could not reproduce Qt results locally.
 
-        * bindings/ScriptControllerBase.cpp:
-        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Now we remove the
+        credential from the request here to avoid forgetting to do so in the different code path.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Just add the
+        "Origin" header.
+        (WebCore::DocumentThreadableLoader::loadRequest): Check here the the credential have
+        been removed so that we don't leak them. Also tweaked a comment to make it clear that
+        the URL check has issue when credential is involved.
 
-2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-04-21  Alexey Proskuryakov  <ap@apple.com>
 
-        Unreviewed. Fixes style problems pointed out by Evan Martin.
+        Reviewed by Adam Roben.
 
-        * platform/gtk/Language.cpp:
-        (WebCore::defaultLanguage):
+        Windows build fix.
 
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+        * platform/network/cf/ResourceHandleCFNet.cpp: Declare CFURLConnectionCreateWithProperties
+        for now, as it's mistakenly missing from WebKitSupportLibrary headers.
 
-        Rubber-stamped by Mark Rowe.
+2010-05-19  Abhishek Arya  <inferno@chromium.org>
 
-        64-bit Leopard build fix after r50259
-        
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
-        Declared ATSUTextInserted in 64-bit.
-        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
-        (WebCore::disableLigatures): Ditto.
-        (WebCore::initializeATSUStyle): Ditto.
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+        Reviewed by David Hyatt.
 
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+        Check that the node is a text node before doing a static cast
+        to a Text class pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=38626    
 
-        Tiger build fix after r50259
+        Test: fast/text/text-transform-nontext-node-crash.xhtml
 
-        * platform/graphics/mac/ComplexTextController.h:
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText):
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText):
+        (WebCore::RenderTextFragment::previousCharacter):
 
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+2010-05-12  Abhishek Arya  <inferno@chromium.org>
 
-        Attempted Tiger build fix after r50259
+        Reviewed by Darin Adler.
 
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        HTML Entity Escape the contents of a textarea node when accessed
+        via the innerHTML and outerHTML node properties.
+        https://bugs.webkit.org/show_bug.cgi?id=38922
 
-2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+        Test: fast/innerHTML/innerHTML-special-elements.html
 
-        Rubber stamped by Mark Rowe.
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30899
-        WebKit fails to build release on 32-bit Windows systems
+2010-05-12  James Robinson  <jamesr@chromium.org>
 
-        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
-        * bindings/js/JSBindingsAllInOne.cpp: Added.
+        Patch by Dan Bernstein.
 
-2009-10-28  Dan Bernstein  <mitz@apple.com>
+        Reviewed by David Hyatt.
 
-        Reviewed by Jon Honeycutt.
+        Fix marking the layout root's parent as needing layout
+        https://bugs.webkit.org/show_bug.cgi?id=37760
 
-        Fixed typos in color names.
+        If an element gets marked as needing layout due to the recalcStyle()
+        call in FrameView::layout(), the m_layoutSchedulingEnabled flag will
+        be set to false.  It's possible at this point that a parent of the
+        existing FrameView::m_layoutRoot will be marked as needing layout.
 
-        * inspector/front-end/Color.js:
+        This patch updates FrameView::scheduleRelayoutOfSubtree to account
+        for this case.
 
-2009-10-28  Dan Bernstein  <mitz@apple.com>
+        Manual test only due to subtle timing issues.
 
-        Reviewed by Sam Weinig.
+        * manual-tests/layoutroot_detach.xml: Added.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayoutOfSubtree):
 
-        Share code between the ATSUI- and Core Text-based Font implementations by doing the
-        following:
-        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
-          parts in ComplexTextControllerCoreText.cpp.
-        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
-        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
-        - Remove FontMacATSUI.
-
-        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
-        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
-        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
-        FontComplexTextMac.cpp.
-
-        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
-        kept the non-Core Text-specific bits.
-        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
-        its own.
-        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
-        m_complexTextRuns holding references instead of objects.
-        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
-        its own.
-        (WebCore::ComplexTextController::advance): Updated for renames.
-        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
-        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
-        and advances() accessors.
-
-        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
-        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
-        the latter RefCounted, added ATSUI-specific members to it, and made some other members
-        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
-        rather than objects.
-        (WebCore::ComplexTextController::ComplexTextRun::create):
-        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
-        (WebCore::ComplexTextController::ComplexTextRun::advances):
-
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
-        parts of the ComplexTextController implementation. 
-        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
-        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
-        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
-        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
-        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
-        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
-        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
-        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
-        get the glyphs, advances and indices vectors populated.
-        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
-        (WebCore::disableLigatures): Ditto.
-        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
-        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
-
-        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
-        CoreTextController.cpp and kept the Core Text-specific bits.
-        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
-        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
-        this was done in adjustGlyphsAndAdvances().
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
-        including its own.
-        * platform/graphics/mac/CoreTextController.cpp: Removed.
-        * platform/graphics/mac/CoreTextController.h: Removed.
-        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
-        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
-        of CoreTextController.
-        (WebCore::Font::drawComplexText): Ditto.
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        (WebCore::Font::offsetForPositionForComplexText): Ditto.
-        * platform/graphics/mac/FontMacATSUI.mm: Removed.
-        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
-
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+2010-05-10  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Darin Adler.
 
-        WAI-ARIA: add support for 'option' role
-        https://bugs.webkit.org/show_bug.cgi?id=30843
-
-        Test: accessibility/aria-option-role.html
-
-        * accessibility/AccessibilityListBoxOption.h:
-        (WebCore::AccessibilityListBoxOption::canHaveChildren):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-        (WebCore::AccessibilityRenderObject::canHaveChildren):
-
-2009-10-28  Jens Alfke  <snej@chromium.org>
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=38583
+        <rdar://problem/7948784> Crash in Element::normalizeAttributes.
 
-        Reviewed by Eric Seidel.
-
-        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=30716
+        Test: fast/dom/Element/normalize-crash.html
 
-        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
-        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
-        * bindings/v8/V8Collection.h:
-        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
-            warning about missing cases in 'switch' statement.
-        * editing/EditorCommand.cpp:
-        (WebCore::createCommandMap):  Fix struct visibiity warning.
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
-            'switch' statement to avoid missing-case warning.
-        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
-        * xml/XPathFunctions.cpp:
-        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+        * dom/Element.cpp:
+        (WebCore::Element::normalizeAttributes): Copy attributes to a vector
+        before iterating.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::copyAttributesToVector): Added.
+        * dom/NamedAttrMap.h:
 
-2009-10-29  Adam Barth  <abarth@webkit.org>
+2010-05-10  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
 
-        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
-        https://bugs.webkit.org/show_bug.cgi?id=30839
-
-        Added null check for the case when the frame is detached from the page.
-
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Based on a patch by Eric Seidel.
 
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30817
-        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
-
-        Also removes the hack I had originally added to solve bug 25411, because
-        the fix here is what I should have done in the first place.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-
-2009-10-28  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30805
-        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
-        Existing Database tests cover this, no change in functionality.
-
-        * storage/DatabaseThread.cpp:
-        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
-        (WebCore::SameDatabasePredicate::operator()):
-        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
-
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Glue subsequent timeline records with same category
-        and title together.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30885
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
-
-2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Xan Lopez.
+        https://bugs.webkit.org/show_bug.cgi?id=28697
+        <rdar://problem/7946578> WebKit crash on WebCore::Node::nodeIndex()
 
-        [GTK] Fails new test fast/js/navigator-language.html
-        https://bugs.webkit.org/show_bug.cgi?id=30440
+        It's not OK to call ContainerNode::willRemoveChild() in a loop, because Range code assumes
+        that it can adjust start and end position to any node except for the one being removed -
+        so these notifications cannot be batched.
 
-        Reimplement WebCore::defaultLanguage to account for changes in
-        locale done by setLocale.
-
-        Already existing test: fast/js/navigator-language.html
-
-        * platform/gtk/Language.cpp:
-        (WebCore::defaultLanguage):
-
-2009-10-28  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7303145> 
-        Can't exit full screen mode or restart movie after pressing command -R.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::removedFromDocument):
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
-            Exit from fullscreen if necessary.
-        * html/HTMLMediaElement.h:
-
-2009-10-28  Alexey Proskuryakov  <ap@apple.com>
-
-        Unreviewed - a trivial fix to get Windows bots running.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30841
-        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
-
-        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
-        access empty vector's data.
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
-
-        Remove the extraneous object of ROLE_PANEL.
-
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        Test: fast/dom/Range/remove-all-children-crash.html
 
-2009-10-28  Jonathan Dixon  <joth@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=30547
-
-        Test: fast/css/text-input-with-webkit-border-radius.html
-
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
-          Implemented rounded border rendering in Chromium Windows theme renderer.
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChild): Removed unused ExceptionCode.
+        (WebCore::willRemoveChildren): New function, used in removeChildren() case.
+        (WebCore::ContainerNode::removeChild): ExceptionCode return was always 0, don't bother with it.
+        (WebCore::ContainerNode::removeChildren): Call willRemoveChildrenFromNode.
+        (WebCore::dispatchChildRemovalEvents): Moved some logic out into willRemoveChildrenFromNode
+        and willRemoveChild.
 
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+        * dom/Document.cpp:
+        (WebCore::Document::nodeChildrenWillBeRemoved): New function, used in removeChildren() case.
 
-        Reviewed by Timothy Hatcher.
+        * dom/Document.h: 
+        (WebCore::Document::nodeChildrenWillBeRemoved): New function, used in removeChildren() case.
 
-        Web Inspector: Pull items collections from resources panel and
-        timeline panel into AbstractTimelinePanel.
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::boundaryNodeChildrenWillBeRemoved): New function, used in removeChildren() case.
+        (WebCore::Range::nodeChildrenWillBeRemoved): Ditto.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30875
+2010-05-03  Alexey Proskuryakov  <ap@apple.com>
 
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel):
-        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
-        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
-        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
-        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
-        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.filter):
-        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
-        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
-        (WebInspector.AbstractTimelinePanel.prototype.refresh):
-        (WebInspector.AbstractTimelinePanel.prototype.reset):
-        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
-        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
-        (WebInspector.AbstractTimelinePanel.prototype.addItem):
-        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
-        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
-        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
-        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
-        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
-        (WebInspector.AbstractTimelineCategory):
-        (WebInspector.AbstractTimelineCategory.prototype.toString):
-        * inspector/front-end/ResourceCategory.js:
-        (WebInspector.ResourceCategory):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
-        (WebInspector.ResourcesPanel.prototype.createItemGraph):
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
-        (WebInspector.ResourcesPanel.prototype.populateSidebar):
-        (WebInspector.ResourcesPanel.prototype.get searchableViews):
-        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
-        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
-        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
-        (WebInspector.ResourcesPanel.prototype.searchCanceled):
-        (WebInspector.ResourcesPanel.prototype.performSearch):
-        (WebInspector.ResourcesPanel.prototype.refresh):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype.removeResource):
-        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
-        (WebInspector.ResourcesPanel.prototype.clearMessages):
-        (WebInspector.ResourcesPanel.prototype.refreshResource):
-        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
-        (WebInspector.ResourcesPanel.prototype.showResource):
-        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
-        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
-        (WebInspector.ResourcesPanel.prototype.get _resources):
-        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.get categories):
-        (WebInspector.TimelinePanel.prototype.populateSidebar):
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
-        (WebInspector.TimelinePanel.prototype.createItemGraph):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelineCategory):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-
-2009-10-28  Kelly Norton  <knorton@google.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Pavel Feldman.
+        https://bugs.webkit.org/show_bug.cgi?id=38497
+        <rdar://problem/7759438> Make sure that http URLs always have a host in SecurityOrigin
 
-        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
-        that it remains active on refreshs and page transitions.
-        https://bugs.webkit.org/show_bug.cgi?id=30874
+        This is a hardening fix, and behavior really depends on what an underlying networking layer
+        does. So, no test.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
-        * inspector/InspectorTimelineAgent.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemeRequiresAuthority): List schemes that need an authority for successful loading.
+        (WebCore::SecurityOrigin::SecurityOrigin): Never let e.g. http origins with empty authorities
+        have the same security origin.
 
-2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+2010-05-03  Abhishek Arya  <inferno@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Adam Barth.
 
-        Provide a way to get counter values with layoutTestContoller
-        https://bugs.webkit.org/show_bug.cgi?id=30555
+        Add support for controlling clipboard access from javascript.
+        Clipboard access from javascript is disabled by default.
+        https://bugs.webkit.org/show_bug.cgi?id=27751
 
-        Expose WebCore::counterValueForElement as a WebCore API.
+        Test: editing/execCommand/clipboard-access.html
 
         * WebCore.base.exp:
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeCounterValuesFromChildren):
-        (WebCore::counterValueForElement):
-        * rendering/RenderTreeAsText.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::supportedCopyCut):
+        (WebCore::supportedPaste):
+        (WebCore::createCommandMap):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setJavaScriptCanAccessClipboard):
+        * page/Settings.h:
+        (WebCore::Settings::javaScriptCanAccessClipboard):
 
-2009-10-28  Nate Chapin  <japhet@chromium.org>
+2010-04-30  Abhishek Arya  <inferno@chromium.org>
 
-        Unreviewed, Chromium build fix for r50225.
+        Reviewed by David Kilzer.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
+        Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
+        Eliminated unused m_dragInitiator accessor to prevent dereferencing.
+        https://bugs.webkit.org/show_bug.cgi?id=37618
 
-2009-10-28  Eric Z. Ayers  <zundel@google.com>
+        Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html
 
-        Reviewed by Pavel Feldman.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+        * page/DragController.h:
+        (WebCore::DragController::draggingImageURL):
+        (WebCore::DragController::documentUnderMouse):
 
-        Adds InspectorTimelineAgent  instrumentation for encountering a
-        <SCRIPT> tag when parsing an HTML document. 
+2010-04-14  Justin Schuh  <jschuh@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30861
+        Reviewed by Adam Barth.
 
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::startLine):
-        (WebCore::ScriptSourceCode::url):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::scriptExecution):
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willLoadXHR):
-        (WebCore::InspectorTimelineAgent::willScriptTag):
-        (WebCore::InspectorTimelineAgent::didScriptTag):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/front-end/TimelineAgent.js:
+        Javascript URL can be set as iframe.src via multiple DOM aliases
+        https://bugs.webkit.org/show_bug.cgi?id=37031
 
-2009-10-28  Steve Block  <steveblock@google.com>
+        Moved frame/iframe checks from Attr to Node on inherited members.
+        Node child manipulation methods now return NOT_SUPPORTED_ERR if used
+        on a frame/iframe src attribute.
+        NamedNodeMap set methods now perform frame/iframe src checks.
+        Moved allowSettingSrcToJavascriptURL static helper function from 
+        JSElementCustom.cpp to exported function in JSDOMBinding.h.
 
-        Reviewed by Darin Adler.
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::setNamedItem):
+        (WebCore::JSNamedNodeMap::setNamedItemNS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::isAttrFrameSrc):
+        (WebCore::JSNode::setNodeValue):
+        (WebCore::JSNode::setTextContent):
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::V8NamedNodeMap::setNamedItemNSCallback):
+        (WebCore::V8NamedNodeMap::setNamedItemCallback):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::isFrameSrc):
+        (WebCore::V8Node::textContentAccessorSetter):
+        (WebCore::V8Node::nodeValueAccessorSetter):
+        (WebCore::V8Node::insertBeforeCallback):
+        (WebCore::V8Node::replaceChildCallback):
+        (WebCore::V8Node::removeChildCallback):
+        (WebCore::V8Node::appendChildCallback):
+        * dom/Attr.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
 
-        Makes sure that Geolocation watch IDs remain positive on overflow.
-        https://bugs.webkit.org/show_bug.cgi?id=30122
+2010-03-26  Justin Schuh  <jschuh@chromium.org>
 
-        No new tests possible.
+        Reviewed by Adam Barth.
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+        Security: iFrame.src accepts JavaScript URL via nodeValue or textContent
+        https://bugs.webkit.org/show_bug.cgi?id=36502
 
-2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+        Overrode inherited nodeValue and textContent in Attr.idl so they proxy 
+        to value, which performs a security check.
 
-        Attempt to fix the Mac debug build after 50225.
+        Test: http/tests/security/xss-DENIED-iframe-src-alias.html
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::nodeValue):
+        (WebCore::JSAttr::setNodeValue):
+        (WebCore::JSAttr::textContent):
+        (WebCore::JSAttr::setTextContent):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::V8Attr::nodeValueAccessorSetter):
+        (WebCore::V8Attr::nodeValueAccessorGetter):
+        (WebCore::V8Attr::textContentAccessorSetter):
+        (WebCore::V8Attr::textContentAccessorGetter):
+        * dom/Attr.idl:
 
-2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+2010-05-05  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30841
-        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
-
-        Tests: http/tests/ssl/referer-301.html
-               http/tests/ssl/referer-303.html
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
-        Remove Referer header if redirecting from https to another protocol.
-
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
-        always done when changing or adding header fields.
-        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
-
-        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
-        no longer inline, since they have non-trivial implementations.
-
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
-        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::setHeaderFields):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        Match Mac changes.
-        
-2009-10-28  Joe Mason  <jmason@rim.com>
-
-        Reviewed by Adam Treat.
-
-        Add FrameLoader::defaultObjectContentType, containing common code for
-        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
-        and win ports have copied this code, and the qt port uses similar code
-        with a few extra clauses.  Moving this to a utility function cuts down
-        on copied code.)   This causes no behavioural change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30868
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
-        * loader/FrameLoader.h:
-
-2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
-        https://bugs.webkit.org/show_bug.cgi?id=30710
-
-        Enforce the versioning, by ignoring any version different
-        from 1.
-
-        * history/qt/HistoryItemQt.cpp:
-        (WebCore::HistoryItem::restoreState):
-        (WebCore::HistoryItem::saveState):
-
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed: follow up fix to InspectorControllerStub.
-        Define it after inspector.js due to namespace
-
-        https://bugs.webkit.org/show_bug.cgi?id=30866
-
-        * inspector/front-end/inspector.html:
-
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=38260
+        <rdar://problem/7917548> Fix whitespace removing in deprecatedParseURL().
 
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add InspectorController stub in order to
-        support opening in standalone mode.
+        Broken all the way since r4 (yes, that's a revision number).
 
-        https://bugs.webkit.org/show_bug.cgi?id=30866
+        Test: http/tests/security/xss-DENIED-javascript-with-spaces.html
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/InspectorControllerStub.js: Added.
-        (.WebInspector.InspectorControllerStub):
-        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
-        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
-        (.WebInspector.InspectorControllerStub.prototype.platform):
-        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
-        (.WebInspector.InspectorControllerStub.prototype.attach):
-        (.WebInspector.InspectorControllerStub.prototype.detach):
-        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
-        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
-        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
-        (.WebInspector.InspectorControllerStub.prototype.search):
-        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
-        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
-        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
-        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
-        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
-        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
-        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
-        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
-        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
-        (.WebInspector.InspectorControllerStub.prototype.loaded):
-        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
-        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
-        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
-        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
-        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
-        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
-        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
-        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
-        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
-        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
-        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
-        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
-        (.WebInspector.InspectorControllerStub.prototype.getProfile):
-        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
-        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
-        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.setSetting):
-        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
-        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
-        (.WebInspector.InspectorControllerStub.prototype.setting):
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.UIString):
+        * css/CSSHelper.cpp: (WebCore::deprecatedParseURL): Fixed loop conditions for remaining length.
 
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+2010-04-23  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Jan Alonzo.
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        <rdar://problem/7898436> :after content is duplicated
 
-        Expands upon the new funtionality which allows platforms to indicate
-        that a particular object should not be ignored, so that they can
-        specify that an object should be ignored or that it should be left up
-        to the default handling to decide.
+        Test: fast/css-generated-content/after-duplicated-after-split.html
 
-        * accessibility/AccessibilityObject.h:
-        * accessibility/chromium/AccessibilityObjectChromium.cpp:
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/qt/AccessibilityObjectQt.cpp:
-        * accessibility/win/AccessibilityObjectWin.cpp:
-        * accessibility/wx/AccessibilityObjectWx.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (AccessibilityRenderObject::accessibilityIsIgnored):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines): Pass the correct owner of the child list.
 
+2010-03-30  Chris Evans  <cevans@chromium.org>
 
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Jan Alonzo.
+        Taint the canvas if an SVG-derived pattern is rendered into it.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25534
-        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+        https://bugs.webkit.org/show_bug.cgi?id=36838
 
-        Expose the table summary as the accessible description because there is no summary object.
+        Test: fast/canvas/svg-taint.html
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_description):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createPattern):
+          Take into account the image's hasSingleSecurityOrigin() property.
 
-2009-10-28  Steve Block  <steveblock@google.com>
+2010-04-07  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darinn Adler.
 
-        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
-        https://bugs.webkit.org/show_bug.cgi?id=30678
+        https://bugs.webkit.org/show_bug.cgi?id=37230
+        <rdar://problem/7813115> REGRESSION (4.0.5): Safari asks for credentials all the time when
+        authenticating to Windows IIS Server
 
-        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+        * platform/network/ProtectionSpace.h: (WebCore::ProtectionSpaceAuthenticationScheme): Added
+        a constant for ProtectionSpaceAuthenticationSchemeUnknown.
 
-        Build fix, no new tests required.
+        * platform/network/cf/AuthenticationCF.cpp: (WebCore::core):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::authenticationSchemeFromAuthenticationMethod):
+        Return ProtectionSpaceAuthenticationSchemeUnknown for unknown scheme.
 
-        * bindings/js/ScriptController.cpp: Modified.
-        (WebCore::ScriptController::initializeThreading): Added.
-        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
-        * bindings/v8/ScriptController.cpp: Modified.
-        (WebCore::ScriptController::initializeThreading): Added.
-        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
-        * loader/icon/IconDatabase.cpp: Modified.
-        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
-        * storage/Database.cpp: Modified.
-        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Support NTLM on systems older than 10.6. We actually get this string from
+        NSURLConnection, even though there was no public constant.
+        (WebCore::core): Return ProtectionSpaceAuthenticationSchemeUnknown for unknown scheme.
 
-2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-04-19  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        Document a feature of the m_liveDecodedResources list.
-        https://bugs.webkit.org/show_bug.cgi?id=30209
-
-        The code made the assumption that the list is sorted by
-        the m_lastDecodedAccessTime property of the CachedResource.
-        The above is not true when CachedResource::setDecodedSize
-        is called and the item is inserted the first time. In this
-        case the m_lastDecodedAccessTime is still zero and the
-        m_liveDecodedResources list becomes unsorted.
-
-        It is impossible that Cache::pruneLiveResources will
-        stop to process the list too early due this feature and
-        the alternatives of updating m_lastDecodedAccessTime in
-        CachedResource::setDecodedSize or changing the insert
-        to search the right position have a negative impact on
-        performance. The best solution for now is to document
-        this feature.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneLiveResources):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::setDecodedSize):
+        Make the fix for <rdar://problem/7873647> from r57759 more robust.
 
-2009-10-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-
-        Make text controls always implement the text interface, and the
-        editable text interface when they are not read only. This is what
-        ATK-users expect.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getInterfaceMaskFromObject):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateHoverActiveState): Use RefPtrs for the Nodes.
 
-2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-04-16  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Change HitTestResult methods to use (3d) transformation aware methods
-        https://bugs.webkit.org/show_bug.cgi?id=27347
+        <rdar://problem/7873647> Crash when updating hover state
 
-        The current HitTestResult methods are not using the (3d)
-        transformation aware routines. This can lead to an assertion
-        SVGRenderBase::mapLocalToContainer method.
+        Test: fast/dynamic/hover-style-recalc-crash.html
 
-        Change HitTestResult::imageRect to use the (3d) transformation
-        aware RenderBox::absoluteContentQuad to avoid running into
-        an assertion with SVG content.
+        Updating the hover state of an element caused the document to need style
+        recalc, and then updating the hover state of a link caused style recalc,
+        which changed the render tree while updateHoverActiveState() was iterating
+        over it, leading to a crash.
 
-        Remove HitTestResult::boundingBox() as it is only used in
-        two places and conceptually doesn't belong into a HitTest
-        which is operating on points.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateHoverActiveState): Collect the nodes to be
+        updated into vectors, then update their active and hover states.
 
-        A classic test case is not possible as the methods are not excercised
-        from within HTML/SVG but from the WebKit API Layer. A unittest
-        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
-        do not support 3d transformations making it impossible to write
-        a reliable test case and the Mac port is currently not doing
-        unit testing.
+2010-03-31  Mark Rowe  <mrowe@apple.com>
 
+        Reviewed by Darin Adler.
 
-        * rendering/HitTestResult.cpp: Remove boundingBox() method
-        (WebCore::HitTestResult::imageRect): Use transformation aware method
-        * rendering/HitTestResult.h: Remove boundingBox()
+        <http://webkit.org/b/36878> REGRESSION: Trailing colon on hostnames (with no port specified) causes "Not allowed to use restricted network port"
 
-2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+        * platform/KURL.cpp:
+        (WebCore::KURL::port): Explicitly handle the case of a colon being present in the URL after the host name but with
+        no port number before the path.  This is handled in the same manner as the colon and port being omitted completely.
 
-        Reviewed by Eric Seidel.
+2010-03-24  Mark Rowe  <mrowe@apple.com>
 
-        [Qt] Custom Cursor doesn't use hotspot.
-        https://bugs.webkit.org/show_bug.cgi?id=30820
+        Revert the portion of r56489 that dealt with port zero as it introduced some test failures.
 
-        Cursors loaded from a QPixmap didn't specifiy the
-        hotspot. Take the hotspot values from the mac
-        implementation.
+        * platform/KURL.cpp:
+        (WebCore::KURL::port): Use the "ok" argument to charactersToUIntStrict to determine whether
+        it was able to successfully parse the string as an unsigned integer, rather than relying on
+        the fact it returned zero when it failed.
 
-        * platform/qt/CursorQt.cpp:
+2010-03-24  Mark Rowe  <mrowe@apple.com>
 
-2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Timothy Hatcher.
+        WebKit should treat port numbers outside the valid range as being blacklisted
+        <http://webkit.org/b/36571> / <rdar://problem/7790908>
 
-        Web Inspector: Initial revision of the Timeline grid.
+        * platform/KURL.cpp:
+        (WebCore::KURL::port): Map invalid port numbers to invalidPortNumber.
+        (WebCore::portAllowed): Add invalidPortNumber to the blacklist.
+        * platform/KURLGoogle.cpp:  invalid port numbers to invalidPortNumber.
+        (WebCore::KURL::port): Add invalidPortNumber to the blacklist.
+        Also bring this in to sync with KURL.  Having this identical code in two places is stupid.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30834
+2010-05-05  Alexey Proskuryakov  <ap@apple.com>
 
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
-        (WebInspector.AbstractTimelinePanel.prototype.refresh):
-        (WebInspector.AbstractTimelineCalculator):
-        * inspector/front-end/Images/timelineBarBlue.png: Added.
-        * inspector/front-end/Images/timelineBarGray.png: Added.
-        * inspector/front-end/Images/timelineBarGreen.png: Added.
-        * inspector/front-end/Images/timelineBarOrange.png: Added.
-        * inspector/front-end/Images/timelineBarPurple.png: Added.
-        * inspector/front-end/Images/timelineBarRed.png: Added.
-        * inspector/front-end/Images/timelineBarYellow.png: Added.
-        * inspector/front-end/Images/timelineCheckmarks.png: Added.
-        * inspector/front-end/Images/timelineDots.png: Added.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceTimeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator):
-        * inspector/front-end/TimelineAgent.js:
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.get statusBarItems):
-        (WebInspector.TimelinePanel.prototype.get categories):
-        (WebInspector.TimelinePanel.prototype.populateSidebar):
-        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
-        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
-        (WebInspector.TimelinePanel.prototype.refresh):
-        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
-        (WebInspector.TimelinePanel.prototype.reset):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelinePanel.prototype.showCategory):
-        (WebInspector.TimelinePanel.prototype.hideCategory):
-        (WebInspector.TimelineRecordTreeElement):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        (WebInspector.TimelineCalculator):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
-        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
-        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
-        (WebInspector.TimelineCalculator.prototype.formatValue):
-        (WebInspector.TimelineGraph):
-        (WebInspector.TimelineGraph.prototype.get graphElement):
-        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
-        (WebInspector.TimelineGraph.prototype.refresh):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
+        Reviewed by Adele Peterson.
 
-2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=26824
+        <rdar://problem/7018610> EventHandler can operate on a wrong frame if focus changes during
+        keyboard event dispatch.
 
-        Reviewed by Pavel Feldman.
+        EventHandler object is tied to a frame, so it's wrong for it to continue processing a keyboard
+        event if focused frame changes between keydown and keypress.
 
-        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
-        https://bugs.webkit.org/show_bug.cgi?id=30844
+        * manual-tests/focus-change-between-key-events.html: Added.
 
-        * inspector/front-end/TestController.js:
-        (WebInspector.TestController.prototype.runAfterPendingDispatches):
-        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+        * page/EventHandler.cpp: (WebCore::EventHandler::keyEvent): Bail out early if focused frame
+        changes while dispatching keydown. Also made similar changes for Windows to maintain matching
+        behavior, even though EventHandler was re-entered anyway due to WM_KEYDOWN and WM_CHAR being
+        separate events.
 
-2009-10-27  Darin Fisher  <darin@chromium.org>
+2010-07-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Simon Hausmann.
 
-        Add missing forward declaration of FramelessScrollView.
-        https://bugs.webkit.org/show_bug.cgi?id=30824
+        [Qt] Canvas arcTo() should draw straight line to p1 if p0, p1 and p2 are collinear
 
-        * platform/chromium/FramelessScrollViewClient.h:
+        The implementation of PathQt's addArcTo() was not float-safe and also had
+        a case where it drew an 'infinite' line, which is not part of the spec.
 
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-arcto
 
-        Reviewed by Adele Peterson.
+        We now use qFuzzyCompare() in both cases. The method isPointOnPathBorder()
+        also had the same problem, and was refactored a bit in the process of fixing
+        the bug.
 
-        WAI-ARIA: add support for 'presentation' role
-        https://bugs.webkit.org/show_bug.cgi?id=30806
+        Initial patch by Andreas Kling.
 
-        Test: accessibility/aria-presentational-role.html
+        https://bugs.webkit.org/show_bug.cgi?id=41412
 
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::RoleEntry::):
+        * platform/graphics/qt/PathQt.cpp:
 
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+2010-03-26  Shu Chang  <chang.shu@nokia.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        ARIA menu/menu item need AXRoleDescription
-        https://bugs.webkit.org/show_bug.cgi?id=30804
+        [Qt] Prevent referring d->m_job in the future because calling abort()
+        deletes the instance itself.
+        https://bugs.webkit.org/show_bug.cgi?id=36618
 
-        Make sure that role descriptions will default to the system's first, before
-        returning an unknown role.
+        Test: http/tests/appcache/fallback.html
 
-        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::cancel):
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
+2010-06-28  Sam Magnuson  <smagnuson@netflix.com>
 
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Qt build fix: migrated away from API that no longer exists.
+        [Qt] GraphicsLayerQt delay seems unnecessary.
+        https://bugs.webkit.org/show_bug.cgi?id=40846
 
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue):
+        Test: compositing/animation/busy-indicator.html
 
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::recache):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setContentsToImage):
+        (WebCore::GraphicsLayerQt::addAnimation):
 
-        Qt build fix: migrated away from API that no longer exists.
+2010-06-25  Sam Magnuson  <smagnuson@netflix.com>
 
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-27  Oliver Hunt  <oliver@apple.com>
+        [Qt] When any geometry change happens to a node it will resize the
+        backing cache
+        https://bugs.webkit.org/show_bug.cgi?id=40378
 
-        Fix wording in comment.
+        Continue to grow the cache, but never toss it. When the pixmap
+        cache gets too big it will be lost and created at the right size
+        next time.
 
-        * bridge/objc/objc_instance.mm:
-        (allocateAutoReleasePool):
+        No new tests: this is an optimization.
 
-2009-10-27  Oliver Hunt  <oliver@apple.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::recache):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        Reviewed by Darin Adler.
+2010-06-30  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Crash occurs after launching Newsfire 1.6 for the first time
-        https://bugs.webkit.org/show_bug.cgi?id=30807
+        Reviewed by Simon Fraser.
 
-        We allocate an autorelease pool but then store it off the stack. In a
-        GC environment this led to it being collected, and thus caused badness
-        to ensue.  To work around this we simply avoid using a pool at all in
-        a GC environment as it would be a no-op anyway.
+        Spatial Navigation: make elements in inner frames nested more than 1 level deep focusable
+        https://bugs.webkit.org/show_bug.cgi?id=41160
 
-        * bridge/objc/objc_instance.mm:
-        (allocateAutoReleasePool):
-        (ObjcInstance::virtualBegin):
+        Patch addresses the problem of spatial navigation not work properly with nested
+        inner frames by adding the isNodeDeepDescendantOfDocument method. It recursively checks
+        if a give node is descendant of a given document or any parent of it.
 
-2009-10-27  Steve Block  <steveblock@google.com>
+        Test: fast/events/spatial-navigation/snav-iframe-nested.html
 
-        Reviewed by Darin Adler.
+        * page/FocusController.cpp:
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/SpatialNavigation.cpp:
+        (WebCore::isNodeDeepDescendantOfDocument):
+        * page/SpatialNavigation.h:
 
-        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
-        have already been denied.
-        https://bugs.webkit.org/show_bug.cgi?id=27944.
+2010-06-30  Andreas Kling  <andreas.kling@nokia.com>
 
-        Tests: fast/dom/Geolocation/permission-denied-already-error.html
-               fast/dom/Geolocation/permission-denied-already-success.html
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
-        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
-        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
-        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
-        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
-        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
-        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
-        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
-        * page/Geolocation.h: Modified.
-        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+        [Qt] Crash when uploading document to Google Docs
+        https://bugs.webkit.org/show_bug.cgi?id=40795
 
-2009-10-27  Chris Marrin  <cmarrin@apple.com>
+        Fix bug where the local file wasn't opened (for POSTing)
+        if it were the first element in the form.
 
-        Reviewed by Oliver Hunt.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::FormDataIODevice::FormDataIODevice):
+        (WebCore::FormDataIODevice::moveToNextElement):
+        (WebCore::FormDataIODevice::openFileForCurrentElement):
+        * platform/network/qt/QNetworkReplyHandler.h:
 
-        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
-        https://bugs.webkit.org/show_bug.cgi?id=30840
+2010-06-29  Abhinav Mithal <abhinav.mithal@nokia.com>
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
+        Reviewed by Laszlo Gombos.
 
-2009-10-27  Eric Seidel  <eric@webkit.org>
+        [Qt] [Symbian] Fix doube-deallocation while destroying PluginContainerSymbian
+        https://bugs.webkit.org/show_bug.cgi?id=37303
 
-        Reviewed by Nikolas Zimmermann.
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformDestroy):
 
-        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
-        https://bugs.webkit.org/show_bug.cgi?id=29620
+2010-06-29  Kristian Amlie  <kristian.amlie@nokia.com>
 
-        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
-        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
-        created before returning a CSSValue that JavaScript can modify.
+        Reviewed by Simon Hausmann.
 
-        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+        [Qt/Symbian] Fixed deployment paths for WebKit declarative plugin.
 
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::getPresentationAttribute):
+        * WebCore.pro:
 
-2009-10-27  Dan Bernstein  <mitz@apple.com>
+2010-06-28  Andreas Kling  <andreas.kling@nokia.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Simon Hausmann.
 
-        Incomplete repaint of text field in relative positioned inline at imdb.com
-        https://bugs.webkit.org/show_bug.cgi?id=30047
+        [Qt] Replace single treat-as-space characters with normal space
+        https://bugs.webkit.org/show_bug.cgi?id=41278
 
-        Test: fast/repaint/inline-relative-positioned.html
+        This keeps Qt from attempting glyph substitution and loading a bunch
+        of extra fonts when encountering &nbsp; entities.
 
-        Implemented offsetFromContainer(), mapLocalToContainer() and
-        mapAbsoluteToLocalPoint() in RenderInline.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
 
-        * rendering/RenderBox.h: Fixed argument names in the declaration of
-        mapLocalToContainer().
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::offsetFromContainer):
-        (WebCore::RenderInline::mapLocalToContainer):
-        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
-        * rendering/RenderInline.h:
+2010-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
-2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+        Unreviewed Symbian build fix.
 
-        Speculative build fix for Chromium.
+        The QML WebKit integration needs to be part of QtWebKit.sis
 
-        * platform/graphics/GraphicsContext3D.h:
+        * WebCore.pro: Deploy qmlwebkitplugin.dll.
 
-2009-10-27  Chris Marrin  <cmarrin@apple.com>
+2010-06-23  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        Reviewed by Simon Fraser.
-        
-        Make WebGL context failure more robust and make it succeed in more cases
-        https://bugs.webkit.org/show_bug.cgi?id=30349
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
-        return null from getContext. Also added a more robust pixel format choosing 
-        mechanism and can render correctly when a SW renderer is chosen.
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/canvas/CanvasRenderingContext.h:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.h:
-        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
-        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::setPixelFormat):
-        (WebCore::GraphicsContext3D::create):
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
-        (WebCore::GraphicsContext3D::reshape):
-        (WebCore::ensureContext):
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
 
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+        The frame view take into acount the list of fixed object when scrolling
+        the view. If the number of object is lower than a certain threshold, the pixel
+        are blitted, and the invalidated area updated.
 
-        Mac build fix: a forwarding header.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::repaintRectIncludingDescendants):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
 
-        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+2010-05-18  Anders Carlsson  <andersca@apple.com>
 
-2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+        Reviewed by Sam Weinig.
 
-        No Review.
+        Allocate the m_preloads list hash set dynamically and free it when done.
+        https://bugs.webkit.org/show_bug.cgi?id=39309
+        <rdar://problem/7998495>
 
-        Making fontWeightIsBold static to fix Snow Leopard build.
+        This saves about 6000 bytes on a fully loaded document.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontWeightIsBold):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestPreload):
+        (WebCore::DocLoader::clearPreloads):
+        * loader/DocLoader.h:
 
-2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+2010-05-18  Anders Carlsson  <andersca@apple.com>
 
-        Reviewed by Eric Seidel.
+        Revert unintended indentation and unnecessary nested name specifier.
 
-        WebKit cannot remove nested bold tags
-        https://bugs.webkit.org/show_bug.cgi?id=30784
+        * rendering/RenderBlock.cpp:
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::insertPositionedObject):
 
-        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
-        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
-        all font weights to either bold or unbold state.
+2010-05-18  Anders Carlsson  <andersca@apple.com>
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontWeightIsBold):
-        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
-        if two style have the same value under getFontWeightValue
+        Reviewed by Sam Weinig.
 
-2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+        Add an inlineCapacity template parameter to ListHashSet and use it to shrink the positioned object list hash set.
+        https://bugs.webkit.org/show_bug.cgi?id=39304
+        <rdar://problem/7998366>
 
-        Reviewed by Darin Adler.
+        Set the inlineCapacity for the positionedObjects ListHashSet to 4 instead of 256. Since a RenderBlock usually has 
+        few positioned objects, this saves memory.
 
-        Give an ability to WebKit to free statically allocated pointers
-        before quit.
-        https://bugs.webkit.org/show_bug.cgi?id=27980
+        * WebCore.base.exp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::insertPositionedObject):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::positionedObjects):
 
-        No new tests for this as the change does not affect WebKit
-        functionality, but only memory usage.
+2010-06-22  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * JavaScriptCore/wtf/StdLibExtras.h:
-        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
-        commandline options or elsewhere in the code. Useful for 
-        implementing custom builds that free resources allocated via
-        DEFINE_STATIC_LOCAL.
+        Unreviewed Qt/Symbian build fix.
 
-2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+        Fix "make clean" to not try to execute clean commands for
+        the extra targets we use to simulate "make install".
 
-        Build fix, no review needed.
+        * WebCore.pro: Use no_clean in CONFIG of extra compilers.
 
-        Fixing the BUILD. m_estimatedSize in Database.h should be of type
-        'unsigned long' instead of 'unsigned long long'.
+2010-06-21  Balazs Kelemen  <kb@inf.u-szeged.hu>
 
-        No tests required.
+        Reviewed by Simon Hausmann.
 
-        * storage/Database.h:
+        [Qt] Avoid unnecessary image conversion in RGBA32Buffer::zeroFill()
+        https://bugs.webkit.org/show_bug.cgi?id=40910
 
-2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::zeroFill):
 
-        Reviewed by Adam Barth.
+2010-05-31  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Refactoring the Database class to not depend on
-        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
-        Database instance, that is safe to use on the file
-        thread. Finally, adding new simple fields and getters to the
-        Database object for storing/getting the display name and estimated
-        size specified by the user in the openDatabase() call.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30548
+        [Qt] Implement the simple text code path.
+        https://bugs.webkit.org/show_bug.cgi?id=40077
 
-        * page/SecurityOrigin.h:
-        * storage/Database.cpp:
-        (WebCore::Database::openDatabase): Storing the display name and
-        the estimated size in the Database object.
-        (WebCore::Database::Database): Storing the display name and the
-        estimated size in the Database object, as well as a SecurityOrigin
-        instance that is safe to use on the DB thread.
-        (WebCore::Database::maximumSize): Delegate the call to
-        DatabaseTracker::getMaxSizeForDatabase().
-        (WebCore::Database::databaseThreadSecurityOrigin): Return the
-        SecurityOrigin instance that's safe to use on the DB thread.
-        (WebCore::Database::threadSafeSecurityOrigin): Return the
-        SecurityOrigin instance that's safe to use on the current thread.
-        (WebCore::Database::displayName): Return the display name
-        specified by the user in the openDatabase() call.
-        (WebCore::Database::estimatedSize): Return the estimated size
-        specified by the user in the openDatabase() call.
-        (WebCore::Database::fileName): Return the name of the file where
-        the current Database is tored.
-        * storage/Database.h:
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
-        maximum size for a DB file based on the current size of that file
-        and the space available for that origin.
-        * storage/DatabaseTracker.h:
-        * storage/SQLTransaction.cpp:
-        * storage/SQLTransactionClient.cpp:
-        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
-        correct SecurityOrigin instance.
+        Remove the FONT_FAST_PATH macro and use the Qt's
+        fast text implementation instead of the one of WebKit.
 
-2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+        The Qt::TextBypassShaping flag is used to tell Qt to
+        only use the glyph advances.
 
-        Reviewed by Timothy Hatcher.
+        Qt 4.7 is needed to get this flag thus the complex path is always
+        used if QtWebKit is compiled against an earlier version.
 
-        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
-        https://bugs.webkit.org/show_bug.cgi?id=30709
+        Contrary to the WebKit's implementation, the complex code path
+        is taken if the text is RightToLeft, justified or is formatted
+        with non-zero letter or word spacing.
 
-        Test: inspector/console-format-collections.html
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::drawText):
+        (WebCore::Font::floatWidth):
+        (WebCore::Font::selectionRectForText):
+        (WebCore::Font::offsetForPosition):
+        * platform/graphics/Font.h:
+        (WebCore::Font::isRoundingHackCharacter):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::fromRawDataWithoutRef):
+        (WebCore::needComplexCodePath):
+        (WebCore::setupPlatformContext):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawSimpleText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForSimpleText):
+        (WebCore::Font::offsetForPositionForSimpleText):
+        (WebCore::Font::selectionRectForSimpleText):
 
-        * inspector/front-end/InjectedScript.js:
-        (Object.type): check for instances of HTMLCollection like we do for NodeList
-        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
-        (WebInspector.dispatch): increment and decrement dispatch counter
-        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+2010-06-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-2009-10-27  Kelly Norton  <knorton@google.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Timothy Hatcher.
+        Move the text code path detection code from FontFastPath.cpp to Font.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=40077
 
-        Adds XMLHttpRequest support to InspectorTimelineAgent.
-        https://bugs.webkit.org/show_bug.cgi?id=30578
+        This is a patch preliminary to the implementation of the
+        simple font code path for the Qt port.
 
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
-        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
-        (WebCore::InspectorTimelineAgent::willLoadXHR):
-        (WebCore::InspectorTimelineAgent::didLoadXHR):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
-        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/front-end/TimelineAgent.js:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setCodePath):
+        (WebCore::Font::codePath):
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
 
-2009-10-27  Enrica Casucci  <enrica@apple.com>
+2010-04-30  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Adele Peterson.
 
-        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
-        extends the top of the selection upwards (but should shrink the selection instead)
-        <rdar://problem/7269075>
-        https://bugs.webkit.org/show_bug.cgi?id=29981
+        Part of <rdar://problem/6649734> Text repainting does not account for glyphs which draw outside the typographic bounds of the font
+        https://bugs.webkit.org/show_bug.cgi?id=6274
+
+        Account for glyph overflow of characters in the range U+1E00..U+2000, but without sending them
+        through the complex text code path. Instead, introduce a variant of the fast path that tracks
+        glyph overflow.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::drawText): Use codePath().
+        (WebCore::Font::floatWidth): Use codePath(). Pass the GlyphOverflow pointer through to
+        floatWidthForSimpleText() if the code path is SimpleWithGlyphOverflow.
+        (WebCore::Font::selectionRectForText): Use codePath().
+        (WebCore::Font::offsetForPosition): Ditto.
+        * platform/graphics/Font.h: Replaced canUseGlyphCache() with codePath(). Added a GlyphOverflow
+        parameter to floatWidthForSimpleText().
+        * platform/graphics/FontFastPath.cpp:
+        Removed ROMAN_AND_GREEK_DIACRITICS_CAN_USE_GLYPH_CACHE.
+        (WebCore::Font::codePath): Renamed canUseGlyphCache() to this. Where it used to return false,
+        it now returns Complex. Where it used to return true, it now returns Simple, except for
+        the range U+1E00..U+2000, where it now returns SimpleWithGlyphOverflow.
+        (WebCore::Font::floatWidthForSimpleText): Added a GlyphOverflow parameter. If not 0, have the
+        width iterator account for glyph bounds, then update the GlyphOverflow accordingly.
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Added boolean parameter telling the width iterator
+        whether to account for glyph bounds. Initialize m_accountForGlyphBounds accordingly. Initialize
+        m_maxGlyphBoundingBoxY, m_minGlyphBoundingBoxY, m_firstGlyphOverflow and m_lastGlyphOverflow.
+        (WebCore::WidthIterator::advance): If accounting for glyph bounds, update the above member variables.
+        * platform/graphics/WidthIterator.h:
+        (WebCore::WidthIterator::maxGlyphBoundingBoxY): Added this accessor.
+        (WebCore::WidthIterator::minGlyphBoundingBoxY): Ditto.
+        (WebCore::WidthIterator::firstGlyphOverflow): Ditto.
+        (WebCore::WidthIterator::lastGlyphOverflow): Ditto.
+
+2010-04-21  Ojan Vafai  <ojan@chromium.org>
 
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+        Reviewed by Adele Peterson.
 
-2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+        http://trac.webkit.org/changeset/57215 caused perf/memory regressions
+        https://bugs.webkit.org/show_bug.cgi?id=37292
 
-        Rubber-stamped by Tim Hatcher.
-        
-        Removed an extra console.log from ElementsTreeOutline.
+        #if out the canUseGlyphCache Changes from r57215 as they caused a 
+        8% perf regression on Chromium's international page load tests so that
+        the perf regression can be fixed properly without being left in the tree.
 
-        * inspector/front-end/ElementsTreeOutline.js:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
 
-2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
+2010-04-07  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dave Hyatt.
 
-        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
-        https://bugs.webkit.org/show_bug.cgi?id=27147
+        Text repainting does not account for glyphs which draw outside the typographic bounds of the font (6274).
+        <rdar://problem/6649734>
+        <https://bugs.webkit.org/show_bug.cgi?id=6274>
+        
+        In order to be able to handle successfully this case, it is necessary to change the glyph width cache to store
+        the bounding box for the glyph instead of the simply caching the glyph width.
+        Retrieving the bounding box for the glyph is expensive, therefore we do it only
+        when we are rendering text using the complex text path to minimize the performance impact.
+        To support characters with stacked diacritics, the method canUseGlyphCache has been modified to
+        return false for the range of characters with stacked diacritics.
+        The glyph cache has been also updated to allow storing the glyph bounding box together with the
+        horizontal width. The bounding box is populated only for complex text.
+        
+        The original version of this patch has been written by Dan Bernstein.
+
+        Test: fast/repaint/stacked-diacritics.html
+
+        * Android.mk: File name change.
+        * GNUmakefile.am: File name change.
+        * WebCore.base.exp: Added parameter in exported function.
+        * WebCore.gypi: File name change.
+        * WebCore.vcproj/WebCore.vcproj: File name change.
+        * WebCore.xcodeproj/project.pbxproj: File name change.
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Added glyphOverflow parameter.
+        * platform/graphics/Font.h:
+        (WebCore::GlyphOverflow::GlyphOverflow): Added.
+        (WebCore::Font::width): Added glyphOverflow parameter.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache): Modified to render characters with stacked diacritics with complex text path.
+        * platform/graphics/GlyphMetricsMap.cpp: Copied from WebCore/platform/graphics/GlyphWidthMap.cpp.
+        (WebCore::GlyphMetricsMap::locatePageSlowCase): Class name changed to reflect new semantics.
+        * platform/graphics/GlyphMetricsMap.h: Copied from WebCore/platform/graphics/GlyphWidthMap.h.
+        (WebCore::GlyphMetricsMap::GlyphMetricsMap):
+        (WebCore::GlyphMetricsMap::~GlyphMetricsMap):
+        (WebCore::GlyphMetricsMap::metricsForGlyph):
+        (WebCore::GlyphMetricsMap::widthForGlyph):
+        (WebCore::GlyphMetricsMap::setMetricsForGlyph):
+        (WebCore::GlyphMetricsMap::GlyphMetricsPage::metricsForGlyph):
+        (WebCore::GlyphMetricsMap::GlyphMetricsPage::setMetricsForGlyph):
+        (WebCore::GlyphMetricsMap::GlyphMetricsPage::setMetricsForIndex):
+        (WebCore::GlyphMetricsMap::locatePage):
+        * platform/graphics/GlyphWidthMap.cpp: Removed.
+        * platform/graphics/GlyphWidthMap.h: Removed.
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::platformGlyphInit):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::):
+        (WebCore::SimpleFontData::widthForGlyph):
+        (WebCore::SimpleFontData::metricsForGlyph):
+        * platform/graphics/cairo/SimpleFontDataCairo.cpp:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added parameter.
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added parameter.
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph): Name and signature vachange
+        * platform/graphics/efl/FontEfl.cpp:
+        (WebCore::Font::floatWidthForComplexText): Name and signature change.
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * platform/graphics/haiku/FontHaiku.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added parameter.
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController):
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
+        * platform/graphics/mac/ComplexTextController.h:
+        (WebCore::ComplexTextController::minGlyphBoundingBoxX):
+        (WebCore::ComplexTextController::maxGlyphBoundingBoxX):
+        (WebCore::ComplexTextController::minGlyphBoundingBoxY):
+        (WebCore::ComplexTextController::maxGlyphBoundingBoxY):
+        * platform/graphics/mac/FontComplexTextMac.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added paramter.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added paramter.
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added parameter.
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::metricsForGDIGlyph):
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::UniscribeController):
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+        * platform/graphics/win/UniscribeController.h:
+        (WebCore::UniscribeController::minGlyphBoundingBoxX):
+        (WebCore::UniscribeController::maxGlyphBoundingBoxX):
+        (WebCore::UniscribeController::minGlyphBoundingBoxY):
+        (WebCore::UniscribeController::maxGlyphBoundingBoxY):
+        * platform/graphics/wince/FontWince.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added parameter.
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added parameter.
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformMetricsForGlyph): Name and signature change.
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::setFallbackFonts):
+        (WebCore::InlineTextBox::fallbackFonts):
+        (WebCore::InlineTextBox::setGlyphOverflow):
+        (WebCore::InlineTextBox::glyphOverflow):
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::clearGlyphOverflowAndFallbackFontMap): Added.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::styleDidChange):
+        (WebCore::RenderText::widthFromCache):
+        (WebCore::RenderText::trimmedPrefWidths):
+        (WebCore::RenderText::calcPrefWidths):
+        (WebCore::RenderText::setText):
+        (WebCore::RenderText::width):
+        * rendering/RenderText.h:
 
-        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
+2010-03-23  Evan Martin  <evan@chromium.org>
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
+        Reviewed by Dmitry Titov.
 
-2009-10-27  Mads Ager  <ager@chromium.org>
+        [chromium] use integral glyph widths
+        https://bugs.webkit.org/show_bug.cgi?id=36510
 
-        Reviewed by Adam Barth.
+        Despite WebKit (and Skia, to an extent) supporting non-integral
+        glyph widths, the font code path we hit in Skia only supports
+        integral glyph positions.  This means that we would accumulate
+        offsets when drawing a sequence up non-integer-width glyphs
+        which would cause gaps when snapped to the pixel grid when drawing.
 
-        [V8] Missing null check after string conversion in error reporting
-        https://bugs.webkit.org/show_bug.cgi?id=30774
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        round glyph widths to integers.
 
-        Add null check after string conversion in error reporting code.
-        ToString conversion can fail for instance when an exception is
-        thrown during conversion.
+2010-06-21  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        Test: fast/dom/error-to-string-stack-overflow.html
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::reportException):
+        [Qt] Decode images directly to QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=40797
 
-2009-10-27  Steve Block  <steveblock@google.com>
+        Decode images to QPixmap directly instead of QImage when possible.
+        RGBA32Buffer transforms the pixmap back to image if
+        necessary.
 
-        Reviewed by Darin Adler.
+        This improve the performance with certain graphic system, and
+        can reduce memory usage.
 
-        Use a pair of maps to store Geolocation watchers.
-        https://bugs.webkit.org/show_bug.cgi?id=29178
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::setPixmap):
 
-        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
-        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
-        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+2010-06-17  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
-        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
-        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
-        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
-        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
-        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
-        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
-        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
-        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
-        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
-        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
-
-2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Dimitri Glazkov.
+        [Qt] Get rid of the the unused imageSize of ImageDecoderQt::internalHandleCurrentImage()
+        https://bugs.webkit.org/show_bug.cgi?id=40620
 
-        [V8] DOM Storage runtime flag should default to on
-        https://bugs.webkit.org/show_bug.cgi?id=30828
+        Remove an unused variable.
 
-        The DOM Storage runtime flag was supposed to default to on.  I accidentally
-        changed the logic to default to false when I moved the flag.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
 
-        * bindings/v8/RuntimeEnabledFeatures.cpp:
+2010-06-18  Ananth Jasty  <ext-ananth.jasty@nokia.com>
 
-2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Dimitri Glazkov.
+        [Qt] Text spacing miscalculation when using wordSpacing.
+        https://bugs.webkit.org/show_bug.cgi?id=40483
 
-        Fix crash found in chromium test_shell.
-        https://bugs.webkit.org/show_bug.cgi?id=30808
+        Removed wordSpacing compensation in FontQt whitespace width
+        calculation. The QFontMetrics::width() overload that takes
+        a character does not take QFont's word spacing into account.
 
-        When WebSocket is deleted without close, webkit would crash
-        when it handles didClose.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
 
-        Check scriptExecutionContext before post task for event.
-        Use WebSocketChannel::disconnect() instead of close() in WebSocket
-        destructor, so that WebSocketChannel should not call deleted WebSocket
-        back in didClose().
-        To make sure WebSocketChannel alive while it is processing WebSocket
-        protocol over SocketStreamHandle, ref() in connect() and deref() in
-        didClose().
+2010-06-13  Robert Hogan  <robert@webkit.org>
 
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::~WebSocket):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        * websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::connect):
-        (WebCore::WebSocketChannel::disconnect):
-        (WebCore::WebSocketChannel::didClose):
-        (WebCore::WebSocketChannel::didReceiveData):
-        * websockets/WebSocketChannel.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-27  Dan Bernstein  <mitz@apple.com>
+        WebCore EventHandler needs to take account of onLoad events 
+        fired before layout() complete
 
-        Reviewed by Darin Adler.
+        https://bugs.webkit.org/show_bug.cgi?id=40102
 
-        Updated Apple license
+        WebCore 'cheats' by firing onLoad events before the frame's layout
+        has been performed. This can result in event listeners performing
+        operations that depend on the document's final layout, such as
+        scrolling operations.
 
-        * LICENSE-APPLE:
+        When scrolling a frameview in eventhandler ensure the layout is complete.
 
-2009-10-27  Brady Eidson  <beidson@apple.com>
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
 
-        Rubberstamped by Sam Weinig.
+2010-06-10  Raine Makelainen  <raine.makelainen@nokia.com>
 
-        Re-enable the check that disallows pages with unload handlers in the page cache.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        <rdar://problem/7196485> and http://webkit.org/b/29021 
+        Impossible to set input method hints based HTML5 input types
+        https://bugs.webkit.org/show_bug.cgi?id=40107
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        Helper methods for checking "tel", "number", "email",
+        and "url" input element types.
 
-2009-10-27  Timothy Hatcher  <timothy@apple.com>
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isTelephoneField):
+        (WebCore::HTMLInputElement::isNumberField):
+        (WebCore::HTMLInputElement::isEmailField):
+        (WebCore::HTMLInputElement::isUrlField):
 
-        Remove more empty files that didn't get removed earlier.
+2010-06-17  Mark Brand  <mabrand@mabrand.nl>
 
-        * inspector/DOMDispatchTimelineItem.cpp: Removed.
-        * inspector/DOMDispatchTimelineItem.h: Removed.
+        Reviewed by Simon Hausmann.
 
-2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        [Qt] use "win32-g++*" scope to match all MinGW makespecs
 
-        Reviewed by Tor Arne Vestbø.
+        The scope "win32-g++" comes from the name of the makespec. However, it
+        is frequently used to check for MinGW. This works fine as long as
+        win32-g++ is the only makespec for MinGW. Now we need the wildcard
+        to cover "win32-g++-cross" as well.
 
-        [Qt] Fix assertion crashes introduced by changes made in r50110.
+        * WebCore.pro:
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+2010-06-16  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-10-27  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Kenneth Christiansen.
 
-        Remove empty files that didn't get removed earlier.
+        Spatial Navigation: using offset{Left,Top} is not enough to get the proper inner frames position
+        https://bugs.webkit.org/show_bug.cgi?id=39439
 
-        * inspector/TimelineItem.cpp: Removed.
-        * inspector/TimelineItem.h: Removed.
+        As pointed out by Darin Adler in https://bugs.webkit.org/show_bug.cgi?id=18662#c20,
+        "It's not correct to use the offsetLeft and offsetTop of the frame owner element's renderer because
+        that's just the distance from the offsetParent, not the absolute position".
 
-2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Patch fixes that behavior by now considering the offsetTop and offsetLeft the offsetParent recursively,
+        starting from the HtmlFrameOwnerElement. Previously, only calling offsetTop and offsetLeft works
+        because all tests were done in htmls where the {i}frame element was a directly a child of the body,
+        e.g. <html>...<body><iframe src=xxx>....<body></html>.
 
-        Reviewed by Xan Lopez.
+        Test: fast/events/spatial-navigation/snav-iframe-recursive-offset-parent.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=25534
-        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+        * page/SpatialNavigation.cpp:
+        (WebCore::renderRectRelativeToRootDocument):
 
-        First part of the implementation of AtkTable.
+2010-06-16  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getCell):
-        (getCellIndex):
-        (webkit_accessible_table_ref_at):
-        (webkit_accessible_table_get_index_at):
-        (webkit_accessible_table_get_n_columns):
-        (webkit_accessible_table_get_n_rows):
-        (webkit_accessible_table_get_column_extent_at):
-        (webkit_accessible_table_get_row_extent_at):
-        (webkit_accessible_table_get_row_header):
-        (atk_table_interface_init):
-        (AtkInterfacesInitFunctions):
-        (GetAtkInterfaceTypeFromWAIType):
+        Reviewed by Simon Fraser.
 
-2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Spatial Navigation: refactor scrollInDirection to work with scrollable content
+        https://bugs.webkit.org/show_bug.cgi?id=39195
 
-        Reviewed by Lars Knoll.
+        scrollInDirection now receives as parameter the node that the Spatial Navigation
+        found as the more appropriated to move focus to. If it is in a scrollable container
+        (e.g. <div> with clipped overflow content), it scrolls recursively starting from
+        the container, not the current focused node.
 
-        [Qt] Don't lose remainder when computing wheel event deltas
+        Test: fast/events/spatial-navigation/snav-only-clipped-overflow-content.html
 
-        * platform/qt/WheelEventQt.cpp:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollInDirection):
+        * page/SpatialNavigation.h:
 
-2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-05-28  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
 
-        Reviewed by Antti Koivisto.
+        Reviewed by Simon Hausmann, Antti Koivisto
 
-        Fix QtWebKit build for WIN_OS if Netscape plug-in support
-        is turned off and refactor some related code
-        https://bugs.webkit.org/show_bug.cgi?id=30786
+        Make repaint throttling parameters runtime configurable.
+        https://bugs.webkit.org/show_bug.cgi?id=38401
 
-        No new tests as there is no new functionality introduced.
+        REPAINT_THROTTLING now chooses default values for throttling parameters.
+        Should be removed when applications start using runtime configuration.
 
-        * platform/FileSystem.h: Refactor to make sure that each different
-        type definition is only repeated once.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::updateDeferredRepaintDelay):
+        (WebCore::FrameView::setRepaintThrottlingDeferredRepaintDelay):
+        (WebCore::FrameView::setRepaintThrottlingnInitialDeferredRepaintDelayDuringLoading):
+        (WebCore::FrameView::setRepaintThrottlingMaxDeferredRepaintDelayDuringLoading):
+        (WebCore::FrameView::setRepaintThrottlingDeferredRepaintDelayIncrementDuringLoading):
+        * page/FrameView.h:
 
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::compareFileVersion): Move it out from the
-        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
-        function body from PluginPackageWin.
+2010-06-16  Dawit Alemayehu  <adawit@kde.org>
 
-        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
-        it is now in PluginPackage.cpp.
+        Reviewed by Simon Hausmann.
 
-2009-10-26  Xan Lopez  <xlopez@igalia.com>
+        [Qt] QtWebKit crashes while initializing flash plugin 10.1.53.64.
+        https://bugs.webkit.org/show_bug.cgi?id=40567
 
-        Reviewed by Gustavo Noronha.
+        Avoid preventable crashes by ensuring gtk_init() is called in the
+        flash viewer plugins before calling NP_Initialize.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27011
-        [Gtk] Implement support for get_index_in_parent
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
 
-        Implement atk_object_get_index_in_parent.
+2010-04-21  Zoltan Herczeg  <zherczeg@webkit.org>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_index_in_parent):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-27  Eric Seidel  <eric@webkit.org>
+        [Qt] startAnimation() is not needed to preceede nativeImageForCurrentFrame()
+        https://bugs.webkit.org/show_bug.cgi?id=37844
 
-        No review, rolling out r50131.
-        http://trac.webkit.org/changeset/50131
+        nativeImageForCurrentFrame() resets the m_decoder parameter under Qt,
+        which is required by startAnimation() to detect frame and repetition counts.
+        Hence, Image::drawTiled cannot start animations under Qt:
+        <html><body background="animated.gif"></body></html> does not work
 
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::ObjcInstance):
-        (ObjcInstance::virtualEnd):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
 
-2009-10-26  Daniel Bates  <dbates@webkit.org>
+2010-05-28  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30491
-
-        Fixes an issue where pressing return/enter on the keyboard 
-        in <isindex> does not submit it if is not within a <form>.
-
-        According to the HTML 2.0 thru HTML 4.01 spec 
-        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
-        <isindex> element does not need to be within a <form> element in 
-        order to submit it. It can submitted on its own. Also, if present,
-        the href property of the <base> element will dictate where to submit
-        the value of the <isindex> element (this is analogous to the action 
-        property of the <form> element).
-
-        Tests: http/tests/misc/isindex-with-no-form-base-href.html
-               http/tests/misc/isindex-with-no-form.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
-        to create a <form> if none is present and we are an <isindex> element.
-        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
-        * html/HTMLInputElement.h:
-
-2009-10-26  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Crash occurs after launching Newsfire 1.6 for the first time
-        https://bugs.webkit.org/show_bug.cgi?id=30807
-
-        Use a RetainPtr in ObjcBinding to ensure that we adequately
-        protect the autorelease pool from GC in GC'd applications.
+        https://bugs.webkit.org/show_bug.cgi?id=39857
+        Make GIFs loop the correct number of times.  Previously, everyone looped
+        one time too few for non-infinitely-looping GIFs.
 
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::ObjcInstance):
-        (ObjcInstance::virtualEnd):
+        Modified a Qt manual test to be correct and moved it to the general
+        manual test directory.
 
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * manual-tests/animated-gif-looping.html: Copied from WebCore/manual-tests/qt/qt-gif-test.html.
+        * manual-tests/qt/qt-10loop-anim.gif: Removed.
+        * manual-tests/qt/qt-anim.gif: Removed.
+        * manual-tests/qt/qt-gif-test.html: Removed.
+        * manual-tests/qt/qt-noanim.gif: Removed.
+        * manual-tests/resources/animated-10x.gif: Copied from WebCore/manual-tests/qt/qt-10loop-anim.gif and modified.
+        * manual-tests/resources/animated-infinite.gif: Copied from WebCore/manual-tests/qt/qt-anim.gif.
+        * manual-tests/resources/non-animated.gif: Copied from WebCore/manual-tests/qt/qt-noanim.gif.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::internalAdvanceAnimation): For a loop count of n, show a total of n + 1 animation cycles.
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::repetitionCount):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::repetitionCount): Remove translation code now that WebCore matches Qt's internal handling of the loop count.  Qt itself may still have a bug here.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::read): Translate loop count 0 to "loop infinitely" (by restoring one piece of the Mozilla code we'd removed).
 
-        Unreviewed.
+2010-05-04  Tucker Jay  <jay.tucker@nokia.com>
 
-        [Qt] Build fix for QtWebKit after r50125.
+        Reviewed by Holger Freyther.
 
-        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+        Animated GIF images does not animate 10x as expected by default.
+        https://bugs.webkit.org/show_bug.cgi?id=36818
 
-2009-10-26  Matt Mueller  <mattm@chromium.org>
+        Added test case to existing manual test to test the
+        fixed functionality.
 
-        Reviewed by Darin Adler.
+        * manual-tests/qt/qt-10loop-anim.gif: Added.
+        * manual-tests/qt/qt-gif-test.html:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::repetitionCount):
 
-        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+2010-05-16  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+        Unreviewed naming fixes of local variables used in Spatial Navigation methods.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30658
+        Summary:
+            * "candidate" renamed to "node";
+            * "currentFocusCandidate" renamed to "candidate"
+            * "closestFocusCandidate" renamed to "closest"
 
-        Covered by running various svg tests under valgrind, ex:
-        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+        That way naming is more consistent in the various Spatial Navigation methods.
 
-        * svg/SynchronizablePropertyController.cpp:
-        (WebCore::SynchronizableProperties::addProperty):
-        (WebCore::SynchronizableProperties::synchronize):
-        (WebCore::SynchronizableProperties::startAnimation):
-        (WebCore::SynchronizableProperties::stopAnimation):
-        (WebCore::SynchronizablePropertyController::registerProperty):
-        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
-        (WebCore::SynchronizablePropertyController::synchronizeProperty):
-        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
-        (WebCore::SynchronizablePropertyController::startAnimation):
-        (WebCore::SynchronizablePropertyController::stopAnimation):
-        * svg/SynchronizablePropertyController.h:
-        (WebCore::SynchronizableProperties::SynchronizableProperties):
-        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
 
-2009-10-26  Kelly Norton  <knorton@google.com>
+2010-06-14  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Fraser and Kenneth Christiansen.
 
-        Renames TimelineItem to TimelineRecord and updates all call sites.
-        https://bugs.webkit.org/show_bug.cgi?id=30785
+        Spatial Navigation: make it work with focusable elements in overflow content
+        https://bugs.webkit.org/show_bug.cgi?id=36463
 
-        * GNUmakefile.am: 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addRecordToTimeline):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::didInstallTimer):
-        (WebCore::InspectorTimelineAgent::didRemoveTimer):
-        (WebCore::InspectorTimelineAgent::willFireTimer):
-        (WebCore::InspectorTimelineAgent::didFireTimer):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
-        * inspector/TimelineItemFactory.cpp: Removed.
-        * inspector/TimelineItemFactory.h: Removed.
-        * inspector/TimelineRecordFactory.cpp: Added.
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
-        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
-        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
-        * inspector/TimelineRecordFactory.h: Added.
-        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.addRecordToTimeline):
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        This patch addresses the problem with Spatial Navigation. It currently does not
+        properly traverse scrollable contents, including scrollable div's. For this to work,
+        a new class member called scrollableEnclosingBox was introduced to FocusCandidate class which
+        keeps track of the current scrollable box Node wrapping a FocusCandidate.
 
-2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
+        To make use of enclosingScrollableBox of FocusCandidate, the DOM traversal routine
+        (FocusController::findNextFocusableInDirection) was changed as follows: when it
+        encounters a scrollable Node, each focusable node which is 'inner' keeps track of
+        the container reference. By the time a sibling of the scrollable Node is encountered,
+        there is no need to track this reference any more and the traversal algorithm continues
+        normally.
 
-        Reviewed by Antti Koivisto.
+        The common case is obviously that there is no scrollable container wrapping it.
 
-        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
-        
-        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
-        QPicture holds a reference to the X Pixmap. As a result, the print preview would
-        update itself when the X Pixmap changes. To prevent the print preview from updating
-        whenever m_drawable is updated (i.e when the view updates), we create a copy.
-        
-        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
-        regardless of the graphicssystem. This is taken care of by
-        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
-        
-        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
-        it will free the Pixmap whenever the user closes the print preview dialog and
-        handles the case of displaying multiple preview dialogs nicely.
-        
-        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
-        
-        https://bugs.webkit.org/show_bug.cgi?id=30714
+        updateFocusCandiditeIfCloser logic was also adapted to fit the need of the
+        newly introduced enclosingScrollableBox class member, getting simpler and more
+        easily maintainable.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+        Tests: fast/events/spatial-navigation/snav-div-scrollable-but-without-focusable-content.html
+               fast/events/spatial-navigation/snav-clipped-overflow-content.html
 
-2009-10-26  Benjamin Otte  <otte@gnome.org>
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateInSameContainer):
+        (WebCore::updateFocusCandidateIfCloser):
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/SpatialNavigation.cpp:
+        (WebCore::isScrollableContainerNode):
+        * page/SpatialNavigation.h:
+        (WebCore::FocusCandidate::FocusCandidate):
+        (WebCore::FocusCandidate::isInScrollableContainer):
+
+2010-06-15  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Simon Hausmann.
 
-        Don't store properties in the MediaPlayerPrivate class
+        [Qt] The qt_webkit_version.pri file gets overwritten on install
+        https://bugs.webkit.org/show_bug.cgi?id=40487
 
-        Access them via the MediaPlayer class instead.
-        https://bugs.webkit.org/show_bug.cgi?id=30462
+        Don't install qt_webkit_version.pri when building WebKit inside of Qt.
+        The import of WebKit into Qt will take care of providing the file
+        in mkspecs/modules and it'll be installed through projects.pro.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::seek):
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setRate):
-        (WebCore::MediaPlayerPrivate::setVisible):
-        (WebCore::MediaPlayerPrivate::paint):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-
-2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+        * WebCore.pro:
 
-        Reviewed by Timothy Hatcher.
+2010-06-13  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Fixes <http://webkit.org/b/30801>.
-        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
-        
-        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
-        [ and ], so we should honor those as well.
+        Reviewed by Eric Seidel.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.documentKeyDown):
+        [Qt] GraphicsLayer: recaching images creates an unnecessary deep copy
+        https://bugs.webkit.org/show_bug.cgi?id=40535
 
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Made sure the painter ends its operation before copying the pixmap.
 
-        Reviewed by Darin Adler.
+        No new tests: this is an optimization.
 
-        Make .rc files compile on Windows without depending on MFC headers
-        https://bugs.webkit.org/show_bug.cgi?id=30750
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::recache):
 
-        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
-        even when MFC is not installed, and is all that's needed here.
+2010-03-24  Dumitru Daniliuc  <dumi@chromium.org>
 
-2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Darin Adler.
+        Changing the V8 and JSC implementations of
+        SQLStatementErrorCallback to interpret as false all results that
+        could be converted to a false boolean. Pretty much a revert of
+        r54981.
 
-        Build corrections for ENABLE_FILTERS in Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30797
+        https://bugs.webkit.org/show_bug.cgi?id=36569
 
-        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomVoidCallback.h:
 
-        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
-          its piDouble constant.
-        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
-          its piDouble constant.  Remove unnecessary call to floor used in
-          the division of an unsigned, converting to int.
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
-          style for MathExtras.h.
+2010-06-13  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-10-26  Brady Eidson  <beidson@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler.
+        [Qt] tests/hybridPixmap fails
+        https://bugs.webkit.org/show_bug.cgi?id=37316
 
-        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+        The problem was that JSC::Instance::createRuntimeObject was never called.
+        This is fixed by overloading newRuntimeObject and calling Instance::createRuntimeObject
+        in between, instead of creating the runtime object directly inside the static function
+        QtPixmapInstance::createRuntimeObject, which had to be renamed as to not overshadow the virtual function.
 
-        Test: fast/loader/grandparent-completion-starts-redirect.html
+        This fixes an existing test, tests/hybridPixmap
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::newRuntimeObject):
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
 
-2009-10-26  Dan Bernstein  <mitz@apple.com>
+2010-06-07  Mahesh Kulakrni  <mahesh.kulkarni@nokia.com>
 
-        Reviewed by Beth Dakin.
+        Reviewed by Simon Hausmann.
 
-        Re-add CSSPropertyWebkitBackgroundSize in one more place
+        [QT] QT_BEARER flag is not enabled on S60 properly
+        https://bugs.webkit.org/show_bug.cgi?id=39357
 
-        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+        enable QT_BEARER for all platform based on qtmobility + 
+        bearer module availability or for qt 4.7+
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * WebCore.pri: 
 
-2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+2010-06-09  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Dirk Schulze.
 
-        [V8] Tidy up the DOM Storage runtime flag stuff
-        https://bugs.webkit.org/show_bug.cgi?id=30794
+        [Qt] Imperfect dependency for generated SVGNames.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=40359
 
-        Clean up the DOM Storage runtime flag stuff to match the new way of doing
-        things.  No behavioral changes.
+        * WebCore.pri: Missing dependency added.
 
-        * bindings/v8/RuntimeEnabledFeatures.cpp:
-        * bindings/v8/RuntimeEnabledFeatures.h:
-        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * storage/Storage.cpp:
-        * storage/Storage.h:
+2010-06-08  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
-2009-10-26  Brady Eidson  <beidson@apple.com>
+        Unreviewed Buildbot fix.
 
-        Reviewed by Darin Adler.
+        Reset the Qt TextBreakIterator when reusing it.
 
-        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::setUpIterator):
 
-        Test: fast/loader/history-forward-in-head.html
+2010-06-08  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
-          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
-          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
-        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
-          the redirect is scheduled.
+        Reviewed by Antti Koivisto.
 
-2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+        [Qt] TextBreakIterator Qt performance
+        https://bugs.webkit.org/show_bug.cgi?id=39958
 
-        Reviewed by Darin Adler.
+        Rework TextBreakIteratorQt to be more in line with the ICU version.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30049
-        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+        We now reuse iterators where ever possible. The string data is compared
+        with memcmp, which should be faster than using a hash, as you need
+        to traverse the full buffer in the case the strings don't match,
+        where as the compare would fail quickly.
 
-        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
-               fast/parser/remove-current-node-parent-x.xhtml
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::TextBreakIterator::TextBreakIterator):
+        (WebCore::setUpIterator):
+        (WebCore::wordBreakIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
 
-        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
-        unreliable after DOM manipulation.
+2010-06-07  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
-        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
-        exiting a node.
-        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
-        replaces setCurrentNode(0).
-        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
-        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
-        (not sure if it was ever practical though - how can a parent become null while adding text?)
+        Reviewed by Simon Hausmann.
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
-        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
-        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
-        added a check fo script element still being in document - Firefox parses those that aren't,
-        but doesn't execute them.
+        [Qt] Fix text selection drawing.
+        https://bugs.webkit.org/show_bug.cgi?id=40221
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::parseStartElement):
-        (WebCore::XMLTokenizer::parseEndElement):
-        Match libxml2 version changes.
+        The regression was introduced in r60169.
 
-2009-10-26  Dan Bernstein  <mitz@apple.com>
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::drawTextCommon):
 
-        Reviewed by Beth Dakin.
+2010-06-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-        background-size: X treated as background-size: X X, not background-size: X auto
-        https://bugs.webkit.org/show_bug.cgi?id=28440
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
-        and fast/backgrounds/size/resources/parsing-inherit.js
+        [Qt] Fix compilation with QT_NO_FEATURE
+        https://bugs.webkit.org/show_bug.cgi?id=38324
 
-        Reinstated -webkit-background-size and kept its behavior of filling in
-        the second value with the first one; and changed background-size to have
-        the behavior of filling in the second value with 'auto'.
+        The #ifdef QT_NO_GRAPHICSEFFECT was in the wrong place, would have
+        made AC not work at all.
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Ditto.
-        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
-        (WebCore::CSSParser::parseFillProperty): Re-added
-        CSSPropertyWebkitBackgroundSize.
-        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
-        background-size.
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Re-added
-        CSSPropertyWebkitBackgroundSize.
+        No new tests.
 
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        Reviewed by Eric Seidel.
+2010-05-24  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
-        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
-        https://bugs.webkit.org/show_bug.cgi?id=30777
+        Reviewed by Kenneth Rohde Christiansen.
 
-        No new tests as the crash can be reproduced by existing storage
-        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+        [Qt] Fix compilation with QT_NO_TEMPORARYFILE
+        https://bugs.webkit.org/show_bug.cgi?id=38324
 
-        * platform/text/String.cpp:
-        (WebCore::String::number): Qt's QString::vsprintf does not
-        understand the "%I64u" format string. Always use the "%lli"
-        format string for Qt port.
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile):
 
-2009-10-26  Tony Chang  <tony@chromium.org>
+2010-05-21  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Simon Hausmann.
 
-        Roll back r50073 because r50041-50043 were reverted.  r50073 was
-        a chromium side fix for r50041.
-        https://bugs.webkit.org/show_bug.cgi?id=30789
+        [Qt] Fix compilation with QT_NO_GRAPHICSEFFECT
+        https://bugs.webkit.org/show_bug.cgi?id=38324
 
-        * bindings/v8/V8Collection.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+2010-05-02  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Simon Hausmann.
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
-        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
-        
-        and related bugs.
+        [Qt] Fix compilation with QT_NO_BEARERMANAGEMENT
+        https://bugs.webkit.org/show_bug.cgi?id=38324
 
-        If the event listener being removed is prior to the current firing event
-        iterator, we need to decrement the current firing event iterator in
-        addition to the endpoint. (Otherwise, shrinking the event listener vector
-        by one implicity moves the current firing event iterator forward by one.
-        It's like relativity, only without the planets.)
-        
-        Also took the opportunity to change some pointers to references, since
-        they can't be null.
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
 
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::removeEventListener):
-        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
-        to end, if need be.
-        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
-        Added a comment to explain a behavior that was implicit enough to be
-        confusing.
+2010-05-02  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
-        * dom/EventTarget.h:
-        (WebCore::FiringEventIterator::FiringEventIterator):
-        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
+        Reviewed by Simon Hausmann.
 
-2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+        [Qt] Fix compilation with QT_NO_LINEEDIT
+        https://bugs.webkit.org/show_bug.cgi?id=38324
 
-        Reviewed by Timothy Hatcher.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::~RenderThemeQt):
+        (WebCore::RenderThemeQt::findFrameLineWidth):
 
-        Fixes <http://webkit.org/b/30792>.
-        Web Inspector: When changing resource scope, resource graph can get in weird state.
-        
-        If the user was scrolled down while looking at All resources, and then just
-        selects Fonts, or something that doesn't have many resources, then the graph
-        will stay scrolled down, even when there is no content there.
-        
-        When the filter is updated, scroll to the top of the graph view, so this won't
-        happen.
+2010-06-04  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        Reviewed by Tor Arne Vestbø.
 
-2009-10-26  Sam Weinig  <sam@webkit.org>
+        [Qt] Compilation fails when compiling against Qt 4.7 and Qt Mobility is installed
+        https://bugs.webkit.org/show_bug.cgi?id=40116
 
-        Fix mac clean build.
+        CONFIG += mobility has the side-effect of pulling in mobility includes, which conflict
+        with Qt 4.7's bearer managenent includes and break the build.
 
-        * html/HTMLOptionsCollection.idl:
+        * WebCore.pro:
 
-2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
+2010-06-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Web Inspector: Extract AbstractTimelinePanel that will be a base
-        class for ResourcesPanel and TimelinePanel.
+        [Qt] Fix NPAPI support on Mac OS X/Cocoa-32
 
-        https://bugs.webkit.org/show_bug.cgi?id=30776
+        qt_mac_window_for() returns a NSWindow on Cocoa, so we were
+        passing in a NSWindow instead of a WindowRef as part of the
+        NP_CGContext.
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/AbstractTimelinePanel.js: Added.
-        (WebInspector.AbstractTimelinePanel):
-        (WebInspector.AbstractTimelinePanel.prototype.get categories):
-        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
-        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
-        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
-        (WebInspector.AbstractTimelinePanel.prototype.filter):
-        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
-        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
-        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
-        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
-        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
-        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
-        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
-        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
-        (WebInspector.AbstractTimelinePanel.prototype.show):
-        (WebInspector.AbstractTimelinePanel.prototype.resize):
-        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
-        (WebInspector.TimelineCalculator):
-        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
-        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
-        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
-        (WebInspector.TimelineCalculator.prototype.reset):
-        (WebInspector.TimelineCalculator.prototype._value):
-        (WebInspector.TimelineCalculator.prototype.formatValue):
-        * inspector/front-end/ResourceCategory.js:
-        (WebInspector.ResourceCategory):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
-        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
-        (WebInspector.ResourcesPanel.prototype.get categories):
-        (WebInspector.ResourcesPanel.prototype.showCategory):
-        (WebInspector.ResourcesPanel.prototype.hideCategory):
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
-        (WebInspector.ResourcesPanel.prototype.populateSidebar):
-        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
-        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.show):
-        (WebInspector.ResourcesPanel.prototype.resize):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
-        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
-        (WebInspector.ResourceTimeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
-        * inspector/front-end/SummaryBar.js:
-        (WebInspector.SummaryBar.prototype.update):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
+        https://bugs.webkit.org/show_bug.cgi?id=38762
 
-2009-10-26  Avi Drissman  <avi@google.com>
+        * WebCore.gypi: Reflect rename
+        * WebCore.pro: Reflect rename
+        * plugins/mac/PluginViewMac.cpp: Renamed to PluginViewMac.mm
+        and fix bug by getting the Carbon windowRef from the NSWindow.
+        * wscript: Reflect rename
 
-        Reviewed by Darin Adler.
+2010-06-02  Nico Weber  <thakis@chromium.org>
 
-        Use Helvetica in the Inspector as intended.
-        https://bugs.webkit.org/show_bug.cgi?id=30787
+        Reviewed by Simon Fraser.
 
-        * inspector/front-end/inspector.css:
+        Scroll events are sent twice per keypress for ports that don't have a platformWidget scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=39918
 
-2009-10-26  Nate Chapin  <japhet@chromium.org>
+        This was regressed by http://trac.webkit.org/changeset/58615 . Fix this by slightly tweaking
+        that patch.
 
-        Reviewed by Alexey Proskuryakov.
+        Test: editing/input/page-up-down-scrolls.html
 
-        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
-        https://bugs.webkit.org/show_bug.cgi?id=30781
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::valueChanged):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::repaintFixedElementsAfterScrolling):
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+2010-06-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Eric Seidel.
+        [Qt] Fix make install on Symbian for headers in package builds when INSTALL_HEADERS is not defined
 
-        Data loss occurs when unbolding nested bold tags.
-        https://bugs.webkit.org/show_bug.cgi?id=30083
+        First we wrote inst_headers.output with $$[QT_INSTALL_HEADERS] and then
+        overwrote it with the $$INSTALL_HEADERS variant without checking if the
+        variable was set.
 
-        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
-        to a temporary valuable.  It was originally calling nextSibling() after appending the child
-        to new parent, in which case, nextSibling is always 0.
+        Fixed and cleaned up the logic of falling back to $$[QT_INSTALL_HEADERS].
 
-        Test: editing/style/unbolding-nested-b.html
+        * WebCore.pro:
 
-        * editing/ReplaceNodeWithSpanCommand.cpp:
-        (WebCore::swapInNodePreservingAttributesAndChildren):
+2010-06-01  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler.
+        [Qt] GraphicsLayer: warnings when reloading page
+        https://bugs.webkit.org/show_bug.cgi?id=39694
 
-        Storage events should use Document::url() rather than documentURI()
-        https://bugs.webkit.org/show_bug.cgi?id=30535
+        Made sure recaching and masks aren't attempted on zero-size layers.
 
-        Storage events should use Document::url() rather than Document::documentURI()
-        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+        No new tests. Old tests (e.g. LayoutTests/compositing/masks) show the problem.
 
-        Test: storage/domstorage/documentURI.html
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::MaskEffectQt::draw):
+        (WebCore::GraphicsLayerQtImpl::recache):
 
-        * storage/StorageEventDispatcher.cpp:
-        (WebCore::StorageEventDispatcher::dispatch):
+2010-05-10  Rodrigo Belem  <rodrigo.belem@openbossa.org>
 
-2009-10-26  Sam Weinig  <sam@webkit.org>
+        Reviewed by Kenneth Christiansen , Simon Hausmann and Gustavo Noronha.
 
-        Rubber-stamped by Darin Adler.
+        [Qt, Gtk] Allows build-webkit script to receive an install prefix as parameter
+        https://bugs.webkit.org/show_bug.cgi?id=26224
 
-        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
-        inherit from HTMLCollection.
+        This patch adds the ability, in the QtWebkit build system, to change
+        the installation path.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        (WebCore::toJS):
-        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::length):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        * bindings/objc/DOMHTML.mm:
-        (kitClass):
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/HTMLCollection.idl:
-        * html/HTMLOptionsCollection.idl:
-
-2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
 
-        Reviewed by Adam Roben.
+2010-06-01  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Build fix for ENABLE_FILTERS under Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30762
+        Reviewed by Laszlo Gombos.
 
-        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+        [Qt] Fix installation of the QtWebKit module .pri file when building inside of Qt
 
-        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
-          (1) Create a new 'filters' sub-folder of the platform/graphics 
-              folder to properly show the sources held in this directory.
-          (2) Move the files that are currently shown in svn/graphics/filters
-              to platform/graphics/filters (where they actually live on disk).
-          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
-              the project so they are built.
-          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
-              being compiled by SVGAllInOne.cpp.  Its presence as a separate
-              entity is causing a linker warning for duplicate symbols.
-          (5) Add ImageBuffer.cpp to the build to support color space
-              calculations for non-CG builds.
-        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
-          path to the search paths in the project.
+        * WebCore.pro:
 
-2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+2010-06-01  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Timothy Hatcher.
-
-        console.assert should prefix messages with "Assertion failed: "
-        https://bugs.webkit.org/show_bug.cgi?id=19135
+        Reviewed by Simon Hausmann.
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
-        (WebInspector.ConsoleMessage.prototype.toString):
-        * page/Console.cpp:
-        (WebCore::Console::assertCondition): Use AssertMessageType.
-        * page/Console.h:
-        (WebCore::MessageType): Added AssertMessageType.
+        [Qt] Fix a QtWebKit.pc corruption problem.
+        https://bugs.webkit.org/show_bug.cgi?id=36826
 
-2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+        The problem occurs while installing QtWebKit from trunk
+        or a source package.
 
-        Reviewed by Eric Seidel.
+        * WebCore.pro:
 
-        Prevent crash when optgroup element is empty by adding a NULL check.
+2010-06-01  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30365
+        Reviewed by Laszlo Gombos.
 
-        Test: fast/forms/select-empty-optgroup.html
+        [Qt] Fix Symbian package dependencies of apps against QtWebKit when installing into Qt
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::appendFormData):
+        Install the versioning qt_webkit_version.pri into $$[QMAKE_MKSPECS]/modules, which is
+        where mkspecs/features/qt.prf expects it.
 
-2009-10-21  Steven Knight  <sgk@chromium.org>
+        * WebCore.pro:
 
-        Reviewed by David Levin.
+2010-05-17  Andreas Kling  <andreas.kling@nokia.com>
 
-        Refactor gyp for separate webcore_bindings{,_sources} targets.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Bring CanvasRenderingContext2D's createImageData() in line with HTML5 spec
+        Added createImageData(ImageData) which returns a new ImageData with the same size as the one passed.
+        Changed createImageData(width, height) to use the absolute values of width and height.
 
-        Handle long link lines by building .idl-generated bindings in a
-        separate webcore_bindings library target.  Avoid Visual Studio
-        dependency issues by building additional generated .cpp and .h files
-        in a separate webcore_bindings_sources target.
+        https://bugs.webkit.org/show_bug.cgi?id=39189
 
-        Chrome should still build and test successfully.
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-createimagedata
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
+        Test: fast/canvas/canvas-createImageData.html
 
-2009-10-26  Mike Belshe  <mike@belshe.com>
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
 
-        Reviewed by Darin Fisher.
+2010-05-16  Andreas Kling  <andreas.kling@nokia.com>
 
-        Make the number of connections for chromium controlled by
-        chromium rather than by ResourceRequestBase.
-        https://bugs.webkit.org/show_bug.cgi?id=30661
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/chromium/ResourceRequest.cpp:
+        Properly handle invalid arguments to CanvasRenderingContext2D's getImageData() and putImageData().
+        Both should throw NOT_SUPPORTED_ERR when called with nonfinite arguments.
+        getImageData() should throw INDEX_SIZE_ERR if either width or height is 0.
 
-2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=39175
 
-        Unreviewed. make distcheck build fixes.
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation
 
-        * GNUmakefile.am:
+        Test: fast/canvas/canvas-getImageData-invalid.html
 
-2009-10-26  Anton Muhin  <antonm@chromium.org>
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
 
-        Reviewed by Dimitri Glazkov.
+2010-05-31  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
 
-        Unbreak Chromium build: that requires adding custom implementations
-        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
-        close to JSC bindings as well.
-        https://bugs.webkit.org/show_bug.cgi?id=30780
+        Reviewed by Simon Hausmann.
 
-        * bindings/v8/V8Collection.h:
-        (WebCore::getNamedItemsFromCollection):
-        (WebCore::getItemFromCollection):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        [Qt] Escape backslashes in the .pro files
 
-2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+        qmake in Qt 4.7 warns about unescaped backspaces and deprecates them.
 
-        Reviewed by Adam Barth and Darin Adler.
+        * WebCore.pro:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30723
-        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+2010-05-28  Antti Koivisto  <koivisto@iki.fi>
 
-        Test: http/tests/security/escape-form-data-field-names.html
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/network/FormDataBuilder.cpp:
-        (WebCore::appendQuotedString):
-        (WebCore::FormDataBuilder::beginMultiPartHeader):
-        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
-        Percent-escape line breaks and quotation marks.
+        https://bugs.webkit.org/show_bug.cgi?id=39874
+        [Qt] Make tiled backing store more configurable
+    
+        Make tile size, tile creation delay and tiling area dynamically configurable.
 
-2009-10-26  Kelly Norton  <knorton@google.com>
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setTileSize):
+        (WebCore::TiledBackingStore::setTileCreationDelay):
+        (WebCore::TiledBackingStore::setKeepAndCoverAreaMultipliers):
+        (WebCore::TiledBackingStore::createTiles):
+        * platform/graphics/TiledBackingStore.h:
+        (WebCore::TiledBackingStore::tileSize):
+        (WebCore::TiledBackingStore::tileCreationDelay):
+        (WebCore::TiledBackingStore::getKeepAndCoverAreaMultipliers):
 
-        Reviewed by Pavel Feldman.
+2010-05-28  Andreas Kling  <andreas.kling@nokia.com>
 
-        Adds DOMTimer support to InspectorTimelineAgent.
-        https://bugs.webkit.org/show_bug.cgi?id=30467
-
-        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
-        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
-        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
-        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
-        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
-        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
-        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
-        * inspector/TimelineItemFactory.h:
-        * page/DOMTimer.cpp: Added instrumentation points.
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::removeById):
-        (WebCore::DOMTimer::fired):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+        [Qt] REGRESSION(r59837): Incorrect clipping of TransparencyLayers
+        https://bugs.webkit.org/show_bug.cgi?id=39784
 
-        Reviewed by Sam Weinig.
+        Move coordinate transformation from TransparencyLayer to clipToImageBuffer()
 
-        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::TransparencyLayer::TransparencyLayer):
+        (WebCore::GraphicsContext::clipToImageBuffer):
 
-        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
-        that allows the layer to return a CGImageRef of its contents.
-        
-        * platform/graphics/mac/Canvas3DLayer.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+2010-05-13  Antti Koivisto  <koivisto@iki.fi>
 
-2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Pavel Feldman.
+        https://bugs.webkit.org/show_bug.cgi?id=39063
+        [Qt] Tiled backing store checker pattern does not paint correctly when scaling factor is not 1
 
-        Pass "console" as object group when evaluating selection.
+        Use the dirty rect that has been adjusted for scaling instead of the original one.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30738
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::paint):
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+2010-05-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Pavel Feldman.
+        [Qt] Make text filling work together with text stroke.
 
-        Fix for Console not showing repeat count when repeatedly logging an Event
-        https://bugs.webkit.org/show_bug.cgi?id=30324
+        When the text has stroke a new QPen was set, overriding the pen
+        set for text filling. This patch fixes that by storing the two
+        pens and using where appropriate.
 
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::addToConsole):
-        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
-        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
-        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
-        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
-        (WebInspector.ConsoleView.prototype.clearMessages):
-        (WebInspector.ConsoleMessage):
-        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
-        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
-        (WebInspector.updateConsoleMessageRepeatCount): Added.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
 
-2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+2010-05-17  Antonio Gomes  <tonikitoo@webkit.org>
 
         Reviewed by Darin Adler.
 
-        crash with AX on when an image map contains an anchor tag
-        https://bugs.webkit.org/show_bug.cgi?id=30739
-
-        Tests: accessibility/crashing-a-tag-in-map.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::addChildren):
-
-2009-10-26  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Adds feature ENABLE guards to V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30697
-
-        This adds guards for the following features to the V8 bindings,
-        to allow builds with V8 to succeed when these features are not enabled.
-        - DATABASE
-        - WORKERS
-        - SHARED_WORKERS
-        - SVG
-        - XPATH
-        - XSLT
-        - INSPECTOR
-
-        This is a build fix only, no new tests required.
-
-        * bindings/v8/DOMObjectsInclude.h: Modified.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
-        * bindings/v8/V8Index.cpp: Modified.
-        * bindings/v8/V8Index.h: Modified.
-
-2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25679
-        [Gtk] Improve accessibility of focusable lists
-
-        Fixes the issues with the Atk states exposed for ListBoxOption
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkStateSetFromCoreObject):
-
-2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27085
-        [Gtk] Incorrect rendering of list
-
-        Adds a way for platforms to indicate that a particular object
-        should not be ignored.
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/chromium/AccessibilityObjectChromium.cpp:
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/qt/AccessibilityObjectQt.cpp:
-        * accessibility/win/AccessibilityObjectWin.cpp:
-        * accessibility/wx/AccessibilityObjectWx.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (AccessibilityRenderObject::accessibilityIsIgnored):
+        Add an optional "starting node' parameter to scrollRecursively and scrollOverflow of EventHandler
+        https://bugs.webkit.org/show_bug.cgi?id=39217
 
-2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+        It would be usefull if scrollOverflow and scrollRecursively methods of EventHandler
+        could receive a parameter to specify where to start scrolling from. Currently they
+        start scrolling from either the current focused node or the node where mouse last
+        pressed on. Patch proposes an aditional starting point as an optional parameter.
+        Since it is optional, all call sites can remain as are, and if a Null node is passed
+        in, both methods work as previously.
 
-        Reviewed by Jan Alonzo.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
 
-        Bug 30619: [Linux] Menu key doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=30619
+2010-05-23  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Test: manual-tests/keyboard-menukey-event.html
-        No new layout tests: testing this will require changes in the test
-        controller in a platform-specific way.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/chromium/KeyCodeConversionGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
-        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
-        GDK_Menu to return V_APPS instead of VK_MENU.
+        [Qt] Using Accelerated Composing the rocket back animation on http://www.the-art-of-web.com/css/css-animation/ works differently as when not using AC.
+        https://bugs.webkit.org/show_bug.cgi?id=39513
 
-2009-10-25  Anton Muhin  <antonm@chromium.org>
+        The value of GraphicsLayer->transform() needs to be changed during the animation, regardless of m_fillsForward.
+        m_fillsForward should only apply at the end of the animation. Based on previous patch by Kenneth Christiansen.
 
-        Reviewed by Adam Barth.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::TransformAnimationQt::applyFrame):
+        (WebCore::OpacityAnimationQt::applyFrame):
 
-        Reuse already fetched proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=30747
+2010-05-25  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        Reviewed by Laszlo Gombos.
 
-2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        [Qt] Running with accelerated compositing enabled sometimes result in a crash
+        https://bugs.webkit.org/show_bug.cgi?id=39609
 
-        Unreviewed build fix.
+        Check if we have a scene before applying the workaround for
+        the QGraphicsScene bug where opacity change doesn't always have
+        immediate effect.
 
-        Build fix for WIN_OS if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=30753
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::OpacityAnimationQt::applyFrame):
 
-        * plugins/PluginDatabase.cpp:
+2010-05-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-2009-10-25  Hironori Bono  <hbono@chromium.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Darin Adler.
+        Fix painting when using clipToImageBuffer()
 
-        A quick fix for Bug 29103.
-        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
-        and the option string before calling String::startsWith().
-        https://bugs.webkit.org/show_bug.cgi?id=29103
+        When we apply the transform of the parent painter to the painter of
+        the transparency layer, we adopt its coordinate system, thus offset
+        should not be in page coordinates, but in the coordinate system of
+        the parent painter.
 
-        Tests: fast/forms/listbox-typeahead-cyrillic.html
-               fast/forms/listbox-typeahead-greek.html
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::TransparencyLayer::TransparencyLayer):
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::typeAheadFind):
+2010-05-19  Andreas Kling  <andreas.kling@nokia.com>
 
-2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Timothy Hatcher.
+        [Qt] REGRESSION: CoolClock isn't rendered properly
 
-        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
-        https://bugs.webkit.org/show_bug.cgi?id=30749
+        https://bugs.webkit.org/show_bug.cgi?id=38526
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+        CanvasRenderingContext2D's arc() should connect to the previous point
+        with a straight line (HTML5 spec 4.8.11.1.8), but if the path is empty
+        to begin with, we don't want a line back to (0,0)
+        This also fixes the rendering artifact discussed in bug 36226.
 
-2009-10-25  Sam Weinig  <sam@webkit.org>
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-arc
 
-        Reviewed by Dan Bernstein.
+        Test: fast/canvas/canvas-arc-connecting-line.html
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
-        HTMLOptionsCollection should not inherit from HTMLCollection
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        Added JSHTMLCollectionFunctions.h
-
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLOptionsCollection::getCallData):
-        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
-        (WebCore::JSHTMLOptionsCollection::nameGetter):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        (WebCore::JSHTMLOptionsCollection::item):
-        (WebCore::JSHTMLOptionsCollection::namedItem):
-        Refactor to use generic implementation of HTMLCollection bindings functions
-        from JSHTMLCollectionFunctions.h
-
-        * bindings/js/JSHTMLCollectionFunctions.h: Added.
-        (WebCore::getCollectionNamedItems):
-        (WebCore::getCollectionItems):
-        (WebCore::callHTMLCollectionGeneric):
-        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
-        JSHTMLOptionsCollection can all use.
-
-        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
-        for toJS on document.all.
-
-        * bindings/objc/DOMHTML.mm:
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        Remove special cases for HTMLOptionsCollection.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/HTMLAllCollection.idl:
-        * html/HTMLCollection.idl:
-        * html/HTMLOptionsCollection.idl:
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
 
-2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
+2010-05-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        Rubberstamped by Simon Hausmann.
 
-        WebInspector: Fixed issue with IME inside console
-        https://bugs.webkit.org/show_bug.cgi?id=30660
+        Return null when creating an ImageBuffer failed, due to for
+        instance a nulled pixmap.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._promptKeyDown):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
-        (WebInspector.startEditing.element.handleKeyEvent):
-        (WebInspector.startEditing):
-        * inspector/front-end/utilities.js:
-        (isEnterKey): Added. Check if in IME.
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
 
-2009-10-24  Brian Weinstein  <bweinstein@apple.com>
+2010-05-17  Antti Koivisto  <koivisto@iki.fi>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
-        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
+        https://bugs.webkit.org/show_bug.cgi?id=39218
+        [Qt] Tiled backing store tiles sometimes flicker when exiting a zoom animation
         
-        Have the scope bars select one scope by default, but if the multiple selection key
-        is pressed, allow for multiple selection.
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView):
-        (WebInspector.ConsoleView.prototype._updateFilter):
-        (WebInspector.ConsoleView.prototype.filter):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
-        Also cleans up the CSS to use classes instead of ID selectors.
+        Tiles sometimes flicker when exiting a zoom animation. This happens as a result
+        of the visible rectangle being momentarily out of sync.
+        
+        Instead of updating the visible rect by explicitly setting it, pull it through
+        the client and recompute in the WebKit level.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28186
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::visibleRectForTiledBackingStore):
+        * page/Frame.cpp:
+        (WebCore::Frame::tiledBackingStoreVisibleRect):
+        * page/Frame.h:
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::checkVisibleRectChanged):
+        (WebCore::TiledBackingStore::createTiles):
+        * platform/graphics/TiledBackingStore.h:
+        * platform/graphics/TiledBackingStoreClient.h:
 
-        Reviewed by Dan Bernstein.
+2010-05-18  Zoltan Herczeg  <zherczeg@webkit.org>
 
-        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
-        * inspector/front-end/inspector.css: Lots of changes to make it look right.
-        * inspector/front-end/inspector.html: Add the scope-bar class.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
+        [Qt] Implementing clipToImageBuffer for Qt port.
+        https://bugs.webkit.org/show_bug.cgi?id=24289
 
-        Fix selecting Resources in the Web Inspector's Resources panel.
+        The implementation combines pixmap layers and destinationIn
+        composition mode.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30743
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::TransparencyLayer::TransparencyLayer):
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clipToImageBuffer):
 
-        Reviewed by Pavel Feldman.
+2010-05-16  Andreas Kling  <andreas.kling@nokia.com>
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
-        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
-        isCategoryVisible on the ResourcesPanel.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
+        Canvas's toDataURL() should be case insensitive wrt the mimeType argument.
+        https://bugs.webkit.org/show_bug.cgi?id=39153
 
-        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
-        All will deselect the other filters.
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-canvas-todataurl
 
-        https://bugs.webkit.org/show_bug.cgi?id=30744
+        Test: fast/canvas/canvas-toDataURL-case-insensitive-mimetype.html
 
-        Reviewed by Pavel Feldman.
+        * dom/CanvasSurface.cpp:
+        (WebCore::CanvasSurface::toDataURL):
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
-        and the child variable instead of target in the loop. Other clean up.
+2010-05-16  Andreas Kling  <andreas.kling@nokia.com>
 
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Make resizing the Web Inspector's Elements panel sidebar work again.
-        Also makes Resources panel use the sidebar code in Panel.
+        Canvas's getContext() must return null when called with an invalid/unsupported parameter.
+        (HTML5 spec 4.8.11): http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-canvas-getcontext
 
-        https://bugs.webkit.org/show_bug.cgi?id=30742
+        https://bugs.webkit.org/show_bug.cgi?id=39150
 
-        Reviewed by Pavel Feldman.
+        Test: fast/canvas/canvas-getContext-invalid.html
 
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel): Don't create the sidebar with an argument.
-        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
-        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
-        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
-        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
-        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
-        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
-        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
-        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel): Call createSidebar.
-        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
-        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
-        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
-        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
-        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel): Call createSidebar.
-        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel): Call createSidebar.
-        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
 
-        Call updateSelection() in a few places so hovering in the Web Inspector's
-        Elements panel always has the correct row selection height.
+2010-05-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30735
+        Reviewed by Laszlo Gombos.
 
-        Reviewed by Pavel Feldman.
+        REGRESSION(59563): [Qt] JSValue QtClass::fallbackObject can be optimized
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
-        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
-        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
+        Patch declared a variable index, which shadowed an earlier declared
+        variable.
 
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
 
-        Remove the re-root tree feature from the Web Inspector's
-        Elements panel. This feature wasn't super useful and gets
-        in the way of double-click to edit.
+2010-05-14  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30736
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Pavel Feldman.
+        [Qt] GraphicsLayer caches directly composited images
+        https://bugs.webkit.org/show_bug.cgi?id=38444
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        Directly-composited images and solid fills shouldn't be cached, as that cache
+        is never used (see GraphicsLayerQtImpl::paint). Cache is only relevant for HTML content,
+        but we were missing that test.
+        The fix makes sure we only cache HTML content.
 
-2009-10-24  Anton Muhin  <antonm@chromium.org>
+        No new tests: this is a minor optimization.
 
-        Reviewed by Adam Barth.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        Implements ReturnsNew hint for V8 bindings generation code.
-        https://bugs.webkit.org/show_bug.cgi?id=30745
+2010-05-15  Anders Bakken  <agbakken@gmail.com>
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-24  Dan Bernstein  <mitz@apple.com>
+        Don't unnecessarily copy data when searching for methods in QtClass.
 
-        Reviewed by Sam Weinig.
+        [Qt] JSValue QtClass::fallbackObject can be optimized
+        https://bugs.webkit.org/show_bug.cgi?id=37684
 
-        Missing images at 350.org due to wrong URLs
-        https://bugs.webkit.org/show_bug.cgi?id=30748
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
 
-        Test: fast/dom/HTMLImageElement/parse-src.html
+2010-05-06  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        * dom/Element.cpp:
-        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
-        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
-        and SVGImageLoader::sourceURI() do.
-
-2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Rubber-stamped by Simon Hausmann.
 
-        Unreviewed.
+        [Qt] use QT_MOBILE_THEME in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=38440
 
-        [Qt] Build fix for QtWebKit after r50013.
+        Putting QT_MOBILE_THEME into use for Symbian.
 
         * WebCore.pro:
 
-2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [V8] Fix up to accommodate for HTMLAllCollection changes in
-        http://trac.webkit.org/changeset/49998.
-
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-
-2009-10-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
-        mac(const Credential&) after authenticating to MobileMe Gallery movie
-
-        * platform/network/Credential.cpp:
-        (WebCore::Credential::Credential): Initialize m_persistence.
-        (WebCore::Credential::isEmpty): Made this method const.
-        * platform/network/Credential.h:
-        * platform/network/mac/AuthenticationMac.mm:
-        (WebCore::mac): Return nil if the Credential is empty.
-
-2009-10-23  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
-        Web Inspector: Resources Scope Bar Should Allow Combinations.
-        
-        Refactor the filtering in ResourcePanel to make it match ConsoleView,
-        and add a divider between All, and the other choices of Resource types.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-        * inspector/front-end/inspector.css:
-
-2009-10-23  Chris Evans  <cevans@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Ignore the Refresh header if we're in view source mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27239
-
-        Test: http/tests/security/view-source-no-refresh.html
-
-        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
-
-2009-10-23  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Sam Weinig.
+2010-05-14  Andreas Kling  <andreas.kling@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30734
-        Remove XMLTokenizer::m_currentNodeIsReferenced
+        Reviewed by Darin Adler.
 
-        No change in behavior, no tests.
+        CSSParser::parseColor() shouldn't alter 'color' unless passed a valid color string.
+        https://bugs.webkit.org/show_bug.cgi?id=39031
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::setCurrentNode):
-        * dom/XMLTokenizer.h:
-        Don't store a boolean for the current node being the document - we can always check for that.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColor):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::extractTextStyles): Don't depend on old behavior.
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow): Remove dead code.
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
-        it unconditionally, and then begin checking it for null, as if it could help.
+2010-05-14  Aaron Kennedy  <tffeeb@gmail.com>
 
-2009-10-23  Beth Dakin  <bdakin@apple.com>
+        Reviewed by Simon Hausmann.
 
-        No review since this is a build fix.
+        [Qt] JavaScript unable to invoke methods declared in QML
+        https://bugs.webkit.org/show_bug.cgi?id=38949
 
-        Build fix for the Mac. (Build is only broken when SVG filters are 
-        enabled.)
+        JavaScript code executed by webkit cannot call into QML declared
+        methods, as it does not check for dynamic meta objects.
 
-        Labelled these function static.
-        * platform/graphics/filters/FEComponentTransfer.cpp:
-        (WebCore::identity):
-        (WebCore::table):
-        (WebCore::discrete):
-        (WebCore::linear):
-        (WebCore::gamma):
-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::boxBlur):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::stringValue): Use QMetaObject::metacall.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call): Ditto.
 
-2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+2010-05-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Web Inspector: Implement a Timeline panel.
+        [Qt] Detect debug mode consistently
+        https://bugs.webkit.org/show_bug.cgi?id=38863
 
-        https://bugs.webkit.org/show_bug.cgi?id=30725
+        No new tests as there is no new functionality.
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/Images/timelineIcon.png: Added.
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.addItemToTimeline):
-        (WebInspector.timelineProfilerWasStarted):
-        (WebInspector.timelineProfilerWasStopped):
-        * inspector/front-end/TimelinePanel.js: Added.
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
-        (WebInspector.TimelinePanel.prototype.get statusBarItems):
-        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
-        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
-        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
-        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
-        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
-        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
-        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
-        (WebInspector.TimelinePanel.prototype.getItemTypeName):
-        (WebInspector.TimelineRecordTreeElement):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
+        * WebCore.pro:
 
-2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+2010-05-14  Andreas Kling  <andreas.kling@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Adler.
 
-        Web Inspector: Clash Between Search's onkeyup and incremental search events
-        https://bugs.webkit.org/show_bug.cgi?id=30731
+        Ignore invalid values for various CanvasRenderingContext2D properties
+        (lineWidth, miterLimit, shadowOffsetX, shadowOffsetY and shadowBlur)
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
+        https://bugs.webkit.org/show_bug.cgi?id=38841
 
-2009-10-23  Kelly Norton  <knorton@google.com>
+        Test: fast/canvas/canvas-invalid-values.html
 
-        Reviewed by Pavel Feldman.
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setLineWidth):
+        (WebCore::CanvasRenderingContext2D::setMiterLimit):
+        (WebCore::CanvasRenderingContext2D::setShadowOffsetX):
+        (WebCore::CanvasRenderingContext2D::setShadowOffsetY):
+        (WebCore::CanvasRenderingContext2D::setShadowBlur):
 
-        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
-        of ScriptObjects.
-        https://bugs.webkit.org/show_bug.cgi?id=30707
+2010-05-12  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/DOMDispatchTimelineItem.cpp: Removed.
-        * inspector/DOMDispatchTimelineItem.h: Removed.
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
-        * inspector/TimelineItem.cpp: Removed.
-        * inspector/TimelineItem.h: Removed.
-        * inspector/TimelineItemFactory.cpp: Added.
-        (WebCore::TimelineItemFactory::createGenericTimelineItem):
-        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
-        * inspector/TimelineItemFactory.h: Added.
-        (WebCore::):
-        (WebCore::TimelineItemFactory::TimelineItemFactory):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+        [Qt] GraphicsLayer: depth-test causes flicker in certain situations
 
-        Reviewed by Geoff Garen.
+        This patch removes the simplistic 2D depth test as it leads to flickering side effects.
+        https://bugs.webkit.org/show_bug.cgi?id=38370
 
-        https://bugs.webkit.org/show_bug.cgi?id=30729
-        Provide private API to request the global context for a specific world.
-        Used to initialize parameters on the global object.
+        Tested by http://webkit.org/blog-files/3d-transforms/morphing-cubes.html
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::globalObject):
-        * bindings/js/ScriptController.h:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::updateTransform):
 
-2009-10-23  Steve Block  <steveblock@google.com>
+2010-04-29  James Robinson  <jamesr@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Simon Fraser.
 
-        Fixes style problems in Android-specific files.
-        https://bugs.webkit.org/show_bug.cgi?id=30717
-
-        Style changes only, no new tests possible.
-
-        * page/android/EventHandlerAndroid.cpp: Modified.
-        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
-        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
-        * platform/android/CursorAndroid.cpp: Modified. 
-        (WebCore::grabCursor): Fixes function braces.
-        (WebCore::grabbingCursor): Fixes function braces.
-        * platform/android/FileChooserAndroid.cpp: Modified.
-        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
-        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
-        (WebCore::unloadModule): Fixes zero test.
-        (WebCore::writeToFile): Fixes if statement structure.
-        * platform/android/KeyEventAndroid.cpp: Modified.
-        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
-        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
-        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
-        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
-
-2009-10-23  Sam Weinig  <sam@webkit.org>
-
-        Another shot at a fixed build.
+        Calls FrameView::scrollPositionChanged whenever a ScrollView is scrolled
+        https://bugs.webkit.org/show_bug.cgi?id=38286
 
-        * DerivedSources.cpp:
+        When a ScrollView's  scroll position is changed, we have to call
+        FrameView::scrollPositionChanged to generate repaint invalidation for
+        fixed position elements.  This ends up getting called indirectly when
+        the ScrollView has a platformWidget through the port layer
+        (see WebHTMLView.mm's _frameOrBoundsChanged method for how the mac
+        port does it) but not when there is no platformWidget.
 
-2009-10-23  Sam Weinig  <sam@webkit.org>
+        This is tested by the fast/repaint/fixed-* tests when run in pixel
+        mode.
 
-        Another shot at a fixed build.
+        Test: fast/repaint/fixed-move-after-keyboard-scroll.html
 
-        * html/HTMLOptionsCollection.idl:
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::valueChanged):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::scrollPositionChanged):
 
-2009-10-23  Brady Eidson  <beidson@apple.com>
+2010-04-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        50,000!
+        Unreviewed build fix.
 
-        * ChangeLog: Point out revision 50,000.
+        Change Media to StyleMedia
 
-2009-10-23  Sam Weinig  <sam@webkit.org>
+        * DerivedSources.make:
 
-        Reviewed by Anders Carlsson.
+2010-04-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
-        Drop .tags() support from HTMLCollection
+        Reviewed by Laszlo Gombos.
 
-        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
-          available for all HTMLCollection like objects in Objective-C since that
-          is API.
-        - Auto-generate HTMLAllCollection.
+        Rename window.media to window.styleMedia
+        https://bugs.webkit.org/show_bug.cgi?id=36187
 
-        Test: fast/dom/HTMLDocument/document-all.html
+        Rename the interface Media to StyleMedia as required by the
+        new CSSOM View spec.
 
-        * DerivedSources.make:
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pri:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLAllCollection.cpp: Removed.
-        * bindings/js/JSHTMLAllCollection.h: Removed.
-        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::getCallData):
-        (WebCore::JSHTMLAllCollection::canGetItemsForName):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/Document.cpp:
-        (WebCore::Document::all):
-        * dom/Document.h:
-        * dom/HTMLAllCollection.idl: Removed.
-        * html/HTMLAllCollection.cpp: Added.
-        (WebCore::HTMLAllCollection::create):
-        (WebCore::HTMLAllCollection::HTMLAllCollection):
-        (WebCore::HTMLAllCollection::~HTMLAllCollection):
-        * html/HTMLAllCollection.h: Added.
-        * html/HTMLAllCollection.idl: Added.
-        * html/HTMLCollection.h:
-        * html/HTMLCollection.idl:
-        * html/HTMLDocument.idl:
+        * css/Media.cpp: Removed.
+        * css/Media.h: Removed.
+        * css/Media.idl: Removed.
+        * css/StyleMedia.cpp: Added.
+        (WebCore::StyleMedia::StyleMedia):
+        (WebCore::StyleMedia::type):
+        (WebCore::StyleMedia::matchMedium):
+        * css/StyleMedia.h: Added.
+        (WebCore::StyleMedia::create):
+        (WebCore::StyleMedia::disconnectFrame):
+        * css/StyleMedia.idl: Added.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::styleMedia):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalMedia):
         * page/DOMWindow.idl:
 
-2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+2010-04-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Web Inspector: pull basic sidebar implementation into the Panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30720
-
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel):
-        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
-        (WebInspector.Panel.prototype.handleKeyEvent):
-        (WebInspector.Panel.prototype._createSidebar):
-        (WebInspector.Panel.prototype._startSidebarDragging):
-        (WebInspector.Panel.prototype._sidebarDragging):
-        (WebInspector.Panel.prototype._endSidebarDragging):
-        (WebInspector.Panel.prototype._updateSidebarWidth):
-        (WebInspector.Panel.prototype.setCenterViewWidth):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
-
-2009-10-23  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Slight optimizations to object returning and exception handling in generated V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30599
-
-        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
-
-2009-10-23  Alpha Lam  <hclam@chromium.org>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Eric Carlson.
+        Rename window.media to window.styleMedia
+        https://bugs.webkit.org/show_bug.cgi?id=36187
 
-        Volume slider always starts at half volume
-        https://bugs.webkit.org/show_bug.cgi?id=28322
+        It has been defined that the AbstractView media extension
+        defined in the CSSOM View spec should be renamed to styleMedia.
+        This patch does that and updates the current layout tests
+        making use of it.
 
-        Sets the value attribute of volume slider to the volume attribute
-        of the media element. Also update the value attribute of the
-        input element for the volume slider when the volume attribute
-        of the media element is updated.
+        * page/AbstractView.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::styleMedia):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
 
-        Test: media/video-volume-slider.html
+2010-05-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderElement::update):
-        Set the value attribute of the input element for the volume slider
-        using the current volume of the media element.
-        * rendering/MediaControlElements.h:
-        Add method definition of update().
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createVolumeSlider):
-        Creates a volume slider with value attribute equals to the current
-        volume attribute of the media element.
-
-2009-10-23  Evan Martin  <evan@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Eric Seidel.
+        [Qt] fast/text/find-hidden-text.html
+        https://bugs.webkit.org/show_bug.cgi?id=32922
 
-        Chrome Linux: fix caret positioning in LTR complex languages
-        The caret is positioned off by one in languages like Thai.
+        Use the real page step for populating the QStyleOption otherwhise
+        the size can be negative, which can break the QStyle used.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28284
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
 
-        A group of us spent a while trying various approaches to write a test
-        for this; however, since it is only that the blinking cursor is
-        displayed incorrectly, we concluded it can not be tested.
+2010-05-03  Antonio Gomes  <tonikitoo@webkit.org>
 
-        (Patch by Hironori Bono.)
+        Reviewed by Kenneth Christiansen.
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::selectionRectForComplexText):
+        Spatial Navigation: create a getter for the "fudgeFactor"
+        https://bugs.webkit.org/show_bug.cgi?id=38488
 
-2009-10-23  Tony Chang  <tony@chromium.org>
+        A couple of places in the Spatial Navigation code make use of a "fudge factor"
+        to improve precision by working around outline focus metrics and such. Patch adds
+        a helper method for unify getter operations of this value, instead of having it
+        declared locally in the various methods it is used.
 
-        Reviewed by David Levin.
+        No behaviour change.
 
-        Fix Chromium build after IsoldatedWorld change (r49963).
-        https://bugs.webkit.org/show_bug.cgi?id=30719
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollIntoView):
+        (WebCore::deflateIfOverlapped):
+        * page/SpatialNavigation.h:
+        (WebCore::fudgeFactor):
 
-        * bindings/ScriptControllerBase.cpp:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::executeScriptInIsolatedWorld):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::mainThreadNormalWorld):
-        * bindings/v8/ScriptController.h:
-        (WebCore::ScriptController::windowShell):
-        (WebCore::ScriptController::existingWindowShell):
-        * dom/Document.cpp:
-        (WebCore::Document::createWrapperCache):
-        * dom/ScriptExecutionContext.cpp:
-        * dom/ScriptExecutionContext.h:
-        * xml/XMLHttpRequest.cpp:
-        * xml/XMLHttpRequest.h:
+2010-05-10  Markus Goetz  <Markus.Goetz@nokia.com>
 
-2009-10-23  Xiaomei Ji  <xji@chromium.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Sam Weinig.
+        Qt after 4.6.3 has its integrated DNS cache. Therefore some
+        code is not necessary anymore.
 
-        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
-        for a zoomed and scrolled page.
-        https://bugs.webkit.org/show_bug.cgi?id=30689.
+        https://bugs.webkit.org/show_bug.cgi?id=38834
 
-        The real cause is the wrong calculation of event.clientX/Y when
-        page is zoomed and scolled.
-        After Sam fixed the event.clientX/Y in r49551, the hit test point
-        should be recalculated (revert r49490).
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookup):
+        (WebCore::DnsPrefetchHelper::lookedUp):
 
-        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+2010-05-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint): calculate the correct point
-        relative to document when page is zoomed and scrolled.
-        (WebCore::Document::caretRangeFromPoint): calculate the correct point
-        relative to document when page is zoomed and scrolled.
+        Unreviewed, build fix WinCE for QtWebKit.
 
-2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+        [Qt] Compilation with Plugins disabled is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31407
 
-        Reviewed by Dmitry Titov.
+        Rename platform/qt/TemporaryLinkStubs.cpp to avoid name collition on
+        Windows.
 
-        Adding a class that allows us to enable/disable features at
-        runtime. Adding a flag to enable database support.
+        Thanks for Ismail "cartman" Donmez for help.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30653
+        No new tests, as there is no new functionality.
 
         * WebCore.gypi:
-        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
-        * bindings/v8/RuntimeEnabledFeatures.h: Added.
-        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-
-2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector injects _inspectorCommandLineAPI into global object when opened
-        https://bugs.webkit.org/show_bug.cgi?id=30675
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
-
-2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] don't undef NULL in Symbian emulator
-
-        npapi.h way of defining mwerks compiler,__intel__
-        and win32 are all true for Symbian emulator.
-        Changed the definions so that NULL won't be undefined
-        when compiling for Symbian emulator nor target HW.
-
-        * bridge/npapi.h:
-
-2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Correct linking of sqlite3 for Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=30569
-
-        ".lib" will try to include library as static library
-        causing the library to be searched from wrong directory and if found
-        will be statically linked instead of the inteded dynamic linking.
-
         * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp: Removed.
+        * platform/qt/TemporaryLinkStubsQt.cpp: Copied from WebCore/platform/qt/TemporaryLinkStubs.cpp.
 
-2009-10-23  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        REGRESSION: Copy is copying incorrect background-color
-        <rdar://problem/7248529>
-        https://bugs.webkit.org/show_bug.cgi?id=29697
-
-        Test: editing/execCommand/indent-paragraphs.html
-
-        This change removes the BackgroundColor from the list 
-        of inheritable CSS properties and changes significantly
-        the way we perform indentation.
-        The new implementation of IndentOutdentCommand uses a new method
-        defined in CompositeEditCommand called moveParagraphWithClones.
-        This is an improved version of the original moveParagraph that
-        is aimed at preserving the original markup of the paragraph being
-        moved.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
-        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
-        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
-        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
-        * editing/CompositeEditCommand.h: Added three new methods.
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
-        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
-        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
-
-2009-10-23  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=30677
-
-        Build fix, no new tests required.
-
-        * page/Console.cpp: Modified. Added UnusedParam.h include.
-        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
-
-2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] Plugins : Use window's winId() instead of the widget's.
-
-        As per, https://developer.mozilla.org/en/NPN_GetValue
-        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
-        plug-in is displayed; returns Window".
-
-        The issue was found because NPNVNetscapeWindow winId() ends up creating
-        a native window resulting in flicker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30706
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::getValue):
-
-2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
-
-        Though it works, it is not correct to use m_clipRect for painting
-        in Windowless mode. Instead, the rect paramater that is passed
-        as a part of PluginView::paint() must be used. This change will
-        also result in some speedup since previously we used to paint all
-        the visible parts of a windowless plugin (even if those parts were
-        not dirty).
-
-        Also, fix invalidateRect() to compute the correct width and height.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30711
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::invalidateRect):
-
-2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Holger Freyther.
-
-        Plugins : Use test.swf in the plugins manual tests.
-
-        They previously referenced youtube videos which among other things are
-        cumbersome to use without internet connection. The old youtube link is
-        just commented out so that testing with youtube can be done with
-        little effort.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30662
-
-        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
-        * manual-tests/plugins/windowed.html:
-        * manual-tests/plugins/windowless.html:
-        * manual-tests/qt/plugin-sibling-frame-include.html:
-
-2009-10-23  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix the Windows Release build by moving Accessibility files
-        into all-in-one file and excluding them from the build.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * accessibility/AccessibilityAllInOne.cpp: Added.
-
-2009-10-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig & Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30696
-        Add support for IsolatedWorlds to JSC bindings.
-
-        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
-        a given document.  To support isolation this patch:
-
-            * Adds support to the ScriptController to track multiple window shells, one per world.
-            * Adds support to Document to support multiple separate wrapper-maps, one per world.
-            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
-              stored on the (new) IsolatedWorld objects.
-
-        In addition to supporting separate copies of these objects, two other features are supported:
+2010-04-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
-            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
-              we can determine which world (and as such, set of DOM bindings) we should be operating on.
-            * EventListeners & Callbacks are run in the world they were registered in.
-              This requires the handler to retain a reference to the world.
-
-        No new tests. (Enabled existing isolated world layout tests.)
-
-        * WebCore.base.exp:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSCallbackData.cpp:
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCallbackData.h:
-        (WebCore::JSCallbackData::JSCallbackData):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::removeWrappers):
-        (WebCore::DOMObjectWrapperMap::get):
-        (WebCore::DOMObjectWrapperMap::set):
-        (WebCore::DOMObjectWrapperMap::remove):
-        (WebCore::DOMObjectWrapperMap::take):
-        (WebCore::IsolatedWorld::IsolatedWorld):
-        (WebCore::IsolatedWorld::~IsolatedWorld):
-        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
-        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
-        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
-        (WebCore::JSGlobalDataWorldIterator::operator bool):
-        (WebCore::JSGlobalDataWorldIterator::operator*):
-        (WebCore::JSGlobalDataWorldIterator::operator->):
-        (WebCore::JSGlobalDataWorldIterator::operator++):
-        (WebCore::getCurrentWorld):
-        (WebCore::getNormalWorld):
-        (WebCore::commonNormalWorld):
-        (WebCore::commonCurrentWorld):
-        (WebCore::DOMObjectHashTableMap::mapFor):
-        (WebCore::DOMObjectWrapperMap::mapFor):
-        (WebCore::forgetDOMObject):
-        (WebCore::getCachedDOMNodeWrapper):
-        (WebCore::forgetDOMNode):
-        (WebCore::cacheDOMNodeWrapper):
-        (WebCore::forgetAllDOMNodesForDocument):
-        (WebCore::forgetWorldOfDOMNodesForDocument):
-        (WebCore::isObservableThroughDOM):
-        (WebCore::markDOMNodesForDocument):
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::takeWrappers):
-        (WebCore::updateDOMNodeDocument):
-        (WebCore::markDOMObjectWrapper):
-        (WebCore::allowsAccessFromFrame):
-        (WebCore::printErrorMessageForFrame):
-        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
-        (WebCore::JSC_callInWorld):
-        (WebCore::JSC_constructInWorld):
-        (WebCore::JSC_evaluateInWorld):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::IsolatedWorld::rememberDocument):
-        (WebCore::IsolatedWorld::forgetDocument):
-        (WebCore::IsolatedWorld::rememberScriptController):
-        (WebCore::IsolatedWorld::forgetScriptController):
-        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
-        (WebCore::DOMObjectHashTableMap::get):
-        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
-        (WebCore::WebCoreJSClientData::currentWorld):
-        (WebCore::WebCoreJSClientData::normalWorld):
-        (WebCore::WebCoreJSClientData::rememberWorld):
-        (WebCore::WebCoreJSClientData::forgetWorld):
-        (WebCore::debuggerWorld):
-        (WebCore::pluginWorld):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::printErrorMessage):
-        (WebCore::JSDOMWindowBase::commonJSGlobalData):
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindow):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        (WebCore::JSDOMWindow::open):
-        (WebCore::JSDOMWindow::showModalDialog):
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindowShell):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        (WebCore::JSHTMLDocument::open):
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        (WebCore::JSHTMLFrameSetElement::nameGetter):
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::databaseForId):
-        (WebCore::JSInspectorBackend::inspectedWindow):
-        (WebCore::JSInspectorBackend::nodeForId):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::markChildren):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::markChildren):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::construct):
-        (WebCore::JSQuarantinedObjectWrapper::call):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::markChildren):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        (WebCore::JSWorkerContext::setTimeout):
-        (WebCore::JSWorkerContext::setInterval):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren):
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::create):
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::~ScriptController):
-        (WebCore::ScriptController::evaluateInWorld):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::processingUserGestureEvent):
-        (WebCore::ScriptController::attachDebugger):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::createRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
-        * bindings/js/ScriptController.h:
-        (WebCore::ScriptController::windowShell):
-        (WebCore::ScriptController::existingWindowShell):
-        (WebCore::ScriptController::globalObject):
-        (WebCore::ScriptController::forgetWorld):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::call):
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptState.cpp:
-        (WebCore::scriptStateFromNode):
-        (WebCore::scriptStateFromPage):
-        * bindings/js/ScriptState.h:
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::WorkerScriptController):
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_Construct):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        * dom/Document.cpp:
-        (WebCore::Document::createWrapperCache):
-        * dom/Document.h:
-        (WebCore::Document::wrapperCacheMap):
-        (WebCore::Document::getWrapperCache):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * platform/network/mac/AuthenticationMac.mm:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::dropProtection):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::create):
-
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
-        https://bugs.webkit.org/show_bug.cgi?id=30705
-
-        * inspector/front-end/EventListenersSidebarPane.js:
-
-2009-10-22  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30506
-        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
-        in the inspectors resource pane
-
-        I don't know how to make a test for this.
-
-        The issue here was that preloaded resources weren't added to DocLoader document resource set,
-        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
-        parser eventually requested the same resource for real and it got added to resource set, it
-        was too late - the Inspector wasn't updated.
-
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::cachedResource):
-        (WebCore::InspectorResource::type):
-        (WebCore::InspectorResource::resourceData):
-        * inspector/InspectorResource.h:
-        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
-        cache. This seems safe, and easier than updating the Inspector on transitions between
-        resource states (revalidate vs. revalidate done and preload vs. non-preload).
-
-2009-10-22  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
-        shadows to work for SVG content
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=30479
-
-        This patch adds a new SVG-specific CSS property called -webkit-
-        shadow that has the same syntax as -webkit-box-shadow
-
-        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
-        make valueForShadow a member function rather than a static function 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSComputedStyleDeclaration.h:
-
-        Call valueForShadow for CSSPropertyWebkitShadow
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-
-        Do standard CSS stuff for CSSPropertyWebkitShadow
-        * css/SVGCSSParser.cpp:
-        (WebCore::CSSParser::parseSVGValue):
-        * css/SVGCSSPropertyNames.in:
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
-
-        Set the appropriate shadow on the paint context if we have one. 
-        This seems to be all we have to do to have an SVG-shaped shadow.
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
-
-        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
-        just because that's the way things are done here right now.
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::SVGRenderStyle):
-        (WebCore::SVGRenderStyle::operator==):
-        * rendering/style/SVGRenderStyle.h:
-        * rendering/style/SVGRenderStyleDefs.cpp:
-        (StyleShadowSVGData::StyleShadowSVGData):
-        (StyleShadowSVGData::operator==):
-        * rendering/style/SVGRenderStyleDefs.h:
-        (WebCore::StyleShadowSVGData::create):
-        (WebCore::StyleShadowSVGData::copy):
-        (WebCore::StyleShadowSVGData::operator!=):
-
-2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
- 
-        Reviewed by Xan Lopez.
+        Reviewed by Laszlo Gombos.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25530
-        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+        [Qt] LayoutTests/fast/canvas/pointInPath.html passed, actually it failed
+        https://bugs.webkit.org/show_bug.cgi?id=37276
 
-        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
-        Also causes the accessible name for labeled controls to be based on
-        the label as expected, rather than based on the contents.
+        QPainterPath::contains doesn't count the point on the bound.
 
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (correspondingLabelForControlElement):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkRelationSetFromCoreObject):
-        (webkit_accessible_ref_relation_set):
-        (webkit_accessible_class_init):
-        (webkit_accessible_get_name):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::isPointOnPathBorder):
+        (WebCore::Path::contains):
 
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+2010-05-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
-        https://bugs.webkit.org/show_bug.cgi?id=30663
+        [Qt] Fix rendering of -webkit-user-select: none
 
-          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+        -webkit-user-select: none is implemented by filling
+        the area with an invalid default-constructed Color.
+        In most ports passing an invalid color down to the
+        graphics backend seems to produce transparent fills.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.windowFocused): fix for inner iframes
-        (WebInspector.windowBlurred): fix for inner iframes
-        (WebInspector.addMainEventListeners): change useCapture to false
+        In Qt the behavior of painting with an invalid QColor
+        is undefined, and in practice it results in painting
+        black opaque areas.
 
-2009-10-22  Jaime Yap  <jaimeyap@google.com>
+        One way to fix this would be to use Qt::transparent
+        when converting an undefined Color to a QColor, but
+        Qt does not have short circuits for fully transparent
+        painting, and we actually end up in slow code paths
+        due to the transparency. So, we're better of doing the
+        short circuit in WebKit.
 
-        Reviewed by Timothy Hatcher.
-
-        Makes a page reload optional when activating resource monitoring in
-        InspectorController. It leaves the default behavior as performing the reload.
-        Reload is an optional param so callsites do not have to change.
+        https://bugs.webkit.org/show_bug.cgi?id=38523
 
-        https://bugs.webkit.org/show_bug.cgi?id=30684
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-        No new tests added.
+2010-04-05  Robert Hogan  <robert@webkit.org>
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::enableResourceTracking):
-        * inspector/InspectorController.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+        [Qt] Fix infinite redirection loop in QNetworkReplyHandler
 
-        Reviewed by Eric Seidel.
+        Put a maximum on consecutive redirections so we don't have to
+        worry about whether it's the same url or not.
 
-        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
-        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
-        after being released.
-        https://bugs.webkit.org/show_bug.cgi?id=30167
+        Tolerate up to 10 consecutive redirections, anything beyond
+        that is considered a potentially infinite recursion in the
+        redirection requests. This is the same behaviour as Firefox.
 
-        No layout test available as a non-functional fix.
+        https://bugs.webkit.org/show_bug.cgi?id=37097
 
         * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::abort):
-        (WebCore::QNetworkReplyHandler::release):
-
-2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Fix DOMAgent leak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30615
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::~InspectorController):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::releaseDOMAgent):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::InspectorDOMAgent::create):
-
-2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Rework event listeners to not hold references to frame or V8 context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30648
-
-        Covered by existing layout tests: fast/events/attribute-listener*
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
-            to event listener handling code.
-        * bindings/v8/DateExtension.cpp:
-        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
-        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
-            and usage.
-        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
-        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
-        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
-        (WebCore::V8DOMWrapper::getEventListener): Ditto.
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
-            because it's no longer needed.
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
-        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
-        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
-        * bindings/v8/V8LazyEventListener.h:
-        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
-        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
-        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
-        (WebCore::V8Proxy::isContextInitialized): Ditto.
-        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
-        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
-        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
-        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
-        (WebCore::V8Proxy::clearForNavigation): Ditto.
-        (WebCore::V8Proxy::setSecurityToken): Ditto.
-        (WebCore::V8Proxy::updateDocument): Ditto.
-        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
-        (WebCore::V8Proxy::context): Changed to use v8::Local.
-        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
-        (WebCore::V8Proxy::setContextDebugId): Ditto.
-        (WebCore::toV8Context):
-        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
-            v8::Persistent for m_context.
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::workerProxy): Added.
-        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
-            WorkerContextExecutionProxy* param.
-        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
-        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
-        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
-        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
-        * bindings/v8/V8WorkerContextEventListener.h:
-        (WebCore::V8WorkerContextEventListener::create): Removed
-            WorkerContextExecutionProxy* param.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
-            template param.
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
-        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
-        (WebCore::V8EventListener::callListenerFunction): Ditto.
-        * bindings/v8/custom/V8CustomEventListener.h:
-        (WebCore::V8EventListener::create): Removed Frame* param.
-
-2009-10-14  Gaurav Shah  <gauravsh@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Replaces temporary link stub for <keygen> tag handler for the Chromium
-        browser with a call via the Chromium Bridge.
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/network/qt/QNetworkReplyHandler.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30360
+2010-04-05  Robert Hogan  <robert@webkit.org>
 
-        * platform/SSLKeyGenerator.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/SSLKeyGeneratorChromium.cpp:
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/chromium/TemporaryLinkStubs.cpp:
-        (WebCore::KURL::fileSystemPath):
-        (WebCore::SharedBuffer::createWithContentsOfFile):
+        Reviewed by Kenneth Rohde-Christiansen.
 
-2009-10-22  Avi Drissman  <avi@chromium.org>
+        [Qt] Fix infinite redirection loop in QNetworkReplyHandler
 
-        Reviewed by Eric Seidel.
+        Qt enters an infinite loop if a redirect response redirects to itself.
 
-        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+        Fixes http/tests/xmlhttprequest/connection-error-sync.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30591
+        https://bugs.webkit.org/show_bug.cgi?id=37097
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
 
-2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+2010-05-07  Ben Murdoch  <benm@google.com>
 
         Reviewed by Darin Adler.
 
-        Make accelerated compositing debug indicators work in release builds
-        https://bugs.webkit.org/show_bug.cgi?id=30588
-        
-        Allow some debug indicators, that show which page elements go into compositing layers,
-        to work in release builds, when the runtime prefs are set.
-
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        (WebCore::GraphicsLayer::setZPosition):
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::clearBorderColor):
-        (WebCore::GraphicsLayer::showRepaintCounter):
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::updateMasksToBounds):
-        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
-        (WebCore::GraphicsLayerCA::setDebugBorder):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::setupContentsLayer):
-        * platform/graphics/mac/WebLayer.mm:
-
-2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Pavel Feldman.
-
-        Inspector should support monitorEvents/un monitorEvents() in the command line
-        https://bugs.webkit.org/show_bug.cgi?id=19879
-
-        * inspector/front-end/EventListenersSidebarPane.js:
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
-        _normalizeEventTypes, monitorEvent, unmonitorEvent.
-
-2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
-        https://bugs.webkit.org/show_bug.cgi?id=30663
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.windowFocused):
-        (WebInspector.windowBlurred):
-
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: Error - requestContentType [undefined] is not an object
-        https://bugs.webkit.org/show_bug.cgi?id=30666
-
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshFormData):
-
-2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Holger Freyther.
-
-        [Haiku] Correction of the accented letter width (they were 2 characters long).
-        https://bugs.webkit.org/show_bug.cgi?id=30629
-
-        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
-        (WebCore::SimpleFontData::platformWidthForGlyph):
-
-2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
-        <rdar://problem/7270314> After halting a transparent PluginView on
-        Windows, the transparency is applied twice
-
-        Replace use of Frame::nodeImage() with a function that takes a snapshot
-        of a PluginView.
-
-        Reviewed by Dan Bernstein.
-
-        * plugins/PluginView.h:
-        Made paintWindowedPluginIntoContext() non-const, as it now calls
-        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
-        and snapshot() for Windows platforms.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::paintIntoTransformedContext):
-        Paints into the passed HDC without applying any coordinate translations.
-        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
-        the memset() of windowpos in lieu of assignment.
-        (WebCore::PluginView::paintWindowedPluginIntoContext):
-        Code moved to paintIntoTransformedContext().
-        (WebCore::PluginView::paint):
-        Ditto.
-        (WebCore::PluginView::snapshot):
-        Create a context, and if the plug-in is windowless, translate it so the
-        plug-in will draw at the correct location. Create a bitmap, and select
-        it into the context. Paint the plug-in, and create a BitmapImage from
-        the bitmap.
-        (WebCore::PluginView::halt):
-        Use snapshot().
-
-2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
+        Potential crash in EventHandler::handleTouchEvent
+        https://bugs.webkit.org/show_bug.cgi?id=38646
 
-        Reviewed by Alexey Proskuryakov.
+        Fix a ref counting bug that can cause a crash if the m_originatingouchPointTargets
+        hashmap holds the last ref to an EventTarget when the user lifts their finger.
 
-        Fix calculation of length in WebSocketChannel.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=30656
+        This is very hard to reproduce in a consistent way and clearly a
+        simple logic error in the code, therefore no new tests.
 
-        * websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::didReceiveData):
-
-2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adding the ability to enable/disable functions in V8 at runtime.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30650
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-10-21  Darin Adler  <darin@apple.com>
-
-        Swedish search (and other languages as well) is broken while fixing Japanese search
-        https://bugs.webkit.org/show_bug.cgi?id=30646
-
-        Rolled Japanese tailoring out that was done to fix
-        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
-        It was overriding the locale-specific tailoring.
-        We'll land a fix once we figure out how to add the
-        Japanese tailoring without removing anything.
-
-        * editing/TextIterator.cpp: Rolled out r49924.
-
-2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed: chromium build fix - add missing image to gypi.
-
-        * WebCore.gypi:
-
-2009-10-21  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Eric Seidel.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Don't let the RefPtr we get back from
+            the hasmap go out of scope so soon as it could delete the wrapped ptr if the
+            hashmap held the last ref (and we use the raw ptr that the RefPtr
+            wraps later in the WebCore::Touch constructor).
 
-        Fixes part of <http://webkit.org/b/30522>.
-        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+2010-05-04  Ben Murdoch  <benm@google.com>
 
-        Expose the description attribute that is now a member of
-        ExceptionBase as of r49723, so when a user logs an exception, they
-        can see the description in the Web Inspector.
+        Reviewed by Simon Hausmann.
 
-        Test: fast/dom/dom-exception-description.html
+        Crash in handleTouchEvent: using dangling node ptrs in hashmap
+        https://bugs.webkit.org/show_bug.cgi?id=38514
 
-        * dom/DOMCoreException.idl:
-        * dom/EventException.idl:
-        * dom/RangeException.idl:
-        * svg/SVGException.idl:
-        * xml/XMLHttpRequestException.idl:
-        * xml/XPathException.idl:
+        When navigating away from a page, if you have your finger still
+        pressed and then lift it on the new page we see a crash if the
+        node got deleted as we still have a dangling pointer in the
+        m_originatingTouchPointTargets hashmap and try to use it as the
+        receiver to dispatch a touchend event.
 
-2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+        Test: fast/events/touch/touch-stale-node-crash.html
 
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
-        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
-        
-        Add a check to make sure a function we need to calculate percentages is
-        defined before we use it.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear): Clear the hashmap of touch targets.
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+2010-05-04  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Timothy Hatcher.
+        [Qt] QT_MOBILE_THEME compile time flag
+        https://bugs.webkit.org/show_bug.cgi?id=38439
 
-        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
-        https://bugs.webkit.org/show_bug.cgi?id=27231
+        Replacing preprocessor conditional used in RenderThemeQt from Q_WS_MAEMO_5 to
+        USE(QT_MOBILE_THEME).
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
-        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
-        treeOutline.showInElementsPanelEnabled is true.
+        * WebCore.pro:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        * platform/qt/RenderThemeQt.h:
 
-2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-25  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30637
-        Fix a compiler warning in windows.
-
-        * loader/ResourceLoadNotifier.h:
-
-2009-10-21  Dmitry Titov  <dimich@chromium.org>
+        [Qt]Fix compile error with QT_NO_LIBRARY
+        https://bugs.webkit.org/show_bug.cgi?id=36533
 
-        Reviewed by Darin Adler.
-
-        Fix the crash when a node not in a document receives dispatchEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=30611
+        * platform/FileSystem.h:
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::unloadModule):
 
-        Test: fast/events/dispatch-event-no-document.html
+2010-05-06  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
-        (WebCore::EventTarget::dispatchEvent):
+        Unreviewed WinCE buildfix after r58842.
+        Preprocessor doesn't understand "true", changed to "1"
 
-2009-10-21  Adam Langley  <agl@google.com>
+        * platform/graphics/MediaPlayer.cpp:
 
-        Reviewed by Eric Seidel.
+2010-05-06  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Chromium Linux: disable subpixel text on layers.
+        Reviewed by Kenneth Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30635
-        http://code.google.com/p/chromium/issues/detail?id=25365
+        Spatial Navigation: adapt the logic of {deep}findFocusableNodeInDirection to do traversal starting from Node* not Document*
+        https://bugs.webkit.org/show_bug.cgi?id=37803
 
-        With the addition of layers for drawing rounded corners in r49641,
-        subpixel text on rounded rectangles broke. This is because the layer
-        only contains a single alpha channel and this is insufficient to
-        compose subpixel text correctly.
+        Instead of receiving a Document pointer as incoming parameter, patch modifies
+        findFocusableNodeInDirection and deepFindFocusableNodeInDirection methods to
+        receive a Node pointer as start for content traversal.
+        This way we can make good use of deepFindFocusableNodeInDirection to traverse
+        other scrollable container like scrollable div's, and not only frames or iframes.
 
-        On Windows, a large body of code in TransparencyWin.cpp exists to try
-        to deal with this. Even then, in some cases, it downgrades to
-        anti-aliased text. We need a fix for the grevious effects quickly thus
-        this patch disables subpixel text when rendering into a layer.
+        Patch also makes use of 'while' instead of 'for' to loop control, that gives move
+        flexibility to the incremental step: e.g. if a scrollable div was processed, the incremental
+        step in the loop does not have to do node->traverseNextNode() but node->traverseNextSibling().
 
-        This would be covered by existing tests except that subpixel text is
-        disabled for pixel tests on Chromium Linux.
+        No behavior change. It is a preparation for supporting scrollable containers in Spatial
+        Navigation.
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::isCanvasMultiLayered):
-        (WebCore::adjustTextRenderMode):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/FocusController.h:
 
-2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+2010-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
-        it will use the sqlite3 system library rather than WebCoreSQLite3.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * wscript:
+        [Qt] REGRESSION: Loading of external CSS and JS files over network fails in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=36755
 
-2009-10-21  Dan Bernstein  <mitz@apple.com>
+        Enable the direct connection between QtNetwork and QtWebKit only for Qt versions
+        greater than 4.6.2, due to a bug in Qt that's been fixed after 4.6.2.
 
-        Reviewed by Sam Weinig.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
 
-        Fixed background-clip parsing regressions introduced in r46240.
+2010-05-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Test: fast/css/background-clip-text.html
+        Reviewed by Simon Hausmann.
 
-        * css/CSSParser.cpp:
-        (WebCore::parseBackgroundClip): Added this helper method.
-        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
-        reparse the value. The old code called parseFillProperty() again, which
-        didn’t work, because parseFillProperty() advances the value list.
-        (WebCore::CSSParser::parseFillProperty): Changed to use
-        parseBackgroundClip().
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
-        CSSValueWebkitText.
+        [Qt]Disable Qt Multimedia backend for HTML 5 Audio and Video elements
+        Fall back to the Phonon backend until the release situation has been cleared up.
 
-2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=38612
 
-        Reviewed by Timothy Hatcher.
+        Buildfix for QT_VERSION >= 0x040700 after r58810.
 
-        Enable creation of custom SidebarTreeElements for different ProfileTypes
+        * platform/graphics/MediaPlayer.cpp:
 
-        ProfileTypes can now create sidebar tree elements of custom types.
-        https://bugs.webkit.org/show_bug.cgi?id=30520
+2010-05-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
-        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
-        (WebInspector.CPUProfileType.prototype.createView):
-        (WebInspector.CPUProfile.prototype.get head):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfileType.prototype.buttonClicked):
-        (WebInspector.ProfileType.prototype.viewForProfile):
-        (WebInspector.ProfileType.prototype.createView):
-        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        (WebInspector.ProfilesPanel.prototype.showProfile):
+        Reviewed by Simon Hausmann.
 
-2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+        [Qt] Fix rendering of <button> elements on Mac OS X
 
-        Reviewed by Timothy Hatcher.
+        The <button> element has ButtonPart appearance, not PushButton part,
+        so we have to include ButtonPart when we decide if we should draw the
+        button as raised on Mac OS X.
 
-        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
-        https://bugs.webkit.org/show_bug.cgi?id=17126
+        https://bugs.webkit.org/show_bug.cgi?id=38458
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
 
-2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+2010-04-26  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Web Inspector: Fix DOM Agent leak.
+        View modes names in CSSValueKeywords.in
+        https://bugs.webkit.org/show_bug.cgi?id=38125
 
-        https://bugs.webkit.org/show_bug.cgi?id=30615
+        View mode names has changed in previous patch but CSSValueKeywords.in file was
+        not updated.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::~InspectorController):
+        * css/CSSValueKeywords.in:
 
-2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-04-28  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Simon Fraser.
 
-        Plugins: Create manual tests for testing plugins
-        
-        Create two test files:
-        1. windowed.html - Test plugin in windowed mode.
-        2. windowless.html - Test plugin in windowless mode.
+        Media queries empty values
+        https://bugs.webkit.org/show_bug.cgi?id=38116
 
-        https://bugs.webkit.org/show_bug.cgi?id=30503
+        Adding isValid() method to MediaQueryExp to make it possible to differentiate
+        between queries with empty values and queries with invalid values.
 
-        * manual-tests/plugins/windowed.html: Added.
-        * manual-tests/plugins/windowless.html: Added.
+        Test: fast/media/media-query-invalid-value.html
 
-2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::MediaQueryEvaluator::eval):
+        * css/MediaQueryExp.cpp:
+        (WebCore::MediaQueryExp::MediaQueryExp):
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::isValid):
 
-        Reviewed by Darin Adler.
+2010-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Fixed Japanese text search problems.
-        Treat small kana letters and kana letters as different characters in search.
-        Do not ignore diacritic marks in search for Japanese texts.
+        Reviewed by Tor Arne Vestbø.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30437
+        [Qt] Disable Qt Multimedia backend for HTML 5 Audio and Video elements
 
-        Test: fast/text/international/japanese-kana-letters.html
+        Fall back to the Phonon backend until the release situation has been cleared up.
 
-        * editing/TextIterator.cpp:
-        (WebCore::createCollator):
-        (WebCore::collator):
-        (WebCore::createSearcher):
+        * WebCore.pro:
 
-2009-10-20  Eric Z. Ayers  <zundel@google.com>
+2010-05-03  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Reviewed by Timothy Hatcher.
-
-        Changes TimelineItems to be created with raw timestamps as opposed
-        to a time relative to a start of session.  Normalized timestamps cause
-        problems when monitoring a browsing session across multiple page
-        transitions.
+        Reviewed by Simon Hausmann.
 
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        * inspector/InspectorTimelineAgent.h:
+        [Qt] Fix qtlibraryinfix not to contain space
 
-2009-10-20  Mark Rowe  <mrowe@apple.com>
+        List catenation with += adds whitespace cutting the infix
+        from the final target.
 
-        Reviewed by Oliver Hunt.
+        * WebCore.pro:
 
-        Fix leak of WebSocketChannel by adopting the newly-created reference.
+2010-05-03  Thomas Zander <t.zander@nokia.com>
 
-        * websockets/WebSocketChannel.h:
-        (WebCore::WebSocketChannel::create):
+        Reviewed by Simon Hausmann.
 
-2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
+        [Qt] Fix library infix usage when compiling inside of Qt
 
-        Reviewed by Adam Barth.
+        Don't apply the infix when building inside Qt, as that's done through the
+        inclusion of qbase.pri.
 
-        DOM Storage runtime flag changes
-        https://bugs.webkit.org/show_bug.cgi?id=30602
+        * WebCore.pro:
 
-        Part 1/2.  Removing sessionStorageEnabled in next patch after the
-        Chromium side of the changes lands.
+2010-04-29  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Revert my changes to Settings and instead implement DOM Storage enabling via
-        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+        Reviewed by Simon Hausmann.
 
-        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
-        LayoutTest visible changes and thus no tests.
+        [Qt] QtWebKit versioning added
+        https://bugs.webkit.org/show_bug.cgi?id=37207
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-        * storage/Storage.cpp:
-        (WebCore::Storage::setLocalStorageAvailable):
-        (WebCore::Storage::localStorageAvailable):
-        (WebCore::Storage::setSessionStorageAvailable):
-        (WebCore::Storage::sessionStorageAvailable):
-        * storage/Storage.h:
+        QtWebkit releases separated from Qt release cycle.
 
-2009-10-20  John Gregg  <johnnyg@google.com>
+        * WebCore.pro:
 
-        Reviewed by David Levin.
+2010-03-27  Robert Hogan  <robert@webkit.org>
 
-        Need to turn off notifications properly at runtime
-        https://bugs.webkit.org/show_bug.cgi?id=30409
+        Reviewed by nobody, fix typo in previous commit.
 
-        This code only affects chromium, and is all behind a compile time
-        flag current turned off, so no new tests.
+        Allow plugins implemented by the application, such as mimetype 'x-qt-plugin',
+         when pluginsEnabled is false
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * notifications/NotificationCenter.cpp:
-        (WebCore::NotificationCenter::setIsAvailable):
-        (WebCore::NotificationCenter::isAvailable):
-        * notifications/NotificationCenter.h:
-        * page/DOMWindow.idl:
-        * workers/WorkerContext.idl:
+        Fix parentheses typo in r56661. This happened while rebasing and was not present
+        in the reviewed patch, so committing unreviewed.
 
-2009-10-20  James Robinson  <jamesr@chromium.org>
+        https://bugs.webkit.org/attachment.cgi?id=49515
 
-        Reviewed by Adam Barth.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
 
-        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
-        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
+2010-03-26  Robert Hogan  <robert@roberthogan.net>
 
-        No new tests, error was caught by valgrind on the Chromium builders.
+        Reviewed by Simon Hausmann.
 
-        * bindings/v8/ScriptString.h:
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator=):
-        * bindings/v8/ScriptStringImpl.h:
-        (WebCore::ScriptStringImpl::create):
+        Allow plugins implemented by the application, such as mimetype 'x-qt-plugin',
+         when pluginsEnabled is false.
 
-2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
+        The purpose of disabling plugins is to prevent the execution of third-party code
+        that may be untrustworthy. Qt plugins are implemented by the client rather than
+        loaded from an external source, so the client should have the opportunity to
+        consider them separately from other plugins.
 
-        Reviewed by Pavel Feldman.
+        Add a function MimeTypeRegistry::isApplicationPluginMIMEType() that WebKit
+        uses in conjunction with arePluginsEnabled() to determine if it should attempt
+        to load a plugin. If isApplicationPluginMIMEType() returns true, WebKit will load
+        the plugin even if arePluginsEnabled() is false.
 
-        Web Inspector: populate child nodes before sorting them.
+        Currently, only Qt has application-implemented plugins: these use the mimetype
+        'x-qt-plugin' and 'x-qt-styled-widget'. This patch permits Qt clients'
+        reimplementation of QWebPage::createPlugin() to decide whether or not
+        to create a Qt plugin, even when arePluginsEnabled is false.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29673
+        For all platforms apart from Qt, isApplicationPluginMIMEType() returns false.
 
-        * inspector/front-end/BottomUpProfileDataGridTree.js:
-        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
-        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
-        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
-        (WebInspector.ProfileDataGridNode.prototype.get _parent):
-        (WebInspector.ProfileDataGridNode.prototype._populate):
-        * inspector/front-end/TopDownProfileDataGridTree.js:
-        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+        https://bugs.webkit.org/show_bug.cgi?id=32196
 
-2009-10-20  Jens Alfke  <snej@chromium.org>
+        Test: plugins/application-plugin-plugins-disabled.html
 
-        Reviewed by Eric Seidel.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+        * platform/MIMETypeRegistry.h:
+        * platform/brew/MIMETypeRegistryBrew.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/gtk/MIMETypeRegistryGtk.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/haiku/MIMETypeRegistryHaiku.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/mac/MIMETypeRegistryMac.mm:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/win/MIMETypeRegistryWin.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/wince/MIMETypeRegistryWince.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        * platform/wx/MimeTypeRegistryWx.cpp:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
 
-        Remove redundant String ref/deref calls in generated V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30579
+2010-04-29  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * bindings/v8/V8Binding.h:
-        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
-            instead of constructing/destructing a String.
+        Reviewed by Simon Hausmann.
 
-2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        [Qt] GraphicsLayer: flicker when starting an animation before the previous one ended.
+        https://bugs.webkit.org/show_bug.cgi?id=38076
 
-        Reviewed by Xan Lopez.
+        This was due to the cude in the removeAnimations functions, which called deleteLater() without stopping the
+        animation synchronously. The delay between the call to that function and the actual call to the animation's destructor
+        is when the flicker occured. We fix this by calling stop() synchronously, and making sure that the value is reverted
+        upon stop (updateState) and not upon the object's destruction.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25411
-        [GTK] ATK accessible ancestry broken
+        http://staff.washington.edu/fmf/2009/03/25/iphone-3d-css-transformations/ now doesn't flicker when
+        the animation is toggled frequently.
 
-        Work around for the problem of bogus additional objects in the ancestry.
-        We now set the parent when we ref the child, then ask the Atk child if
-        it knows its parent. This solves the bulk of the cases. For those it
-        doesn't, fall back to the existing logic.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
+        (WebCore::TransformAnimationQt::applyFrame):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::OpacityAnimationQt::~OpacityAnimationQt):
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty):
+        (WebCore::GraphicsLayerQt::removeAnimationsForKeyframes):
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-        (webkit_accessible_ref_child):
+2010-04-29  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Alice Liu.
+        Reverse animations don't work in some use cases        
+        https://bugs.webkit.org/show_bug.cgi?id=38075
 
-        Fixes <http://webkit.org/b/30421>.
-        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+        This was due to a code path special-casing reverse animations, that became obselete when we aligned our animation code
+        with the CA implementation. That special case code path is now a bug - and this patch removes it.
 
-        When a page like Google generates an about:blank, it shows up as a local file on
-        the list of Cookie domains, but has all of the cookies of Google. When we are adding
-        cookie domains to the inspector, we should only add the domain is the URL of the resource
-        is in the HTTP protocol family or a file URL.
+        http://staff.washington.edu/fmf/2009/03/25/iphone-3d-css-transformations/ now runs the reverse
+        animation correctly.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didFinishLoading):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::TransformAnimationQt::applyFrame):
 
-2009-10-20  Mark Mentovai  <mark@chromium.org>
+2010-04-29  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Use a version of libWebKitSystemInterface with global symbols marked
-        private_extern for Chromium Mac.
+        [Qt] Speed up text layouting
+        https://bugs.webkit.org/show_bug.cgi?id=31719
 
-        https://bugs.webkit.org/show_bug.cgi?id=30590
+        Use QFontMetrics::width() for the text width calculation instead
+        of QTextLayout. This avoids expensive bearing calculations and the
+        line breaking code.
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gyp/mac: Added.
-        * WebCore.gyp/mac/Empty.cpp: Added.
-        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
 
-2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+2010-04-29  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Tor Arne Vestbø.
 
-        Allow custom memory allocation control for WebCore's CSSProperty
-        https://bugs.webkit.org/show_bug.cgi?id=30564
+        [Qt] REGRESSION(r57638): tst_qwebframe::objectDeleted() fails
+        https://bugs.webkit.org/show_bug.cgi?id=38316
 
-        Inherits CSSProperty class from FastAllocBase because it has been
-        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+        Accessing properties of a deleted objects doesn't throw an exception
+        anymore.
 
-        * css/CSSProperty.h:
+        Continue to expose the QObject class wrapper for objects that
+        previously existed but don't exist anymore. QtClass is safe to
+        use with a deleted QObject.
 
-2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getClass): Return null only if m_class
+        doesn't exist yet and there's no m_object.
 
-        Reviewed by Eric Seidel.
+2010-04-28  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Hide Chromium's media slider thumb if no source has been loaded.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30529
+        [Qt] GraphicsLayer: preserves-3d and backface visibility
+        https://bugs.webkit.org/show_bug.cgi?id=35312
 
-        Covered by existing layout tests, notably:
-            LayoutTests/media/controls-rendering.html
-            LayoutTests/media/unsupported-tracks.html
-            LayoutTests/media/video-src-none.html
+        Implement preserves-3d by maintaining the 3D transformation heirarchy inside GraphicsLayerQt, and extrapolating
+        the relative QTransform. When the extrapolation fails (un-invertible matrix) we ignore the transformation change.
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
-        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
-        (WebCore::paintMediaPlayButton): Ditto.
-        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+        WebKitSite/blog-files/3d-transforms test now work with Qt.
 
-2009-10-20  Nate Chapin  <japhet@chromium.org>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::updateTransform):
+        (WebCore::GraphicsLayerQtImpl::opaqueArea):
+        (WebCore::GraphicsLayerQtImpl::boundingRect):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        Reviewed by Adam Barth.
+2010-04-28  Justin McPherson <justin.mcpherson@nokia.com>
 
-        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
-        This will allow Chromium to more intelligently detect
-        noreferrer links and therefore open them in a new process.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30581
+        [Qt] Fix detection of Qt 4.7's multimedia libraries
 
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+        QtMultimedia has been split into an additional media services library, which
+        we're using. mediaservices depends on multimedia.
 
-2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+        * WebCore.pro:
 
-        Reviewed by Darin Adler.
+2010-04-26  Andreas Kling  <andreas.kling@nokia.com>
 
-        Allow custom memory allocation control for WebCore's CSSParserFunction
-        https://bugs.webkit.org/show_bug.cgi?id=30563
+        Reviewed by Tor Arne Vestbø.
 
-        Inherits CSSParserFunction struct from FastAllocBase because it has been
-        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+        [Qt] Fix compilation against Qt 4.7
 
-        * css/CSSProperty.h:
+        Some QtMultimedia things have been moved into QtMediaServices
+        https://bugs.webkit.org/show_bug.cgi?id=38111
 
-2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+        * WebCore.pro:
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::totalBytes):
 
-        Reviewed by Timothy Hatcher.
+2010-04-21  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
-        https://bugs.webkit.org/show_bug.cgi?id=30554
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * inspector/front-end/inspector.css: added style to pane buttons
+        [Qt] Make sure WebKit is not compiled using C++0x.
+        https://bugs.webkit.org/show_bug.cgi?id=37867
 
-2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+        As the rest of Qt compiles in the C++0x mode, people might start
+        compiling it in this mode. WebKit don't support this yet.
 
-        Reviewed by Pavel Feldman.
+        Patch by Thiago Macieira <thiago.macieira@nokia.com>
 
-        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+        * WebCore.pro:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30559
+2010-04-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInIsolatedWorld):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
-        * bindings/v8/V8Proxy.h:
+        Reviewed by Simon Hausmann.
 
-2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        [Qt] Hide the OpenGL and QtMultimedia dependencies from syncqt.
 
-        Unreviewed buildfix.
-        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+        This prevents the dependent headers from being included by
+        qt/include/QtWebKit/QtWebKit
 
         * WebCore.pro:
 
-2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+2010-04-27  Thomas Zander <t.zander@nokia.com>
 
-        Reviewed by David Levin.
+        Reviewed by Simon Hausmann.
 
-        Set EnabledAtRuntime for WebSocket in DOMWindow
-        https://bugs.webkit.org/show_bug.cgi?id=29896
+        [Qt] Fix linking on Symbian on Linux using the Makefile based mkspec.
 
-        Supported by chromium/v8 only.
-        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
-        bindings.
-        Remove Settings::experimentalWebSocketsEnabled() and
-        setExperimentalWebSocketsEnabled(bool).
+        Disable thumb mode due to library size limitations, just like it's done
+        for the sbs/sbsv2 based build system.
 
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::setIsAvailable):
-        (WebCore::WebSocket::isAvailable):
-        * websockets/WebSocket.h:
-
-2009-10-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
+        * WebCore.pro:
 
-        REGRESSION: Dromaeo DOM test is 14% slower
-        https://bugs.webkit.org/show_bug.cgi?id=30273
+2010-04-26  Ruben Van Boxem  <vanboxem.ruben@gmail.com>
 
-        Whoops, make prototype bindings actually use the StructureFlags.
+        Reviewed by Adam Roben.
 
-        * bindings/scripts/CodeGeneratorJS.pm:
+        Fixes for Win64 compilation under gcc (mingw-w64)
 
-2009-10-19  James Robinson  <jamesr@chromium.org>
+        *  WebCore/bridge/npapi.h: for win64 compatibility, mirroring mozilla-central, see Mozilla bug 560298
+        *  WebCore/platform/Arena.h: uword is used to cast from pointers here. unsigned long is 32-bit on Windows (but 64-bit on mac), and too small to hold a pointer. uintptr_t is 32-bit on 32-bit systems (mac, linux and windows) and 64-bit on all 64-bit systems
+        *  WebCore/platform/graphics/transforms/TransformationMatrix.h: let mingw-w64/w32 use MSVC codepath
+        *  WebCore/platform/text/TextStream.cpp: let mingw-w64 use MSVC codepath
+        *  WebCore/platform/text/TextStream.h: let mingw-w64 use MSVC codepath
+        *  WebCore/plugins/PluginView.cpp: fix pointer casts on WIN64 and let mingw-w64 use MSVC codepath
+        *  WebCore/plugins/win/PluginViewWin.cpp: fix pointer casts on WIN64
 
-        Reviewed by Adam Barth.
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Better implementation of WebCore::ScriptString for the V8 bindings.
+        Reviewed by NOBODY (OOPS!).
 
-        https://bugs.webkit.org/show_bug.cgi?id=29909
+        [RVCT] ACID3 test crash
+        https://bugs.webkit.org/show_bug.cgi?id=33280
 
-        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
-        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
-        is pretty inefficient, especially since responseText is built up with a sequence of
-        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
-        this patch adopts a similar approach for V8.
+        Workaround developed by Yongjun Zhang.
 
-        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
 
-        * WebCore.gypi:
-        * bindings/v8/ScriptString.h:
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator String):
-        (WebCore::ScriptString::isNull):
-        (WebCore::ScriptString::size):
-        (WebCore::ScriptString::operator=):
-        (WebCore::ScriptString::operator+=):
-        (WebCore::ScriptString::v8StringOrNull):
-        * bindings/v8/ScriptStringImpl.cpp: Added.
-        (WebCore::ScriptStringImpl::ScriptStringImpl):
-        (WebCore::ScriptStringImpl::~ScriptStringImpl):
-        (WebCore::ScriptStringImpl::toString):
-        (WebCore::ScriptStringImpl::isNull):
-        (WebCore::ScriptStringImpl::size):
-        (WebCore::ScriptStringImpl::append):
-        * bindings/v8/ScriptStringImpl.h: Added.
-        (WebCore::ScriptStringImpl::ScriptStringImpl):
-        (WebCore::ScriptStringImpl::v8StringHandle):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
+2010-04-26  Markus Goetz  <Markus.Goetz@nokia.com>
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+        Reviewed by Simon Hausmann.
 
-        No review, rolling out r49837.
-        http://trac.webkit.org/changeset/49837
+        [Qt] HTTP pipelining efficiency increase
+        https://bugs.webkit.org/show_bug.cgi?id=38062
 
-        * page/Settings.cpp:
-        (WebCore::Settings::setStandardFontFamily):
-        (WebCore::Settings::setFixedFontFamily):
-        (WebCore::Settings::setSerifFontFamily):
-        (WebCore::Settings::setSansSerifFontFamily):
-        (WebCore::Settings::setCursiveFontFamily):
-        (WebCore::Settings::setFantasyFontFamily):
-        * page/Settings.h:
-        (WebCore::Settings::standardFontFamily):
-        (WebCore::Settings::fixedFontFamily):
-        (WebCore::Settings::serifFontFamily):
-        (WebCore::Settings::sansSerifFontFamily):
-        (WebCore::Settings::cursiveFontFamily):
-        (WebCore::Settings::fantasyFontFamily):
-        * platform/text/UScriptCode.h: Removed.
+        Increase number of network requests that are fed into
+        QNetworkAccessManager.
 
-2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
 
-        Reviewed by Eric Seidel.
+2010-04-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
-        https://bugs.webkit.org/show_bug.cgi?id=30473
+        Reviewed by Kenneth Rohde Christiansen.
 
-        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
-        PLALTFORM(WIN_OS) guards.
+        [Qt] Fix compilation with RVCT 4
+        https://bugs.webkit.org/show_bug.cgi?id=37727
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::error):
+        Swap extern and declspec to fix visibility of symbol imported from QtGui.
 
-2009-10-19  Jungshik Shin  <jshin@chromium.org>
+        * page/qt/EventHandlerQt.cpp:
 
-        Reviewed by Eric Seidel.
+2010-04-26  Bruno Schmidt  <bruno.schmidt@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20797
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Make generic font family getters/setters accept an additional
-        argument (script code). It has a default value so that if an embedder
-        does not have/want a per-script font family setting, call-sites
-        don't have to be changed.
-        This is to prepare for fixing bug 10874 (font selection is not
-        language-dependent) and bug 18085.
+        [Qt] Exposing an QVariantMap containing QObjectStar to Javascript
+        causes Segmentation Fault
+        https://bugs.webkit.org/show_bug.cgi?id=34729
 
-        There should be no change in layout and no new layout test
-        is added.
+        If an QVariantMap containing QObjectStar is added to the to QtWebkit
+        Javascript, it's use causes Segmentation Fault.
+        It happens because, in the case QMetaType::QVariantMap, the "root"
+        object that is inside of a PassRefPtr is passed recursively inside a
+        loop to recover the content of the map, but the PassRefPtr semantics
+        prohibit its use inside a loop, so the "root" object mus be passed
+        using the method "PassRefPtr::get" in order to keep the current
+        reference.
 
-        * WebCore.base.exp:
-        * page/Settings.cpp:
-        * page/Settings.h:
-        * platform/text/UScriptCode.h: Added. This is for ports that
-          do not use ICU. the part of ICU's common/unicode/uscript.h
-          that defines script code enum was copied. To keep enums compatible
-          with those in ICU, we don't generate the list out of Scripts.txt
-          of the Unicode Data base or CLDR's data.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue): change to root.get()
 
-2009-10-19  Evan Stade  <estade@chromium.org>
+2010-04-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Clarify usage of SuddenTermination API. No code change.
-
-        * platform/SuddenTermination.h:
-
-2009-10-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
+        Fix the MSVC 64bit build.
+        https://bugs.webkit.org/show_bug.cgi?id=37980
 
-        REGRESSION: Dromaeo DOM test is 14% slower
-        https://bugs.webkit.org/show_bug.cgi?id=30273
-
-        Make DOM bindings automatically inherit correct structure
-        flags rather than being needlessly conservative.  This is
-        done by making the bindings generator use the same model
-        for TypeInfo flags that we now use in JSC.
-
-        This gains us about 1% of this regression back.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
-
-2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Fixed a bug on nested SVG <use> elements.
-        https://bugs.webkit.org/show_bug.cgi?id=26117
-        When a <use> element refer to another <use> element which has
-        child/children, the instance tree built for this <use> element
-        is incorrect (more nodes than expected).
-
-        Test: svg/dom/use-on-use-with-child.svg
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::buildInstanceTree):
-
-2009-10-19  Oliver Hunt  <oliver@apple.com>
-
-        Small changes to fully invalidate and update the JavaScriptCallFrame.
-
-        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
-        https://bugs.webkit.org/show_bug.cgi?id=27146
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/JavaScriptCallFrame.h:
-        (WebCore::JavaScriptCallFrame::invalidate):
-        (WebCore::JavaScriptCallFrame::update):
-
-2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dmitri Titov.
-
-        Remove "source" from storage events
-        https://bugs.webkit.org/show_bug.cgi?id=30536
-
-        Remove "source" from storage events per
-        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
-
-        This was removed because it makes it introduces synchronous access that can
-        cross the event loop boundry (since a storage event can fire from one process
-        and be handled in another).
-
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        (WebCore::StorageEvent::initStorageEvent):
-        * storage/StorageEvent.h:
-        (WebCore::StorageEvent::uri):
-        * storage/StorageEvent.idl:
-        * storage/StorageEventDispatcher.cpp:
-        (WebCore::StorageEventDispatcher::dispatch):
-
-2009-10-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove ResourceLoadNotifier::activeDocumentLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30533
-
-        Removing this method from ResourceLoadNotifier better decouples the
-        notifier from FrameLoader.
+        * platform/text/TextStream.cpp:
+        * platform/text/TextStream.h:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformStart):
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::requestFromDelegate):
-        * loader/ResourceLoadNotifier.cpp:
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        * loader/ResourceLoadNotifier.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
+2010-04-22  Ray Rischpater  <Raymond.Rischpater@Nokia.com>
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Eric Seidel.
+        In HTMLInputElement.cpp, shouldUseInputMethod does not return true for
+        some text input types (TELEPHONE, NUMBER, URL, and EMAIL). Addressed
+        this by changing shouldUseInputMethod to use internal methods to 
+        check that the field is a text field that isn't a password field. 
 
-        Move sendRemainingDelegateMessages to ResourceLoadNotifier
-        https://bugs.webkit.org/show_bug.cgi?id=30531
+        No new tests.
 
-        This method is about notifying folks and doesn't interact with the rest
-        of FrameLoader.
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=37719>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        * loader/FrameLoader.h:
-        * loader/ResourceLoadNotifier.cpp:
-        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
-        * loader/ResourceLoadNotifier.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::shouldUseInputMethod):
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+2010-04-22  Gustavo Sverzut Barbieri  <barbieri@profusion.mobi>
 
         Reviewed by Eric Seidel.
 
-        Bypass popup blocker using click event
-        https://bugs.webkit.org/show_bug.cgi?id=21501
+        Fix build if NPAPI support is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=36621
 
-        Keep track of which events were generated by JavaScript and use that
-        inforation when figuring out if we're processing a user gesture.
+        No new tests, this is a build fix.
+        Re-submit r58043 with fix for EFL.
 
-        Test: http/tests/security/popup-blocked-from-fake-event.html
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGestureEvent):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        * dom/Document.cpp:
-        (WebCore::Document::createEvent):
-        * dom/Event.cpp:
-        (WebCore::Event::Event):
-        * dom/Event.h:
-        (WebCore::Event::createdByDOM):
-        (WebCore::Event::setCreatedByDOM):
+        * plugins/PluginViewNone.cpp:
 
-2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+2010-03-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Fixing a typo.
+        Fix build if NPAPI support is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=36621
 
-        https://bugs.webkit.org/show_bug.cgi?id=30543
+        No new tests, this is a build fix.
 
-        * platform/sql/SQLiteDatabase.h:
-
-2009-10-19  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
+        * plugins/PluginView.cpp: Guard getValueStatic() with
+        NETSCAPE_PLUGIN_API
+        (WebCore::PluginView::getValue):
+        * plugins/PluginView.h: Guard getValue() with NETSCAPE_PLUGIN_API
+        * plugins/PluginViewNone.cpp: Guard platformGetValue() and
+        platformGetValueStatic with NETSCAPE_PLUGIN_API;
+        Guard privateBrowsingStateChanged() and setJavaScriptPaused() with
+        PLATFORM(MAC)
 
-        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
-        https://bugs.webkit.org/show_bug.cgi?id=30544
+2010-04-14  Simon Fraser  <simon.fraser@apple.com>
 
-        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+        Reviewed by Dan Bernstein.
 
-2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+        Repaint of fixed, transformed element is broken
+        https://bugs.webkit.org/show_bug.cgi?id=37637
 
-        Reviewed by Darin Adler.
-
-        Flash at end of opacity/transform transition sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=30501
-        
-        When a transition finishes, there window of time between when the animation is
-        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
-        to its old appearance for one or two frames. To avoid this, we set the final
-        transform or opacity at the start of the transition; we know that the animation
-        will override the final value for as long as its running.
+        RenderBox::computeRectForRepaint() failed to set the 'fixed' flag correctly
+        for elements that had both fixed position and a transform. If the element has
+        a transform, 'fixed' should only remain true if the element itself is fixed
+        position.
         
-        No test because this is a very transient effect that can't be captured
-        in a test.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateLayerOpacity):
-        (WebCore::RenderLayerBacking::updateLayerTransform):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::startTransition):
-        * rendering/RenderLayerBacking.h:
-
-2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add more stop characters into console completions.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30477
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-
-2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
-
-        Reviewed by Adam Roben.
-
-        implemented ClipboardWin::files()
-        https://bugs.webkit.org/show_bug.cgi?id=29666
-
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::files):
-
-2009-10-19  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
-
-        https://bugs.webkit.org/show_bug.cgi?id=28986
-
-        Tests: http/tests/navigation/no-referrer-reset.html
-               http/tests/navigation/no-referrer-same-window.html
-               http/tests/navigation/no-referrer-subframe.html
-               http/tests/navigation/no-referrer-target-blank.html
-
-        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
-        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
-        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
-        (WebCore::HTMLAnchorElement::defaultEventHandler):
-        (WebCore::HTMLAnchorElement::parseMappedAttribute):
-        (WebCore::HTMLAnchorElement::hasRel):
-        (WebCore::HTMLAnchorElement::setRel):
-        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::createWindow):
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
-        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
-        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
-        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
-        * loader/FrameLoaderTypes.h: Add enum for referrer policy
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
-
-
-2009-10-19  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
-
-        [v8] typeof(HTMLMediaElement) should return undefined if media
-        engine is not available
-        https://bugs.webkit.org/show_bug.cgi?id=30343
-
-        Check for availability of the media engine to disable
-        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
-        in runtime.
-
-        Try runs and review in Chromium:
-        http://codereview.chromium.org/276011
-
-        Test: manual-tests/chromium/media-player-not-available.html
-
-        The above test can work work in Chromium. Testing procedures:
-        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
-        2. Open Chromium with above test page
-        3. Verify the test results according to the test page
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        Declare enabler methods.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        Report enabled only if media player is available.
-        * manual-tests/chromium/media-player-not-available.html: Added.
-        Manual test, following instruction in this test for procedures.
-        * page/DOMWindow.idl:
-        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
-        as enabled at runtime.
-
-2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        Refactor out some of the code in paint() into paintPanScrollIcon()
-        and paintScrollbars() in preparation of some Qt API changes.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::paint):
-        * platform/ScrollView.h:
-
-2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Make the local static panScrollIcon into a Image* instead
-        of a RefPtr<Image>.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
-
-2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by David Levin.
-
-        Forcefully set antialiasing for Chromium media controls.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30521
-
-        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
-
-        Covered by existing layout tests.
-
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
-
-2009-10-19  Jens Alfke  <jens@mooseyard.com>
-
-        Reviewed by Darin Adler.
-
-        Optimize string upper/lowercasing
-        https://bugs.webkit.org/show_bug.cgi?id=30261
+        Also cache style()->position() in a local variable for performance.
         
-        - Added AtomicString::upper() and lower()
-        - Further optimized StringImpl::lower()
-        - Removed StringImpl::isLower()
-        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
-          thousands of upper() calls and string allocations.
- 
-         * dom/Element.cpp:
-         (WebCore::Element::setAttribute): Call AtomicString::lower()
-         * dom/QualifiedName.cpp:
-         (WebCore::QualifiedName::localNameUpper): New method
-         * dom/QualifiedName.h: Added localNameUpper() method
-         * dom/StyledElement.cpp:
-         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
-         * html/HTMLDocument.cpp:
-         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
-         * html/HTMLElement.cpp:
-         (WebCore::HTMLElement::nodeName): Call localNameUpper()
-         * platform/text/AtomicString.cpp:
-         (WebCore::AtomicString::lower): New method
-         (WebCore::AtomicString::upper): New method
-         * platform/text/AtomicString.h: Added lower() and upper()
-         * platform/text/StringImpl.cpp: Removed isLower()
-         (WebCore::StringImpl::lower): Further optimization of initial loop
-         * platform/text/StringImpl.h: Removed isLower()
- 
-2009-10-19  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        If a call to a plugin's invokeMethod, invokeDefault or construct
-        returns false, throw an exception into JS.        
-
-        https://bugs.webkit.org/show_bug.cgi?id=30239
-
-        Test: plugins/netscape-invoke-failure.html
-
-        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
-        (npObjectInvokeImpl):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::invokeMethod): Check return value
-        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
-        (JSC::Bindings::CInstance::invokeConstruct): Check return value
-
-2009-10-16  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for chromium/skia canvas arc start/end positions, when the arc is
-        >= 360 degrees.
-        https://bugs.webkit.org/show_bug.cgi?id=30449
-
-        Covered by new test:
-        LayoutTests/fast/canvas/arc360.html
-
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::addArc):
-
-2009-10-19  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix uninitialized variable reference in Element::removeAttribute().
-        https://bugs.webkit.org/show_bug.cgi?id=30502
+        Test: fast/repaint/fixed-tranformed.html
 
-        * dom/Element.cpp:
-        (WebCore::Element::removeAttribute):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
 
-2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+2010-04-19  Antonio Gomes  <tonikitoo@webkit.org>
 
         Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30463
-        Remove HTML5 media element 'loadend' event
-
-        * dom/EventNames.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
-        (WebCore::HTMLMediaElement::loadInternal): Ditto.
-        (WebCore::HTMLMediaElement::noneSupported): Ditto.
-        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
-        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
-        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
-
-2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Adam Barth.
-
-        [Qt] Remove deletion of outgoing FormData object when reply is finished.
-        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
-        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        * platform/network/qt/QNetworkReplyHandler.h:
-
-2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
-        fastRealloc edge case.
-        https://bugs.webkit.org/show_bug.cgi?id=29313
-
-        No test, the crash shows up occasionally in crash dumps, we weren't able
-        to reproduce it locally.
+        Spatial Navigation: at @updateFocusCandidateIfCloser make an assignment shortcut when FocusCandidate is null
+        https://bugs.webkit.org/show_bug.cgi?id=37802
 
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
-            avoid calling fastRealloc with the size of 0.
-
-2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+        In updateFocusCandidateIfCloser method, we do all bail out checks in the begining of
+        the method body. If after those bail out checks, no "best FocusCandidate" has been taken
+        yet (i.e. focusCandidate.isNull() == true), we can safely take the current candidate,
+        and exit earlier.
 
-        Reviewed by Eric Seidel.
+        No behavior change, it is just a safe assignment shortcut.
 
-        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30371
-
-        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
-
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
-
-2009-10-19  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
-        https://bugs.webkit.org/show_bug.cgi?id=29832
-
-        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
-        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
-
-        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
-
-2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Unreviewed build warning fix.
-        [Qt] Apply changes to WebCore.pro introduced in r49778
-
-        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
-
-2009-10-19  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Move feGaussianBlur from WebCore/svg to WebCore/platform
-        [https://bugs.webkit.org/show_bug.cgi?id=30495]
-
-        This patch moves SVGFRGaussianBlur from svg/graphics/filters
-        to platform/graphics/filters/FEGaussianBlur. This is needed
-        for shadow support on Qt and Cairo.
-        No change in functionality, therfore no new test case needed.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
-        * platform/graphics/filters/FEGaussianBlur.h: Added.
-        * svg/SVGFEGaussianBlurElement.h:
-        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
-        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
-
-2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
-
-        Unreviewed.
-
-        Added reviewer name to r49574.
-
-2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30489
-        [Gtk] The document frame/html container claims to be parentless
-
-        Work around for the parentless claim made by the accessible associated
-        with the embedded WebView. When we identify this condition, get the
-        widget's parent, and then get the AtkObject from that. Admittedly an ugly
-        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
-        plan to switch over to WebKit.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-
-2009-10-19  Benjamin Otte  <otte@gnome.org>
-
-        Reviewed by Jan Alonzo.
-
-        Handle duration queries properly
-        https://bugs.webkit.org/show_bug.cgi?id=29999
-
-        Previously duration queries failed to handle unknown duration
-        and didn't treat the returned duration as an unsigned.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-
-2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Fix build on Windows.
-
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-
-2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] Windowed Plugins: Don't crash when client is 0.
-        
-        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
-        In addition, setFrameRect()/updatePluginWidget() is called even if the
-        plugin was not succesfully loaded. updatePluginWidget() updates the
-        window rect which is, in theory, useful to draw something that indicates
-        that we didn't load successfully.
-        
-        So, a status check is added to setNPWindowIfNeeded.
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30380
+2010-04-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::platformStart):
-
-2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Holger Freyther.
+        [Qt] Fix or remove the runtime flag for accelerated compositing.
 
-        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
-        
-        Fixes various sources of crashes:
-        1. The PluginContainer is a child of QWebView. When the view gets deleted,
-        the PluginView is not notified about the deletion of PluginContainer.
-        2. QWebView destructor does not set client to 0.
-        3. Sometimes pending paint events are sent after the plugin has died, so add
-        a check in PluginView::setNPWindowIfNeeded.
+        This adds a way for a chrome client to disallow layers from becoming composited,
+        even if the settings enable accelerated compositing. This is necessary for platforms
+        where different views can be applied with the same settings to the same page.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30354
+        We enable an API through ChromeClient to ask the chrome-client whether or not
+        it can render composited layers, which is taken into account when the compositor
+        decides whether or not to start compositing.
 
-        * plugins/qt/PluginContainerQt.cpp:
-        (PluginContainerQt::~PluginContainerQt):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
+        https://bugs.webkit.org/show_bug.cgi?id=37313
 
-2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+        Pages under LayoutTests/compositing now work under QWebView, even when
+        QWebSettings::AcceleratedCompositingEnabled is on.
 
-        Reviewed by Adam Barth.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::allowsAcceleratedCompositing):
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::allowsAcceleratedCompositing):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::canBeComposited):
 
-        https://bugs.webkit.org/show_bug.cgi?id=29042
-        Allow one to customize the minimal and maximal shrink factors used when printing.
+2010-04-23  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::begin):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPrintingMinimumShrinkFactor):
-        (WebCore::Settings::setPrintingMaximumShrinkFactor):
-        * page/Settings.h:
-        (WebCore::Settings::printingMinimumShrinkFactor):
-        (WebCore::Settings::printingMaximumShrinkFactor):
-
-2009-10-18  Erik Arvidsson  <arv@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Adam Barth.
+        [Qt] [Performance] GraphicsLayer: constructing the layers takes too long
+        https://bugs.webkit.org/show_bug.cgi?id=36365
 
-        Fixes issue where doubleclicking a word could select following adjacent newlines.
-        https://bugs.webkit.org/show_bug.cgi?id=30234
+        The issue came from using QGraphicsView's cache as is. The problem is that
+        several code-paths require re-rendering of the item, but not re-rendering
+        of the web content into the cache.
 
-        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
-               platform/mac/editing/selection/script-tests/TEMPLATE.html
-               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
-               platform/win/editing/selection/script-tests/TEMPLATE.html
+        The way to solve it is by having GraphicsLayerQt manage the cache directly
+        via QPixmapCache, instead of using QGraphicsItem cache modes.
 
-        * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        FPS measurement shows significant improvement (20FPS before, 40FPS after)
+        on several use-cases, including blog-files/leaves on a desktop environment.
 
-2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::recache):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        CURL build fix, use proper header name.
+2010-04-21  Benjamin Poulain  <ikipou@gmail.com>
 
-        * platform/network/curl/ResourceHandleManager.h:
+        Reviewed by Simon Fraser.
 
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+        Update of fixed elements is not made correctly when the page has been scrolled
+        https://bugs.webkit.org/show_bug.cgi?id=36783
 
-        Reviewed by Timothy Hatcher.
+        When a fixed element was updated, the old geometry was not repainted correctly
+        because the repaint rect was cached during the layout and not updated when 
+        scrolling.
 
-        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+        The rect is now updated while scrolling so the region updated correspond to the
+        region of the element on the screen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30485
+        The method RenderLayer::updateRepaintRectsAfterScroll() updates
+        the repaint rect of all fixed tree after scroll.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray):
-        (WebInspector.ConsoleView.prototype._printArray):
+        Tests: fast/repaint/fixed-child-move-after-scroll.html
+               fast/repaint/fixed-child-of-fixed-move-after-scroll.html
+               fast/repaint/fixed-child-of-transformed-move-after-scroll.html
+               fast/repaint/fixed-move-after-scroll.html
 
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateRepaintRectsAfterScroll):
+        * rendering/RenderLayer.h:
 
-        Not reviewed: touching WebCore so that it
-        initiated inspector frontend deployment on Windows.
+2010-04-21  David Leong  <david.leong@nokia.com>
 
-        Web Inspector: frontend files are not deployed in Windows
-        incremental build.
+        Reviewed by Simon Hausmann.
 
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::unbind):
+        [Qt] Symbian apps crash on exit due to a bad qObject_cast.
 
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=37303
 
-        Reviewed by Timothy Hatcher.
+        Added check for NULL to avoid the crash. Reworked to fix memory leak
+           
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformDestroy):
 
-        Web Inspector: Title of dir(["test", "test2"]) should be Array
+2010-04-14  Antonio Gomes  <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30486
+        Reviewed by Simon Fraser.
 
-        Test: inspector/console-tests.html
+        Spatial Navigation: make hasOffscreenRect() to earlier return 'true' if absoluteClippedOverflowRect() gives an empty rect
+        https://bugs.webkit.org/show_bug.cgi?id=37635
 
-        * inspector/front-end/InjectedScript.js:
+        absoluteClippedOverflowRect method of RenderObject does return an empty IntRect for offscreen nodes.
+        So hasOffscreenRect method (SpatialNavigation.cpp) can safily bail out earlier in such cases.
 
-2009-10-18  Dirk Schulze  <krit@webkit.org>
+        * page/SpatialNavigation.cpp:
+        (WebCore::hasOffscreenRect):
 
-        Reviewed by Nikolas Zimmermann.
+2010-04-12  Antonio Gomes  <tonikitoo@webkit.org>
 
-        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
-        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+        Reviewed by Simon Fraser.
 
-        Patch for SVGMaskElement landed in r49598 should correct the location of
-        the mask image graphics context. It only corrects the location for userSpaceOnUse
-        mode in maskContentUnits but breaks objectBoundingBoxMode.
-        The maskDestRect shouldn't be moved. It is not responsible for the correct context
-        postioin but for the correct position of the mask image.
-        This patch calculates the context postion independently from the maskDestRect.
-        It also uses lineareRGB color space for masking on CG now. This is the default
-        color space for masking operations.
-        We already have tests for both maskContentUnits modes.
+        Spatial Navigation: make renderRectRelativeToRootDocument method to fallback to getRect() of Element when needed
+        https://bugs.webkit.org/show_bug.cgi?id=37461
 
-            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
-            *svg/custom/mask-with-default-value.svg
+        getRect() of Element can be used instead of absoluteClippedOverflowRect of RenderObject when
+        the node is currently offscreen in an scroll overflowed content.
 
-        Some tests needed new pixel tests because of the new color space.
+        Test: fast/events/spatial-navigation/snav-simple-content-overflow.html
 
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
+        * page/SpatialNavigation.cpp:
+        (WebCore::renderRectRelativeToRootDocument):
 
-2009-10-18  Anton Muhin  <antonm@chromium.org>
+2010-03-29  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Fraser.
 
-        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
-        That is notably faster for small numbers (most common case).
-        https://bugs.webkit.org/show_bug.cgi?id=30493
+        Spatial Navigation: proper handle negative x or y coordinates
+        https://bugs.webkit.org/show_bug.cgi?id=36773
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+        In Spatial Navigation logic, during rect acquisition in renderRectRelativeToRootDocument,
+        sometimes negative x() or y() values are got, and the current algorithm bails out in
+        any of such cases.
 
-2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        However, when a node is in a scrollable content (content overflow <div>) and
+        this scrollable container scrolled up, element gets offscreen, and gets negative values
+        for y(), for example. In such cases, they are still valid to be used in Spatial Navigation
+        logic.
 
-        Reviewed by Holger Freyther.
+        Test: fast/events/spatial-navigation/snav-offscreen-content.html
 
-        [GTK] Add MathML to the build system
-        https://bugs.webkit.org/show_bug.cgi?id=30487
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceDataForNode):
+        (WebCore::checkNegativeCoordsForNode):
 
-        Add MathML sources if MathML support is enabled.
+2010-04-05  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * GNUmakefile.am:
+        Reviewed by Kenneth Christiansen.
 
-2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+        Spatial Navigation: bail out as soon as algorithm finds a focus candidate is not applicable
+        https://bugs.webkit.org/show_bug.cgi?id=37135
 
-        Non-PCH build fix. Added missing header.
+        It happens, for example, when distanceDataForNode assigns numeric_limits<long long> to
+        current focus candidate's. It means that current candidate is not in direction, or not
+        a valid target node.
 
-        * bridge/runtime_root.h:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::findFocusableNodeInDirection):
 
-2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+2010-03-29  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Compositing layers not correctly updated after partial layout
-        https://bugs.webkit.org/show_bug.cgi?id=30425
-        
-        When a partial layout happened, for example as the result of a postion-change-only
-        layout, then some compositing layer positions were not correctly updated. To fix
-        this, updateLayerPositions() now carries along a flag that is set at the rootmost
-        layer being updated, and used to determine when we hit the first compositing layer
-        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
-        to do a full geometry update on that layer, which is thus the rootmost compositing
-        layer that is being updated.
+        Spatial Navigation: Initial code simplification in FocusController.cpp and SpatialNavigation.cpp
 
-        Test: compositing/geometry/partial-layout-update.html
+        WebCore::distanceInDirection method was handling much of the logic not
+        strictly only related to the distance between nodes acquisition. This
+        method was simplified and renamed to 'WebCore::distanceDataForNode'.
+        The latter is now responsible for only getting the distance and alignment
+        data, while all assignement logic previously in distanceInDirection method
+        was moved place to updateFocusCandidateIfCloser.
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        * rendering/RenderLayerBacking.h:
+        Parent document distance and alignment acquisitions, in turn, have also
+        changed location: they are both got from deepFindFocusableNodeInDirection,
+        and passed in a recursive call to findFocusableNodeInDirection via the
+        candidateParent variable (optional parameter). In addition, the need for
+        the 'focusCandidateCopy' variable in deepFindFocusableNodeInDirection method
+        was removed, making the code much cleaner.
 
-2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+        No behaviour change at this point. Mostly moving code around to the place
+        where it should live in.
 
-        Reviewed by Kevin Ollivier.
-
-        Add support for proxies in CURL.
- 
-        https://bugs.webkit.org/show_bug.cgi?id=30446
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        (WebCore::updateFocusCandidateIfCloser):
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/FocusController.h:
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceDataForNode):
+        (WebCore::renderRectRelativeToRootDocument):
+        * page/SpatialNavigation.h:
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::setProxyInfo):
-        (WebCore::ResourceHandleManager::initializeHandle):
-        * platform/network/curl/ResourceHandleManager.h:
-        (WebCore::ResourceHandleManager::):
+2010-04-20  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Reviewed by Antti Koivisto.
 
-        Reviewed by Xan Lopez
+        [Qt] GraphicsLayer: support fill-modes
+        https://bugs.webkit.org/show_bug.cgi?id=36216
+        Implement the CSS-animation "fill mode" concept in GraphicsLayerQt. The concept
+        enables a key-frame animation to go to the animation's starting point before the delay,
+        and/or to stay at the animation's ending point after its ended, without reverting to the default
+        value.
+        We do that by manually setting the value to keyframe-0 before the delay if fill-mode is backwards/both,
+        and manually modifying the default value to the animated value as we animate, with fill-mode forwards/both.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25901
-        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQtBase::AnimationQtBase):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
+        (WebCore::TransformAnimationQt::applyFrame):
+        (WebCore::GraphicsLayerQt::addAnimation):
 
-        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+2010-04-13  Eskil Blomfeldt <eblomfel@trolltech.com>, Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_role):
+        Reviewed by Simon Hausmann.
 
-2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+        [Qt] Use integer pixel metric QFont API to fix rounding errors in text rendering on the Mac
+        https://bugs.webkit.org/show_bug.cgi?id=36532
 
-        Reviewed by George Staikos.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::font):
 
-        Cleanup SVGElement code, preparing for animVal support
-        https://bugs.webkit.org/show_bug.cgi?id=30466
+2010-04-16  Daniel Bates  <dbates@rim.com>
 
-        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
-        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
-        be used to control the start/end state of an animated property.
+        Reviewed by Adam Treat.
 
-        We're currently tracking animated properties that need synchronization, generalize this concept and use
-        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
-        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+        https://bugs.webkit.org/show_bug.cgi?id=36312
 
-        No change in functionality, thus no tests.
+        Adds support for the viewport meta tag. The code is largely derived in whole
+        or in part from the WebCore-528.15 source published as part of the iPhone 3.1.3
+        source code <http://www.opensource.apple.com/source/WebCore/WebCore-528.15/>.
 
-        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * Android.mk: Added file ViewportArguments.cpp.
+        * GNUmakefile.am: Added files ViewportArguments.cpp and ViewportArguments.h.
         * WebCore.gypi: Ditto.
         * WebCore.pro: Ditto.
         * WebCore.vcproj/WebCore.vcproj: Ditto.
         * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * svg/SVGAllInOne.cpp: Ditto.
-        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
-        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
-        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
-        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
-        (WebCore::lookupOrCreateWrapper):
-        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
-        (WebCore::SVGElement::updateAnimatedSVGAttribute):
-        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
-        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
-        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
-        (WebCore::SVGViewSpec::SVGViewSpec):
-        (WebCore::SVGViewSpec::viewTarget):
-        * svg/SVGViewSpec.h: Ditto.
-        (WebCore::SVGViewSpec::contextElement):
-        * svg/SynchronizablePropertyController.cpp: Added.
-        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
-        (WebCore::SynchronizablePropertyController::registerProperty):
-        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
-        (WebCore::SynchronizablePropertyController::synchronizeProperty):
-        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
-        (WebCore::SynchronizablePropertyController::startAnimation):
-        (WebCore::SynchronizablePropertyController::stopAnimation):
-        * svg/SynchronizablePropertyController.h: Added.
-        (WebCore::SynchronizableProperty::SynchronizableProperty):
-        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
-        (WebCore::SynchronizableProperty::operator==):
-        (WebCore::SynchronizablePropertyHash::hash):
-        (WebCore::SynchronizablePropertyHash::equal):
-        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
-        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
-
-2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25413
-        [GTK] Please expose the level of headings
-
-        Exposes the heading level as an attribute of the AtkObject.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (addAttributeToSet):
-        (webkit_accessible_get_attributes):
-        (webkit_accessible_class_init):
-
-2009-10-17  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
-        https://bugs.webkit.org/show_bug.cgi?id=30472
-
-        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
-        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
-
-        * page/EventHandler.cpp:
-
-2009-10-17  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [chromium] Video controls not zoomed / transformed correctly
-        https://bugs.webkit.org/show_bug.cgi?id=30461
-
-        Draw the images in the controls scaled.
-
-        No new tests. With this change Chromium will pass the following tests:
-        LayoutTests/media/video-controls-zoomed.html
-        LayoutTests/media/video-controls-transformed.html
-
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaButton):
-        Pass along the target rect directly.
-        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
-        Adjust the thumb slide applied with the scale factor.
-
-2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Gtk] Build fix for WebKitGtk after r49723.
-
-        Add bindings/js/JSExceptionBase.* to the build.
-
-        * GNUmakefile.am:
-
-2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Qt] Build fix for QtWebKit after r49723.
-
-        Add bindings/js/JSExceptionBase.cpp to the build.
-
-        * WebCore.pro:
-
-2009-10-16  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30456
-        Fixes for new Debug_All Windows build configuration.
-
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
-        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-
-2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Add SPI to determine whether a plug-in has ever been halted.
-
-        Part of <rdar://problem/7312158>.
-
-        Reviewed by Dan Bernstein.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        Initialize m_hasBeenHalted.
-
-        * plugins/PluginView.h:
-        (WebCore::PluginView::hasBeenHalted):
-        Return m_hasBeenHalted.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
-        Set m_hasBeenHalted.
+        * dom/Document.cpp:
+        (WebCore::isSeparator): Added.
+        (WebCore::Document::processArguments): Added.
+        (WebCore::Document::processViewport): Added.
+        * dom/Document.h:
+        * dom/ViewportArguments.cpp: Added.
+        (WebCore::setViewportFeature):
+        (WebCore::viewportErrorMessageTemplate):
+        (WebCore::viewportErrorMessageLevel):
+        (WebCore::reportViewportWarning):
+        * dom/ViewportArguments.h: Added.
+        (WebCore::):
+        (WebCore::ViewportArguments::):
+        (WebCore::ViewportArguments::ViewportArguments):
+        (WebCore::ViewportArguments::hasCustomArgument):
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::process): Modified to call Document::processViewport.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::didReceiveViewportArguments): Added.
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+2010-04-15  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Antti Koivisto.
 
-        @charset rule after the first byte causes the rest of css to be ignored
-        https://bugs.webkit.org/show_bug.cgi?id=18265
+        No default selection for <select multiple> menu lists.
+        https://bugs.webkit.org/show_bug.cgi?id=37530
 
-        Apparently we're supposed to tolerate whitespace before the charset
-        rule so folks can write code like this:
+        Manual test: manual-tests/no-listbox-rendering.html
 
-        <style>
-        @charset "utf-8"
-        ...
-        </style>
+        For menu lists, if the selection is not indicated by the html file, the first <option> will be
+        selected after loading the page or reseting the form. On the other hand listboxes may have no
+        element selected after loading the page or reseting the form.
 
-        I'm told this is one of the top compatability problems in China.
-        Tests: fast/css/comment-before-charset-external.html
-               fast/css/comment-before-charset.html
-               fast/css/many-spaces-before-charset.html
-               fast/css/space-before-charset-external.html
-               fast/css/space-before-charset.html
+        When NO_LISTBOX_RENDERING is enabled listboxes becomes menu lists. Those <select multiple>
+        that did not have selected elements, now being menu lists, will have the first <option>
+        selected. That is the behavior difference that this patch corrects.
 
-        * css/CSSGrammar.y:
+        When NO_LISTBOX_RENDERING is enabled usesMenuList() always returns true then usesMenuList() cannot
+        be used to decide about initial selection of the elements. This patch replaces (usesMenuLists())
+        by (!multiple && size <= 1) where initial selection is considered.
 
-2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::reset):
+        * manual-tests/no-listbox-rendering.html: Added.
 
-        Reviewed by Darin Adler.
+2010-04-19  Balazs Kelemen  <kb@inf.u-szeged.hu>
 
-        Fixes part of <http://webkit.org/b/30412>.
-        Web Inspector should get human readable DOM Exceptions.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Add a description field to ExceptionBase, and call it through 
-        reportException which allows the user/developer to get a more detailed
-        and coherent error explanation through the Web Inspector.
+        [Qt] Destroy SharedTimerQt before destruction of QCoreApplication.
 
-        This only applies to exceptions that come from a script on the page when
-        it is run. DOM Exceptions that come from the code run in the console, or DOM
-        exceptions that are caught and logged will come in a future patch.
+        To avoid unsafe situations caused by running WebCore code (through firing timers) when destruction of QCoreApplication
+        has been started, we should explicitly destroy the SharedTimerQt instance on application exit.
+        We can achieve that through installing a self-destroying slot for the QCoreApplication::aboutToQuit() signal
+        into the SharedTimerQt instance.
 
-        Tests: inspector/uncaught-dom1-exception.html
-               inspector/uncaught-dom3-exception.html
-               inspector/uncaught-dom8-exception.html
+        https://bugs.webkit.org/show_bug.cgi?id=36832
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        * bindings/js/JSExceptionBase.cpp: Added.
-        (WebCore::toExceptionBase):
-        * bindings/js/JSExceptionBase.h: Added.
-        * dom/ExceptionBase.cpp:
-        (WebCore::ExceptionBase::ExceptionBase):
-        * dom/ExceptionBase.h:
-        (WebCore::ExceptionBase::description):
-        * dom/ExceptionCode.cpp:
-        (WebCore::):
-        (WebCore::getExceptionCodeDescription):
-        * dom/ExceptionCode.h:
+        No functional change so no new tests.
 
-2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+        * platform/qt/SharedTimerQt.cpp:
+        (WebCore::SharedTimerQt::SharedTimerQt):
+        (WebCore::SharedTimerQt::destroy):
+        (WebCore::SharedTimerQt::inst):
 
-        Build fix: forgot to check in this #include.
+2010-04-16  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * bridge/runtime_root.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+        Make GraphicsLayerQt always use ItemCoordinateCache, and remove ItemUsesExtendedStyleOption.
+        This aligns our implementation with the Safari implementation - layers are always uploaded
+        to textures in item units, and WebCore is responsible for the heuristics.
 
-        Reviewed by Dan Bernstein.
+        [Qt] GraphicsLayer: performance optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=35393
 
-        Transform layer gets stuck with the wrong transform after an animation ends
-        <rdar://problem/7311662>
+        No new tests. Still no FPS benchmarks available (on any platform)
+        but animations are noticably better.
 
-        Work around a CoreAnimation bug which causes an animated transform layer to
-        end up with a stale transform.
-        
-        Test: compositing/animation/state-at-end-event-transform-layer.html
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::TransformAnimationQt::updateState):
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::bug7311367Workaround):
-        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+2010-04-16  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+        Unreviewed QtWebKit (with Qt 4.7) build fix.
 
-        Reviewed by Dan Bernstein.
+        Bug 37683 moved code from FontQt.cpp to FontPlatformDataQt.cpp but did not
+        renamed the variable used.
 
-        After running a transition with an end event listener, can't change the transform
-        https://bugs.webkit.org/show_bug.cgi?id=30454
-        
-        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
-        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
-        
-        Now, we always clean up the animations right after queuing up the end events.
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
 
-        Tests: animations/state-at-end-event.html
-               transitions/move-after-transition.html
+2010-04-16  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::onAnimationEnd):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::onAnimationEnd):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+        [Qt] WebCore::Font::font() causes a QFont detach
+        https://bugs.webkit.org/show_bug.cgi?id=37683
 
-        Reviewed by Timothy Hatcher.
+        Moved the setStyleStrategy call to FontPlatformData
+        to avoid the detach.
 
-        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
-        https://bugs.webkit.org/show_bug.cgi?id=30428
+        Thanks to Holger for spotting this.
 
-        TextNode => Edit Text Node
-        Has Attributes => Edit First Attribute
-        No Attributes => Start Editing New Attribute
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
-        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
-        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
-        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+2010-04-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        Reviewed by Antti Koivisto.
 
-        Reviewed by Eric Seidel.
+        [Qt]QtLauncher crash on page with CSS 3D transform
+        https://bugs.webkit.org/show_bug.cgi?id=36859
 
-        Fix header indent style for FrameLoader and friends
-        https://bugs.webkit.org/show_bug.cgi?id=30430
+        Added a neccessary null-pointer check, lack of which created the crash circumstances.
 
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::frame):
-        (WebCore::FrameLoader::policyChecker):
-        (WebCore::FrameLoader::history):
-        (WebCore::FrameLoader::notifier):
-        (WebCore::FrameLoader::isLoadingMainResource):
-        (WebCore::FrameLoader::documentLoader):
-        (WebCore::FrameLoader::policyDocumentLoader):
-        (WebCore::FrameLoader::provisionalDocumentLoader):
-        (WebCore::FrameLoader::state):
-        (WebCore::FrameLoader::client):
-        (WebCore::FrameLoader::url):
-        (WebCore::FrameLoader::isLoadingFromCachedPage):
-        (WebCore::FrameLoader::committingFirstRealLoad):
-        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
-        (WebCore::FrameLoader::creatingInitialEmptyDocument):
-        * loader/HistoryController.h:
-        (WebCore::HistoryController::currentItem):
-        (WebCore::HistoryController::provisionalItem):
-        * loader/PolicyCallback.h:
-        (WebCore::PolicyCallback::request):
-        * loader/PolicyChecker.h:
-        (WebCore::PolicyChecker::loadType):
-        (WebCore::PolicyChecker::setLoadType):
-        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
-        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
-        * loader/RedirectScheduler.h:
-        * loader/ResourceLoadNotifier.h:
-
-2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+        Tested by http://css-vfx.googlecode.com/svn/trunk/snowstack/snowstack.html
 
-        Reviewed by Adam Roben.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        Add a Debug_All configuration to build entire stack as debug.
-        Change Debug_Internal to:
-        - stop using _debug suffix for all WebKit/Safari binaries
-        - not use _debug as a DLL naming suffix
-        - use non-debug C runtime lib.
+2010-04-18  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
-        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
-        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        Reviewed by Laszlo Gombos.
 
-2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+        [Qt] Fix JavaScriptCore's include path for WinCE builds
 
-        No review, rolling out r49693, because it broke Chromium build.
-        http://trac.webkit.org/changeset/49693
+        https://bugs.webkit.org/show_bug.cgi?id=36751
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
+        * WebCore.pro:
 
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+2010-04-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Eric Carlson.
+        Reviewed by Simon Hausmann.
 
-        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+        [Qt] Fix compilation against namespaced Qt.
 
-        Noticable changes:
-            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
-            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/Tile.h:
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
 
-        Tests: media/video-src-empty.html
-               media/video-src-none.html
+2010-04-14  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30407
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+        Changing view mode names due to specification changes
+        https://bugs.webkit.org/show_bug.cgi?id=37615
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        test: fast/media/media-feature-wgt-view-mode.html
 
-        Reviewed by Eric Seidel.
+        specification: http://dev.w3.org/2006/waf/widgets-vmmf/
 
-        Insecure plug-ins don't trigger mixed content
-        https://bugs.webkit.org/show_bug.cgi?id=30431
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::view_modeMediaFeatureEval):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isWindowed):
+        (WebCore::ChromeClient::isMaximized):
+        (WebCore::ChromeClient::isMinimized):
 
-        Added the missing check.
+2010-04-15  Bruno Schmidt  <bruno.schmidt@gmail.com>
 
-        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadPlugin):
+        [Qt] Null QObjects properties cause Segmentation Fault
+        https://bugs.webkit.org/show_bug.cgi?id=34730
 
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+        QObjects exported to the QWebkit javascript with properties that are
+        a null "QObject*" cause Segmentation Fault.
 
-        Reviewed by Eric Carlson.
+        If an QObject is added to the javascript context and it contains
+        properties of the type QObject* with NULL value, calling the property
+        causes Segmentation Fault.
+        So now the code below properly checks for null pointers:
 
-        Set autobuffer to true and schedule load in V8 audio element constructor.
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getClass): may return NULL
+        (JSC::Bindings::QtInstance::getMethod): may return jsNull()
+        (JSC::Bindings::QtInstance::stringValue): may return jsNull()
+        (JSC::Bindings::QtInstance::booleanValue): may return false
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant): 
+        (JSC::Bindings::convertQVariantToValue): May return jsNull on QObjectStar
 
-        https://bugs.webkit.org/show_bug.cgi?id=30448
+2010-04-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Covered by existing tests.
+        Reviewed by Simon Fraser.
 
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+        Remove "all" value from the view-mode media feature (as agreed on
+        1-Apr-2010) in the Widgets voice conf.
 
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+        * css/CSSValueKeywords.in:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::view_modeMediaFeatureEval):
 
-        Reviewed by Eric Seidel.
+2010-04-09  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
-        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30422
+        [Qt]Fix compile error with QT_NO_PROPERTIES
+        https://bugs.webkit.org/show_bug.cgi?id=36526
 
-        Covered by existing media layout tests.
+        Disable dynamic properties when QT_NO_PROPERTIES is defined.
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Removed round() and FIXME.
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getPropertyNames):
+        (JSC::Bindings::QtField::name):
+        (JSC::Bindings::QtField::valueFromInstance):
+        (JSC::Bindings::QtField::setValueToInstance):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtField::):
 
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+2010-03-25  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        Fix Chromium media controls to render a disabled play button when the element is unintialized.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30410
-
-        Covered by existing layout tests.
-
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
-
-2009-10-16  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
+        [Qt]Fix compile error with QT_NO_ANIMATION
+        https://bugs.webkit.org/show_bug.cgi?id=36526
 
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl):
+        * platform/graphics/qt/GraphicsLayerQt.h:
 
-        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
-        flag.
+2010-04-09  David Leong  <david.leong@nokia.com>
 
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
+        Reviewed by Simon Hausmann.
 
-2009-10-16  Steven Knight  <sgk@chromium.org>
+        [Qt] Symbian apps crash on exit due to a bad qObject_cast.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=37303
 
-        https://bugs.webkit.org/show_bug.cgi?id=30447
-        Handle long link lines by building .idl-generated bindings in a
-        separate webcore_bindings library target.  Avoid Visual Studio
-        dependency issues by building additional generated .cpp and .h files
-        in a separate webcore_bindings_sources target.
+        Added check for NULL to avoid the crash.
 
-        Chrome should still build and test successfully.
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformDestroy):
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Eric Carlson.
+        [Qt] Fix crashes with package builds in release
 
-        Transform transitions that used to be accelerated are no longer so
-        https://bugs.webkit.org/show_bug.cgi?id=30453
+        * WebCore.pro: Don't add NDEBUG to the defines here, add it from JavaScriptCore.pri
 
-        The change in r49633, to not run accelerated animations/transitions on layers that
-        are not attached, broke accelerated transitions/animations in many cases where they start
-        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
-        attached.
-        
-        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+2010-04-09  Andras Becsi  <abecsi@webkit.org>
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
+        Reviewed by Simon Hausmann.
 
-2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+        [Qt] User agent style sheets are crippled by moc -E in make-css-file-arrays.pl
+        https://bugs.webkit.org/show_bug.cgi?id=37296
 
-        wxMSW build fix, build the MSW source to get methods that use the MSW version of
-        PlatformModuleVersion.
+        Do not use moc to preprocess user agent style sheets because it removes at-symbols
+        and hexadecimal colours from declarations.
+        Remove unneeded preprocessor usage from make-css-file-arrays.pl since the script
+        processes default css files using regular expressions therefore preprocessing is redundant.
 
-        * wscript:
+        * WebCore.pri: remove --preprocessor usage
+        * css/make-css-file-arrays.pl: remove gcc dependency
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+2010-04-01  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
-        casing.
+        Reviewed by David Hyatt.
 
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
-        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
-        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
-        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
-        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
-        (WebCore::dummyHashSet):
-        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
-        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        [Qt] REGRESSION:(r50665) QWebFrame::setScrollBarPolicy(Qt::Vertical,Qt::ScrollBarAlwaysOff) has no effect.
+        https://bugs.webkit.org/show_bug.cgi?id=29431
 
-        Reviewed by Darin Adler.
+        Test: fast/overflow/scrollbar-restored-and-then-locked.html
 
-        MimeTypeRegistryChromium is mis-casen
-        https://bugs.webkit.org/show_bug.cgi?id=30441
+        Patch introduces a lock scrollbars concept to ScrollView, as in WebDynamicScrollBarsView.mm/h
+        on WebKit/mac. It is needed because in QtWebKit, we have Api for setting both vertical and
+        horizontal scrollbars on/off/auto. When it is set to off, for example, it should remain
+        as such, unless unset.
 
-        Change the case of MimeTypeRegistryChromium to match other platforms.
+        For the locking concept, optional 'lock' parameters were added to setScrollbarModes,
+        setHorizontalScrollbarMode and setVerticalScrollbarMode methods of ScrollView. As these
+        are all optional, any previous code calling them do not need modification.
 
-        * WebCore.gypi:
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
-        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+        Two optional parameters were also added to Frame's createView method, for horizontal and vertical
+        lock state persistence cross page loads.
 
-2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setScrollbarModes):
+        (WebCore::ScrollView::setHorizontalScrollbarMode):
+        (WebCore::ScrollView::setVerticalScrollbarMode):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::setHorizontalScrollbarLock):
+        (WebCore::ScrollView::isHorizontalScrollbarLocked):
+        (WebCore::ScrollView::setVerticalScrollbarLock):
+        (WebCore::ScrollView::isVerticalScrollbarLocked):
+        (WebCore::ScrollView::setScrollingModesLocked):
 
-        Reviewed by Eric Seidel.
+2010-04-08  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        Change EmptyPluginHalterClient in SVGImage to be non-static, to
-        match changes made http://trac.webkit.org/changeset/49385.
-        https://bugs.webkit.org/show_bug.cgi?id=30403
-
-        Run the following layout test sequence:
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
-          LayoutTests/svg/carto.net/scrollbar.svg
-          LayoutTests/svg/carto.net/selectionlist.svg
-
-        selectionlist.svg should not crash.
+        Reviewed by Simon Hausmann.
 
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+         [Qt] Remove shaderSource manipulation from GraphicsContext3DQt.cpp
+         https://bugs.webkit.org/show_bug.cgi?id=37226
 
-2009-10-16  Victor Wang  <victorw@chromium.org>
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::shaderSource):
 
-        Reviewed by David Levin.
+2010-04-07  Rodrigo Belem  <rodrigo.belem@openbossa.org>
 
-        Add beforeload event support to V8DOMWrapper
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30413
+        [Qt] The build system is not installing the generated headers (QGraphicsWebView, QWebDatabase, etc)
+        https://bugs.webkit.org/show_bug.cgi?id=37173
 
-        LayoutTests/fast/dom/beforeload/frame-before-load.html
+        This patch sets the correct path to the classheaders.pri and then
+        fixes the installation of the generated headers.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * WebCore.pro:
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+2010-04-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        MimeTypeRegistryChromium is mis-casen
-        https://bugs.webkit.org/show_bug.cgi?id=30441
-
-        Change the case of MimeTypeRegistryChromium to match other platforms.
-
-        * WebCore.gypi:
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
-        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
+        Poor rendering on lala.com with frame flattening
+        https://bugs.webkit.org/show_bug.cgi?id=37164
 
-        Reviewed by Mark Rowe.
-
-        Chrome doesn't set Content-Type for file upload when the file extension
-        is not recognized
-        https://bugs.webkit.org/show_bug.cgi?id=30433
-
-        Apparently, getMIMETypeForPath is supposed to return
-        application/octet-stream when it doesn't have a better MIME type.
+        Do not flatten offscreen iframes.
 
-        * platform/chromium/MimeTypeRegistryChromium.cpp:
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        Test: fast/frames/flattening/iframe-flattening-offscreen.html
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Pull out r49676 as it caused build breakges on Symbian
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
+        * rendering/RenderPartObject.h:
 
-        * plugins/symbian/PluginViewSymbian.cpp:
+2010-04-07  Dawit Alemayehu  <adawit@kde.org>
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Ariya Hidayat.
+        https://bugs.webkit.org/show_bug.cgi?id=36827
 
-        Crash fix when loading NPAPI plugins on Qt/Mac
+        Replaced the 'shouldTreatAsAttachment' function with a more generic 
+        function that returns the content disposition type.
 
-        There's no guarantee that the plist will be valid even if we
-        ask the plugin to create it. Crash obverved with iGetter.
+        See comments 39-42 in https://bugs.webkit.org/show_bug.cgi?id=36395
 
-        * plugins/mac/PluginPackageMac.cpp:
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::contentDispositionType):
+        * platform/network/HTTPParsers.h:
+        (WebCore::):
 
-2009-10-15  Stephen White  <senorblanco@chromium.org>
+2010-04-07  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by David Levin.
+        Reviewed by Laszlo Gombos.
 
-        Fix for Chromium/skia's implementation of canvas's isPointInPath().
-        https://bugs.webkit.org/show_bug.cgi?id=30402
+        https://bugs.webkit.org/show_bug.cgi?id=36750
 
-        Covered by LayoutTests/fast/canvas/pointInPath.html.
+        [Qt] Package build without touch support is broken
 
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::SkPathContainsPoint):
+        Use the conditional attribute instead of #ifdefs in the idl file for the
+        touch specific properties, to make the generated files compile with and
+        without the touch events enabled.
 
-2009-10-15  Adam Barth  <abarth@webkit.org>
+        * dom/Document.idl: Use conditional instead of #ifdef.
+        * dom/Element.idl: Ditto.
+        * page/DOMWindow.idl: Ditto.
 
-        Reviewed by Darin Adler.
+2010-04-07  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Factor ResourceLoadNotifier out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30379
+        Reviewed by Holger Freyther.
 
-        These methods have virtually no interaction with the rest of
-        FrameLoader.
+        Add the touch event related IDL files to the idl generation, so that
+        they can be safely included from generated JS bindings files. The
+        generated files have #ifdef feature guards.
 
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::FrameLoader::sendRemainingDelegateMessages):
-        (WebCore::FrameLoader::requestFromDelegate):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::notifier):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::receivedError):
-        * loader/ResourceLoadNotifier.cpp: Added.
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        * loader/ResourceLoadNotifier.h: Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didReceiveData):
-        (WebCore::ResourceLoader::didFinishLoadingOnePart):
-        (WebCore::ResourceLoader::didFail):
-        (WebCore::ResourceLoader::didCancel):
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
 
-2009-10-15  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
-        (https://bugs.webkit.org/show_bug.cgi?id=30427)
-        
-        Remove no longer needed methods from ChromiumDataObject.
-
-        No new tests (no functional change)
-
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-25  yael aharon  <yael.aharon@nokia.com>
 
-        Reviewed by Tor Arne Vestbø.
+        Reviewed by Laszlo Gombos.
 
-        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
-        https://bugs.webkit.org/show_bug.cgi?id=30179
+        [Qt] Windowed netscape plugins don't work with QGraphicsWebView on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=35112
 
-        Inform the application when a plugin is created or destroyed, but only if the 
-        application registered for these notifications.
+        Add a proxy widget when loading a QWidget based plugin in a QGraphicsWebView.
 
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        (PluginContainerSymbian::PluginContainerSymbian):
+        (PluginContainerSymbian::focusInEvent):
+        * plugins/symbian/PluginContainerSymbian.h:
+        (WebCore::PluginContainerSymbian::proxy):
         * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::updatePluginWidget):
         (WebCore::PluginView::platformStart):
         (WebCore::PluginView::platformDestroy):
 
-2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        Default language translation should be determined by locale settings,
-        e.g., "en-US".
-        https://bugs.webkit.org/show_bug.cgi?id=29653
-
-        Test: fast/js/navigator-language.html
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::defaultLanguage):
-
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        Crash fix when loading NPAPI plugins on Qt/Mac
-
-        There's no guarantee that the plist will be valid even if we
-        ask the plugin to create it. Crash obverved with iGetter.
-
-        * plugins/mac/PluginPackageMac.cpp:
-
-2009-10-15  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix for Chromium/skia's implementation of canvas's isPointInPath().
-        https://bugs.webkit.org/show_bug.cgi?id=30402
-
-        Covered by LayoutTests/fast/canvas/pointInPath.html.
-
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::SkPathContainsPoint):
-
-2009-10-15  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Factor ResourceLoadNotifier out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30379
-
-        These methods have virtually no interaction with the rest of
-        FrameLoader.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::FrameLoader::sendRemainingDelegateMessages):
-        (WebCore::FrameLoader::requestFromDelegate):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::notifier):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::receivedError):
-        * loader/ResourceLoadNotifier.cpp: Added.
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        * loader/ResourceLoadNotifier.h: Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didReceiveData):
-        (WebCore::ResourceLoader::didFinishLoadingOnePart):
-        (WebCore::ResourceLoader::didFail):
-        (WebCore::ResourceLoader::didCancel):
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
-
-2009-10-15  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
-        (https://bugs.webkit.org/show_bug.cgi?id=30427)
-        
-        Remove no longer needed methods from ChromiumDataObject.
-
-        No new tests (no functional change)
-
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-10-15  Daniel Bates  <dbates@webkit.org>
-
-        No review, rolling out r49644.
-        http://trac.webkit.org/changeset/49644
-        
-        We need to think about this change some more. See bug #30418 
-        for more details.
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Add SPI to determine whether a node is a halted plug-in.
-
-        Part of <rdar://problem/7273354> Halted plug-ins should restart on
-        mouseover
-
-        https://bugs.webkit.org/show_bug.cgi?id=30151
+2010-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Darin Adler.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        Initialize m_isHalted.
-
-        * plugins/PluginView.h:
-        (WebCore::PluginView::isHalted):
-        Return m_isHalted.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
-        Set m_isHalted to true.
-        (WebCore::PluginView::restart):
-        clear m_isHalted.
+        JS code generator does not support feature conditional attributes that are writable
+        https://bugs.webkit.org/show_bug.cgi?id=37149
 
-2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        [Qt] Build fix for QtWebKit after r49649.
-
-        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
-
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed - build fix.
-
-        Web Inspector: add file missing in r49648
-
-        * inspector/front-end/TestController.js: Added.
-        (WebInspector.TestController):
-        (WebInspector.TestController.prototype.waitUntilDone):
-        (WebInspector.TestController.prototype.notifyDone):
-        (WebInspector.evaluateForTestInFrontend):
-
-2009-10-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
-
-        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+        Write out the feature #ifdef not only for the getter, but also for the setter
+        function.
 
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
         * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: introduce test controller with waitUntilDone
-        on frontend side.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30400
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/TestController.js: Added.
-        (WebInspector.TestController):
-        (WebInspector.TestController.prototype.waitUntilDone):
-        (WebInspector.TestController.prototype.notifyDone):
-        (WebInspector.evaluateForTestInFrontend):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-
-2009-10-15  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27895
-        
-        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
-        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
-        the HTML Base element, HTML Object element, inline and external script tags, and
-        JavaScript multi-line variants of all of these attacks.
-
-        Tests: http/tests/security/xssAuditor/base-href-comment.html
-               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
-               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
-               http/tests/security/xssAuditor/img-onerror-comment.html
-               http/tests/security/xssAuditor/object-tag-comment.html
-               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
-               http/tests/security/xssAuditor/script-tag-comment.html
-               http/tests/security/xssAuditor/script-tag-with-source-comment.html
-
-        * page/XSSAuditor.cpp: Added constant minAttackLength.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
-        to minAttackLength of script code plus context (if any).
-        * page/XSSAuditor.h:
-
-2009-10-08  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Currently, Skia clip paths are 1-bit. This patch makes our path
-        clipping anti-aliased for non-canvas drawing.
-
-        http://code.google.com/p/chromium/issues/detail?id=5927
-        https://bugs.webkit.org/show_bug.cgi?id=28820
-        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
-
-        Already covered by layout tests. New baselines will be needed in the
-        Chromium tree.
-
-        (Reland. First landed in r49329, reverted in r49330 due to Windows
-        build break)
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::clip):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::canvasClip):
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::clipPathAntiAliased):
-        (PlatformContextSkia::restore):
-        (PlatformContextSkia::applyAntiAliasedClipPaths):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-
-2009-10-15  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
-
-        * WebCore.Video.exp: Export muted and setMute.
-
-2009-10-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Transitions fail to run sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=26770
+2010-04-06  Abhinav Mithal <abhinav.mithal@nokia.com>
 
-        Fix an issue where we could attempt to start accelerated animations or transitions on
-        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
-        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
-        software transitions.
+        Reviewed by Laszlo Gombos.
 
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
-        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
-        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
-        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
-        (WebCore::AnimationControllerPrivate::startTimeResponse):
-        * page/animation/AnimationControllerPrivate.h:
-        Make some methods non-inline for ease of debugging (these are not hot methods).
-        Rename m_waitingForAResponse to m_waitingForResponse.
-        
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::hasAncestor):
-        New method to report whether the receiver has the given layer as an ancestor. Used for checking
-        whether a layer is rooted.
+        [Qt] npapi header leaves XP_WIN flag defined even when __SYMBIAN32__ flag is found
+        https://bugs.webkit.org/show_bug.cgi?id=34614
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+        Do not define XP_WIN if WebKit is compiled for Symbian.
 
-2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+        No new tests as there is no new functionality.
 
-        Reviewed by Pavel Feldman.
+        * bridge/npapi.h:
 
-        Refactor ProfilesPanel to support multiple profile types
+2010-04-05  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Data describing different profile types are now stored in distinct objects.
-        https://bugs.webkit.org/show_bug.cgi?id=30332
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.CPUProfileView.profileCallback):
-        (WebInspector.CPUProfileView):
-        (WebInspector.CPUProfileView.prototype._sortData):
-        (WebInspector.CPUProfileType):
-        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
-        (WebInspector.CPUProfileType.prototype.get buttonStyle):
-        (WebInspector.CPUProfileType.prototype.buttonClicked):
-        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
-        (WebInspector.CPUProfile):
-        (WebInspector.CPUProfile.prototype.get title):
-        (WebInspector.CPUProfile.prototype.get uid):
-        (WebInspector.CPUProfile.prototype.get head):
-        (WebInspector.CPUProfile.prototype.createView):
-        (WebInspector.CPUProfile.prototype.viewForProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfileType):
-        (WebInspector.ProfileType.prototype.get buttonTooltip):
-        (WebInspector.ProfileType.prototype.get buttonStyle):
-        (WebInspector.ProfileType.prototype.get buttonCaption):
-        (WebInspector.ProfileType.prototype.get id):
-        (WebInspector.ProfileType.prototype.get name):
-        (WebInspector.ProfileType.prototype.buttonClicked):
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.reset):
-        (WebInspector.ProfilesPanel.prototype.registerProfileType):
-        (WebInspector.ProfilesPanel.prototype._makeKey):
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        (WebInspector.ProfilesPanel.prototype.showProfile):
-        (WebInspector.ProfilesPanel.prototype.getProfileType):
-        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
-        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
-        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
-        (WebInspector.ProfilesPanel.prototype.get searchableViews):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-        (WebInspector.documentClick.followLink):
-        (WebInspector.documentClick):
-        (WebInspector.addProfileHeader):
-        (WebInspector.setRecordingProfile):
-        (WebInspector.linkifyStringAsFragment):
-        (WebInspector.showProfileForURL):
+        [Qt] Maemo5 theme - wrong spelling
+        https://bugs.webkit.org/show_bug.cgi?id=37110
 
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+        Correcting wrong spelling in RenderThemeQt.cpp.
 
-        Reviewed by Timothy Hatcher.
+        * platform/qt/RenderThemeQt.cpp:
 
-        Web Inspector: Enable inspector layout tests.
+2010-04-01  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30014
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::evaluateForTestInFrontend):
+        [Qt] Maemo5 theme - <select multiple> custom rendering
+        https://bugs.webkit.org/show_bug.cgi?id=36369
 
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
+        Customizing rendering of <select multiple> elements in Maemo5.
 
-        Reviewed by Gustavo Noronha.
+        * platform/qt/Maemo5Webstyle.cpp:
+        (Maemo5WebStyle::drawMultipleComboButton):
+        (Maemo5WebStyle::drawSimpleComboButton):
+        (Maemo5WebStyle::getButtonImageSize):
+        (Maemo5WebStyle::findComboButton):
+        (Maemo5WebStyle::drawComplexControl):
+        * platform/qt/Maemo5Webstyle.h:
 
-        [GStreamer] READY state doesn't mean "enough data"
-        https://bugs.webkit.org/show_bug.cgi?id=30003
+2010-03-31  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        STATE_READY means MediaPlayer::HaveNothing
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::updateStates):
+        [Qt] Maemo5 theme - form controls style
+        https://bugs.webkit.org/show_bug.cgi?id=36370
 
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
+        Adjusting Mameo5 form elements rendering.
 
-        Reviewed by Gustavo Noronha.
+        * WebCore.pri:
+        * WebCore.pro:
+        * css/themeQtMaemo5.css: Added.
+        (select):
+        (select:disabled):
+        (select:active):
+        (select:active:disabled):
+        (textarea):
+        (textarea:disabled):
+        (textarea:active):
+        * platform/qt/Maemo5Webstyle.cpp: Added.
+        (Maemo5WebStyle::Maemo5WebStyle):
+        (drawRectangularControlBackgorund):
+        (Maemo5WebStyle::drawChecker):
+        (Maemo5WebStyle::findChecker):
+        (Maemo5WebStyle::drawRadio):
+        (Maemo5WebStyle::findRadio):
+        (Maemo5WebStyle::drawControl):
+        (Maemo5WebStyle::drawComplexControl):
+        * platform/qt/Maemo5Webstyle.h: Added.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::popupInternalPaddingBottom):
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * platform/qt/RenderThemeQt.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30002
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        implement cancelLoad
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::cancelLoad):
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
 
-2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
 
-        Reviewed by Gustavo Noronha.
+        No new tests as there is no new functionality.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30353
-        
-        Fix race condition, leading to a deadlock
+        * config.h:
 
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_render):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (webkit_video_sink_unlock_stop):
-        (webkit_video_sink_stop):
-        (webkit_video_sink_start):
-        (webkit_video_sink_class_init):
-        Fix race condition in unlock/render that would lead to deadlocks.
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Gustavo Noronha.
+        Consolidate the definition of SKIP_STATIC_CONSTRUCTORS_ON_GCC
 
-        https://bugs.webkit.org/show_bug.cgi?id=30374
-        
-        Check if caps are valid before parsing them
+        Instead of defining and undefining it later, let's not
+        define SKIP_STATIC_CONSTRUCTORS_ON_GCC for WINSCW.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-        Check if caps are valid before parsing them in ::naturalSize().
-        This prevents assertions if the natural size should be calculated
-        before the video caps are negotiated.
+        No new tests as there is no new functionality.
 
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
+        * config.h:
 
-        Reviewed by Gustavo Noronha.
+2010-03-30  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30006
-        [GStreamer] Unnecessary checks for Messages types in callbacks
+        Reviewed by Kenneth Rohde Christiansen.
 
-        refactored gst message callbacks into a single one
+        [Qt] Maemo5 theme - QtMaemoWebPopup class
+        https://bugs.webkit.org/show_bug.cgi?id=36790
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateMessageCallback):
-        (WebCore::do_gst_init):
-        (WebCore::MediaPlayerPrivate::duration):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Moving maemo5 theme related code from WebCore.pri to WebCore.pro and adding
+        new maemo menu lists popup class source and header to the project.
 
-2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+        The code was in .pri file because of a theme css that was conditionally included.
+        As the css file is been included unconditionally there is no need to this
+        code to be kept in webcore.pri.
 
-        Reviewed by Adele Peterson.
+        * WebCore.pri:
+        * WebCore.pro:
 
-        Anchor elements should be mouse focusable regardless isLink flag.
-        https://bugs.webkit.org/show_bug.cgi?id=26856
+2010-04-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * html/HTMLAnchorElement.cpp:
-        * html/HTMLAnchorElement.h:
+        Reviewed by Eric Seidel.
 
-2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Accept XHTML-MP content type as XHTML content
+        https://bugs.webkit.org/show_bug.cgi?id=34262
 
-        Not reviewed. Sort XCode project file.
+        Enable processing XHTML-MP mime type as an XHTML document
+        even if XHTML-MP support is not enabled.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
 
-2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+2010-04-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Dave Hyatt.
 
-        Return correct shorthand property name for 
-        background-repeat-x, background-repeat-y, background-position-x,
-        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
-        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28972
-
-        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: Migrate profiles to the injected script-based schema.
+        Fixed to the iframe flattening code so that the iframes on
+        http://www.samisite.com/test-csb2nf/id43.htm are actually
+        flattened.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+        Covered by current tests.
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
-
-2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Create and update frontend script objects only when
-        web inspector is visible.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30376
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::pruneResources):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        (WebCore::InspectorController::identifierForInitialRequest):
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
-        (WebCore::InspectorController::mainResourceFiredLoadEvent):
-        (WebCore::InspectorController::willSendRequest):
-        (WebCore::InspectorController::didReceiveResponse):
-        (WebCore::InspectorController::didReceiveContentLength):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::didFailLoading):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        (WebCore::InspectorController::scriptImported):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-
-2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Fix Windows build.
-
-        * dom/Document.idl:
-
-2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Adam Barth.
+        * page/FrameView.cpp: Propagate contents changes of iframes
+        and subframes in framesets to the parent so that it is relayouted
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::scheduleRelayout):
+        * rendering/RenderPart.cpp: HTMLIFrameElement do not inherit from
+        HTMLFrameElement, but HTMLFrameElementBase, correct cast. Correct
+        the use of inset border values. Avoid a sometimes unnecessary
+        relayout.
+        (WebCore::RenderPart::layoutWithFlattening):
+        * rendering/RenderPartObject.cpp: Make the calcHeight and calcWidth
+        return the right values, considering scrolling and fixed width/height
+        (WebCore::RenderPartObject::flattenFrame):
+        (WebCore::RenderPartObject::calcHeight):
+        (WebCore::RenderPartObject::calcWidth):
+        (WebCore::RenderPartObject::layout):
 
-        [HTML5] Add document.head
-        https://bugs.webkit.org/show_bug.cgi?id=30232
+2010-03-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Test is fast/dom/document-head.html
+        Unreviewed crash fix.
 
-        * dom/Document.idl: added readonly attribute head
+        Crash with frame flattening on after r56854
+        https://bugs.webkit.org/show_bug.cgi?id=36894
 
-2009-10-14  Matt Mueller  <mattm@chromium.org>
+        Solution tested by Greg Bolsinga, thanks.
 
-        Reviewed by Darin Adler.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::avoidScrollbarCreation):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
 
-        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
-        https://bugs.webkit.org/show_bug.cgi?id=30347
-        https://bugs.webkit.org/show_bug.cgi?id=22772
+2010-03-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+        Reviewed by Antti Koivisto.
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-2009-10-14  Adam Barth  <abarth@webkit.org>
+        Do not draw scrollbars for subframes when frame flattening is
+        enabled. Implemented using a virtual method in ScrollView as
+        suggested by Dave Hyatt.
 
-        Reviewed by Sam Weinig.
+        Do not suppress scrollbars as that is wrong according to
+        Dave Hyatt.
 
-        Move scrolling code from FrameLoader to FrameView
-        https://bugs.webkit.org/show_bug.cgi?id=30370
+        Covered by current tests.
 
-        This code is about controlling the Frame's view, not about loading
-        stuff into the frame.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-        (WebCore::FrameLoader::scrollToAnchor):
         * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToFragment):
-        (WebCore::FrameView::scrollToAnchor):
+        (WebCore::FrameView::avoidScrollbarCreation):
         * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::avoidScrollbarCreation):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::layoutWithFlattening):
 
-2009-10-14  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
-        
-        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
-
-2009-10-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        [XSSAuditor] Add an exception for local files
-        https://bugs.webkit.org/show_bug.cgi?id=30352
-
-        Reduce XSS auditor false positives by always letting pages load scripts
-        from their own host. We don't actually know of any false positives
-        that this prevents, but it seems like a good idea.
-
-        One subtly is that we don't add this exception for scripts that have a
-        query string because (1) URLs with query strings are more apt to
-        confuse servers and (2) it is much less common to load scripts with a
-        query string.
-
-        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
-               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-
-2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
-
-        Reviewed by George Staikos.
-
-        Kill virtual contextElement() method spread all over SVG code
-        https://bugs.webkit.org/show_bug.cgi?id=30183
-
-        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
-        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
-        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
-
-        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
-        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
-
-        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::::synchronize):
-        (WebCore::::startAnimation):
-        (WebCore::::stopAnimation):
-        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGCircleElement.h: Ditto.
-        * svg/SVGClipPathElement.h: Ditto.
-        * svg/SVGCursorElement.h: Ditto.
-        * svg/SVGDefsElement.h: Ditto.
-        * svg/SVGEllipseElement.h: Ditto.
-        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
-        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
-        * svg/SVGFEMergeNodeElement.h: Ditto.
-        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
-        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
-        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
-        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGForeignObjectElement.h: Ditto.
-        * svg/SVGGElement.h: Ditto.
-        * svg/SVGGradientElement.h: Ditto.
-        * svg/SVGImageElement.h: Ditto.
-        * svg/SVGLineElement.h: Ditto.
-        * svg/SVGMPathElement.h: Ditto. Fix license indention.
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGMaskElement.h: Ditto.
-        * svg/SVGPathElement.h: Ditto.
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
-        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGRectElement.h: Ditto.
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGScriptElement.h: Ditto.
-        * svg/SVGSwitchElement.h: Ditto.
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
-        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
-        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
-        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
-
-2009-10-14  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Masking with wrong offset
-        [https://bugs.webkit.org/show_bug.cgi?id=30325]
-
-        SVGMaskElement moves the mask image graphics context to the wrong location.
-        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
-        is not used in the later calculation. Fix by consistenly calculating the translation
-        offsets from the final mask destination rect.
-
-        Test: svg/custom/mask-with-default-value.svg
-
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
-
-2009-10-14  Kevin Decker  <kdecker@apple.com>
+2010-03-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Rubberstamped by Jon Honeycutt.
-        
-        Export a few more showSubstituteImage() related methods.
-        
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj:
+        Reviewed by Antti Koivisto.
 
-2009-10-14  Evan Martin  <evan@chromium.org>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Reviewed by Darin Adler.
+        Fix wrongly reversing logic in frame flattening check.
 
-        Stringify CSS units manually (without printf) to make the formatting
-        locale-insensitive and obey CSS spec with respect to large values.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=18994
+        Tests:
+        fast/frames/flattening/iframe-flattening-fixed-height.html
+        fast/frames/flattening/iframe-flattening-fixed-width.html
+        fast/frames/flattening/iframe-flattening-fixed-width-and-height.html
+        fast/frames/flattening/iframe-flattening-fixed-width-and-height-no-scrolling.html
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::appendCSSDouble):
-        (WebCore::formatWithUnits):
-        (WebCore::CSSPrimitiveValue::cssText):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
 
-2009-10-14  Mark Seaborn  <mseaborn@google.com>
+2010-03-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Check error return value in Perl build script
-        https://bugs.webkit.org/show_bug.cgi?id=30316
-
-        * css/makevalues.pl: Die if gperf fails.
-
-2009-10-14  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG wrong filterRegions for userSpaceOnUse and percentage values
-        [https://bugs.webkit.org/show_bug.cgi?id=30330]
-
-        Some clean-up of the SVG filter calculation code. This clean-up
-        also fixes the problem with percentage and userSpaceInUse mode.
-
-        Test: svg/filters/subRegion-in-userSpace.svg
-
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::FilterEffect):
-        * platform/graphics/filters/FilterEffect.h:
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::buildFilter):
-        (WebCore::SVGFilterElement::canvasResource):
-        * svg/SVGFilterElement.h:
-        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
-        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
-        * svg/graphics/SVGResourceFilter.cpp:
-        (WebCore::SVGResourceFilter::SVGResourceFilter):
-        (WebCore::SVGResourceFilter::~SVGResourceFilter):
-        (WebCore::SVGResourceFilter::addFilterEffect):
-        (WebCore::SVGResourceFilter::prepareFilter):
-        * svg/graphics/SVGResourceFilter.h:
-        (WebCore::SVGResourceFilter::create):
-        * svg/graphics/filters/SVGFilter.cpp:
-        (WebCore::SVGFilter::SVGFilter):
-        (WebCore::SVGFilter::calculateEffectSubRegion):
-        (WebCore::SVGFilter::create):
-        * svg/graphics/filters/SVGFilter.h:
-
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
-
-        The last change fixed the problem, removing diagnostic printfs.
-
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-
-2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+        tryLayoutDoingPositionedMovementOnly does not have to be in RenderObject or be virtual
+        https://bugs.webkit.org/show_bug.cgi?id=36810
 
-        CURL build fix for versions < 7.18.
+        Move tryLayoutDoingPositionedMovementOnly as a regular method of RenderBox
 
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::setDefersLoading):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::initializeHandle):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly):
+        * rendering/RenderObject.h:
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+2010-03-30  Stanislav Paltis  <Stanislav.Paltis@nokia.com>
 
-        One more round of changes to figure out why the webgl 
-        tests are crashing on the build bot. Here I am trying
-        to see if we can create a software renderer. I am also
-        printing the found pixel formats.
+        Reviewed by Laszlo Gombos.
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        [Qt] qmake/symbian build failure
+        https://bugs.webkit.org/show_bug.cgi?id=36745
 
-2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
- 
-        Reviewed by Simon Hausmann.
- 
-        Enabling NPAPI plugin support on Qt Webkit for S60 platform
-        https://bugs.webkit.org/show_bug.cgi?id=29302
+        Fix build break in Symbian build introduced in r56714,
+        by modifying comment escape character from ";" to "#".
 
-        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
-        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
-        <norbert.leser@nokia.com>
-         
         * WebCore.pro:
-        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
-        new plugin files to be compiled under symbian: macro
-
-        * bridge/npapi.h:
-        Added NPEvent and NPRegion definition for Symbian
-
-        * plugins/PluginPackage.h:
-        Added S60 specific plugin interface and plugin loader variables
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
-        Default implementation to be used only for non-symbian platform
-        * plugins/PluginDatabase.cpp:
-        Macro !SYMBIAN checking
-        * plugins/PluginView.h:
-        Add Symbian to platforms that support setNPWindowIfNeeded
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
-        call setNPWindowRect from setFrameRect
-         
-        Added folder 'symbian' which contains implementation files for S60
-        platform-specific NPAPI plugin functionality, under /plugins folder
-        * plugins/symbian
-        * plugins/symbian/npinterface.h:
-        Plugin Interface to be implemented by S60 NPAPI plugins 
-        * plugins/symbian/PluginContainerSymbian.h:
-        * plugins/symbian/PluginContainerSymbian.cpp:
-        * plugins/symbian/PluginDatabaseSymbian.cpp:
-        * plugins/symbian/PluginViewSymbian.cpp:
-        * plugins/symbian/PluginPackageSymbian.cpp:
-
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
-
-        More changes to figure out why the webgl tests are crashing on the build bot.
-
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-
-2009-10-14  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Round non-integer line height values.
-
-        Change webkit to rounding non-integer line height values
-        instead of truncating them. This fixes a layout test
-        failure on Windows and matches the calculation in IE and Firefox. 
 
-        https://bugs.webkit.org/show_bug.cgi?id=24434
-
-        Test: fast/css/line-height-rounding.html
-              fast/forms/textarea-scrollbar-height.htm
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
-        * rendering/RenderBR.cpp:
-        (WebCore::RenderBR::lineHeight):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::computedLineHeight):
-
-2009-10-13  Kelly Norton  <knorton@google.com>
-
-        Reviewed by Pavel Feldman.
-
-        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
-        interfaces to be more consistent with the JavaScript profiler.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::startTimelineProfiler):
-        (WebCore::InspectorBackend::stopTimelineProfiler):
-        (WebCore::InspectorBackend::timelineProfilerEnabled):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::startTimelineProfiler):
-        (WebCore::InspectorController::stopTimelineProfiler):
-        (WebCore::InspectorController::timelineProfilerEnabled):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
-        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.timelineProfilerWasStarted):
-        (WebInspector.timelineProfilerWasStopped):
-
-2009-10-01  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adele Peterson.
-
-        Fix crash when loading invalid image data
-        https://bugs.webkit.org/show_bug.cgi?id=29980
-
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::setImageSizeForAltText):
-
-2009-10-09  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix for NULL ptr deref in canvas's toDataURL().
-        https://bugs.webkit.org/show_bug.cgi?id=30254
-
-        Test: fast/canvas/canvas-toDataURL-crash.html
-
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::toDataURL):
-
-2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed, reverting r49558 since it broke profiler tests.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30328
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
-
-2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-29  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Simon Hausmann.
 
-        ImageDecoderQt: Minor tweaks to the decoder
-
-        - Only cache the data when we start to use it.
-        - Start with a repetition count of none for normal images.
-        - Do not use canRead as this will trigger parsing of the full image
-        - Cope with a GIF failing to decode the first frame, do not
-          set m_failed to true if decoding the first frame failed
-        - Inform the QImageReader about the format that was detected
-        - Always create a ImageDecoderQt when when we have more
-        than four byte.
-
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
-        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
-        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
-        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
-        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
-        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
-        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
-        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
-        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
-
-2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+        [Qt] Package build fixes for Symbian
 
-        Reviewed by Pavel Feldman.
+        * enable building standalone QtWebkit for Symbian using qtlibinfix configuration option
 
-        Web Inspector: Migrate profiles to the injected script-based schema.
+        qtlibinfix adds possibility having multiple versions of Qt in Symbian devices.
+        Fix also allows unfrozen DLL exports during development.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+        * Removed heap size configuration. DLLs don't have a heap.
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
-
-2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Pavel Feldman.
-
-        Don't collect call frame properties until they're needed for completion.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30334
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
-        * inspector/front-end/ScriptsPanel.js:
-
-2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29106
-        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
-
-        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
-        compiler aggressively resolve inheritance of class R.  
-        
-        The winscw compiler bug is reported at:
-        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
-        
-        The change should be reverted when the above bug is fixed in winscw compiler.
+        * Removed enforcement to def files for package builds. Instead inherit the setting from
+        Qt's qconfig.pri whether to use def files or not. It's still possible to override this
+        also at qmake time by passing CONFIG+=def_files.
 
-        * loader/CachedResourceHandle.h:
-        (WebCore::::CachedResourceHandle):
-
-2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r49554, because it broke Win and Chromium builds.
-        http://trac.webkit.org/changeset/49554
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
-
-2009-10-13  Evan Martin  <evan@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Stringify CSS units manually (without printf) to make the formatting
-        locale-insensitive and obey CSS spec with respect to large values.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=18994
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::appendCSSDouble):
-        (WebCore::formatWithUnits):
-        (WebCore::CSSPrimitiveValue::cssText):
-
-2009-10-13  Evan Martin  <evan@chromium.org>
-
-        Reviewed by David Levin.
-
-        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
-        While we're rebaselining scrollbars, fix an off by one in the vertical
-        scrollbar rendering too.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30319
-
-        Tests: this is covered by every pixel test involving scrollbars.
-
-        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
-        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
-
-2009-10-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        Fix issue where clientX and clientY on MouseEvents were wrong when
-        the page was zoomed and scrolled.
+        * WebCore.pro:
 
-        Test: fast/events/clientXY-in-zoom-and-scroll.html
+2010-03-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::contentsX): Take page zoom into account.
-        (WebCore::contentsY): Ditto.
+        Reviewed by Antti Koivisto.
 
-2009-10-13  Dave Hyatt  <hyatt@apple.com>
+        Implement flattening for iframes.
 
-        Reviewed by Adam Roben.
+        Refactoring of frameset flattening code to reuse it for
+        iframe flattening.
 
-        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
-        out into separate ones for scripts and stylesheets.
+        Tests: fast/frames/flattening/iframe-flattening-simple.html
 
         * WebCore.base.exp:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserScriptToWorld):
-        (WebCore::PageGroup::addUserStyleSheetToWorld):
-        (WebCore::PageGroup::removeUserScriptFromWorld):
-        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
-        (WebCore::PageGroup::removeUserScriptsFromWorld):
-        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userScripts):
-        (WebCore::PageGroup::userStyleSheets):
-
-2009-10-13  Evan Martin  <evan@chromium.org>
-
-        Reviewed by Dmitry Titov.
-
-        Chrome's "Skia" theme paints select controls backwards in RTL.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30320
-
-        Test: fast/text/international/bidi-menulist.html
-        (The test is about something else, but it includes RTL selects.)
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
-
-2009-10-13  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30318
-        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
-        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
-        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setFrameFlatteningEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::frameFlatteningEnabled):
+        * rendering/RenderFrame.cpp:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::flattenFrameSet):
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::layoutWithFlattening):
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
+        (WebCore::RenderPartObject::calcHeight):
+        (WebCore::RenderPartObject::calcWidth):
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderPartObject.h:
 
-        Tests:
-        Test adds event listener to a DocumentType Node which is created without a document
-        and then dispatches the event after attaching a node to the tree. Event
-        should fire when node is attached to the tree.
+2010-03-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * fast/events/add-event-without-document-expected.txt: Added.
-        * fast/events/add-event-without-document.html: Added.
+        Reviewed by David Kilzer.
 
-        All changes in files below are the same - remove the code that calls
-        EventTarget::scriptExecutionContext and checks it for NULL.
+        Guard Geolocation files with ENABLE_GEOLOCATION
+        https://bugs.webkit.org/show_bug.cgi?id=25756
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
+        The intent is to guard the Geolocation implementation files 
+        and minimize the impact on on clients/call sites.
 
-2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+        * DerivedSources.make:
+        * WebCore.Geolocation.exp: Added. Exported interfaces if GEOLOCATION
+        is enabled.
+        * WebCore.base.exp:
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame): Stub implementation if
+        GEOLOCATION is turned off.
+        (WebCore::Geolocation::Geolocation): Ditto.
+        (WebCore::Geolocation::~Geolocation): Ditto.
+        (WebCore::Geolocation::setIsAllowed): Ditto.
+        * page/Geolocation.h: 
+        * page/Geolocation.idl:
+        * page/GeolocationPositionCache.cpp:
+        * page/Geoposition.idl:
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+        * platform/mock/GeolocationServiceMock.cpp:
 
-        Reviewed by David Levin.
+2010-03-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Enable SHARED_WORKERS for Chromium
-        https://bugs.webkit.org/show_bug.cgi?id=30289
+        Reviewed by Simon Fraser.
 
-        Cleaned up bitrot in SharedWorker V8 bindings.
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
 
-        * WebCore.gypi:
-        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added V8SharedWorkerContext.cpp.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
-        * bindings/v8/V8Index.cpp:
-        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
-        * bindings/v8/V8Index.h:
-        Added definition for SHAREDWORKERCONTEXT wrapper.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        Added includes for SharedWorker.h and SharedWorkerContext.h.
-        * bindings/v8/custom/V8CustomBinding.h:
-        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
-        Also added field indexes for SharedWorkers.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        Added runtime enabler for the SharedWorker constructor.
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Cleaned up bitrot (various APIs have changed since this file was written).
-        * page/DOMWindow.idl:
-        Added EnabledAtRuntime flag to window.SharedWorker.
+        When enabling Web Widgets, add support for the view-mode media
+        feature (http://www.w3.org/TR/widgets-vmmf/).
 
-2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+        Test: fast/media/media-feature-wgt-view-mode.html
 
-        Reviewed by Brady Eidson.
+        * css/CSSValueKeywords.in:
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::view_modeMediaFeatureEval):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isDocked):
+        (WebCore::ChromeClient::isFloating):
+        (WebCore::ChromeClient::isApplication):
+        (WebCore::ChromeClient::isFullscreen):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30345
-        HTTP tests for credential handling fail on Tiger
+2010-03-29  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
-        let it do its work without intervention. Once again, we pass explicitly passed credentials
-        in URL, fixing regressions from Safari 3.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceHandle::receivedCredential):
+        [Qt] Multiselect - Adding method itemIsSelected() to QtAbstractWebPopup
+        https://bugs.webkit.org/show_bug.cgi?id=36769
 
-2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+        Adding method itemIsSelected() to QtAbstractWebPopup.
 
-        Reviewed by Adam Barth.
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::itemIsSelected):
 
-        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+2010-03-29  Dawit Alemayehu  <adawit@kde.org>
 
-        Reworked and added to the getter/setter interface in ChromiumDataObject:
-        - added contains...() methods to just query the state
-        - added containsValid...URL() methods for URL data members
-        - removed takeFileNames() as this was too type-dependent
-        - changed return type of fileNames() to Vector<String>
-        - added interface methods to allow appending to and iteration over file names
+        Reviewed by Simon Hausmann.
 
-        No new tests (no functional behavior changed).
+        Added a function, WebCore::shouldTreatAsAttachment, to HTTPParsers.*
 
-        * platform/chromium/ChromiumDataObject.h:
-        (WebCore::ChromiumDataObject::containsMainURL):
-        (WebCore::ChromiumDataObject::containsValidMainURL):
-        (WebCore::ChromiumDataObject::containsMainURLTitle):
-        (WebCore::ChromiumDataObject::containsTextPlain):
-        (WebCore::ChromiumDataObject::containsTextHTML):
-        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
-        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
-        (WebCore::ChromiumDataObject::containsContent):
-        (WebCore::ChromiumDataObject::containsContentFileExtension):
-        (WebCore::ChromiumDataObject::containsContentFileName):
-        (WebCore::ChromiumDataObject::setContentFileName):
-        (WebCore::ChromiumDataObject::containsFileNames):
-        (WebCore::ChromiumDataObject::fileNames):
-        (WebCore::ChromiumDataObject::clearFileNames):
-        (WebCore::ChromiumDataObject::countFileNames):
-        (WebCore::ChromiumDataObject::fileNameAt):
-        (WebCore::ChromiumDataObject::setFileNames):
-        (WebCore::ChromiumDataObject::appendToFileNames):
-        (WebCore::ChromiumDataObject::popFileName):
-
-2009-10-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+        https://bugs.webkit.org/show_bug.cgi?id=36395
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        This function, which was moved from WebKit/chromium/src/FrameClientImpl.cpp,
+        is used to check whether or not a request is supposed to be rendered or
+        simply downloaded based on the "Content-Disposition" header sent by the
+        web server. The intent of code refactoring is to avoid code duplication
+        so that this piece of code can be used by other implementations such as
+        QtWebKit.
 
-2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::shouldTreatAsAttachment):
+        * platform/network/HTTPParsers.h:
 
-        Reviewed by Dan Bernstein.
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Visibility:visible inside a compositing layer doesn't make the element visible
-        https://bugs.webkit.org/show_bug.cgi?id=30339
-        
-        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
-        only consulted hasVisibleContent(), which does not take into a account child layers which
-        may be visible. We also have to consult hasVisibleDescendant() as well.
+        Reviewed by nobody, build fix.
 
-        Test: compositing/compositing-visible-descendant.html
+        [Qt] Fix build break introduced in r56724.
 
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasVisibleDescendant):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * WebCore.pro:
 
-2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
-        https://bugs.webkit.org/show_bug.cgi?id=30278
-
-        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
-        from the make system into common code.
-
-        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
-        support is not enabled.
+        [Qt] Do not generate INSTALLS for webkit when building inside Qt.
+        Qt will do this for us.
 
-        Remove notImplemented() from PluginPackageNone.cpp and 
-        PluginDataNone.cpp make them just empty functions.
-
-        * GNUmakefile.am:
         * WebCore.pro:
-        * plugins/PluginDataNone.cpp:
-        (WebCore::PluginData::initPlugins):
-        (WebCore::PluginData::refresh):
-        * plugins/PluginPackageNone.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::load):
-
-2009-10-13  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30150
-        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
-
-        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
 
-        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
-        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
-        converts null strings to non-null @"".
-
-2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
-
-        Reviewed by Dimitri Glazkov.
+2010-03-29  Antti Koivisto  <koivisto@iki.fi>
 
-        window attributes (like localStorage) that are disabled at runtime are still visible
-        https://bugs.webkit.org/show_bug.cgi?id=30240
-
-        Adding codegen/bindings to support runtime disabling of attributes.
-
-        No new tests (only supported by chrome currently)
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
-        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::batchConfigureAttributes):
-        Refactored attribute setting code into a common inline routine.
-        * bindings/v8/V8Proxy.h:
-        (WebCore::configureAttribute):
-        Inline function which configures a single attribute given a BatchedAttribute struct.
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
-        * page/DOMWindow.idl:
-        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
-
-2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27457
-        Added support for static validation on type=email input elements as per
-        HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
-
-        Test: fast/forms/ValidityState-typeMismatch-email.html
-
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
-        performs validation on type=email input elements now.
-        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
-        * html/ValidityState.h:
-
-2009-10-13  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Event listeners installed on a window object returned from window.open() don't work
-        https://bugs.webkit.org/show_bug.cgi?id=28716
-
-        Tests: http/tests/security/window-events-clear-domain.html
-               http/tests/security/window-events-clear-port.html
-               http/tests/security/window-events-pass.html
-
-        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
-        window event handlers when implicitOpen is called. It is called in 2 cases - on
-        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
-
-        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
-        event handlers, to preserve the behavior of document.open().
-
-        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
-        does not remove window event handlers.
-
-        * dom/Document.h: Removed clear().
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
-        if we transition from temporary empty document to a loaded one.
-
-        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
-        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Pavel Feldman.
-
-        Fix a leak in the inspector by calling didRemoveNode with
-        an error code when it fails, instead of returning from the
-        Backend.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::removeNode):
-        * inspector/front-end/ElementsTreeOutline.js:
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
-        Web Inspector: Should be able to delete nodes from the Elements Tree.
-        
-        When the delete key is pressed and a element is selected in the tree,
-        the element should be deleted from the Elements Tree and the DOM.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::removeNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didRemoveNode):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        https://bugs.webkit.org/show_bug.cgi?id=36703
+        Timer restart loop during page loading
         
-        Set pointer-events: none on the new overlay so mouseover events are passed
-        to the resources graph so we can show timings.
+        Fix regression introduced in http://trac.webkit.org/changeset/54526. 
+        Restarting the request timer unconditionally from the timer callback is a bad idea. 
+        Instead, start the timer when a non-cached request completes.
 
-        * inspector/front-end/inspector.css:
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::nonCacheRequestComplete):
+        (WebCore::Loader::Host::servePendingRequests):
 
-2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
-        
-        This is a bug for two reasons:
-        1. Everytime we use winId(), we end up creating a native widget. This causes an
-        unnecessary copy of contents from the backing store to the native widget.
-        2. Neither windowed nor windowless plugins require the winId of the QWebView or
-        QGraphicsView.
-        
-        Introduce ownerWidget() which returns a QWidget * without creating a native widget
-        (as opposed to QWidget::find(winId)).
-
-       https://bugs.webkit.org/show_bug.cgi?id=30170
-
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepthPerComponent):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/QWebPageClient.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::setSharedXEventFields):
-        (WebCore::PluginView::initXEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-
-2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed build system fix. Typo in a filename.
-
-        * GNUmakefile.am:
-
-2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-        Alter profile link format to enable multiple profile types
-        https://bugs.webkit.org/show_bug.cgi?id=30253
-
-        The new profile URL includes the profile type along with the
-        profile title and uid.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        * inspector/front-end/inspector.js:
-        (WebInspector.documentClick.followLink):
-        (WebInspector.documentClick):
-        (WebInspector.linkifyStringAsFragment):
-
-2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Fix same-named profiles grouping in the Profiles panel.
-
-        The tree node re-parenting while adding a new group node was broken.
-         
-        https://bugs.webkit.org/show_bug.cgi?id=30299
-
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfile):
-
-2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Enforce async interaction between inspector controller and frontend.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30300
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.dispatch.delayDispatch):
-        (WebInspector.dispatch):
-
-2009-10-12  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
-        scrolled page.
-        https://bugs.webkit.org/show_bug.cgi?id=30034
-
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint): calculate the correct point 
-        relative to document when the page is zoomed and scrolled.
-        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
-        relative to document when the page is zoomed and scrolled.
-
-2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        JavaScript bindings of WebSocket addEventListener/removeEventListener
-        https://bugs.webkit.org/show_bug.cgi?id=29841
-
-        Test: fast/websockets/websocket-event-target.html
-
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * websockets/WebSocket.idl:
-
-2009-10-12  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
+        [Qt] Shadowbuilds of WebCore with Qt on Symbian fails.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
-        <rdar://problem/7288221>
+        https://bugs.webkit.org/show_bug.cgi?id=36749
 
-        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+        Doing a 'make sis' expects the dll in the libdir, so place it
+        there. This fixes out-of-source building to always put the dll
+        in the expected dir.
 
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::pruneBlacklistedCodecs):
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
+        * WebCore.pro: Fix for shadow builds inside Qt.
 
-2009-10-09  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
-        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
-        for the Objective-C wrapper class as well.
-
-        Added fast/dom/beforeload/frame-before-load.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/objc/DOMEvents.mm:
-        (kitClass):
-        * dom/BeforeLoadEvent.h:
-        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
-        * dom/Event.cpp:
-        (WebCore::Event::isBeforeLoadEvent):
-        * dom/Event.h:
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadWithDocumentLoader):
-
-2009-10-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Fix <rdar://problem/7094146> Reproducible crash at
-        RenderObject::localToAbsolute()
-
-        Test: fast/dynamic/position-absolute-to-fixed-crash.html
-
-        The crash was caused by stale positioned objects lists following an
-        object transitioning from being absolutely position to being fixed
-        positioned.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleWillChange): In case of a transition between
-        absolute and fixed position, mark the parent as having a child needing
-        layout, so that this object will get inserted into its new container's
-        positioned objects list.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
-        this transition, so that this object gets removed from its current
-        container's positioned objects list.
-
-2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add a palette() method that is needed by our RenderTheme.
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-12  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Gradients can't handle percentage values in userSpaceOnUse mode
-        [https://bugs.webkit.org/show_bug.cgi?id=30286]
-
-        Fixed *GradientAttributes to take SVGLength instead of double. This casues
-        the problem, that we can't calculate the correct size of a gradient on
-        userSpaceOnUse mode with percentage values.
-
-        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
-
-        * svg/LinearGradientAttributes.h:
-        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
-        (WebCore::LinearGradientAttributes::x1):
-        (WebCore::LinearGradientAttributes::y1):
-        (WebCore::LinearGradientAttributes::x2):
-        (WebCore::LinearGradientAttributes::y2):
-        (WebCore::LinearGradientAttributes::setX1):
-        (WebCore::LinearGradientAttributes::setY1):
-        (WebCore::LinearGradientAttributes::setX2):
-        (WebCore::LinearGradientAttributes::setY2):
-        * svg/RadialGradientAttributes.h:
-        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
-        (WebCore::RadialGradientAttributes::cx):
-        (WebCore::RadialGradientAttributes::cy):
-        (WebCore::RadialGradientAttributes::r):
-        (WebCore::RadialGradientAttributes::fx):
-        (WebCore::RadialGradientAttributes::fy):
-        (WebCore::RadialGradientAttributes::setCx):
-        (WebCore::RadialGradientAttributes::setCy):
-        (WebCore::RadialGradientAttributes::setR):
-        (WebCore::RadialGradientAttributes::setFx):
-        (WebCore::RadialGradientAttributes::setFy):
-        * svg/SVGLinearGradientElement.cpp:
-        (WebCore::SVGLinearGradientElement::buildGradient):
-        (WebCore::SVGLinearGradientElement::collectGradientProperties):
-        * svg/SVGRadialGradientElement.cpp:
-        (WebCore::SVGRadialGradientElement::buildGradient):
-        (WebCore::SVGRadialGradientElement::collectGradientProperties):
-
-2009-10-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30315>.
-        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
-        
-        Add tooltip text to the Load event and DOM Content event lines through
-        a new layer that allows these lines to be on top of the view.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
-        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
-        * inspector/front-end/inspector.css:
-
-2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r49429, because it broke layout tests.
-        http://trac.webkit.org/changeset/49429
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-
-2009-10-12  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        SVG - crash on feMerge when input not available
-        [https://bugs.webkit.org/show_bug.cgi?id=30297]
-
-        Make a early return in SVGFEMergeElement if the needed
-        filter effect doesn't exist.
-
-        Test: svg/filters/feMerge-wrong-input.svg
-
-        * svg/SVGFEMergeElement.cpp:
-        (WebCore::SVGFEMergeElement::build):
-
-2009-10-12  Chris Marrin  <cmarrin@apple.com>
+        [Qt] Make it possible to build using both Windows and Linux for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=36748
 
-        Reviewed by Oliver Hunt.
-
-        Added automatic flush before compositing
-        https://bugs.webkit.org/show_bug.cgi?id=30236
-
-        This causes image to always render correctly. In writing a testcase
-        I needed to implement readPixels. This exposed a bug in reading back
-        values from a CanvasArray subclass, so I fixed that as well. Now when
-        you wrap a CanvasArray in a JSValue it actually wraps the specific
-        subclass. To do this I need to add virtual methods to each CanvasArray
-        subclass to determine the type and a custom toJS method for CanvasArray
-        to create the proper wrapper. 
-
-        Test: fast/canvas/webgl/triangle.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasArrayCustom.cpp:
-        (WebCore::toJS):
-        * html/canvas/CanvasArray.h:
-        (WebCore::CanvasArray::isByteArray):
-        (WebCore::CanvasArray::isUnsignedByteArray):
-        (WebCore::CanvasArray::isShortArray):
-        (WebCore::CanvasArray::isUnsignedShortArray):
-        (WebCore::CanvasArray::isIntArray):
-        (WebCore::CanvasArray::isUnsignedIntArray):
-        (WebCore::CanvasArray::isFloatArray):
-        * html/canvas/CanvasArray.idl:
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::isByteArray):
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::isFloatArray):
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::isIntArray):
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::readPixels):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::isShortArray):
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::readPixels):
+        * WebCore.pro: don't assume Windows buildsystem is the only one
+        and exclude the windows-only setters from the linux builds.
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30307
-        
-        Fix 0 sentinel for g_object_set() function call.
-
-        * platform/graphics/gtk/DataSourceGStreamer.cpp:
-        (webkit_data_src_uri_set_uri):
-        0 is passed as 32 bit value on x86-64 in vararg functions, but
-        g_object_set() expects a 64 bit 0. This will cause crashes.
-
-2009-10-12  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Drop in="" from <feFlood>
-        https://bugs.webkit.org/show_bug.cgi?id=29001
-
-        This makes <feFlood in="bogus"> have an effect, too.
-
-        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
-
-        Test: svg/dom/feFlood-no-in1.html
-
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFEFloodElement.h:
-        * svg/SVGFEFloodElement.idl:
-        * svg/graphics/filters/SVGFEFlood.cpp:
-        (WebCore::FEFlood::FEFlood):
-        (WebCore::FEFlood::create):
-        * svg/graphics/filters/SVGFEFlood.h:
+        Reviewed by Simon Hausmann.
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=36745
 
-        Reviewed by Gustavo Noronha.
+        [Qt] Fix def file builds with Qt 4.7.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29998
-        
-        Scale video to completely fill the target surface while
-        keeping the aspect ratio. This fixes displaying of the
-        YouTube HTML5 sample website.
+        Switched to using DEF_FILE, which is the official variable.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Scale video to completely fill the target surface, keep
-        the aspect ratio and center it.
+        * WebCore.pro: Use DEF_FILE
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+2010-03-28  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29997
-        
-        Fixes double memcpy of all rendered video frames.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateRepaintCallback):
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::duration):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_dispose):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (marshal_VOID__MINIOBJECT):
-        (webkit_video_sink_class_init):
-        (webkit_video_sink_new):
-        * platform/graphics/gtk/VideoSinkGStreamer.h:
-        Directly pass the buffers up to the MediaPlayerPrivate::paint()
-        method instead of rendering them first to an intermediate cairo
-        surface. This should increase performance and peak memory usage.
-
-2009-10-11  Daniel Bates  <dbates@webkit.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Adam Barth.
+        [Qt] GraphicsLayer: Timing functions don't work with transitions
+        https://bugs.webkit.org/show_bug.cgi?id=36589
 
-        https://bugs.webkit.org/show_bug.cgi?id=30242
-        
-        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
-        bypass the XSSAuditor.
+        If the animation value doesn't have timing function set, we need to
+        use the animation's timing function.
         
-        JavaScript URLs that are completed by method Document::completeURL have added
-        URL-encoded characters such that a direct comparison with the URL-decoded 
-        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
-        HTTP parameters must be URL-decoded before comparison.
-
-        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
-               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
-               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
-
-        * bindings/ScriptControllerBase.cpp:
-        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
-        the URL-decoded source code for the JavaScript URL.
-        * page/XSSAuditor.cpp:
-        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
-        parameter decodeURLEscapeSequencesTwice.
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::decodeURL): Ditto.
-        (WebCore::XSSAuditor::findInRequest): Ditto.
-        * page/XSSAuditor.h:
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
-
-2009-10-11  Dominic Cooney  <dominicc@google.com>
-
-        Reviewed by Adam Barth.
-
-        Fixes a build break in the V8 bindings caused by revision 49420.
-        https://bugs.webkit.org/show_bug.cgi?id=30294
+        Fixed also a bug in passing the duration to solveCubicBezierFunction.
+        The duration was divided two times by 1000 and meanwhile casted to int.
+        It needs to be kept as double and divided by 1000 only once.
 
-        Revision 49420 introduces an IDL-defined CanvasActiveInfo
-        type. This causes a build break in the V8 bindings where
-        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
-        non-ref type.
+        Test case: https://bugs.webkit.org/attachment.cgi?id=51619
 
-        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
-        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
-          ptr type.
-        * bindings/v8/DOMObjectsInclude.h: Include generated
-          CanvasActiveInfo files.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-10-11  Collin Jackson  <collinj@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Log mixed content warnings to console
-
-        https://bugs.webkit.org/show_bug.cgi?id=30290
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
-        (WebCore::FrameLoader::checkIfRunInsecureContent):
-
-2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
-        https://bugs.webkit.org/show_bug.cgi?id=30250
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-
-2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
-
-        https://bugs.webkit.org/show_bug.cgi?id=30244
-
-        This change requires no test case as it fix a compiling error.
-
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::applyTimingFunction):
+        (WebCore::AnimationQt:::AnimationQtBase):
+        (WebCore::AnimationQt::updateCurrentTime):
 
-2009-10-11  Dominic Cooney  <dominicc@google.com>
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Adam Barth.
-
-        Sets a 500K stack limit for JavaScript workers in Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=29797
-
-        Runaway recursion in JavaScript workers crashes the Chromium
-        worker process on OS X. This is because V8's default stack limit
-        is 512K on ia32 or 1M on x64, but the worker process runs workers
-        on a thread with the OS X default stack size--512K. Because there
-        are already some C+frames on the stack when V8 establishes its
-        512K default stack limit, and V8 doesn't precisely enforce the
-        stack limit, runaway recursion in V8 workers overflows the OS
-        stack and segfaults, killing the worker process. This is described
-        in Chromium bug 21653 <http://crbug.com/21653>.
-
-        This patch sets the V8 stack limit for worker JavaScript in
-        Chromium to a more conservative 500K on all platforms. This allows
-        some "headroom" for the C+stack in use when the limit is set up,
-        and some "legroom" for the V8 helper functions which in practice
-        briefly flout the V8 stack limit.
-
-        Test: LayoutTests/fast/workers/use-machine-stack.html
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-
-2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for wxMac 2.9, use wxGC API for measuring text.
-
-        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
-        (GetTextExtent):
-
-2009-10-10  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Sam Weinig.
-
-        Allow [Reflect] on SVG elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28936
-
-        Update the JS binding generators to reference SVGNames instead of
-        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
-        SVGElement::id use [Reflect].
-
-        Also make [Reflect] on an attribute with a setter exception work in ObjC
-        bindings.
-
-        Test: svg/dom/id-reflect.html
-
-        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
-        appropriate C+namespace for attribute name constants.
-        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
-        code for [Reflect] on an attribute with a setter exception.
-        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
-        "HTMLNames" when appropriate.
-        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
-        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
-        * svg/SVGElement.cpp: Remove getter and setter methods for id.
-        * svg/SVGElement.h: Ditto.
-        * svg/SVGElement.idl: Add [Reflect] to id.
-
-2009-10-10  Oliver Hunt  <oliver@apple.com>
-
-        Fix paths in xcode.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-10-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Eric Carlson.
-
-        Implement getActiveAttrib and getActiveUniform
-        https://bugs.webkit.org/show_bug.cgi?id=30276
-
-        Implements the getActiveAttrib and getActiveUniform APIs.
-        Rather simple patch, adds CanvasActiveInfo definition and implementation
-        and adds forwarding to the GraphicsContext3D.
-
-        Test: fast/canvas/webgl/getActiveTest.html
-
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/canvas/CanvasActiveInfo.h: Added.
-        (WebCore::CanvasActiveInfo::create):
-        (WebCore::CanvasActiveInfo::name):
-        (WebCore::CanvasActiveInfo::type):
-        (WebCore::CanvasActiveInfo::size):
-        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
-        * html/canvas/CanvasActiveInfo.idl: Added.
-        * html/canvas/CanvasObject.h:
-        (WebCore::CanvasObject::context):
-          Need to make the context public as it is needed to ensure we don't
-          provide a program from one context as an argument to another.
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
-        (WebCore::CanvasRenderingContext3D::getActiveUniform):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::getActiveAttrib):
-        (WebCore::GraphicsContext3D::getActiveUniform):
-
-2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Web Inspector: Adding new attributes in Element Panel is
-        counterintuitive.
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
 
-        https://bugs.webkit.org/show_bug.cgi?id=30057
+        No new tests as there is no new functionality.
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
-        (WebInspector.ElementsTreeElement.prototype.set hovered):
-        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+        * WebCore.pri: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
 
-2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Laszlo Gombos.
 
-        Build fix if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=30275
+        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
+        https://bugs.webkit.org/show_bug.cgi?id=34081
 
-        In addition to fixing the build break with guards
-        remove notImplemented() from PluginViewNone.cpp and
-        make them just just be empty functions.
+        Defining StringImpl instances as globals will cause a crash on process exit as 
+        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
+        constructing one exiting thread.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::handlePostReadFile):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::updatePluginWidget):
+        * config.h:
 
-2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Unreviewed.
+        Reviewed by Simon Hausmann.
 
-        [Qt] Build fix for QtWebKit after r49415.
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
 
-        Add HistoryController.cpp to the build.
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
 
         * WebCore.pro:
 
-2009-10-09  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
-        https://bugs.webkit.org/show_bug.cgi?id=30262
-
-        This is not testable from WebKit since WebKit never uses the member
-        function form of protocolIs with input that can be controlled from a
-        web page.  It always passes string literals lacking hyphens.
-
-        * platform/KURLGoogle.cpp:
-        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
-        transform the input character.
-
-2009-10-10  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Move HistoryController to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=30272
-
-        Purely mechanical.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/HistoryController.cpp: Added.
-        * loader/HistoryController.h: Added.
-
-2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        ApplyStyleCommand removes presentational tags even when not necessary
-        https://bugs.webkit.org/show_bug.cgi?id=28091
-
-        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
-        (triggering removal of tag) only if the style implicitly added by the element is not present in
-        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
-        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
-        style span when the style attribute is empty.
-
-        Test: editing/execCommand/toggle-style-3.html
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
-        decoration is not present in the style to apply
-        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
-        returns true if the tag is used in new style
-        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
-        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
-        with the surrounding identical elements
-        * editing/ApplyStyleCommand.h:
-
-2009-10-09  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Factor HistoryController out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30246
-
-        HistoryController is in charge of managing the current / previous /
-        provisional HistoryItems.  The split isn't perfect, but it's a place to
-        start.  I'll move HistoryController into its own file in another patch.
-
-        * WebCore.base.exp:
-        * loader/FrameLoader.cpp:
-        (WebCore::HistoryController::HistoryController):
-        (WebCore::HistoryController::~HistoryController):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::closeURL):
-        (WebCore::FrameLoader::begin):
-        (WebCore::HistoryController::restoreDocumentState):
-        (WebCore::HistoryController::setCurrentItem):
-        (WebCore::HistoryController::setProvisionalItem):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::FrameLoader::scrollToAnchor):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
-        (WebCore::FrameLoader::didFirstLayout):
-        (WebCore::HistoryController::updateForFrameLoadCompleted):
-        (WebCore::FrameLoader::frameLoadCompleted):
-        (WebCore::FrameLoader::detachFromParent):
-        (WebCore::FrameLoader::receivedMainResourceError):
-        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
-        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
-        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
-        (WebCore::HistoryController::createHistoryItem):
-        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
-        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
-        (WebCore::HistoryController::createHistoryItemTree):
-        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
-        (WebCore::HistoryController::restoreScrollPositionAndViewState):
-        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
-        (WebCore::HistoryController::saveDocumentState):
-        (WebCore::FrameLoader::loadItem):
-        (WebCore::HistoryController::urlsMatchItem):
-        (WebCore::HistoryController::goToItem):
-        (WebCore::HistoryController::recursiveGoToItem):
-        (WebCore::HistoryController::childFramesMatchItem):
-        (WebCore::HistoryController::updateForStandardLoad):
-        (WebCore::HistoryController::updateForClientRedirect):
-        (WebCore::HistoryController::updateForBackForwardNavigation):
-        (WebCore::HistoryController::updateForReload):
-        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
-        (WebCore::HistoryController::updateForCommit):
-        (WebCore::HistoryController::updateForAnchorScroll):
-        (WebCore::HistoryController::saveDocumentAndScrollState):
-        (WebCore::HistoryController::setCurrentItemTitle):
-        (WebCore::FrameLoader::didChangeTitle):
-        * loader/FrameLoader.h:
-        (WebCore::HistoryController::current):
-        (WebCore::HistoryController::provisional):
-        (WebCore::FrameLoader::policyChecker):
-        (WebCore::FrameLoader::history):
-        (WebCore::FrameLoader::creatingInitialEmptyDocument):
-        * page/Page.cpp:
-        (WebCore::Page::goToItem):
-
-2009-10-09  Alexey Proskuryakov  <ap@apple.com>
-
-        Unreviewed - fixing an obvious typo in my previous check-in.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30260
-        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
-
-        Fixes existing tests (which I thought I had run the previous time).
-
-        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
-        set by reference.
-
-2009-10-09  David Levin  <levin@chromium.org>
+2010-03-25  Jakub Wieczorek  <jwieczorek@webkit.org>
 
         Reviewed by Eric Seidel.
 
-        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
-        https://bugs.webkit.org/show_bug.cgi?id=30264
-
-        The base class method changed in r48884.
-
-        Test: fast/worker/worker-script-error.html
+        [Qt] RenderTheme: fix size adjustment for text fields
+        https://bugs.webkit.org/show_bug.cgi?id=36413
 
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        * bindings/v8/V8WorkerContextEventListener.h:
-
-2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+        To match other ports, remove the hardcoded dimensions for text fields so that
+        the default ones from WebCore can be used.
+        Properly apply the correct padding to text areas - this fixes their appearance
+        with the Oxygen style.
 
-        Reviewed by Brady Eidson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30260
-        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
-
-        Tests: http/tests/xmlhttprequest/logout.html
-               http/tests/xmlhttprequest/re-login-async.html
-               http/tests/xmlhttprequest/re-login.html
-
-        Fix several issues with existing credential handling code.
-
-        * platform/network/CredentialStorage.cpp:
-        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
-        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
-        want to iterate paths for origins that never had credentials associated with them. Changed
-        to use a separate HashSet for this.
-        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
-        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
-        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
-        is now PathToDefaultProtectionSpaceMap.
-        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
-        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
-        (WebCore::CredentialStorage::set): Updated for above changes.
-        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
-        a prefix in OriginToDefaultBasicCredentialMap.
-        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
-        URL default protection space. It does nothing if the given URL doesn't correspond to a known
-        protection space.
-        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
-
-        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
-        protection space and those that deduce one from URL more clear.
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
-        This makes the following pattern work:
-          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
-          req.send("");
-          req.abort();
-        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
-        Note that one cannot log in using the same method, because there isn't a known protection
-        space for the URL yet in that case, so the added code has no effect.
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
-        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
-        course), and matches sync case.
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
-        Renamed getDefaultAuthenticationCredential() to get().
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::WebCoreSynchronousLoader::load):
-        Same changes as in Mac code.
-
-2009-10-09  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Undoing a indent removes text instead of it's formatting.
-        <rdar://problem/7169206>
-        https://bugs.webkit.org/show_bug.cgi?id=28722
-        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
-        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
-        
-        Added editing/undo/undo-indent.html test.
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
-        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
-        ensure TextIterator could correctly calculate the position starting from the index.
-        * editing/IndentOutdentCommand.h: Restored.
-
-2009-10-09  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Darin Adler.
-        
-        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
-        https://bugs.webkit.org/show_bug.cgi?id=30186
-
-        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
-        detect no-ops and return this instead of creating a new instance.
-        Empirical testing shows that the majority of calls to these methods are no-ops, making
-        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
-        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::lower):
-        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
-        (WebCore::StringImpl::stripWhiteSpace):
-        (WebCore::StringImpl::simplifyWhiteSpace):
-
-2009-10-09  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
 
-        SVG Filter feGaussianBlur implementation is missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+2010-03-26  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        This is the implementation of GaussianBlur filter for SVG.
+        Reviewed by Laszlo Gombos.
 
-        There is already a test for feGaussianBlur
-        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+        [Qt] fast/canvas/drawImage-with-negative-source-destination.html failed
+        https://bugs.webkit.org/show_bug.cgi?id=35005
 
-        Test: svg/filters/feGaussianBlur.svg
+        To support negative width or height at context.drawImage
 
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::FilterEffect):
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::isAlphaImage):
-        (WebCore::FilterEffect::setIsAlphaImage):
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::apply):
-        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
-        (WebCore::boxBlur):
-        (WebCore::FEGaussianBlur::apply):
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
 
-2009-10-09  Philippe Normand  <pnormand@igalia.com>
+2010-03-24  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Gustavo Noronha.
+        Unreviewed, Chromium test fix.
 
-        [GTK] QoS support in the video sink
-        https://bugs.webkit.org/show_bug.cgi?id=29959
+        Recent r56445 added CustomEvent and a test but it didn't work on Chromium bots.
+        Test crashed due to infinte recursion because the compiler did not have the right definition of toV8(CustomEvent*)
+        and was substituting toV8(Event*).
 
-        Removed the async buffer queue from the sink. Synchronize the
-        render method of the sink using a g_timeout_add() combined with a
-        gcond triggered when the buffer has been rendered.
-        Also fixed the video sink reference handling in the player, now
-        that the idle is not there anymore to mess up things.
+        Fixing test fast/events/custom-event.html
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_init):
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_render):
-        (webkit_video_sink_dispose):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (webkit_video_sink_stop):
-        (webkit_video_sink_class_init):
+        * bindings/v8/custom/V8EventCustom.cpp:
 
-2009-10-09  Dirk Schulze  <krit@webkit.org>
+2010-03-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Nikolas Zimmermann.
+        Reviewed by Antti Koivisto.
 
-        feMorphology filter is not implemented
-        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+        Add support for DOM Level 3 Custom Event
+        http://www.w3.org/TR/DOM-Level-3-Events
 
-        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
-        with the attribute "operator". It was only accessible via "_operator" 
-        on JavaScript.
+        V8 Generator change by Nate Chapin <japhet@chromium.org>, Thanks!
 
-        Test: svg/dom/operatorAttribute.xhtml
+        Test: fast/events/custom-event.html
 
         * DerivedSources.cpp:
-        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.SVG.Filters.exp:
         * WebCore.gypi:
+        * WebCore.pri:
         * WebCore.pro:
+        * WebCore/DerivedSources.make:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/objc/DOM.mm:
-        (WebCore::createElementClassMap):
-        * bindings/objc/DOMSVG.h:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
         * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * page/DOMWindow.idl:
-        * svg/SVGAllInOne.cpp:
-        * svg/SVGFECompositeElement.idl:
-        * svg/SVGFEMorphologyElement.cpp: Added.
-        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
-        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
-        (WebCore::SVGFEMorphologyElement::setRadius):
-        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
-        (WebCore::SVGFEMorphologyElement::build):
-        * svg/SVGFEMorphologyElement.h: Added.
-        * svg/SVGFEMorphologyElement.idl: Added.
-        * svg/graphics/filters/SVGFEMorphology.cpp:
-        (WebCore::operator<<):
-        * svg/graphics/filters/SVGFEMorphology.h:
-        (WebCore::):
-        * svg/svgtags.in:
-
-2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix Chromium breakage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30104
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * dom/CustomEvent.cpp: Added.
+        (WebCore::CustomEvent::CustomEvent):
+        (WebCore::CustomEvent::initCustomEvent):
+        (WebCore::CustomEvent::isCustomEvent):
+        * dom/CustomEvent.h: Added.
+        (WebCore::CustomEvent::create):
+        (WebCore::CustomEvent::detail):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isCustomEvent):
+        * dom/Event.h:
 
-2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
+2010-03-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
-
-        https://bugs.webkit.org/show_bug.cgi?id=30023
+        Add a way to check if the page client is making use of
+        a QWidget.
 
         * platform/qt/QWebPageClient.h:
+        (QWebPageClient::isQWidgetClient):
 
-2009-10-08  Dave Hyatt  <hyatt@apple.com>
+2010-03-25  Antti Koivisto  <koivisto@iki.fi>
 
-        Reviewed by Darin Adler.
-
-        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
-        ImageEventSender that can be used by both load and beforeload events.  If the document has any
-        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
-        and will be held up until the beforeload event can fire at a later date.
-
-        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
-        in the typical parsing case we don't have to put off the beforeload/load events until after
-        a layout or paint might already have happened.  This lets beforeload/load not cause extra
-        layouts and repaints.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::addListenerTypeIfNeeded):
-        * dom/Document.h:
-        (WebCore::Document::):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::write):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::attach):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::attach):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
-        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
-        (WebCore::beforeLoadEventSender):
-        (WebCore::ImageLoader::ImageLoader):
-        (WebCore::ImageLoader::~ImageLoader):
-        (WebCore::ImageLoader::setImage):
-        (WebCore::ImageLoader::setLoadingImage):
-        (WebCore::ImageLoader::updateFromElement):
-        (WebCore::ImageLoader::notifyFinished):
-        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
-        (WebCore::ImageLoader::dispatchPendingEvents):
-        (WebCore::ImageEventSender::ImageEventSender):
-        (WebCore::ImageEventSender::dispatchEventSoon):
-        (WebCore::ImageEventSender::cancelEvent):
-        (WebCore::ImageEventSender::dispatchPendingEvents):
-        (WebCore::ImageEventSender::timerFired):
-        * loader/ImageLoader.h:
-        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
-        * wml/WMLImageElement.cpp:
-        (WebCore::WMLImageElement::attach):
-
-2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30174
-
-        No tests due to no Script* test infrastructure.
-
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        https://bugs.webkit.org/show_bug.cgi?id=36316
+        Tiles of selected content do not update if not in viewport
         
-        'client' is 0 when we have no view.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30251
+        Don't clip repaints to viewport when tiling is enabled.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        (WebCore::Frame::setTiledBackingStoreEnabled):
 
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Plugins : Add missing setCurrentPlugin(0)
+        [Qt] Implement ChromeClient::windowResizerRect()
 
-        https://bugs.webkit.org/show_bug.cgi?id=30248
+        https://bugs.webkit.org/show_bug.cgi?id=21300
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
+        The helper function geometryRelativeToOwnerWidget() in the page
+        client is used to clip the resize rect to the actual size of the
+        viewport, not the size of the QGraphicsView.
 
-2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+        * platform/qt/QWebPageClient.h:
+
+2010-03-26  Olivier Goffart  <ogoffart@trolltech.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] beforeload event does not fire on script elements in XML
-        https://bugs.webkit.org/show_bug.cgi?id=30235
+        [Qt] Fix compilation on Windows
 
-        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
-        made in XMLTokenizerLibxml2.cpp.
+        For some reason, the MSVC compiler choose the
+        operator+(const QString &, const QString &) instead of
+        operator+(const WebCore::String &, const WebCore::String &)
+        resulting in errors when QT_USE_FAST_OPERATOR_PLUS is used.
 
         * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-
-2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Allow custom memory allocation control for WebCore's CSSParserValueList
-        https://bugs.webkit.org/show_bug.cgi?id=30249
-
-        Inherits CSSParserValueList class from FastAllocBase because it has 
-        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+        (WebCore::handleElementNamespaces):
 
-        * css/CSSParserValues.h:
+2010-03-25  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Simon Hausmann.
+        Missing forward ENABLE_DATALIST macro to JavaScript enabled features macros
+        on WebKit.pri
 
-        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+        [Qt] Forward ENABLE_DATALIST macro to JavaScript enabled macros
+        https://bugs.webkit.org/show_bug.cgi?id=36547
 
-        https://bugs.webkit.org/show_bug.cgi?id=30214
+        * WebCore.pri:
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
+2010-03-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
-2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
-        for the existence of a PluginHalterDelegate.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        This fixes a leak of WebPluginHalterClients:
-        https://bugs.webkit.org/show_bug.cgi?id=30119.
+        [Qt] Fix the package build on Maemo 5
 
-        Reviewed by Dan Bernstein.
+        https://bugs.webkit.org/show_bug.cgi?id=36607
 
-        * WebCore.base.exp:
-        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+        Always embed the stylesheet for the no-listbox rendering. This way it'll be
+        included in the generated files for the package generation.
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyPluginHalterClient::enabled):
+        * WebCore.pri:
 
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Remove initialization of m_pluginHalterClient, which was removed. If a
-        non-null PluginHalterClient was passed, create the PluginHalter, and
-        set its allowed run time.
+2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
 
-        * page/Page.h:
-        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+        Reviewed by Simon Hausmann.
 
-        * page/PluginHalter.cpp:
-        (WebCore::PluginHalter::didStartPlugin):
-        Check whether the PluginHalterClient is enabled.
-        (WebCore::PluginHalter::didStopPlugin):
-        Ditto.
+        [Qt] Support for QT_LIBINFIX in Symbian builds
 
-        * page/PluginHalter.h:
-        Made m_client an OwnPtr.
+        Configuring Qt with -qtlibinfix parameter will enable installing
+        an alternate version of Qt on devices that already have it on ROM.
+        This patch provides support for infixed builds of Webkit.
 
-        * page/PluginHalterClient.h:
-        Added a function to return the enabled state.
+        * WebCore.pro:
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        Remove initialization of removed member.
+2010-03-24  Kent Tamura  <tkent@chromium.org>
 
-        * page/Settings.h:
-        Removed settings for the enabled state of the PluginHalter; we now use
-        the existence of a WebPluginHalterDelegate to determine whether the
-        PluginHalter is enabled.
+        Reviewed by Darin Adler.
 
-2009-10-08  Adam Barth  <abarth@webkit.org>
+        Make Icon::createIconForFiles() optional.
+        https://bugs.webkit.org/show_bug.cgi?id=35072
+
+        r54923 made Icon::createIconForFiles() deprecated. However moving
+        existing icon loading code to outside of WebCore is not good.  So,
+        we assume:
+        - ChromeClient::chooseIconForFiles(), renamed from iconForFiles(), is
+          the primary API to load icons.
+        - Icon::createIconForFiles() is an optional API to help
+          implementing ChromeClient::iconForFiles().
+
+        This patch removes a call to Icon::createIconForFiles() from
+        FileChooser::loadIcon(), and ChromeClient::chooseIconForFiles() of
+        non-Chromium ports calls Icon::createIconForFiles().
+
+        * WebCore.base.exp: Export FileChooser::iconLoaded(),
+          Icon::createIconForFiles(), and Icon::~Icon().
+        * WebCore.xcodeproj/project.pbxproj: Export Icon.h
+        * loader/EmptyClient.h: Rename iconForFiles() to chooseIconForFiles().
+        * page/Chrome.cpp: ditto.
+        * page/Chrome.h: ditto.
+        * page/ChromeClient.h: ditto.
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::loadIcon):
+        * platform/graphics/Icon.h: Remove a comment on createIconForFiles().
+        * platform/graphics/chromium/IconChromiumLinux.cpp: Remove createIconForFiles().
+        * platform/graphics/chromium/IconChromiumMac.cpp: ditto.
+        * platform/graphics/chromium/IconChromiumWin.cpp: ditto.
+        * rendering/RenderFileUploadControl.cpp: Rename iconForFiles() to chooseIconForFiles().
+        * rendering/RenderFileUploadControl.h: ditto.
 
-        Reviewed by Eric Seidel.
+2010-03-23  Dan Bernstein  <mitz@apple.com>
 
-        Move executeScript from FrameLoader to ScriptController
-        https://bugs.webkit.org/show_bug.cgi?id=30200
+        Fixed typos.
 
-        These methods have virtually no interaction with FrameLoader.  They
-        really seem like they ought to belong to ScriptController.
+        * manual-tests/plugin-visible-rect-change.html:
 
-        * WebCore.base.exp:
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::executeScript):
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::executeScript):
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-        * bindings/v8/ScriptController.h:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptExecution):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected):
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::replaceDocument):
-        * loader/FrameLoader.h:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
+2010-03-23  Dan Bernstein  <mitz@apple.com>
 
-2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by John Sullivan.
 
-        Windows build fix: added missing #include.
+        WebCore part of
+        <rdar://problem/7197736> Plug-in clip rect does not update when overflow
+        clip changes
+        https://bugs.webkit.org/show_bug.cgi?id=36479.
 
-        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+        * manual-tests/plugin-visible-rect-change.html: Added.
+        * platform/mac/WidgetMac.mm:
+        (WebCore::WidgetPrivate::WidgetPrivate): Added previousVisibleRect.
+        (WebCore::Widget::setFrameRect): If the visible rect changed but the
+        frame rect did not, send a -visibleRectDidChange message to the view,
+        if it responds to it.
+        (WebCore::Widget::releasePlatformWidget): Reset previousVisibleRect.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry): Track changes to the clip rect
+        imposed by the enclosing layer. Call Widget::setFrameRect when it changes,
+        even if the frame rect did not.
+        * rendering/RenderWidget.h:
+        (WebCore::RenderWidget::windowClipRect): Added this accessor.
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+2010-03-23  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dan Bernstein.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
-        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        Assertion ASSERTION FAILED: rootLayer == m_clipRectsRoot at hulu.com
+        https://bugs.webkit.org/show_bug.cgi?id=34065
         
-        Make sure to call update script object if we have an InspectorFrontend to
-        call it on when we get one of the new events.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
-        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        Fix another cause of assertions related to the clip rects root. Embeds
+        with zero size caused the overlap testing to fail, yet we require them to work
+        for correct compositing, so when the composited bounds is empty, use a 1x1 rect
+        for overlap testing.
 
-2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+        Test: compositing/geometry/empty-embed-rects.html
 
-        Build fix: updated for removal of Structure::markAggregate().
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::markChildren):
+2010-03-23  David Levin  <levin@chromium.org>
 
-2009-10-08  Jens Alfke  <snej@chromium.org>
+        Reviewed by Nate Chapin.
 
-        Reviewed by Darin Adler.
+        [chromium] XMLHttpRequest.send sends 'undefined' string when passed undefined value.
+        https://bugs.webkit.org/show_bug.cgi?id=36506
 
-        Make AtomicString create its StringImpl via create(), not the constructor,
-        so it gets allocated in a single heap block, saving memory and CPU cycles.
-        This eliminates two StringImpl constructors, making the remaining ones
-        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
-        Added const attribute to UChar* in StringImpl constructor, eliminating the
-        need for several const_casts in calls to it.
-        StringImpl also unfriends AtomicString (OMG drama!!!)
-        https://bugs.webkit.org/show_bug.cgi?id=30141
+        Test: http/tests/xmlhttprequest/send-undefined-and-null.html
 
-        * platform/text/AtomicString.cpp:
-        (WebCore::CStringTranslator::translate): Call StringImpl::create().
-        (WebCore::UCharBufferTranslator::translate): Ditto.
-        (WebCore::HashAndCharactersTranslator::translate): Ditto.
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
-        (WebCore::StringImpl::adopt): Ditto.
-        (WebCore::StringImpl::createUninitialized): Ditto.
-        (WebCore::StringImpl::create): Ditto.
-        (WebCore::StringImpl::crossThreadString): Ditto.
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::isDocumentType): Unrelated style fix: fixed the casing of the method.
+        (WebCore::V8XMLHttpRequest::sendCallback): Added check for null/undefined to do the send.
+        This mirrors what is done in the JSC bindings. Previously, sending 'null' worked because
+        the last case, which did "toWebCoreStringWithNullCheck", resulted in sending an empty
+        request body.
 
-2009-10-08  Anders Carlsson  <andersca@apple.com>
+2010-03-23  Chris Evans  <cevans@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Darin Adler.
 
-        Remove the shouldLoadMediaElementURL frame loader client function.
+        Fix hard-to-see crash due to incorrect libxml API usage.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
+        https://bugs.webkit.org/show_bug.cgi?id=36000
 
-2009-10-08  John Gregg  <johnnyg@google.com>
+        Test: fast/text/bad-encoding.html
 
-        Reviewed by Dimitri Glazkov.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd): Avoid operations on a closed context.
 
-        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
-        which wasn't exposed until a clean build.
-        https://bugs.webkit.org/show_bug.cgi?id=30217
+2010-03-23  Nate Chapin  <japhet@chromium.org>
 
-        No new tests, just a build fix.
+        Unreviewed, revert r56376.
 
-        * bindings/v8/V8Index.cpp:
+        This revision introduced a crash in a couple of layout tests
+        on Chromium Linux.
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupItem::):
+        (WebCore::PopupItem::PopupItem):
+        (WebCore::PopupContainerSettings::):
+        (WebCore::PopupContainer::listBox):
 
-        Not reviewed. Sort XCode project file.
+2010-03-23  David Hyatt  <hyatt@apple.com>
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Reviewed by Simon Fraser and Darin Adler.
 
-2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36272, make sure nth-child can work when the portion with "n" is omitted.
 
-        Reviewed by Timothy Hatcher.
+        Added fast/css/nth-child-implied-step.html
 
-        unselectable resources in resource panel
-        https://bugs.webkit.org/show_bug.cgi?id=30079
+        * css/CSSGrammar.y:
+        * css/tokenizer.flex:
 
-        manual test added
-        
-        Also changed the way DnD for resources in the Resources panel is 
-        handled.
+2010-03-23  Darin Adler  <darin@apple.com>
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
-        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+        Reviewed by Sam Weinig.
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+        Reduce and straighten internal use of DOMImplementation
+        https://bugs.webkit.org/show_bug.cgi?id=36501
 
-        Reviewed by Timothy Hatcher.
+        * WebCore.xcodeproj/project.pbxproj: Xcode decided to
+        re-sort this file.
 
-        Fixes <http://webkit.org/b/30233>
-        Local Storage and Cookies show Blank Titles on Local Files.
+        * dom/Clipboard.cpp: Removed unneeded include of DOMImplementation.h.
 
-        If a local storage or cookies sidebar item has no domain, set the 
-        title to "Local Files", because that is what it represents.
+        * dom/DOMImplementation.cpp: Removed unneeded createDocument and
+        createHTMLDocument functions. These should be done directly instead
+        of involving the DOMImplementation class.
+        * dom/DOMImplementation.h: Ditto.
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        * dom/DocumentType.cpp: Removed unneeded include of DOMImplementation.h.
 
-2009-10-08  Dave Hyatt  <hyatt@apple.com>
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer): Don't allocate a
+        DOMImplementation object just to use a class member function.
 
-        Reviewed by Oliver Hunt.
+        * loader/CachedFont.cpp: Removed unneeded include of DOMImplementation.h.
 
-        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
-        document, since video/audio (and images eventually too) can load when not in the document yet.
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseXML): Use Document::create to create a
+        new document instead of involving DOMImplementation.
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Ditto. And in the case
+        where we do need to call DOMImplementation to interpret the MIME type,
+        don't allocate a DOMImplementation object just to use a class member
+        function.
 
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+2010-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Eric Seidel.
+        [Qt] Maemo5 theme - all <select> elements should be rendered as menu lists.
+        https://bugs.webkit.org/show_bug.cgi?id=36367
 
-        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30230
+        Enabling NO_LISTBOX_RENDERING in WebCore.pri for Maemo5.
 
-        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
-        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
-        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+        * WebCore.pri:
 
-        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
-        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
-        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
-        * svg/SVGFitToViewBox.h:
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
-        * svg/SVGMarkerElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        (WebCore::SVGPatternElement::buildPattern):
-        * svg/SVGPatternElement.h:
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        (WebCore::SVGSVGElement::viewBoxToViewTransform):
-        * svg/SVGSVGElement.h:
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::SVGSymbolElement):
-        * svg/SVGSymbolElement.h:
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::SVGViewElement):
-        * svg/SVGViewElement.h:
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::SVGViewSpec):
-        * svg/SVGViewSpec.h:
-
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+        Reviewed by David Kilzer.
 
-        Reviewed by Jon Honeycutt.
+        Upstream iPhone KeyEvent platform code and share with Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
 
-        Correct a typo that fixes the resizing of columns in Cookie view when you
-        resize the Inspector window.
+        * platform/iphone/KeyEventCodesIPhone.h: Improper comment for #endif.
+        * platform/iphone/KeyEventIPhone.mm: Fixed headers.
 
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView.prototype.resize):
+2010-03-23  David Hyatt  <hyatt@apple.com>
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Adam Roben.
+        https://bugs.webkit.org/show_bug.cgi?id=36277, make sure nth-child supports the positive unary prefix (+) as well as the negative
+        one (-).
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
-        Text in Inspector's Styles gear menu is invisible.
-        
-        Adds a style rule for the option text and hr's in the gear menu,
-        to prevent them from being transparent.
+        Added fast/css/nth-child-unary-prefix.html
 
-        * inspector/front-end/inspector.css:
+        * css/tokenizer.flex:
 
-2009-10-08  John Gregg  <johnnyg@google.com>
+2010-03-23  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Dmitry Titov.
 
-        Fix build problem with SVGURIReference in V8.
-        https://bugs.webkit.org/show_bug.cgi?id=30217
+        Change notification sent to inspector frontend on workers creation / destruction
+        to be posted asynchronously to avoid JS reenterability problems. Also, renamed
+        willDestroyWorker to didDestroyWorker to reflect that it gets called later and got
+        rid of explicit IDs for workers (use addresses instead).
+        https://bugs.webkit.org/show_bug.cgi?id=36213
 
-        No new tests, just a build fix.
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::didDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::PostWorkerNotificationToFrontendTask::create):
+        (WebCore::PostWorkerNotificationToFrontendTask::PostWorkerNotificationToFrontendTask):
+        (WebCore::PostWorkerNotificationToFrontendTask::performTask):
+        (WebCore::InspectorController::postWorkerNotificationToFrontend):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::didDestroyWorker):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didDestroyWorker):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorWorkerResource.h:
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.didDestroyWorker):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::asID):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-        * WebCore.gypi:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
+2010-03-22  David Hyatt  <hyatt@apple.com>
 
-2009-10-07  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Eric Carlson.
+        https://bugs.webkit.org/show_bug.cgi?id=36266, support DOM Level 3 focusin/focusout events.  Add support for
+        IE onfocusin/onfocusout extensions to HTML.  The old DOM level 2 names (DOMFocusIn/DOMFocusOut are still supported).
 
-        Make beforeload work on <video>/<audio> elements.
+        Added fast/events/focusinout.html
 
-        Added fast/dom/beforeload/video-before-load.html
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Event.cpp:
+        (WebCore::Event::aliasedType):
+        (WebCore::Event::hasAliasedType):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * dom/EventTarget.h:
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchUIEvent):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute):
-        (WebCore::HTMLMediaElement::selectMediaResource):
-        (WebCore::HTMLMediaElement::selectNextSourceChild):
+2010-03-23  MORITA Hajime  <morrita@google.com>
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Eric Seidel.
+        WebCore::SelectionController::setSelection NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31545
 
-        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30218
+        Added missing NULL-check that other APIs have.
 
-        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
-        No change in functionality, thus no new tests.
+        Test: svg/dom/frame-related-api-during-load.html
 
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::SVGAElement):
-        * svg/SVGAElement.h:
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::SVGAnimationElement):
-        * svg/SVGAnimationElement.h:
-        * svg/SVGCircleElement.cpp:
-        (WebCore::SVGCircleElement::SVGCircleElement):
-        * svg/SVGCircleElement.h:
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::SVGClipPathElement):
-        * svg/SVGClipPathElement.h:
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::SVGCursorElement):
-        * svg/SVGCursorElement.h:
-        * svg/SVGDefsElement.cpp:
-        (WebCore::SVGDefsElement::SVGDefsElement):
-        * svg/SVGDefsElement.h:
-        * svg/SVGEllipseElement.cpp:
-        (WebCore::SVGEllipseElement::SVGEllipseElement):
-        * svg/SVGEllipseElement.h:
-        * svg/SVGExternalResourcesRequired.cpp:
-        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
-        * svg/SVGExternalResourcesRequired.h:
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::SVGFEImageElement):
-        * svg/SVGFEImageElement.h:
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::SVGFilterElement):
-        * svg/SVGFilterElement.h:
-        * svg/SVGFontElement.cpp:
-        (WebCore::SVGFontElement::SVGFontElement):
-        * svg/SVGFontElement.h:
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
-        * svg/SVGForeignObjectElement.h:
-        * svg/SVGGElement.cpp:
-        (WebCore::SVGGElement::SVGGElement):
-        * svg/SVGGElement.h:
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::SVGGradientElement):
-        * svg/SVGGradientElement.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::SVGImageElement):
-        * svg/SVGImageElement.h:
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::SVGLineElement):
-        * svg/SVGLineElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::SVGMPathElement):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        * svg/SVGMarkerElement.h:
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::SVGMaskElement):
-        * svg/SVGMaskElement.h:
-        * svg/SVGPathElement.cpp:
-        (WebCore::SVGPathElement::SVGPathElement):
-        * svg/SVGPathElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        * svg/SVGPatternElement.h:
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::SVGPolyElement):
-        * svg/SVGPolyElement.h:
-        * svg/SVGRectElement.cpp:
-        (WebCore::SVGRectElement::SVGRectElement):
-        * svg/SVGRectElement.h:
         * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        * svg/SVGSVGElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/SVGSwitchElement.cpp:
-        (WebCore::SVGSwitchElement::SVGSwitchElement):
-        * svg/SVGSwitchElement.h:
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::SVGSymbolElement):
-        * svg/SVGSymbolElement.h:
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGTextContentElement::SVGTextContentElement):
-        * svg/SVGTextContentElement.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::SVGUseElement):
-        * svg/SVGUseElement.h:
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::SVGViewElement):
-        * svg/SVGViewElement.h:
-
-2009-10-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        SVG feComposite: operator over mixes up inputs
-        [https://bugs.webkit.org/show_bug.cgi?id=30205]
-
-        SVG feComposite operator over mixed up the inputs.
-        The pixel-test svg/filters/feComposite.svg can already test this.
-        No new test result is needed as long as filters are disabled.
-
-        * platform/graphics/filters/FEComposite.cpp:
-        (WebCore::FEComposite::apply):
-
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
-
-        Reviewed by George Staikos.
-
-        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30184
-
-        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
-        No change in functionality, thus no new tests.
-
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::SVGAElement):
-        * svg/SVGAElement.h:
-        * svg/SVGAltGlyphElement.cpp:
-        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
-        * svg/SVGAltGlyphElement.h:
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::SVGCursorElement):
-        * svg/SVGCursorElement.h:
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::SVGFEImageElement):
-        * svg/SVGFEImageElement.h:
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::SVGFilterElement):
-        * svg/SVGFilterElement.h:
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
-        * svg/SVGForeignObjectElement.h:
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::SVGGradientElement):
-        * svg/SVGGradientElement.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::SVGImageElement):
-        * svg/SVGImageElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::SVGMPathElement):
-        (WebCore::SVGMPathElement::pathElement):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::SVGMaskElement):
-        * svg/SVGMaskElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        * svg/SVGPatternElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::SVGTRefElement):
-        * svg/SVGTRefElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::SVGTextPathElement):
-        * svg/SVGTextPathElement.h:
-        * svg/SVGURIReference.cpp:
-        (WebCore::SVGURIReference::SVGURIReference):
-        * svg/SVGURIReference.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::SVGUseElement):
-        * svg/SVGUseElement.h:
+        (WebCore::SVGSVGElement::deselectAll):
 
-2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-03-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
-        by r49169. Also changed the location of the sync just after the
-        creation instead of just before sending it to the plugin.
-        https://bugs.webkit.org/show_bug.cgi?id=25053
+        [Qt] LayoutTests/fast/canvas/fillrect_gradient.html failed
+        https://bugs.webkit.org/show_bug.cgi?id=36444
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::platformStart):
+        Handle duplicated or unsorted colorStop at platformDestory
 
-2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-        Reviewed by Timothy Hatcher.
+2010-03-23  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        Inspector: NodeLists Don't Display Well in the Console
-        https://bugs.webkit.org/show_bug.cgi?id=28061
+        Unreviewed build fix.
 
-        * inspector/front-end/InjectedScript.js:
-        (Object.type):
+        Try to make the window buildbot happy.
 
-2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+        * xml/XMLHttpRequestProgressEventThrottle.cpp:
+        * xml/XMLHttpRequestProgressEventThrottle.h: Move initialization of the
+        static const in the cpp file.
 
-        Reviewed by Simon Hausmann.
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
-        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
-        
-        The reason for the XSync was that the plugin would not know about the
-        Drawable. It turns out that the real reason behind this is that even
-        though XCreatePixmap returns a handle, this id is unknown to the server
-        until we flush the connection.
-        
-        So, move the XSync to right after we create the Pixmap.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30207
+        Reviewed by Timothy Hatcher.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
+        Web Inspector: make gear menu appear on styles panel at all times.
 
-2009-10-07  Daniel Bates  <dbates@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36490
 
-        Reviewed by Eric Seidel.
+        * inspector/front-end/inspector.css:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30188
-        
-        Fixes an issue where performing a non DHTML drag-and-drop operation 
-        does not work as expected. For instance, dragging some selected text 
-        to an external application, such as TextEdit.
-        
-        This issue was a regression that arose from patching bug #30107.
-        
-        This change is covered by the manual test: 
-        drag-out-of-background-window.html
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
-        * page/DragController.cpp:
-        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
-        operation then default to drag operations DragOperationGeneric and 
-        DragOperationCopy according to similar functionality removed when fixing
-        bug #30107, see: 
-        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+        Reviewed by Timothy Hatcher.
 
-2009-10-07  Xan Lopez  <xlopez@igalia.com>
+        Web Inspector: render nodes in inherited style bars as links.
 
-        Fix more breakage in the GTKbuild.
+        https://bugs.webkit.org/show_bug.cgi?id=36486
 
-        * GNUmakefile.am:
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update.else.insertInheritedNodeSeparator):
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylesSidebarPane.prototype._selectNode):
+        * inspector/front-end/inspector.js:
 
-2009-10-07  Adam Barth  <abarth@webkit.org>
+2010-03-23  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Alexey Proskuryakov.
 
-        Move PolicyChecker to it's own file
-        https://bugs.webkit.org/show_bug.cgi?id=30193
+        [XHR] onProgress event needs to be dispatched according to what the specification states
+        https://bugs.webkit.org/show_bug.cgi?id=18654
 
-        This is just moving code around and re-naming things.
+        Test: http/tests/xmlhttprequest/xmlhttprequest-50ms-download-dispatch.html
 
+        * Android.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/PolicyCallback.cpp: Added.
-        (WebCore::PolicyCallback::PolicyCallback):
-        (WebCore::PolicyCallback::~PolicyCallback):
-        (WebCore::PolicyCallback::clear):
-        (WebCore::PolicyCallback::set):
-        (WebCore::PolicyCallback::call):
-        (WebCore::PolicyCallback::clearRequest):
-        (WebCore::PolicyCallback::cancel):
-        * loader/PolicyCallback.h: Added.
-        (WebCore::PolicyCallback::request):
-        * loader/PolicyCheck.cpp: Removed.
-        * loader/PolicyCheck.h: Removed.
-
-2009-10-07  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by Mark Rowe.
-
-        Include <limits> for std::numeric_limits.  Required by gcc-4.4
-        https://bugs.webkit.org/show_bug.cgi?id=30197
-
-        * html/canvas/CanvasByteArray.h:
-        * html/canvas/CanvasIntArray.h:
-        * html/canvas/CanvasShortArray.h:
-        * html/canvas/CanvasUnsignedByteArray.h:
-        * html/canvas/CanvasUnsignedIntArray.h:
-        * html/canvas/CanvasUnsignedShortArray.h:
-
-2009-10-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Factor PolicyChecker out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30155
-
-        This patch separates PolicyChecker from FrameLoader.  Loader policy is
-        in change of managing the FrameLoaderClient callbacks.  Ideally, it
-        shouldn't know anything about FrameLoader, but I couldn't quite remove
-        all knowledge (although we might be able to do more later).  In a
-        future patch, I'll move PolicyChecker into a separate file.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::load):
-        (WebCore::FrameLoader::loadWithDocumentLoader):
-        (WebCore::PolicyChecker::handleUnimplementablePolicy):
-        (WebCore::PolicyChecker::cannotShowMIMEType):
-        (WebCore::PolicyChecker::PolicyChecker):
-        (WebCore::PolicyChecker::checkNavigationPolicy):
-        (WebCore::PolicyChecker::checkContentPolicy):
-        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
-        (WebCore::FrameLoader::stopAllLoaders):
-        (WebCore::PolicyChecker::cancelCheck):
-        (WebCore::PolicyChecker::stopCheck):
-        (WebCore::PolicyChecker::continueAfterContentPolicy):
-        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::loadPostRequest):
-        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
-        (WebCore::PolicyChecker::checkNewWindowPolicy):
-        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
-        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        * loader/FrameLoader.h:
-        (WebCore::PolicyChecker::loadType):
-        (WebCore::PolicyChecker::setLoadType):
-        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
-        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
-        (WebCore::FrameLoader::policy):
-        * loader/FrameLoaderClient.h:
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didCancel):
-        (WebCore::MainResourceLoader::willSendRequest):
-        (WebCore::MainResourceLoader::continueAfterContentPolicy):
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-
-2009-10-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
-        thread, permanently slowing down JavaScript
-
-        Changed callback objects to use a standard helper object. The helper
-        object ASSERTs that it is deleted on the main thread, so no lock is
-        required when unprotecting its members. It also centralizes some previously
-        duplicated code.
-        
-        Callback objects that might be deleted on a secondary thread use
-        callOnMainThread to delete their helper objects on the main thread.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
-        (WebCore::JSCallbackData::deleteData):
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
-        (WebCore::JSCallbackData::JSCallbackData):
-        (WebCore::JSCallbackData::~JSCallbackData):
-        (WebCore::JSCallbackData::callback):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h:
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-
-2009-10-07  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Dave Levin.
-
-        Fix StringImpl::m_buffer
-        https://bugs.webkit.org/show_bug.cgi?id=30189
-
-        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
-        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl):
-        (WebCore::StringImpl::createUninitialized):
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::bufferIsInternal):
-
-2009-10-07  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Update isolated worlds under v8 to support world reuse.
-        https://bugs.webkit.org/show_bug.cgi?id=30145
-
-        * bindings/v8/ScriptController.cpp:
-        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        * bindings/v8/ScriptController.h: Ditto.
-        * bindings/v8/V8Proxy.cpp: Ditto.
-        (WebCore::V8Proxy::~V8Proxy): Dittio.
-        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
-        * bindings/v8/V8Proxy.h: Ditto.
-        * bindings/v8/V8IsolatedWorld.cpp:
-        Add support for controlling lifetime of a world, rather than relying on GC.
-        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
-        (WebCore::V8IsolatedWorld::destroy): Ditto.
-        * bindings/v8/V8IsolatedWorld.h: Ditto.
-
-2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix for http://trac.webkit.org/changeset/49272 on Windows
-
-        * platform/text/StringImpl.h:
-
-2009-10-07  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Optimization of StringImpl:
-        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
-          m_data points to just past the end of the object's members.
-        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
-          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
-        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
-          
-        https://bugs.webkit.org/show_bug.cgi?id=29500
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl): Re-ordered members.
-        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
-        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
-            to ensure chars are copied to correct location.
-        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
-            in a single malloc block.
-        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
-        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
-        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
-        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
-        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
-        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
-
-2009-10-07  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30102
-        And
-        <rdar://problem/5015957>
-        
-        Manual test to confirm that the not-allowed cursor is shown for an
-        invalid drag-and-drop operation.
-        
-        We cannot test this using DRT because of a discrepancy between the Windows
-        API-based drop effect and the WebKit drop effect. See bug #24731 for more
-        details.
-
-        * manual-tests/drag-cursor-notallowed.html: Added.
-
-2009-10-07  Mark Rowe  <mrowe@apple.com>
-
-        Fix the build.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+        Added XMLHttpRequestProgressEventThrottle to the build systems.
 
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30104>.
-        Inspector should show cookies of sub-resources on the page.
-        
-        This function implements showing cookies for all sub-resources of a page.
-        When the page is loaded, it populates the Storage Panel with a list of all
-        domains that were loaded as part of the full page load (iframes, ads, etc).
-        When the user selects one of the domains, the inspector calls back into the
-        controller, and the controller combines all of the cookies from that domain
-        into a list, and sends that list is sent back to the controller to render.
-        
-        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
-        
-        As a result of a previous patch, we now have detailed cookie information for
-        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
-        support on Windows.
-
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        * bindings/js/ScriptObject.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::deleteCookie):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::getCookies):
-        (WebCore::InspectorController::buildArrayForCookies):
-        (WebCore::InspectorController::buildObjectForCookie):
-        (WebCore::InspectorController::deleteCookie):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addCookieDomainForDocument):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.Cookies.getCookiesAsync):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.reset):
-        (WebInspector.StoragePanel.prototype.addCookieDomain):
-        (WebInspector.StoragePanel.prototype.showCookies):
-        (WebInspector.CookieSidebarTreeElement):
-        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addCookieDomain):
-        * platform/Cookie.h:
-        (WebCore::CookieHash::hash):
-        (WebCore::CookieHash::equal):
-        (WTF::):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::deleteCookie):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Created the throttle.
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener): The 'readyState' event are
+        dispatched using the XMLHttpRequestProgressEventThrottle now. For the DONE state, we
+        need to flush any pending progress event as we do not want it to be dispatched after
+        the DONE readyState event.
+        (WebCore::XMLHttpRequest::createRequest): Made this event use the
+        XMLHttpRequestProgressEventThrottle for event dispatching.
+        (WebCore::XMLHttpRequest::abort): Ditto.
+        (WebCore::XMLHttpRequest::networkError): Ditto.
+        (WebCore::XMLHttpRequest::abortError): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto. Also fixed a potential warning.
+        (WebCore::XMLHttpRequest::suspend):
+        (WebCore::XMLHttpRequest::resume): Implemented the logic for suspend / resume.
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestProgressEventThrottle.cpp: Added.
+        (WebCore::XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle):
+        (WebCore::XMLHttpRequestProgressEventThrottle::~XMLHttpRequestProgressEventThrottle):
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchProgressEvent): Implemented the bulk
+        of the event throttling here: we use a timer to do so, as long as the timer is active it means
+        that events are coming faster than the throttling time and we coalesce them.
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchEvent): Generic method to dispatch an event.
+        (WebCore::XMLHttpRequestProgressEventThrottle::flushProgressEvent): Called when we want to dispatch
+        any pending events and stopping any further dispatching.
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchPausedEvent): Used to dispatch the event
+        that was queued due to the object being suspended.
+        (WebCore::XMLHttpRequestProgressEventThrottle::fired): Used to dispatch any coalesced event.
+        (WebCore::XMLHttpRequestProgressEventThrottle::hasEventToDispatch): Used to check if we have
+        an event to dispatch.
+        (WebCore::XMLHttpRequestProgressEventThrottle::suspend): Marked the object as suspended.
+        (WebCore::XMLHttpRequestProgressEventThrottle::resume): Dispatched the event that was queued.
+        * xml/XMLHttpRequestProgressEventThrottle.h: Added.
+        (WebCore::):
+        (WebCore::XMLHttpRequestProgressEventThrottle::suspended):
 
-2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+        Web Inspector: Element inspector search funtion: Error dispatching: performSearch.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30104
+        https://bugs.webkit.org/show_bug.cgi?id=36488
 
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        * bindings/v8/ScriptObject.h:
-
-2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build fix for Windows (Cairo).
-
-        Provide implementation of new BitmapImage::create that was
-        added in @r49060.
-
-        * platform/graphics/win/ImageCairoWin.cpp:
-
-2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
-
-        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29987
-
-        Covered by existing layout tests as no new functionality was introduced.
-
-        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
-        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
-        * rendering/MediaControlElements.cpp:
-        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
-        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
-        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
-        * rendering/RenderMediaControlsChromium.cpp: Added.
-        (WebCore::platformResource): Helper to load and cache media control image resources.
-        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
-        (WebCore::mediaVolumeSliderThumbImage): Ditto.
-        (WebCore::paintMediaButton): Ditto.
-        (WebCore::paintMediaMuteButton): Ditto.
-        (WebCore::paintMediaPlayButton): Ditto.
-        (WebCore::paintMediaSlider): Ditto.
-        (WebCore::paintMediaSliderThumb): Ditto.
-        (WebCore::paintMediaVolumeSlider): Ditto.
-        (WebCore::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::paintMediaTimelineContainer): Ditto.
-        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
-        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
-        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
-        * rendering/RenderMediaControlsChromium.h: Added.
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
-        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
-        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
-
-2009-10-07  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Make plugins work with beforeload.
-
-        Added fast/dom/beforeload/flash-before-load.html
-
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget):
+        Test: inspector/elements-panel-search.html
 
-2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Protect JS listener object from GC while clearing a property on it.
-        See http://crbug.com/23780.
-        https://bugs.webkit.org/show_bug.cgi?id=30137
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-
-2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
-
-        Rubber-stamped by Eric Seidel.
-
-        Allow custom memory allocation control for WebCore's CachedResourceClient class
-        https://bugs.webkit.org/show_bug.cgi?id=30165
-
-        Inherits CachedResourceClient class from FastAllocBase because (its
-        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
-
-        * loader/CachedResourceClient.h:
-
-2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Allow custom memory allocation control for WebCore's IdentifierRep 
-        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
-
-        Inherits IdentifierRep class from FastAllocBase because it has been                                 
-        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
-
-        * bridge/IdentifierRep.h:
-
-2009-10-07  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fetch pointers to C+DOM window immediately from holder
-        object (do not search prototype chain for proper JS wrapper).
-        https://bugs.webkit.org/show_bug.cgi?id=29031
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::installDOMWindow):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-2009-10-07  Adam Roben  <aroben@apple.com>
-
-        Fix typo in PluginView::load that was causing cross-origin loads to
-        be allowed
-
-        This typo was introduced in the build fix in r49213.
-
-        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
-        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
-
-        Reviewed by Sam Weinig.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load): Removed a comma operator that was making
-        a condition always evaluate to true.
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        (injectedScriptConstructor):
 
-2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Do not create valid QColor's for invalid WebCore::Color's.
+        [Qt]  fast/canvas/patternfill-repeat.html failed.
+        https://bugs.webkit.org/show_bug.cgi?id=34477
 
-        * platform/graphics/qt/ColorQt.cpp:
-        (WebCore::Color::operator QColor):
-
-2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
+        Change Pattern to expose the repeatX and repeatY
+        At GraphicsContextQt to apply repeatX and repeatY
 
-        [Qt] Symbian SBSv2 .data segment adress fix
-        https://bugs.webkit.org/show_bug.cgi?id=30157
-
-        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
-        base address to start from 0x800000 instead of the toolchain default 0x400000
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::repeatX):
+        (WebCore::Pattern::repeatY):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::rotate):
 
-        * WebCore.pro:
+2010-03-23  Alex Milowski  <alex@milowski.com>
 
-2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Timothy Hatcher.
+        Removed the use of beta STIX fonts.
 
-        Web Inspector: Migrate database inspection to the injected script-based schema.
+        * css/mathml.css:
 
-        https://bugs.webkit.org/show_bug.cgi?id=29788
+2010-03-23  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::databaseForId):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::dispatchOnInjectedScript):
-        (WebCore::InspectorBackend::databaseForId):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::getDatabaseTableNames):
-        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::selectDatabase):
-        (WebCore::InspectorController::databaseForId):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::selectDOMStorage):
-        (WebCore::InspectorController::getDOMStorageResourceForId):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDatabaseResource.cpp:
-        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
-        (WebCore::InspectorDatabaseResource::bind):
-        * inspector/InspectorDatabaseResource.h:
-        (WebCore::InspectorDatabaseResource::database):
-        (WebCore::InspectorDatabaseResource::id):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addDatabase):
-        (WebCore::InspectorFrontend::selectDatabase):
-        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
-        (WebCore::InspectorFrontend::addDOMStorage):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/Database.js:
-        (WebInspector.Database):
-        (WebInspector.Database.prototype.get id):
-        (WebInspector.Database.prototype.set name):
-        (WebInspector.Database.prototype.set version):
-        (WebInspector.Database.prototype.set domain):
-        (WebInspector.Database.prototype.getTableNames):
-        (WebInspector.Database.prototype.executeSql):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.dispatch):
-        (InjectedScript.executeSql):
-        (InjectedScript.executeSql.errorCallback):
-        (InjectedScript.executeSql.queryTransaction):
-        * inspector/front-end/InjectedScriptAccess.js:
-        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
-        (InjectedScriptAccess._installHandler):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.selectDatabase):
-        (WebInspector.StoragePanel.prototype.dataGridForResult):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addDatabase):
+        Reviewed by Holger Freyther.
 
-2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+        [GTK] Does not build with latest GTK+ development release
+        https://bugs.webkit.org/show_bug.cgi?id=36398
 
-        Reviewed by Simon Hausmann.
+        Fix building with newest GTK+ versions.
 
-        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
-        
-        We cannot support content propagation for items in QGraphicsView because
-        the contents of the backing store might be transformed. So turn it off
-        if we are not painting on QWidget.
-        
-        Note that this check will not work for a QWebView in a
-        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
-        even uglier cast: static_cast painter's paintDevice() to QWidget and
-        check if it is the viewport() of QGraphicsView.
+        * GNUmakefile.am:
+        * platform/gtk/GtkPluginWidget.cpp:
+        (WebCore::GtkPluginWidget::invalidateRect):
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/GtkVersioning.h: Added.
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::paint):
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_set_position):
+        (gtk_xtbin_unrealize):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30149
+2010-03-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+        [Qt] Remove support for Qt v4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36389
 
-        Fix the Qt build by adding the missing files to the build.
+        No new tests as there is no new functionality.
 
+        * WebCore.pri:
         * WebCore.pro:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        * plugins/mac/PluginViewMac.cpp:
 
-2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-03-23  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Xan Lopez.
+        Reviewed by Adam Barth.
 
-        Fix incorrect convertion of double into int while assigning it to
-        a float.
+        Add checks if setNeedsWillValidateCheck() and
+        setNeedsValidityCheck() are called correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=34924
 
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::platformInit):
+        Introduce HTMLFormControlElement::m_willValidate and
+        m_isValid. They are the caches of willValidate() and
+        isValidFormControlElement(). setNeedsWillValidateCheck() updates
+        m_willValidate and setNeedsValidityCheck() updates m_isValid.
 
-2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        willValidate() and isValidFormControlElement() have assertions to
+        check m_willvalidate or m_isValid has the correct state. If
+        setNeedsWillValidateCheck() or setNeedsValidityCheck() is needed
+        to be called and is not called, these assertions fail.
 
-        Reviewed by Xan Lopez.
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::recalcWillValidate):
+        * html/HTMLFieldSetElement.h:
+        (WebCore::HTMLFieldSetElement::recalcWillValidate):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::recalcWillValidate):
+        (WebCore::HTMLFormControlElement::willValidate):
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+        (WebCore::HTMLFormControlElement::validationMessage):
+        (WebCore::HTMLFormControlElement::isValidFormControlElement):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::recalcWillValidate):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
 
-        Fix rounding error issues in height calculation in 64 bits.
+2010-03-22  Pavel Feldman  <pfeldman@chromium.org>
 
-        Already covered by existing tests.
+        Reviewed by Dave Hyatt.
 
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::platformInit):
+        Web Inspector: display CSS selector source line in the styles sidebar pane.
 
-2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36414
 
-        Reviewed by Eric Seidel.
+        This change adds a sourceLine field into the CSSStyleRule that is populated
+        from within the parser. CSSParser is now keeping track of the line numbers
+        and last selector line number that is being used while creating CSSStyleRules.
 
-        Dual lines in css2.1 layout tests do not match:
-        https://bugs.webkit.org/show_bug.cgi?id=23262
+        Test: inspector/styles-source-lines.html
 
-        Now we can put a counter node as the next sibling of a reset node.
-        Re-layout the counter content when the count is updated.
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::countLines):
+        (WebCore::CSSParser::createStyleRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::updateLastSelectorLine):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::create):
+        (WebCore::CSSStyleRule::sourceLine):
+        * css/tokenizer.flex:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
 
-        Tests: fast/css/counters/t1204-increment-00-c-o.html
-               fast/css/counters/t1204-increment-01-c-o.html
+2010-03-22  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        * rendering/CounterNode.cpp:
-        (WebCore::CounterNode::recount):
-        * rendering/RenderCounter.cpp:
-        (WebCore::findPlaceForCounter):
+        Reviewed by Laszlo Gombos.
 
-2009-10-06  Xan Lopez  <xlopez@igalia.com>
+        [Qt] Fix arc function in canvas
+        https://bugs.webkit.org/show_bug.cgi?id=36296
 
-        Try to fix the GTKbuild.
+        Based on HTLM5 spec (4.8.10.1.8 Complex shapes), arc function should draw a line to previous point, not only the arc.
 
-        * GNUmakefile.am:
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+2010-03-19  Abhishek Arya  <inferno@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Removed unused member variable from FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30146
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        * loader/FrameLoader.h:
-
-2009-10-06  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (build fix).
-
-        A few small/trivial tweaks to the last build fix.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-10-06  David Levin  <levin@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36339
+        Off-by-one memory corruption fix for long invalid websockets upgrade header
 
-        Reviewed by Dimitri Glazkov.
+        Test: websocket/tests/long-invalid-header.html
 
-        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
-        https://bugs.webkit.org/show_bug.cgi?id=30147
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
 
-        No change in functionality so no new tests.
+2010-03-22  Fumitoshi Ukai  <ukai@chromium.org>
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/SerializedScriptValue.h: Added.
-         A very simple implementation of SerializedScriptValue
-         that only works for strings.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessageEventCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        Unreviewed build fix for Chromim Mac at r56376
 
-2009-10-06  Sam Weinig  <sam@webkit.org>
+        Fix initializer order  of PopupContainer.
 
-        Reviewed by Brady Eidson.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::PopupContainer):
 
-        Fix for <rdar://problem/7271202>
-        Dispatch resource load delegate functions for the media element.
-        Since we don't get the required callbacks from the media engine,
-        just fake the parameters to the delegate functions as best as possible.
+2010-03-22  Jay Campan  <jcampan@google.com>
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadResource):
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-        * loader/FrameLoader.h:
+        Reviewed by Darin Fisher.
 
-2009-10-06  Oliver Hunt  <oliver@apple.com>
+        Making Chromium select popups not steal activation from the browser.
+        Select popups are now like autocomplete popups, shown in non-activated
+        windows.
+        https://bugs.webkit.org/show_bug.cgi?id=36062
 
-        Reviewed by NOBODY (Build fix).
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupContainer::):
+        (WebCore::PopupContainer::popupType):
 
-        More build fixes.
+2010-03-22  Dmitry Titov  <dimich@chromium.org>
 
-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::DeserializingTreeWalker::getProperty):
-        (WebCore::TeardownTreeWalker::getProperty):
-        * bindings/js/SerializedScriptValue.h:
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        Reviewed by Nate Chapin.
 
-2009-10-06  Oliver Hunt  <oliver@apple.com>
+        [v8] Crash if the worker is terminated before its initial script is executed.
+        https://bugs.webkit.org/show_bug.cgi?id=36336
 
-        Reviewed by NOBODY (Build fix).
+        Test: fast/workers/termination-early.html
 
-        Build and formatting fix.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): Check for 0 context. When terminated, the v8 heap initialization returns 0.
+        (WebCore::WorkerContextExecutionProxy::evaluate): Don't execute script if initialization failed.
+        * bindings/v8/WorkerContextExecutionProxy.h:
 
-        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
-        * bindings/js/SerializedScriptValue.cpp:
-        * bindings/js/SerializedScriptValue.h:
-        (WebCore::SerializedScriptValueData::operator bool):
-        (WebCore::SerializedScriptValueData::release):
-        (WebCore::SerializedScriptValue::release):
-        (WebCore::SerializedScriptValue::toString):
-        (WebCore::SerializedScriptValue::~SerializedScriptValue):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
+2010-03-22  Andrey Kosyakov  <caseq@chromium.org>
 
-2009-10-05  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Gavin Barraclough.
+        Support creation of fake workers before document is loaded by deferring
+        attaching of fake workers iframe until document is loaded and buffering all
+        messages addressed to worker.
+        https://bugs.webkit.org/show_bug.cgi?id=36445
 
-        It should be possible to post (clone) built-in JS objects to Workers
-        https://bugs.webkit.org/show_bug.cgi?id=22878
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker.prototype.postMessage):
+        (InjectedFakeWorker.FakeWorker.prototype._buildWorker):
+        (InjectedFakeWorker.FakeWorker.prototype._attachWorkerFrameToDocument):
+        (InjectedFakeWorker.FakeWorker.prototype._onWorkerFrameLoaded):
 
-        Implement object cloning semantics for postMessage.  Currently only
-        a partial implementation of the spec -- cloning of File, FileList,
-        ImageData, and RegExp were left out as they would have significantly
-        increased patch size.
+2010-03-22  Darin Fisher  <darin@chromium.org>
 
-        Cloning requires multiple tree walks so we use a templated tree
-        walk function, allowing us to share a single implementation for
-        serialization, deserialization, and eventual destruction of the
-        serialized object tree.
+        Reviewed by Brady Eidson.
 
-        Test: fast/dom/Window/window-postmessage-clone.html
+        HistoryController::replaceState() should modify m_currentItem
+        instead of the current HistoryItem of the BackForwardList.
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::postMessage):
-        * bindings/js/JSMessageEventCustom.cpp:
-        (WebCore::JSMessageEvent::initMessageEvent):
-        * bindings/js/JSMessagePortCustom.h:
-        (WebCore::handlePostMessage):
-        * bindings/js/SerializedScriptValue.cpp: Added.
-        (WebCore::SerializedObject::set):
-        (WebCore::SerializedObject::names):
-        (WebCore::SerializedObject::values):
-        (WebCore::SerializedObject::create):
-        (WebCore::SerializedObject::clear):
-        (WebCore::SerializedObject::SerializedObject):
-        (WebCore::SerializedArray::setIndex):
-        (WebCore::SerializedArray::canDoFastRead):
-        (WebCore::SerializedArray::getIndex):
-        (WebCore::SerializedArray::getSparseIndex):
-        (WebCore::SerializedArray::length):
-        (WebCore::SerializedArray::create):
-        (WebCore::SerializedArray::clear):
-        (WebCore::SerializedArray::SerializedArray):
-        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
-        (WebCore::SharedSerializedData::asArray):
-        (WebCore::SharedSerializedData::asObject):
-        (WebCore::):
-        (WebCore::walk):
-        (WebCore::BaseWalker::BaseWalker):
-        (WebCore::BaseWalker::shouldTerminate):
-        (WebCore::BaseWalker::ticksUntilNextCheck):
-        (WebCore::BaseWalker::didTimeOut):
-        (WebCore::BaseWalker::throwStackOverflow):
-        (WebCore::BaseWalker::throwInterruptedException):
-        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
-        (WebCore::SerializingTreeWalker::null):
-        (WebCore::SerializingTreeWalker::isArray):
-        (WebCore::SerializingTreeWalker::isObject):
-        (WebCore::SerializingTreeWalker::asInputArray):
-        (WebCore::SerializingTreeWalker::asInputObject):
-        (WebCore::SerializingTreeWalker::createOutputArray):
-        (WebCore::SerializingTreeWalker::createOutputObject):
-        (WebCore::SerializingTreeWalker::length):
-        (WebCore::SerializingTreeWalker::canDoFastRead):
-        (WebCore::SerializingTreeWalker::getIndex):
-        (WebCore::SerializingTreeWalker::getSparseIndex):
-        (WebCore::SerializingTreeWalker::getProperty):
-        (WebCore::SerializingTreeWalker::convertIfTerminal):
-        (WebCore::SerializingTreeWalker::getPropertyNames):
-        (WebCore::SerializingTreeWalker::putIndex):
-        (WebCore::SerializingTreeWalker::putProperty):
-        (WebCore::SerializingTreeWalker::startArray):
-        (WebCore::SerializingTreeWalker::endArray):
-        (WebCore::SerializingTreeWalker::startObject):
-        (WebCore::SerializingTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::serialize):
-        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
-        (WebCore::DeserializingTreeWalker::null):
-        (WebCore::DeserializingTreeWalker::isArray):
-        (WebCore::DeserializingTreeWalker::isObject):
-        (WebCore::DeserializingTreeWalker::asInputArray):
-        (WebCore::DeserializingTreeWalker::asInputObject):
-        (WebCore::DeserializingTreeWalker::createOutputArray):
-        (WebCore::DeserializingTreeWalker::createOutputObject):
-        (WebCore::DeserializingTreeWalker::length):
-        (WebCore::DeserializingTreeWalker::canDoFastRead):
-        (WebCore::DeserializingTreeWalker::getIndex):
-        (WebCore::DeserializingTreeWalker::getSparseIndex):
-        (WebCore::DeserializingTreeWalker::getProperty):
-        (WebCore::DeserializingTreeWalker::convertIfTerminal):
-        (WebCore::DeserializingTreeWalker::getPropertyNames):
-        (WebCore::DeserializingTreeWalker::putIndex):
-        (WebCore::DeserializingTreeWalker::putProperty):
-        (WebCore::DeserializingTreeWalker::startArray):
-        (WebCore::DeserializingTreeWalker::endArray):
-        (WebCore::DeserializingTreeWalker::startObject):
-        (WebCore::DeserializingTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::deserialize):
-        (WebCore::TeardownTreeWalker::shouldTerminate):
-        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
-        (WebCore::TeardownTreeWalker::didTimeOut):
-        (WebCore::TeardownTreeWalker::throwStackOverflow):
-        (WebCore::TeardownTreeWalker::throwInterruptedException):
-        (WebCore::TeardownTreeWalker::null):
-        (WebCore::TeardownTreeWalker::isArray):
-        (WebCore::TeardownTreeWalker::isObject):
-        (WebCore::TeardownTreeWalker::asInputArray):
-        (WebCore::TeardownTreeWalker::asInputObject):
-        (WebCore::TeardownTreeWalker::createOutputArray):
-        (WebCore::TeardownTreeWalker::createOutputObject):
-        (WebCore::TeardownTreeWalker::length):
-        (WebCore::TeardownTreeWalker::canDoFastRead):
-        (WebCore::TeardownTreeWalker::getIndex):
-        (WebCore::TeardownTreeWalker::getSparseIndex):
-        (WebCore::TeardownTreeWalker::getProperty):
-        (WebCore::TeardownTreeWalker::convertIfTerminal):
-        (WebCore::TeardownTreeWalker::getPropertyNames):
-        (WebCore::TeardownTreeWalker::putIndex):
-        (WebCore::TeardownTreeWalker::putProperty):
-        (WebCore::TeardownTreeWalker::startArray):
-        (WebCore::TeardownTreeWalker::endArray):
-        (WebCore::TeardownTreeWalker::startObject):
-        (WebCore::TeardownTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::tearDownSerializedData):
-        * bindings/js/SerializedScriptValue.h: Added.
-        (WebCore::SharedSerializedData::~SharedSerializedData):
-        (WebCore::SerializedScriptValueData::):
-        (WebCore::SerializedScriptValueData::type):
-        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
-        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
-        (WebCore::SerializedScriptValueData::asImmediate):
-        (WebCore::SerializedScriptValueData::asDouble):
-        (WebCore::SerializedScriptValueData::asString):
-        (WebCore::SerializedScriptValueData::asObject):
-        (WebCore::SerializedScriptValueData::asArray):
-        (WebCore::SerializedScriptValueData::operator bool ):
-        (WebCore::SerializedScriptValueData::release):
-        (WebCore::SerializedScriptValue::create):
-        (WebCore::SerializedScriptValue::release):
-        (WebCore::SerializedScriptValue::toString):
-        (WebCore::SerializedScriptValue::deserialize):
-        (WebCore::SerializedScriptValue::~SerializedScriptValue):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        (WebCore::MessageEvent::data):
-        * dom/MessageEvent.idl:
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        * dom/MessagePort.h:
-        * dom/MessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::EventData::message):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-        (WebCore::DOMWindow::postMessage):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/EventSource.cpp:
-        (WebCore::EventSource::createMessageEvent):
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::didReceiveMessage):
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::postMessage):
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix for Windows.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load):
+        https://bugs.webkit.org/show_bug.cgi?id=36435
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+        Test: fast/loader/stateobjects/replacestate-in-iframe.html
 
-        Reviewed by Eric Seidel.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::replaceState):
 
-        Move FrameLoader::canLoad to SecurityOrigin
-        https://bugs.webkit.org/show_bug.cgi?id=30111
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * WebCore.base.exp:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        (WebCore::FrameLoader::loadPlugin):
-        (WebCore::FrameLoader::loadFrameRequest):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::createJavaAppletWidget):
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::canLoad):
-        (WebCore::SecurityOrigin::shouldHideReferrer):
-        * page/SecurityOrigin.h:
+        Reviewed by David Kilzer.
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+        Upstream Part of the iPhone Platform sharing code with the Mac Platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283> and <rdar://problem/7707318>
 
-        Reviewed by Eric Seidel.
+        Part 3 of 3: Shared code between iphone and mac. The shared code was
+        refactored to be usable by both platforms without platform specific
+        typing, meaning no NSEvent versus WebEvent special cases.
 
-        Move setLocalLoadPolicy and friends to SecurityOrigin
-        https://bugs.webkit.org/show_bug.cgi?id=30110
+          Shared code usable by either mac or iphone platforms.
 
-        These have more to do with security policies than with loading frames.
+        * platform/cocoa/KeyEventCocoa.h:
+        * platform/cocoa/KeyEventCocoa.mm:
+        (WebCore::keyIdentifierForCharCode):
+        (WebCore::windowsKeyCodeForKeyCode):
+        (WebCore::windowsKeyCodeForCharCode):
 
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::setLocalLoadPolicy):
-        (WebCore::SecurityOrigin::restrictAccessToLocal):
-        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
-        * page/SecurityOrigin.h:
-        (WebCore::SecurityOrigin::):
+          Make use of the shared code. Keep anything platform specific in the
+          original file before calling the shared code.
 
-2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+        * platform/iphone/KeyEventIPhone.mm:
+        (WebCore::keyIdentifierForKeyEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::keyIdentifierForKeyEvent):
+        (WebCore::windowsKeyCodeForKeyEvent):
 
-        Reviewed by Brady Eidson.
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        Preparation for <http://webkit.org/b/30104>.
-        Inspector should show cookies of sub-resources on the page.
-        
-        Implement getRawCookies for CFNetwork for Windows, so we can see more
-        than just a key/value pair for Cookies when we are on Windows.
+        Reviewed by Simon Fraser.
 
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-2009-10-06  Dave Hyatt  <hyatt@apple.com>
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Fix a find/repalce mistake from my earlier patch.
+        Rename m_setShowsMissingPluginIndicator -> m_showsMissingPluginIndicator. 
+        (WebCore::RenderEmbeddedObject::updateWidget): Don't update the widget if we're showing
+        the missing plug-in indicator.
+        (WebCore::RenderEmbeddedObject::paint):Fix a find/repalce mistake from my earlier patch.
+        Rename m_setShowsMissingPluginIndicator -> m_showsMissingPluginIndicator. 
+        (WebCore::RenderEmbeddedObject::paintReplaced): Ditto.
+        * rendering/RenderEmbeddedObject.h: Ditto.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator): Ditto.
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator): Ditto.
 
-        Reviewed by Adam Roben.
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
-        XML processing instructions.
+        Reviewed by David Kilzer.
 
-        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
-        data gets changed.
+        Upstream Part of the iPhone Platform sharing code with the Mac Platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283>
 
-        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
-        access it.
+        Part 2 of 3: No changes other than moving code around.
+        Copied KeyEvent function from platform/mac to a platform/cocoa shared directory.
 
-        Added fast/dom/beforeload/link-before-load.html
+        * WebCore.xcodeproj/project.pbxproj: Added cocoa group and new files.
+        * platform/cocoa/KeyEventCocoa.h: Added.
+        * platform/cocoa/KeyEventCocoa.mm: Copied from WebCore/platform/mac/KeyEventMac.mm.
+        (WebCore::keyIdentifierForKeyEvent):
+        (WebCore::windowsKeyCodeForKeyEvent): Include the shared code.
+        * platform/mac/KeyEventMac.mm:
 
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
-        * dom/ContainerNode.h:
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::checkStyleSheet):
-        (WebCore::ProcessingInstruction::setData):
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::parseMappedAttribute):
-        (WebCore::HTMLLinkElement::process):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::forAttributeValue):
-        * html/HTMLScriptElement.h:
-        * svg/SVGScriptElement.cpp:
-        * svg/SVGScriptElement.h:
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by David Kilzer.
 
-        Reviewed by Mark Rowe.
+        Part 1 of 3: Upstream iPhone KeyEvent platform code and share with Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283>
 
-        accessibility/media-element.html crashes (and has incorrect result)
-        https://bugs.webkit.org/show_bug.cgi?id=30108
+        * WebCore.xcodeproj/project.pbxproj: Added iphone group and new files.
+        * platform/iphone: Added.
+        * platform/iphone/KeyEventCodesIPhone.h: Added.
+        * platform/iphone/KeyEventIPhone.mm: Added. Ensure PLATFORM(IPHONE)
+        * platform/mac/KeyEventMac.mm: Ensure PLATFORM(MAC)
 
-        Fix up the accessibilty label for the newly added fullscreen button,
-        and update the test result accordingly.
+2010-03-22  Kevin Decker  <kdecker@apple.com>
+    
+        Attempt to fix the Leopard build.
+        * rendering/RenderEmbeddedObject.cpp: Add ".f" to contants.
 
-        * accessibility/AccessibilityMediaControls.cpp:
-        (WebCore::AccessibilityMediaControl::controlTypeName):
+2010-03-22  Justin Schuh  <jschuh@chromium.org>
 
-2009-10-06  Kelly Norton  <knorton@google.com>
+        Reviewed by Dirk Schulze.
 
-        Reviewed by Timothy Hatcher.
+        Out of bounds read in SVG feColorMatrix filter
+        https://bugs.webkit.org/show_bug.cgi?id=32714
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
-        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
-        InspectorFrontend.
+        Prevents an invalid read when a valid values attribute is not
+        supplied for an feColorMatrix SVG filter. Also fixes general
+        handling of missing or invalid values attribute.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+        Tests: svg/filters/feColorMatrix-invalid-value.svg
+               svg/filters/feColorMatrix-values.svg
 
-2009-10-06  Antti Koivisto  <antti@apple.com>
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
 
-        Reviewed by Dave Kilzer.
+2010-03-22  Philippe Normand  <pnormand@igalia.com>
 
-        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+        Reviewed by Eric Carlson.
 
-        * bindings/objc/DOM.mm:
-        (-[DOMNode textRects]):
+        [GStreamer] Use ImageBuffer API to do painting
+        https://bugs.webkit.org/show_bug.cgi?id=35783
 
-2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+        New ImageGStreamer class abstracting the conversion of GStreamer
+        buffers to cairo surfaces. Using this makes the painting code of
+        the player more generic.
 
-        Reviewed by Ariya Hidayat.
-        
-        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
-        
-        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
-        
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/ImageGStreamer.h: Added.
+        (WebCore::ImageGStreamer::image):
+        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp: Added.
+        (ImageGStreamer::createImage):
+        (ImageGStreamer::ImageGStreamer):
+        (ImageGStreamer::~ImageGStreamer):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-10-06  Kent Tamura  <tkent@chromium.org>
+2010-03-22  Beth Dakin  <bdakin@apple.com>
 
         Reviewed by Darin Adler.
 
-        Implement min/max attributes, ValidityState.rangeUnderflow and
-        ValidityState.rangeOverflow for <input type=number> and <input type=range>
-        https://bugs.webkit.org/show_bug.cgi?id=29069
-        
-        HTMLInputElement::max and min are not defined for COM because they
-        conflict with the standard min() and max() macros.
-
-        Tests: fast/forms/ValidityState-rangeOverflow-number.html
-               fast/forms/ValidityState-rangeOverflow-range.html
-               fast/forms/ValidityState-rangeUnderflow-number.html
-               fast/forms/ValidityState-rangeUnderflow-range.html
-               fast/forms/input-minmax.html
+        Fix for <rdar://problem/7766437> With Web Inspector opened, a crash 
+        occurs at Webcore:getMatchedCSSRules() when navigating to a 
+        previous page
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::rangeUnderflow):
-        (WebCore::HTMLInputElement::rangeOverflow):
-        (WebCore::HTMLInputElement::rangeMinimum):
-        (WebCore::HTMLInputElement::rangeMaximum):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * html/ValidityState.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
+        defaultView() can legitimately by null (as it is in this case), so 
+        it must be null-checked.
 
-        Reviewed by Eric Seidel.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::getComputedStyle):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
 
-        Move m_openedByDOM to Page
-        https://bugs.webkit.org/show_bug.cgi?id=30109
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        We only need one instance of m_openedByDOM per page, we should move it
-        to a page-scoped object.  Notice that it's only ever touched for the
-        main frame.
+        Reviewed by Darin.
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
+        https://bugs.webkit.org/show_bug.cgi?id=36328
+        
         * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::close):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::openedByDOM):
-        (WebCore::Page::setOpenedByDOM):
-        * page/Page.h:
+        (WebCore::FrameLoader::loadPlugin): Call setShowsMissingPluginIndicator(true) in cases that fail
+        to generate a widget.
+        * rendering/RenderEmbeddedObject.cpp: Added new missing plug-in related static constants
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Initialize newly boolean to false.
+        (WebCore::RenderEmbeddedObject::paint): Added.
+        (WebCore::RenderEmbeddedObject::paintReplaced): Added. Draws a subtle rounded rectangle
+        containing the text "Missing Plug-in".
+        * rendering/RenderEmbeddedObject.h: Added the following two methods below.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator):
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator):
+        * rendering/RenderWidget.h: Moved paint(PaintInfo&, int, int) from private to protected.
+
+2010-03-22  Jakub Wieczorek  <faw217@gmail.com>
 
-2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Some functions in GraphicsContext do not work
-        as expected if the associated painter has no clipping.
-        https://bugs.webkit.org/show_bug.cgi?id=29691
+        [Qt] Phonon media backend: expose supported MIME types to WebCore
 
-        No new tests are associated with this because DumpRenderTree
-        always sets clipping on the painter, thus it would never hit 
-        the test case, but fast/box-shadow/basic-shadows.html is a
-        good example of what happens if the clipping is not set by
-        the user of QtWebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=33453
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        Fixed to handle the case that there is no clipping
-        before the call.
+        MediaPlayerPrivate should expose the MIME types that are supported
+        by the underlying backend in Phonon.
 
-2009-10-06  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportedTypesCache):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+2010-03-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        Added tests in fast/dom/beforeload/.
+        Reviewed by Pavel Feldman.
 
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * html/HTMLAttributeNames.in:
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
-        * html/HTMLScriptElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
-        * svg/SVGScriptElement.h:
+        Web Inspector: AuditRules still use getMatchedCSSRules as a part of the img-related audit.
+        https://bugs.webkit.org/show_bug.cgi?id=36424
 
-2009-10-06  Xan Lopez  <xlopez@igalia.com>
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.receivedImages):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.pushImageNodes):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        Reviewed by Eric Seidel.
+2010-03-22  Darin Adler  <darin@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=25526
-        [Gtk] Additional support is needed for caret browsing
+        Reviewed by Dan Bernstein.
 
-        Enable caret movement commands also when caret browsing setting is
-        enabled.
+        TextBreakIteratorICU.cpp is incompatible with new UBreakIterator type in ICU 4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36381
 
-        * editing/EditorCommand.cpp:
-        (WebCore::caretBrowsingEnabled):
-        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
-        (WebCore::enabledInEditableTextOrCaretBrowsing):
-        (WebCore::CommandEntry::):
-        * manual-tests/gtk/caret-browsing.html: Added.
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::setUpIterator): Use reinterpret_cast instead of static_cast or relying
+        on conversion to void*.
+        (WebCore::textBreakFirst): Ditto.
+        (WebCore::textBreakLast): Ditto.
+        (WebCore::textBreakNext): Ditto.
+        (WebCore::textBreakPrevious): Ditto.
+        (WebCore::textBreakPreceding): Ditto.
+        (WebCore::textBreakFollowing): Ditto.
+        (WebCore::textBreakCurrent): Ditto.
+        (WebCore::isTextBreak): Ditto.
+        (WebCore::setUpIteratorWithRules): Ditto.
 
-2009-10-06  Anton Muhin  <antonm@chromium>
+2010-03-22  Eric Carlson  <eric.carlson@apple.com>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Sam Weinig.
 
-        Non standard, but popular exetension allows automagically
-        turn a function into a namespace resolver.  Support that in
-        Chromium as well.
+        Typo in GPL license text
+        https://bugs.webkit.org/show_bug.cgi?id=36442
 
-        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
-        https://bugs.webkit.org/show_bug.cgi?id=30128
+        Fix typo - "aint with this library" -> "along with this library".
 
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::getXPathNSResolver):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * bindings/scripts/generate-bindings.pl:
 
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Web Inspector: close inspector client view on
-        InspectorController::close API call.
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
 
-        In order to run batch web inspector layout tests (and not affect
-        subsequent tests) we should close inspector client's view upon
-        InspectorController::close API call.
+        Instead, keep one instance per RenderTheme around.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30009
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::findFrameLineWidth):
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedPageDestroyed):
-        (WebCore::InspectorController::close):
+2010-03-22  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Tor Arne Vestbø.
+        [Qt] Multiselect Popup - adjusting QtAbstractWebPopup
+        https://bugs.webkit.org/show_bug.cgi?id=36186
 
-        Fix the Qt/Windows build by stubbing out the still image
-        support for halted plugins for the Qt build.
+        QtAbstractWebPopup must provide new methods to be used by its descendants that
+        wish to handle <select multiple> elements.
 
-        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
-        tracks removing this by implementing Frame::nodeImage().
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::selectItem):
+        (WebCore::QtAbstractWebPopup::multiple):
+        * platform/qt/QtAbstractWebPopup.h:
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
+2010-03-22  Alex Milowski  <alex@milowski.com>
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Simon Hausmann.
+        Added basic support for mfrac (fractions)
 
-        [Qt] Change QImageReader usage in ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Test: mathml/presentation/fractions.xhtml
 
-        Replace the ReadContext with another appoach to
-        reading the image. Attempt to only read meta information
-        like the image size and number of frames (for animations)
-        first and then when the page is getting drawn decode
-        the image with the QImageReader.
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLFraction.cpp: Added.
+        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
+        (WebCore::RenderMathMLFraction::updateFromElement):
+        (WebCore::RenderMathMLFraction::addChild):
+        * mathml/RenderMathMLFraction.h: Added.
 
-        This is a huge benefit on pages with many images and saves
-        ~2GB of memory on the szeged image test page.
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::repetitionCount):
-        (WebCore::ImageDecoderQt::filenameExtension):
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
-        (WebCore::ImageDecoderQt::internalDecodeSize):
-        (WebCore::ImageDecoderQt::internalReadImage):
-        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
-        (WebCore::ImageDecoderQt::forceLoadEverything):
-        (WebCore::ImageDecoderQt::failRead):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        Reviewed by John Sullivan.
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-        Reviewed by Simon Hausmann.
+        * page/mac/WebCoreViewFactory.h: Added -missingPluginText method 
+        * platform/LocalizedStrings.h: Added missingPluginText()
+        * platform/gtk/LocalizedStringsGtk.cpp: Likewise.
+        * platform/mac/LocalizedStringsMac.mm: Same here.
+        * platform/qt/Localizations.cpp: Ditto.
 
-        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+2010-03-22  Yury Semikhatsky  <yurys@chromium.org>
 
-        Use the RGBA32Buffer instead of the internal ImageData
-        to be able to use support of the base class, optionally
-        support WebCore decoders for Qt and most importantly
-        separate metadata and image data for better cache control.
+        Reviewed by Pavel Feldman.
 
-        Remove ImageSourceQt as everything is now shared with
-        the normal ImageSource.
+        Handle worker exceptions in V8MessageHandler like it's done in regular documents. This way all worker exceptions will be logged in the console not only those which happen in event listeners. 
 
-        Change the ownership of the NativeImagePtr/QPixmap in
-        ImageQt.cpp to delete the m_frame to be subject to cache
-        control.
+        https://bugs.webkit.org/show_bug.cgi?id=31171
 
-        * WebCore.pro:
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::decodedImage):
-        (WebCore::RGBA32Buffer::getAddr):
-        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::setDecodedImage):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::asNewNativeImage):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Removed explicit call to reportException.
+        * bindings/v8/V8Utilities.cpp: reportException function was removed since it's not used.
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::v8MessageHandler):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): Setup message handler when first worker context is created.
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] ImageDecoderQt avoid QString creation.
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Add EFL-specific code to page/EventHandler.cpp.
+        http://webkit.org/b/36306
 
-        Avoid going from CString to QString to String
-        and go directly from CString to String. Also
-        avoid going to lower case to avoid an extra
-        memory allocation.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        * page/EventHandler.cpp:
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Cleanup the ImageDecoder of Qt.
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Remove the various enums for partial load. The fact is
-        that this image decoder will decode everything that is
-        in the file at once. Make it look like it behaves to
-        ease fixing this core problem.
+        Add EFL-specific code to platform/DragImage.h and
+        platform/DragData.h.
+        http://webkit.org/b/36310
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageData::ImageData):
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::hasFirstImageHeader):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/DragImage.h:
+        * platform/DragData.h:
 
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Reimplement frameCount instead of overloading it.
+        Add EFL-specific code to platform/FileSystem.h.
+        http://webkit.org/b/36313
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameCount):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/FileSystem.h:
 
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] QImageReader does not support progressive reading
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Add EFL-specific code to platform/Cursor.h.
+        http://webkit.org/b/36319
 
-        Change the ImageDecoderQt::setData to store the encoded
-        data in ImageDecoder.
+        * platform/Cursor.h:
 
-        Only call ReadContext when the whole Resource has been
-        loaded to avoid needless calls to reset and the
-        ReadContext as progressive loading is not supported.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Remove dead code from ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Add EFL-specific code to platform/NotImplemented.h.
+        http://webkit.org/b/36320
 
-        Remove unused variables and debugging code. The debug
-        code has never been used and does not provide anything
-        useful.
+        * platform/NotImplemented.h:
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::repetitionCount):
-        (WebCore::ImageDecoderQt::filenameExtension):
-        (WebCore::ImageDecoderQt::imageAtIndex):
-
-2009-10-06  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
-        https://bugs.webkit.org/show_bug.cgi?id=30120
-
-        Fix use of gst_video_format_parse_caps()
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-03-21  Kim Grönholm  <kim.gronholm@nomovok.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Update mediaControls CSS
-
-        * css/mediaControlsQt.css:
+        [Qt] GraphicsLayer: matrix interpolations in transform-animations don't behave correctly
+        https://bugs.webkit.org/show_bug.cgi?id=35520
+        
+        The case where the list of source and target transform operations are 
+        not the same but have the same size needs to be special-cased in
+        GraphicsLayerQt, as well as the case where the source or target
+        operation list is empty. The URLs listed here render correctly after
+        applying the patch.
 
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+        Tests: https://bug-35520-attachments.webkit.org/attachment.cgi?id=49890
+               https://bug-35520-attachments.webkit.org/attachment.cgi?id=49889
+            
 
-        Reviewed by Timothy Hatcher.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::TransformAnimationQt::applyFrame):
 
-        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+2010-03-21  Dmitry Gorbik  <socket.h@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30092
+        <http://webkit.org/b/14858> <col> width ignored when not tied to a single cell
 
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent):
-        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.update):
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype.onpopulate):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren):
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
-        * inspector/front-end/inspector.js:
-        * inspector/front-end/utilities.js:
-        (Node.prototype.rangeOfWord):
-        (traverseNextNode):
-        (traversePreviousNode):
-        (onlyTextChild):
-
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Do not call nodeTitleInfo twice +
-        followup fixes for r49101.
+        Reviewed by David Kilzer.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30087
+        Fixed width calculation for cells with span when <col> is defined.
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
+        Test: fast/table/col-width-span-expand.html
 
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleOrColWidth): Added the calculation of cell width
+        in case of <col> defined and span > 1.
 
-        Reviewed by Simon Hausmann.
+2010-03-20  Antonio Gomes  <tonikitoo@webkit.org>
 
-        [Qt] Windowless plugins: Enable painting on printer.
+        Reviewed by Kenneth Christiansen.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        The print preview dialog crashed because the depth of the drawable
-        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
-        and set a 24-bit pixmap as source, it will convert the source to
-        32-bit.
+        Spatial Navigation: Code simplification in FocusController.cpp and SpatialNavigation.cpp (part I)
+        https://bugs.webkit.org/show_bug.cgi?id=36168
 
-        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+        Make use of isNull and document methods introduced in FocusCandidate class by patch in bug 36167.
+        No functionalty change.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
 
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+        [wx] Build fixes after recent changes.
 
-        Reviewed by Simon Hausmann.
+        * platform/graphics/wx/ImageWx.cpp:
+        * wscript:
 
-        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+2010-03-20  Joseph Pecoraro  <joepeck@webkit.org>
 
-        The element gets resized when zoomed. So, we have to make sure that we resize
-        the drawable and do a setwindow call. Multiple calls to setwindow do not
-        crash plugin in windowless mode (unlike in windowed mode).
+        Reviewed by David Kilzer.
 
-        For mouse events we have to convert the pos to post-zoom position.
+        Assertion failure in media/video-controls-with-mutation-event-handler.html
+        https://bugs.webkit.org/show_bug.cgi?id=36376
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
+        Test: media/video-controls-with-mutation-event-handler.html
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::setXButtonEventSpecificFields):
-        (WebCore::setXMotionEventSpecificFields):
-        (WebCore::setXCrossingEventSpecificFields):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowIfNeeded):
+        Break early (when not attached) in the defaultEventHandler before the
+        slider is completely set up.
 
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
 
-        Reviewed by Simon Hausmann.
+2010-03-19  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+        Reviewed by Dan Bernstein.
 
-        Flash does not use the visual provided by us to draw into the drawable.
-        It instead uses the system default visual (as returned by XDefaultVisual).
-        This means that if the screen default visual is 24-bit, Flash won't be
-        able to draw on 32-bit drawable created by us. This is a bug in Flash
-        and for the moment, the above quirk is only set for Flash.
+        WebCore::RenderButton::styleDidChange ReadAV@NULL (6739b7fe455ecb54a6812c0866c3b47c)
+        https://bugs.webkit.org/show_bug.cgi?id=34641
 
-        Our strategy to create the drawable:
-        1. Create a 32-bit drawable if the default screen depth is 32 or the
-        quirk is not set (i.e not flash)
-        2. If we didn't create a 32-bit drawable (maybe the Display has no such
-        visual), we create a drawable with default screen depth.
+        Don't dig into buttons and menu lists when finding which element
+        should be modified by :first-letter pseudo class.  Even before
+        this change, we didn't dig into inline buttons and menu lists as
+        they are replaced so this issue wasn't found long time.
 
-        As a result of the above changes, content propagation behavior changes as:
-        1. Content propagation is possible only if the drawable we create and
-        Qt's backing store are of the same depth.
-        2. If we created a 32-bit drawable, there is no need for content
-        propagation (Qt will take care of it).
+        Test: fast/css/first-letter-block-form-controls-crash.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
 
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        * plugins/PluginQuirkSet.h:
-        (WebCore::):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::getVisualAndColormap):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
+2010-03-19  Adam Barth  <abarth@webkit.org>
 
-2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+        Reviewed by Daniel Bates.
 
-        Reviewed by Ariya Hidayat.
+        Change XSSAuditor block syntax
+        https://bugs.webkit.org/show_bug.cgi?id=34436
 
-        Qt build fix.
-        https://bugs.webkit.org/show_bug.cgi?id=29362.
+        Update our blocking syntax to something more reasonable.  Also,
+        implemented a way for a web site to disable the filter.
 
-        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
-        introduced to avoid the expensive construction of QBrush.
-        By casting WebCore::Color to QColor, we can compile on Qt 4.4
-        and use optimization for solid color fill in Qt 4.5.
+        Tests: http/tests/security/xssAuditor/no-protection-script-tag.html
+               http/tests/security/xssAuditor/xss-protection-parsing-01.html
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::drawBorderlessRectShadow):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::xssProtection):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::skipToken):
+        (WebCore::parseXSSProtectionHeader):
+        * platform/network/HTTPParsers.h:
+        (WebCore::):
 
-2009-10-05  Andrei Popescu  <andreip@google.com>
+2010-03-19  Eric Uhrhane  <ericu@chromium.org>
 
-        Reviewed by Eric Carlson.
+        Reviewed by Dmitry Titov.
 
-        Allow the platform media player to know the <video> poster URL.
-        Add MediaPlayerPrivate::prepareToPlay() to support media engines
-        that do not buffer video data automatically. This method allows
-        such media engines to start the buffering just before starting
-        playback.
-        https://bugs.webkit.org/show_bug.cgi?id=29133
+        Refactor DatabaseTracker.cpp for thread safety
+        https://bugs.webkit.org/show_bug.cgi?id=34991
 
-        All platforms that currently implement <video> return false
-        in MediaPlayerPrivate::canLoadPoster() and do nothing in
-        MediaPlayerPrivate::prepareToPlay() their behavior is
-        unchanged. The current set of media test should then be
-        sufficient to guarantee that this patch does not break anything.
+        This enables calling into DatabaseTracker from multiple context threads,
+        as will happen once Workers can access the Database.  It required a fair
+        amount of reshuffling of locks.  I ended up splitting the public
+        interface [calls that take locks and call private functions] from the
+        implementations [calls that assert that locks are already held] in order
+        to avoid lock conflicts.  I also had to make sure we weren't sharing
+        Strings or SecurityOrigins across threads.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadResource):
-        After the MediaPlayer is created, inform it what the poster URL is.
-        (WebCore::HTMLMediaElement::updatePlayState):
-        Add another case where prepareToPlay is called for the platforms
-        that do not buffer video content automatically.
-        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
-        Same as potentiallyPlaying, except that we don't check for
-        the readyState being at least HAVE_FUTURE_DATA.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
-        Empty implementation for the NullMediaPlayerPrivate.
-        (WebCore::NullMediaPlayerPrivate::setPoster):
-        Empty implementation for the NullMediaPlayerPrivate.
-        (WebCore::MediaPlayer::canLoadPoster):
-        Proxy to the m_private.
-        (WebCore::MediaPlayer::setPoster):
-        Proxy to m_private.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
-        (WebCore::MediaPlayerPrivateInterface::setPoster):
-        Add new methods that allow the platform player to receive the poster URL.
-        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
-        Notifies the media engine that playback should start. The media engine
-        should start preparing (e.g. by initializing the player and starting to buffer)
-        and call back when the state is changed to HAVE_FUTURE_DATA.
+        No new tests.
 
-2009-10-06  David Levin  <levin@chromium.org>
+        Allow access to database handles from multiple threads IFF SQLite is new enough and the user requests it.
 
-        Reviewed by Oliver Hunt.
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::disableThreadingChecks):
+        * platform/sql/SQLiteDatabase.h:
+        (WebCore::SQLiteDatabase::sqlite3Handle):
+        (WebCore::SQLiteDatabase::disableThreadingChecks):
 
-        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
-        https://bugs.webkit.org/show_bug.cgi?id=30095
+        Remove an asynchronous call from Database::close back to the execution thread, so that cleanup can be more deterministic.
 
-        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
-        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+        * storage/Database.cpp:
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        * storage/Database.h:
+        (WebCore::Database::):
+        * storage/DatabaseDetails.h:
+        (WebCore::DatabaseDetails::DatabaseDetails):
+        (WebCore::DatabaseDetails::thread):
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseCloseTask::doPerformTask):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
 
-        No visible change in functionality so no new tests.
+        Any Strings that get stored in DatabaseTracker, and any Strings returned from DatabaseTracker, are now threadsafeCopies.
+        Public functions now take all needed locks, then generally call only private functions [there are a few exceptions: deletion functions and origins()].
+        Private functions no longer take locks.
+        m_quotaMapGuard becomes m_databaseGuard, and now protects m_database, m_quotaMap, m_proposedDatabases, m_databaseDirectoryPath, m_originsBeingDeleted, m_beingCreated, and m_beingDeleted.
+        m_proposedDatabases replaces m_proposedDatabase, to account for reentrancy.
 
-        * dom/MessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::open):
-        (WebCore::IconDatabase::iconForPageURL):
-        (WebCore::IconDatabase::iconURLForPageURL):
-        (WebCore::IconDatabase::retainIconForPageURL):
-        (WebCore::IconDatabase::releaseIconForPageURL):
-        (WebCore::IconDatabase::setIconDataForIconURL):
-        (WebCore::IconDatabase::setIconURLForPageURL):
-        (WebCore::IconDatabase::databasePath):
-        (WebCore::IconDatabase::defaultDatabaseFilename):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
-        it makes threadsafe calls.
-        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
-        needed a threadsafe method.
-        * page/SecurityOrigin.h:
-        * platform/CrossThreadCopier.cpp:
-        (WebCore::::copy):
-        * platform/KURL.cpp:
-        (WebCore::KURL::copy):
-        * platform/network/HTTPHeaderMap.cpp:
-        (WebCore::HTTPHeaderMap::copyData):
-        * platform/network/ResourceErrorBase.cpp:
-        (WebCore::ResourceErrorBase::copy):
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::copyData):
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::copyData):
-        * platform/sql/SQLValue.cpp:
-        (WebCore::SQLValue::SQLValue):
-        (WebCore::SQLValue::string):
-        * platform/sql/SQLValue.h:
-        (WebCore::SQLValue::SQLValue):
-        All constructors now initialize the m_number which is a double. Failure to
-        do so can result in unexpected crashes when it is copied in the copy constructor.
-        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::threadsafeCopy):
-        (WebCore::String::crossThreadString):
-        * platform/text/StringImpl.cpp:
-        Removed StringImpl::substringCopy which was no longer being used anywhere.
-        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
-        it is threadsafe.
-        (WebCore::StringImpl::crossThreadString): The way to get strings for
-        another thread which is not threadsafe. This shares the underlying buffer
-        with both strings and gives them a way to do threadsafe refcounting for it.
-        * platform/text/StringImpl.h:
-        * storage/ChangeVersionWrapper.cpp:
-        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap):
-        (WebCore::Database::Database):
-        (WebCore::Database::getVersionFromDatabase):
-        (WebCore::Database::setVersionInDatabase):
-        (WebCore::Database::version):
-        (WebCore::Database::setExpectedVersion):
-        (WebCore::Database::securityOriginCopy):
-        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.h:
         * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::originQuotaManagerNoLock):
+        (WebCore::DatabaseTracker::originQuotaManager):
+        (WebCore::DatabaseTracker::DatabaseTracker):
+        (WebCore::DatabaseTracker::setDatabaseDirectoryPath):
+        (WebCore::DatabaseTracker::databaseDirectoryPath):
+        (WebCore::DatabaseTracker::trackerDatabasePath):
+        (WebCore::DatabaseTracker::openTrackerDatabase):
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::hasEntryForOriginNoLock):
+        (WebCore::DatabaseTracker::hasEntryForOrigin):
+        (WebCore::DatabaseTracker::hasEntryForDatabase):
+        (WebCore::DatabaseTracker::originPath):
+        (WebCore::DatabaseTracker::fullPathForDatabaseNoLock):
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::populateOrigins):
+        (WebCore::DatabaseTracker::origins):
+        (WebCore::DatabaseTracker::databaseNamesForOriginNoLock):
+        (WebCore::DatabaseTracker::databaseNamesForOrigin):
+        (WebCore::DatabaseTracker::detailsForNameAndOrigin):
+        (WebCore::DatabaseTracker::setDatabaseDetails):
+        (WebCore::DatabaseTracker::usageForDatabase):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::usageForOriginNoLock):
+        (WebCore::DatabaseTracker::usageForOrigin):
+        (WebCore::DatabaseTracker::quotaForOriginNoLock):
+        (WebCore::DatabaseTracker::quotaForOrigin):
+        (WebCore::DatabaseTracker::setQuota):
+        (WebCore::DatabaseTracker::addDatabase):
+        (WebCore::DatabaseTracker::deleteAllDatabases):
+        (WebCore::DatabaseTracker::deleteOrigin):
+        (WebCore::DatabaseTracker::deleteDatabase):
+        (WebCore::DatabaseTracker::deleteDatabaseFile):
+        (WebCore::DatabaseTracker::setClient):
         (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
-        * storage/OriginQuotaManager.cpp:
-        (WebCore::OriginQuotaManager::addDatabase):
-        * storage/SQLError.h:
-        (WebCore::SQLError::message):
-        (WebCore::SQLError::SQLError):
-        * storage/SQLStatement.cpp:
-        (WebCore::SQLStatement::SQLStatement):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::syncTimerFired):
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::importItem):
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
-        (WebCore::SharedWorkerProxy::name):
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
-        * workers/SharedWorkerThread.cpp:
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::Task::Task):
-        (WebCore::WorkerRunLoop::postTaskForMode):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
-
-        This has the following advantages:
-        1. Allows more sharing of code between gtk and Qt ports in the future
-        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
-        3. QPixmap may sometime change depth behind our back! This will require us to
-        update the plugin about the new visual and colormap.
-        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
-        -graphicssystem raster, QPixmap uses the raster (image) backend.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::platformDestroy):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Add support for windowless NPAPI plugins
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect):
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::setSharedXEventFields):
-        (WebCore::PluginView::initXEvent):
-        (WebCore::setXKeyEventSpecificFields):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::inputEventState):
-        (WebCore::setXButtonEventSpecificFields):
-        (WebCore::setXMotionEventSpecificFields):
-        (WebCore::setXCrossingEventSpecificFields):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::handleFocusInEvent):
-        (WebCore::PluginView::handleFocusOutEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::getPluginDisplay):
-        (WebCore::PluginView::platformStart):
-
-2009-10-05  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Filters do not support source images besides "sourceGraphic"
-        [https://bugs.webkit.org/show_bug.cgi?id=6022]
-
-        Add support for SourceAlpha to SVG filters.
+        (WebCore::DatabaseTracker::notifyDatabasesChanged):
+
+        These functions keep track of in-progress deletions and creations, so that we can make sure nobody every deletes a database file while a live database is using it.
+        (WebCore::DatabaseTracker::canCreateDatabase):
+        (WebCore::DatabaseTracker::recordCreatingDatabase):
+        (WebCore::DatabaseTracker::doneCreatingDatabase):
+        (WebCore::DatabaseTracker::creatingDatabase):
+        (WebCore::DatabaseTracker::canDeleteDatabase):
+        (WebCore::DatabaseTracker::recordDeletingDatabase):
+        (WebCore::DatabaseTracker::doneDeletingDatabase):
+        (WebCore::DatabaseTracker::deletingDatabase):
+        (WebCore::DatabaseTracker::canDeleteOrigin):
+        (WebCore::DatabaseTracker::deletingOrigin):
+        (WebCore::DatabaseTracker::recordDeletingOrigin):
+        (WebCore::DatabaseTracker::doneDeletingOrigin):
+
+        Any SecurityOrigins stored in OriginQuotaManager are now threadsafeCopies of inputs.  There's a new tryLock() function in addition to the existing lock().
 
-        Test: svg/filters/sourceAlpha.svg
-
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::calculateEffectRect):
-        (WebCore::SourceAlpha::apply):
-        * platform/graphics/filters/SourceAlpha.h:
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::tryLock):
+        (WebCore::OriginQuotaManager::trackOrigin):
+        * storage/OriginQuotaManager.h:
 
-2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::databaseIdentifier):
+        Removed DEFINE_STATIC_LOCAL wrapper on a local variable; it appears to have been a small optimization, but it's not thread-safe.
 
-        Reviewed by Adam Barth.
+2010-03-19  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Fix reliablity bot crash in DateExtension.
-        https://bugs.webkit.org/show_bug.cgi?id=30033
+        Reviewed by Antti Koivisto.
 
-        There were a few problems using the weak persistent pointers because no one else had a
-        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+        Multiselect popups - rendering
+        https://bugs.webkit.org/show_bug.cgi?id=36006
 
-        * bindings/v8/DateExtension.cpp:
-        (WebCore::DateExtension::setAllowSleep):
-        (WebCore::DateExtension::GetNativeFunction):
-        (WebCore::DateExtension::Setup):
-        (WebCore::DateExtension::OnSleepDetected):
-        * bindings/v8/DateExtension.h:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        (WebCore::V8HiddenPropertyName::sleepFunction):
-        * bindings/v8/V8HiddenPropertyName.h:
+        The objective of this patch is to create a compile time flag that can be used
+        to force all <select> elements to be rendered as menu lists.
 
-2009-10-05  Stephanie Lewis  <slewis@apple.com>
+        Theme stylesheet mechanism has been used to change the appearance of the elements.
 
-        Reviewed by Dan Bernstein.
+        Class QtStyleOptionWebComboBox has been introduced to provide to QStyle objects
+        the needed information to render <select multiple> comboboxes.
 
-        Crash when trying to load a null stylesheet for a site specific hack. 
-        https://bugs.webkit.org/show_bug.cgi?id=30105
+        * WebCore.pri:
+        * WebCore.pro:
+        * css/themeQtNoListboxes.css: Added.
+        (select[size][multiple]):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::usesMenuList):
+        * platform/qt/QtStyleOptionWebComboBox.h: Added.
+        (WebCore::QtStyleOptionWebComboBox::QtStyleOptionWebComboBox):
+        (WebCore::QtStyleOptionWebComboBox::multiple):
+        (WebCore::QtStyleOptionWebComboBox::checkMultiple):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        * platform/qt/RenderThemeQt.h:
 
-        Created a testcase and tested in browser.  DRT doesn't test
-        site specific hacks.
+2010-03-19  Zhenyao Mo  <zmo@google.com>
 
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        Reviewed by Oliver Hunt.
 
-2009-10-05  James Robinson  <jamesr@google.com>
+        Update WebGLArray.slice() to new spec
+        https://bugs.webkit.org/show_bug.cgi?id-35612
+
+        * bindings/js/JSWebGLArrayCustom.cpp: Adding support for default inputs.
+        (WebCore::JSWebGLArray::slice):
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Ditto.
+        (WebCore::V8WebGLArray::sliceCallback):
+        * html/canvas/WebGLArray.cpp: Map start/end to offset/length.
+        (WebCore::WebGLArray::calculateOffsetAndLength):
+        * html/canvas/WebGLArray.h: Modified slice parameters.
+        * html/canvas/WebGLArray.idl: Define custom binding for slice().
+        * html/canvas/WebGLByteArray.cpp: Modified slice parameters.
+        (WebCore::WebGLByteArray::slice):
+        * html/canvas/WebGLByteArray.h: Ditto.
+        * html/canvas/WebGLFloatArray.cpp: Ditto.
+        (WebCore::WebGLFloatArray::slice):
+        * html/canvas/WebGLFloatArray.h: Ditto.
+        * html/canvas/WebGLIntArray.cpp: Ditto.
+        (WebCore::WebGLIntArray::slice):
+        * html/canvas/WebGLIntArray.h: Ditto.
+        * html/canvas/WebGLShortArray.cpp: Ditto.
+        (WebCore::WebGLShortArray::slice):
+        * html/canvas/WebGLShortArray.h: Ditto.
+        * html/canvas/WebGLUnsignedByteArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedByteArray::slice):
+        * html/canvas/WebGLUnsignedByteArray.h: Ditto.
+        * html/canvas/WebGLUnsignedIntArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedIntArray::slice):
+        * html/canvas/WebGLUnsignedIntArray.h: Ditto.
+        * html/canvas/WebGLUnsignedShortArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedShortArray::slice):
+        * html/canvas/WebGLUnsignedShortArray.h: Ditto.
+
+2010-03-19  Yong Li <yong.li@torchmobile.com> and Andy Estes <aestes@apple.com>
 
         Reviewed by Darin Adler.
 
-        Fix forward declaration (struct vs class mismatch)
-
-        https://bugs.webkit.org/show_bug.cgi?id=30094
-
-        * loader/RedirectScheduler.h:
+        Ensure the segments inside SharedBuffer are merged before constructing
+        a CFData with it.
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=50843
 
-        Unreviewed, last Chromium build fix corresponding to revision 49113.
-        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+        * manual-tests/WebKitSite.webarchive: Added.
+        * manual-tests/webarchive-test.html: Added.
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::createCFData):
 
-        * bindings/v8/DOMObjectsInclude.h:
-
-2009-10-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix Windows build.
+2010-03-19  Justin Schuh  <jschuh@chromium.org>
 
-        * html/HTMLMediaElement.cpp:
+        Reviewed by Oliver Hunt.
 
-2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+        Security: ReadAV@NULL for negative feMorphology filter radius
+        https://bugs.webkit.org/show_bug.cgi?id=34566
 
-        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+        Prevents building the filter if either radius is negative.
+        Catches negative radii resulting from conversions.
 
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Test: svg/filters/feMorphology-invalid-radius.svg
 
-2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
-
-        Reviewed by Simon Fraser
-        
-        Support fullscreen in MediaPlayer (Mac)
-        https://bugs.webkit.org/show_bug.cgi?id=26742
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
 
-        Add a fullscreen button to the <video> controller if the media engine,
-        and the theme have support for fullscreen, and can show appropriate controls.
-        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
-        in WebKit to do a nice animation to fullscreen, with a custom controller.
+2010-03-19  Chris Marrin  <cmarrin@apple.com>
 
-        * DerivedSources.make:
-        * WebCore.Video.exp: Added.
-        New export file for when VIDEO is enabled.
-        
-        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
-        * WebCore.xcodeproj/project.pbxproj: New files
-        
-        * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::willRemove):
-        (WebCore::HTMLMediaElement::screenRect):
-        (WebCore::HTMLMediaElement::enterFullscreen):
-        (WebCore::HTMLMediaElement::exitFullscreen):
-        (WebCore::HTMLMediaElement::platformMedia):
-        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
-        used for fullscreen.
-        
-        * html/HTMLVideoElement.h:
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
-        to see if it's possile to enter fullscreen for this element.
-        
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::supportsFullscreenForNode):
-        (WebCore::ChromeClient::enterFullscreenForNode):
-        (WebCore::ChromeClient::exitFullscreenForNode):
-        New methods
-        
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::platformMedia):
-        (WebCore::MediaPlayer::platformMedia):
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::platformMedia):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::platformMedia):
-        (WebCore::MediaPlayerPrivate::supportsFullscreen):
-        New methods to return platform-specific playback data for fullscreen.
-        
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
-        Hook up the fullscreen button.
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
-        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
-        on the QuickTime version, since this affects what controls are availabl.e
-
-2009-10-05  Kevin Decker  <kdecker@apple.com>
+        Reviewed by Simon Fraser.
 
-        Export a few more methods from Settings.h
-        
-        Rubberstamped by Jon Honeycutt.
+        Fixed a crash with AnimationController getting deleted out from under itself.
         
-        * WebCore.base.exp:
+        It's possible for the Frame that owns an AnimationController to get deleted
+        in the EndTransitionEvent (or other animation events) to get deleted in the
+        event handler. Normally this case is protected against by preventing the Frame
+        from getting deleted until the end of the runloop. But native uses of the 
+        WebView can subvert this protection. So I added a protector to the 
+        animation event dispatcher to protect it in those cases.
 
-2009-10-05  Dmitry Titov  <dimich@chromium.org>
+        Test: transitions/transition-end-event-destroy-iframe.html
 
-        Reviewed by Darin Adler.
-
-        1-char fix for obviously reverse condition.
-        https://bugs.webkit.org/show_bug.cgi?id=30100
-        No test since the only difference is a timing of GC.
-
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
 
-2009-09-30  Kenneth Russell  <kbr@google.com>
+2010-03-19  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Darin Fisher.
-
-        Update platform-specific #ifdefs in GraphicsContext3D.h for the
-        Chromium port.
-        https://bugs.webkit.org/show_bug.cgi?id=29936
+        Reviewed by Antti Koivisto.
 
-        * platform/graphics/GraphicsContext3D.h:
-        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+        Multiselect Popup - PopupMenuClient extension
+        https://bugs.webkit.org/show_bug.cgi?id=36178
 
-2009-10-05  Dan Bernstein  <mitz@apple.com>
+        PopupMenuClient class is the interface used by combobox popup implementations.
+        It needs to be extended to handle <select multiple> needs.
 
-        Reviewed by Darin Adler.
+        A new interface named ListPopupMenuClient that inherits from PopupMenuClient was created.
+        The use of this new class instead of adding methods to PopupMenuClient avoids changes
+        in other non related implementations of PopupMenuClient.
 
-        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
-        <rdar://problem/7269108>
-        https://bugs.webkit.org/show_bug.cgi?id=29982
+        RenderMenuList has changed to inherit ListPopupMenuClient instead of PopupMenuClient
+        and to have the new methods implemented.
 
-        Test: fast/repaint/line-in-scrolled-clipped-block.html
+        * platform/PopupMenuClient.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::listBoxSelectItem):
+        (WebCore::RenderMenuList::multiple):
+        * rendering/RenderMenuList.h:
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
-        (including layout overflow) for the repaint rect calculation.
+2010-03-19  Simon Fraser  <simon.fraser@apple.com>
 
-2009-10-05  Drew Wilson  <atwilson@google.com>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=36387
+        REGRESSION: Can "uncheck" radio buttons by clicking on them
+        
+        My change in r56174 caused radio buttons and checkboxes to go down the same code path by virtue
+        of allowsIndeterminate(), but this broke save/restore behavior on radio buttons.
+        
+        Fix by saving and restoring both the intermediate and checked state for radio buttons
+        and checkboxes, as well as the "current radio button" state.
 
-        Chromium wants to turn off SharedWorkers at runtime
-        https://bugs.webkit.org/show_bug.cgi?id=29757
+        Test: fast/forms/radio-checkbox-restore-indeterminate.html
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::sharedWorker):
-        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerRepository::isAvailable):
-        Made SharedWorkers available by default.
-        * workers/SharedWorkerRepository.h:
-        Added definition for SharedWorkerRepository::isAvailable().
+        * html/HTMLInputElement.cpp:
+        (WebCore::EventHandlingState::EventHandlingState): New struct to hold state between preDispatchEventHandler()
+        and postDispatchEventHandler().
+        (WebCore::HTMLInputElement::preDispatchEventHandler): Store intermedate and checked state
+        and the current radio button.
+        (WebCore::HTMLInputElement::postDispatchEventHandler): Restore state as appropriate.
+        * html/HTMLInputElement.h: Add a comment to clarify how 'intermediate' interacts with 'checked', according
+        to the spec.
 
-2009-10-05  Hironori Bono  <hbono@chromium.org>
+2010-03-19  Alexander Pavlov  <apavlov@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Pavel Feldman.
 
-        A super quick fix for Bug 28710.
+        Web Inspector: caret moves past prompt in javascript console
+        https://bugs.webkit.org/show_bug.cgi?id=26602
 
-        https://bugs.webkit.org/show_bug.cgi?id=28710
+        Having noticed any Element children besides a leading <br> (which are empty
+        text nodes), WebCore editing facility thinks it should delete the <br>,
+        thus clearing away the text prompt contents.
 
-        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
-        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
-        (This change is nothing but a better-than-crash change.)
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.clearAutoComplete):
+        (WebInspector.TextPrompt.prototype._completionsReady):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.pruneEmptyTextNodes):
 
-        Tests: editing/selection/select-crash-001.html
-               editing/selection/select-crash-002.html
+2010-03-19  Adam Roben  <aroben@apple.com>
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
-        * editing/markup.cpp:
-        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+        Windows clean build fix after r56192
 
-2009-10-05  Sam Weinig  <sam@webkit.org>
+        * WebCore.vcproj/WebCore.vcproj: Copy headers from
+        platform/graphics/cg to $WebKitOutputDir as part of the post-build
+        event so that WebKit can use them. (The only one we currently require
+        is FontPlatformData.h.)
 
-        Reviewed by Mark Rowe.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp: Touched to force a
+        build.
 
-        Silence duplicate errors logged for missing getComputedStyle
-        implementations. Improves the error message as well.
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::logUnimplementedPropertyID):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Reviewed by David Kilzer.
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        Assertion failure in media/video-controls-with-mutation-event-handler.html
+        https://bugs.webkit.org/show_bug.cgi?id=36376
 
-        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+        Fix crashing test. Underlying the media element's volume slider is a
+        range input, which sanitizes values before expected on the media control.
 
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
 
-2009-10-05  Mark Rowe  <mrowe@apple.com>
+2010-03-19  Brady Eidson  <beidson@apple.com>
 
-        Try and fix the GTK build.
+        Reviewed by Darin Adler.
 
-        * GNUmakefile.am:
+        3 of the new HTML5 loading events need to be asynchronous.
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        Laying the groundwork for:
+        https://bugs.webkit.org/show_bug.cgi?id=36201
+        https://bugs.webkit.org/show_bug.cgi?id=36202
+        https://bugs.webkit.org/show_bug.cgi?id=36334
+        https://bugs.webkit.org/show_bug.cgi?id=36335
 
-        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+        Document already had an asynchronous event delivery mechanism for storage events, so
+        we can repurpose that for all async events.
 
-        * bindings/v8/V8Index.h:
+        No new tests. (No change in behavior)
 
-2009-10-05  Julie Parent  <jparent@chromium.org>
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::implicitClose): Use Document::schedule* for the related events.
+        (WebCore::Document::enqueueEvent): Renamed from enqueueStorageEvent
+        (WebCore::Document::pendingEventTimerFired): Renamed from "storageEventTimerFired"
+        (WebCore::Document::statePopped): Use Document::schedulePopstateEvent
+        (WebCore::Document::enqueuePageshowEvent): All Pageshow events are piped through here.
+          This will be made asynchronous in a separate patch.
+        (WebCore::Document::enqueueHashchangeEvent): All Hashchange events are piped through here.
+          This will be made asynchronous in a separate patch.
+        (WebCore::Document::enqueuePopstateEvent): All Popstate events are piped through here.
+          This will be made asynchronous in a separate patch.
+        * dom/Document.h:
+        (WebCore::):
 
-        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Use Document::enqueuePageshowEvent
 
-        * WebCore.gypi:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Use Document::enqueueHashchangeEvent
 
-2009-10-05  Dave Hyatt  <hyatt@apple.com>
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch): Use Document::enqueueEvent
 
-        Reviewed by Sam Weinig.
+2010-03-19  Kevin Decker  <kdecker@apple.com>
 
-        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
-        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
-        from occurring.
+        Reviewed by Darin Adler and Brady Eidson.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/BeforeLoadEvent.h: Added.
-        (WebCore::BeforeLoadEvent::create):
-        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
-        (WebCore::BeforeLoadEvent::url):
-        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
-        * dom/BeforeLoadEvent.idl: Added.
-        * dom/EventNames.h:
-        * page/DOMWindow.idl:
+        First step toward:
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-2009-10-05  Priit Laes  <plaes@plaes.org>
+        This is the first step torward eliminating the WebKit WebNullPluginView class. The responsibility for this will soon
+        be in platform-independent code in WebCore. The plan is to change RenderEmbeddedObject and give it the capability of
+        drawing the missing plug-in text. 
 
-        Reviewed by Gustavo Noronha.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject): Renamed the renderer parameter to requestEmbeddedObject and made it
+        a RenderEmbeddedObject.
+        (WebCore::FrameLoader::loadPlugin): Likewise.
+        * loader/FrameLoader.h: Updated loadPlugin() and requestObject() method signatures accordingly. 
 
-        Add Gentoo-specific paths for searching browser plugins.
-        https://bugs.webkit.org/show_bug.cgi?id=30088
+2010-03-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::defaultPluginDirectories):
+        Reviewed by Simon Hausmann.
 
-2009-10-02  Chris Marrin  <cmarrin@apple.com>
+        [Qt] Disable TILED_BACKING_STORE if Qt version is earlier than Qt4.6
+        https://bugs.webkit.org/show_bug.cgi?id=36348
 
-        Reviewed by Adele Peterson.
+        Backing store implementation for QtWebKit requires at least Qt
+        version 4.6.
 
-        Add functionality to pause/throttle CSS transitions/animations in a WebView
-        https://bugs.webkit.org/show_bug.cgi?id=29942
+        No new tests as there is no new functionality.
 
-        Exporting call from AnimationController
+        * WebCore.pri:
 
-        * WebCore.base.exp:
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-10-05  Kevin Decker  <kdecker@apple.com>
+        Reviewed by David Kilzer.
 
-        Rubberstamped by Anders Carlsson.
-        
-        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
-        * WebCore.xcodeproj/project.pbxproj: Likewise.
+        <input type=range> does not validate correctly without a renderer and the tests are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=36259
 
-2009-10-05  Eric Seidel  <eric@webkit.org>
+        Setting value attribute on an <input type=range> to an out-of-range value fires oninput
+        https://bugs.webkit.org/show_bug.cgi?id=16990
 
-        No review, rolling out r49104.
-        http://trac.webkit.org/changeset/49104
+        Part 2 of 2: When setting the range element's value, overflows and underflows
+        are automatically sanitized to valid values. Moved the general case
+        sanitization code out of the Renderer into HTMLInputElement::sanitizeValue.
 
         * html/HTMLInputElement.cpp:
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
+        (WebCore::HTMLInputElement::value): when getting a default value on reset() ensure the defaultValue is provided
+        (WebCore::HTMLInputElement::sanitizeValue): clamp the value within the max/min/step range constraints
+        * html/StepRange.cpp:
+        (WebCore::StepRange::StepRange): allow const element in the constructor
+        (WebCore::StepRange::clampValue): clamp from a String value
+        * html/StepRange.h:
+        (WebCore::StepRange::defaultValue): easy calculation of the default value for max/min/step range constraints
         * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
+        (WebCore::RenderSlider::updateFromElement): no longer handle the general case sanitization in the renderer
 
-2009-10-05  Kent Tamura  <tkent@chromium.org>
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by David Kilzer.
 
-        Update style immediately when validation-related values are updated.
-        https://bugs.webkit.org/show_bug.cgi?id=28868
+        <input type=range> does not validate correctly without a renderer and the tests are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=36259
 
-        In order to apply :valid, :invalid, :optional or :required lively,
-          - call setNeedsStyleRecalc() when properties which can change
-            willValidate state are updated, and
-             (Parent form element, name, disabled, readonly)
-          - call updateValidity() when properties which can change validity
-            state are updated. (value, pattern, required)
+        Part 1 of 2: Refactoring the SliderRange struct out of RenderSlider
+        into a more appropriate place. Changed the named to StepRange. Changed
+        from a struct to a class.
 
-        Tests: fast/forms/input-live-pseudo-selectors.html
-               fast/forms/textarea-live-pseudo-selectors.html
+          Added new files to the build.
 
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
-        (WebCore::HTMLFormControlElement::parseMappedAttribute):
-        (WebCore::HTMLFormControlElement::required):
-        (WebCore::HTMLFormControlElement::updateValidity):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        (WebCore::HTMLInputElement::setFileListFromRenderer):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::setValue):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
-
-2009-10-05  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Implement min/max attributes, ValidityState.rangeUnderflow and
-        ValidityState.rangeOverflow for <input type=number> and <input type=range>
-        https://bugs.webkit.org/show_bug.cgi?id=29069
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Tests: fast/forms/ValidityState-rangeOverflow-number.html
-               fast/forms/ValidityState-rangeOverflow-range.html
-               fast/forms/ValidityState-rangeUnderflow-number.html
-               fast/forms/ValidityState-rangeUnderflow-range.html
-               fast/forms/input-minmax.html
+          Renamed and moved class SliderRange to StepRange.
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::rangeUnderflow):
-        (WebCore::HTMLInputElement::rangeOverflow):
-        (WebCore::HTMLInputElement::rangeMinimum):
-        (WebCore::HTMLInputElement::rangeMaximum):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * html/ValidityState.h:
+        * html/StepRange.cpp: Added.
+        (WebCore::StepRange::StepRange):
+        (WebCore::StepRange::clampValue):
+        (WebCore::StepRange::valueFromElement):
+        (WebCore::sliderPosition):
+        * html/StepRange.h: Added.
+        (WebCore::StepRange::proportionFromValue):
+        (WebCore::StepRange::valueFromProportion):
         * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
-
-2009-10-05  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Introduces
-         - new CSS pseudo selector: "-webkit-input-list-button"
-         - new CSS apperance type: "list-button"
-         - new ControlPart value: "ListButtonPart"
-        for the UI of the list attribute of the input element, and adds
-        implementation to draw ListButtonPart on Mac.
-        The code is guarded by ENABLE(DATALIST).
+        (WebCore::RenderSlider::updateFromElement): updated to use StepRange
+        (WebCore::RenderSlider::setValueForPosition): updated to use StepRange
 
-        https://bugs.webkit.org/show_bug.cgi?id=27794
-
-        Test: platform/mac/fast/forms/input-list-button-size.html
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        * css/CSSValueKeywords.in:
-        * css/html.css:
-        * html/HTMLInputElement.cpp:
-        * platform/ThemeTypes.h:
-        (WebCore::):
-        * platform/mac/ThemeMac.mm:
-        (WebCore::listButtonSizes):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::controlSize):
-        (WebCore::ThemeMac::minimumControlSize):
-        (WebCore::ThemeMac::controlBorder):
-        (WebCore::ThemeMac::paint):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-10-05  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
-        nodeTitleInfo should be placed in ElementsTreeOutline.
-        
-        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._updateTitle):
-        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
-        * inspector/front-end/utilities.js:
-
-2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-19  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Inform the application when a new request is created
-        https://bugs.webkit.org/show_bug.cgi?id=29975
-
-        Emit a signal each time a request is created, with the request and the frame
-        that created it.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::start):
-
-2009-10-05  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Darin Adler.
-
-        Add an ASSERT in updateGuidVersionMap.
-        https://bugs.webkit.org/show_bug.cgi?id=30077
-
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
-
-2009-10-05  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Allow V8 to throw an exception in _NPN_SetException without worrying about context
-        if we don't have enough information to find the correct context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30026
+        https://bugs.webkit.org/show_bug.cgi?id=36366
+        Repaint loop when painting using scaled CTMs with different translations
 
-        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+        The code in RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality
+        tests if the scaling has changed from the previous value by comparing the
+        transformations. The test fails if the scale is the same but the translation 
+        changes. This can lead to infinite repaint loop if the document is painted 
+        in pieces using different translations (for example for tiling).
 
-        * bindings/v8/NPV8Object.cpp: 
-        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
 
-2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+2010-03-19  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+        Web Inspector: editing shorthands does not always work.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29961
+        https://bugs.webkit.org/show_bug.cgi?id=36362
 
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::applyStyleText):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorDOMAgent::shorthandValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
         * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
+        (.section .properties li.disabled .enabled-button):
         * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
+        (WebInspector.startEditing.editingCommitted):
 
-2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+2010-03-19  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Added pure virtual QWebPageClient::pluginParent()
-
-        https://bugs.webkit.org/show_bug.cgi?id=29710
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
-        https://bugs.webkit.org/show_bug.cgi?id=30042
-
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
+        [Qt] Don't replace clip when drawing complex text
 
-2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
-
-        V8ObjectEventListener.h has been removed at r48978
-
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-
-2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector console stops working while JS in IFRAME is paused.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29958
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateOn):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-
-2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Introduce inspected object groups for console
-        and watch evaluation results so that they could be released
-        explicitly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29891
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::wrapObject):
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::wrapObject):
-        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::wrapObject):
-        (WebCore::InspectorController::unwrapObject):
-        (WebCore::InspectorController::releaseWrapperObjectGroup):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._enterKeyPressed):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateAndWrap):
-        (InjectedScript.evaluateInCallFrame):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSidebarPane):
-        (WebInspector.WatchExpressionsSection.prototype.update):
-
-2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Eric Carlson.
-
-        Move mediaControls extras for the Qt port into WebCore/css like other ports
-
-        https://bugs.webkit.org/show_bug.cgi?id=30013
-
-        * WebCore.pro:
-        * WebCore.qrc:
-        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
-
-2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Eric Carlson.
-
-        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
-
-        https://bugs.webkit.org/show_bug.cgi?id=30013
-
-        The QT suffix has been expanded to QuickTime, to not cause confusion
-        and name-crashes with similar files in the Qt port.
-
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::):
-        (WebCore::mediaControllerTheme):
-        (WebCore::RenderThemeMac::adjustSliderThumbSize):
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
-
-2009-10-04  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-        
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
-        Syntax Highlighting CSS shouldn't be duplicated.
-
-        Refactor syntax highlighting CSS into a new file, add it to the
-        projects, and have SourceFrame.js and inspector.html include the
-        new CSS file.
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
-        * inspector/front-end/WebKit.qrc:
-
-2009-10-04  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-        
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
-        Inspector should syntax highlight JS/CSS in elements view.
-
-        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
-        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
-        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
-        or style tag.
-
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/utilities.js:
-
-2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Eric Seidel
-
-        Enable Web Sockets in chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=29917
-
-        * WebCore.gyp/WebCore.gyp:
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustova Noronha.
-
-        [GTK] performs a POST when refreshing a view that was obtained with a GET
-        https://bugs.webkit.org/show_bug.cgi?id=29761
-
-        Update the HTTP method in the request stored by willSendRequest
-        after a redirect, since it could have changed.
-
-        Test: http/tests/navigation/postredirect-reload.html
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Revert previous patch, as the newly added test breaks other tests.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustova Noronha.
-
-        [GTK] performs a POST when refreshing a view that was obtained with a GET
-        https://bugs.webkit.org/show_bug.cgi?id=29761
-
-        Update the HTTP method in the request stored by willSendRequest
-        after a redirect, since it could have changed.
-
-        Test: http/tests/navigation/postredirect-reload.html
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
+        * platform/graphics/qt/FontQt.cpp:
 
-2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+2010-03-18  Darin Fisher  <darin@chromium.org>
 
         Reviewed by Adam Barth.
 
-        [V8] Fixed Function leak in V8LazyEventListener.
-        (Should fix the remaning leak in
-        https://bugs.webkit.org/show_bug.cgi?id=29093).
-        V8LazyEventListeners used to create FunctionTemplates for each
-        wrapped listener which in turn created Functions that were cached
-        forever in V8 Context. Now there is at most one such Function per
-        Context.
-        https://bugs.webkit.org/show_bug.cgi?id=30060
-
-        Added new hidden property name to store toString result:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        * bindings/v8/V8HiddenPropertyName.h:
-
-        Switched to static FunctionTemplate:
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListenerToString):
-        (WebCore::V8LazyEventListener::prepareListenerObject):
-
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
+        If a frame is already in the document, then setting its "src" attribute
+        should add the resultant navigation to history.
 
-        CSS Source View Should be Syntax Highlighted
-        https://bugs.webkit.org/show_bug.cgi?id=14359
+        https://bugs.webkit.org/show_bug.cgi?id=9166
 
-          Support for WebKit's CSS Variables @variables and var()
-
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.CSSSourceSyntaxHighligher):
-
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
+        This behavior is specified in section 4.8.2 of the HTML5 spec.
 
-        Inspector should remember preferences for docked/undocked etc
-        https://bugs.webkit.org/show_bug.cgi?id=29089
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
-        * inspector/front-end/inspector.js:
-        (WebInspector._loadPreferences): factored out loading preferences
-        (WebInspector.loaded):
-
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        CSS Source View Should be Syntax Highlighted
-        https://bugs.webkit.org/show_bug.cgi?id=14359
-
-          Trigger the Syntax Highlighter for CSS files.
-
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
-        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._contentLoaded):
-
-          Factored out the Syntax Highlighting procedure into a "Class"
-          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
-
-        (WebInspector.SourceSyntaxHighligher):
-        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
-        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
-        (WebInspector.SourceSyntaxHighligher.prototype.process):
-        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
-        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
-
-2009-10-03  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Factor back-forward list methods out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30037
-
-        This change moves these back-forward related methods from FrameLoader
-        to Page.  It's possible we should move these methods into some kind of
-        "page controller" object, but we can figure that out in a future patch.
+        Test: fast/loader/frame-src-change-added-to-history.html
 
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::openURL):
+        (WebCore::HTMLFrameElementBase::setLocation):
+        * html/HTMLFrameElementBase.h:
         * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
         * loader/FrameLoader.h:
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::close):
-        * page/History.cpp:
-        (WebCore::History::length):
-        * page/Page.cpp:
-        (WebCore::Page::canGoBackOrForward):
-        (WebCore::Page::goBackOrForward):
-        (WebCore::Page::getHistoryLength):
-        * page/Page.h:
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::populate):
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-
-2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: prepare InspectorController for being used from layout tests.
-        This change adds evaluateForTestInFrontend method with the callback that
-        allows evaluating arbitrary code in the frontend context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30008
-
-        * WebCore.Inspector.exp:
-        * WebCore.order:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-        (WebCore::InspectorController::didEvaluateForTestInFrontend):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/inspector.js:
-        (WebInspector.evaluateForTestInFrontend):
-
-2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Node search mode is not getting reset on element selection.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30016
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
-        Should be able to resize Cookie Columns.
 
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView.prototype.update.callback):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.resize):
-
-2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Make WebCore::PluginView participate in plug-in halting.
-
-        Reviewed by Sam Weinig.
+2010-03-18  Chris Evans  <cevans@chromium.org>
 
-        * platform/graphics/BitmapImage.h:
-        Declare a create() function that takes an HBITMAP.
+        Reviewed by Nikolas Zimmermann.
 
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::create):
-        Use GetObject() to fill out a DIBSECTION structure for the given
-        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
-        bits of the bitmap. Create a CG image from the context, and pass this
-        when creating a new BitmapImage.
+        Fix a minor crash with mismatched array sizes in SVG animation
+        elements.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        If we successfully started, tell our parent frame's Page.
-        (WebCore::PluginView::stop):
-        Tell our parent frame's Page that we stopped.
-        (WebCore::PluginView::node):
+        https://bugs.webkit.org/show_bug.cgi?id=35606
 
-        * plugins/PluginView.h:
-        Inherit from HaltablePlugin.
-        (WebCore::PluginView::setPlatformPluginWidget):
-        On platforms where the platform plug-in widget is the WebCore::Widget's
-        platform widget, have setPlatformPluginWidget() call
-        setPlatformWidget().
+        Test: svg/animations/keypoints-mismatch.svg
 
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
-
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        Globally apply validations relevant to all animation types.
 
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+2010-03-18  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
+        Reviewed by Adam Barth.
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::platformDestroy):
-        After destroying the window, set the platform plug-in widget to 0 to
-        ensure that Widget isn't holding a stale handle.
-        (WebCore::PluginView::halt):
-        Have our element's RenderWidget display a screenshot of the plug-in,
-        then stop the plug-in and destroy it.
-        (WebCore::PluginView::restart):
-        Clear the RenderWidget's substitute image, then start the plug-in.
+        Implement software composited graphics layers in Chromium using the Skia library.
+        https://bugs.webkit.org/show_bug.cgi?id=35557
+        This is an initial step in the implementation. Layer compositing is functioning
+        but not optimized in any way. Subsesquent check-ins will be necessary to fine tune
+        it.
 
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::showSubstituteImage):
-        Set m_substituteImage to the passed image, and repaint.
-        (WebCore::RenderWidget::paint):
-        If we have a substitute image, paint that instead of allowing the
-        widget to paint itself.
+        Test: No new exposed functionality so no new tests.
 
-        * rendering/RenderWidget.h:
-        Declare showSubstituteImage(). Added a member to store the substitute
-        image.
-
-2009-10-02  Adam Barth  <abarth@webkit.org>
+        * WebCore.gypi:
+          Added new source files to the chromium build
+        * platform/graphics/GraphicsLayer.h:
+          Added necessary typedef's and forward declarations for Chromium.
+        * platform/graphics/skia/GraphicsLayerSkia.cpp: Added.
+        * platform/graphics/skia/GraphicsLayerSkia.h: Added.
+          Declaration and implementation of the platform-specific GraphicsLayer class.
+        * platform/graphics/skia/LayerRendererSkia.cpp: Added.
+        * platform/graphics/skia/LayerRendererSkia.h: Added.
+          Declaration and implementation of the Skia-based software compositor.
+        * platform/graphics/skia/LayerSkia.cpp: Added.
+        * platform/graphics/skia/LayerSkia.h: Added.
+          Declaration and implementation of a compositable layer that uses a Skia canvas
+          for backing store.
+
+2010-03-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Move PolicyCheck out of FrameLoader.{h,cpp}
-        https://bugs.webkit.org/show_bug.cgi?id=30035
+        Make setPrinting() with printing=false, restore the previous
+        media type in use.
 
-        Purely code motion (and adding a destructor).
+        Test: fast/media/print-restores-previous-mediatype.html
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/PolicyCheck.cpp:
-        * loader/PolicyCheck.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setPrinting):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustMediaTypeForPrinting):
+        * page/FrameView.h:
 
-2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-03-18  David Kilzer  <ddkilzer@apple.com>
 
-        Reviewed by Tor Arne Vestbø.
+        <http://webkit.org/b/36338> Remove unused RenderReplaced::adjustOverflowForBoxShadowAndReflect() declaration
 
-        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
-        Plugin error message was:
-        ERROR: failed to initialize brower-side RPC events listener
-        https://bugs.webkit.org/show_bug.cgi?id=25053
+        Rubber-stamped by Darin Adler.
 
-        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
-        (WebCore::PluginPackage::load):
+        This declaration should have been removed in r47440.
 
-2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Removed.
 
-        Reviewed by Tor Arne Vestbø.
+2010-03-18  Jian Li  <jianli@chromium.org>
 
-        [Qt] X sync our XEmbed container window creation before sending the
-        xid to plugins.
-        https://bugs.webkit.org/show_bug.cgi?id=25053
+        Reviewed by Dmitry Titov.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
+        Dragging a PDF image triggers assertion in DragController::startDrag()
+        https://bugs.webkit.org/show_bug.cgi?id=36247
 
-2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+        Test: fast/images/drag-pdf-as-image.html
 
-        Reviewed by Dan Bernstein.
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::filenameExtension):
+        * platform/graphics/cg/PDFDocumentImage.h:
 
-        Setting zero size on a container of a video element doesn't hide the controller
-        https://bugs.webkit.org/show_bug.cgi?id=30031
-        
-        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
-        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
-        answer to the logic used to actually parent compositing layers, so layer positions
-        and layer hierarchy would be out of agreement.
-        
-        Test: compositing/geometry/clipped-video-controller.html
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        * rendering/RenderLayer.cpp:
-        (WebCore::compositingContainer):
-        (WebCore::RenderLayer::enclosingCompositingLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setCompositingParent):
+        Reviewed by Dan Bernstein.
 
-2009-10-02  Kent Tamura  <tkent@chromium.org>
+        Avoid taking a reference to a String owned by a temporary AtomicString.
 
-        Reviewed by Eric Seidel.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::RareData::parseNth):
 
-        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
-          to HTMLTextFormControlElement.
-           setSelectionStart()
-           setSelectionEnd()
-           select()
-           setSelectionRange()
-           selectionStart()
-           selectionEnd()
-           selection()
+2010-03-18  Chris Marrin  <cmarrin@apple.com>
 
-        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+        Reviewed by Simon Fraser.
 
-        - Unify HTMLInputElement::isTextFieldWithRenderer() and
-         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        Fixed parenting issues with HW layers on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=32449
         
-        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29782
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
-        (WebCore::HTMLTextFormControlElement::setSelectionStart):
-        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
-        (WebCore::HTMLTextFormControlElement::select):
-        (WebCore::HTMLTextFormControlElement::setSelectionRange):
-        (WebCore::HTMLTextFormControlElement::selectionStart):
-        (WebCore::HTMLTextFormControlElement::selectionEnd):
-        (WebCore::HTMLTextFormControlElement::selection):
-        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::select):
-        (WebCore::HTMLInputElement::cachedSelectionStart):
-        (WebCore::HTMLInputElement::cachedSelectionEnd):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
-        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
-
-2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Disconnect event listeners on navigation.
-        Fixes http://crbug.com/23597.
-        https://bugs.webkit.org/show_bug.cgi?id=30027
-
-        Added V8ListenerGuard that is shared by listeners and proxy. On
-        navigation proxy sets a flag in the guard turning off listeners.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8ListenerGuard::create):
-        (WebCore::V8ListenerGuard::isDisconnected):
-        (WebCore::V8ListenerGuard::disconnectListeners):
-        (WebCore::V8ListenerGuard::V8ListenerGuard):
-        (WebCore::V8AbstractEventListener::disconnected):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener):
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::disconnectFrame):
-        (WebCore::V8Proxy::disconnectEventListeners):
-        (WebCore::V8Proxy::clearForNavigation):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::listenerGuard):
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        (WebCore::V8WorkerContextEventListener::create):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        * bindings/v8/custom/V8CustomEventListener.h:
-        (WebCore::V8EventListener::create):
-
-2009-10-02  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        [chromium] Fix WebGL build after CustomGetter constructor changes
-        https://bugs.webkit.org/show_bug.cgi?id=30020
-
-        * page/DOMWindow.idl:
-        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
-
-2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: text in a "Request Payload" section disappears on selection
-        https://bugs.webkit.org/show_bug.cgi?id=29967
-
-        No new tests.
-
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshRequestPayload):
-
-2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Recursion guard for V8Proxy::callFunction.
-        Fixes http://crbug.com/23278.
-        https://bugs.webkit.org/show_bug.cgi?id=29974
-
-        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::callFunction):
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix test breakages by adding null checks, and putting inspector code in
-        ENABLE(INSPECTOR).
-
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchLoadEvent):
-
-2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Clean up the QNetworkReplyHandler to only apply HTTP headers
-        for protocols in the HTTP family.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Move error check into sendResponseIfNeeded() as suggested
-        by Eric Seidel. Also, remove some dead code.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-10-02  Enrica Casucci  <enrica@apple.com>
+        CACF can't properly fix superlayer changes, so a layer added
+        as a sublayer must have a null superlayer. I changed a couple of
+        places that change sublayers to removeFromSuperlayer while adding
+        to a new layer. This fixes both the problem of disappearing children
+        and children getting doubled. Also got rid of removeSublayer(). Layers
+        should always be removed from their parent with removeFromSuperlayer().
+        
+        This also removed moveLayer(), which is not used and may not be safe in how
+        it copies.
 
-        Reviewed by Adele Peterson.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Changed setName to be like Mac, to give more debugging info (to fix problems like these)
+        (WebCore::GraphicsLayerCACF::setName):
+        * platform/graphics/win/WKCACFLayer.cpp:Make sure superlayer is null before adding
+        (WebCore::WKCACFLayer::insertSublayer):
+        (WebCore::WKCACFLayer::replaceSublayer):
+        (WebCore::WKCACFLayer::removeFromSuperlayer):
+        (WebCore::WKCACFLayer::setSublayers):
+        (WebCore::WKCACFLayer::printLayer):print the superlayer for better debugging
+        * platform/graphics/win/WKCACFLayer.h:
 
-        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
-        <rdar://problem/7148712>
-        https://bugs.webkit.org/show_bug.cgi?id=28992
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Test: editing/selection/replace-selection-crash.html
+        Unreviewed, build fix.
 
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
-        the destination position matching the end of the paragraph to move.
+        [Chromium] Change the order of mac/ and cg/ include dirs to fix compile break
+        due to http://trac.webkit.org/changeset/56192,
 
-2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+        * WebCore.gyp/WebCore.gyp: Changed the order.
 
-        Reviewed by Dimitri Glazkov.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Implement per-storage-area quotas for LocalStorage
-        https://bugs.webkit.org/show_bug.cgi?id=29991
-
-        I put 90% of the code in StorageMap since the decision to allow an update is
-        closely tied to quota tracking.  The quota is set via a page's Settings class.
-        Like with the local storage path and whether it's enabled, it's assumed that
-        all pages in the same group will have the same settings.  The setting defaults
-        to 5mb which is what the spec suggests, but it can easily be changed to
-        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
-        grandfathered in regarudless of quota, so importItem only tracks (and will
-        never block) imports.
-
-        I believe this change is a good transition to more complex quota management.
-        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
-        a function to the StorageMap that sets the quota.  This would be fine since all
-        use of LocalStorage is blocked on the import completing, so you'd never hit a
-        quota error in the mean time.  Also, if embedders wanted to ask the user
-        whether to expand the quota whenever it's hit (before deciding whether or not
-        to raise an exception), a callback via the chrome client should be fairly easy.
-        That said, I think it's best to add these features in steps rather than one
-        huge patch.  (Both of these are on my TODO list, btw.)
-
-        Included is a layout test that verifies the behavior.  It assumes the default
-        quota is 5mb (since that's what Settings defaults to).
-
-        Test: storage/domstorage/localstorage/quota.html
+        Reviewed by Oliver Hunt.
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::localStorage):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setLocalStorageQuota):
-        * page/Settings.h:
-        (WebCore::Settings::localStorageQuota):
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::create):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::clear):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::create):
-        (WebCore::StorageMap::StorageMap):
-        (WebCore::StorageMap::copy):
-        (WebCore::StorageMap::setItem):
-        (WebCore::StorageMap::removeItem):
-        (WebCore::StorageMap::importItem):
-        * storage/StorageMap.h:
-        (WebCore::StorageMap::quota):
-        * storage/StorageNamespace.cpp:
-        (WebCore::StorageNamespace::localStorageNamespace):
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::localStorageNamespace):
-        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36325
 
-        Reviewed by Timothy Hatcher.
+        Add support for stopImmediatePropagation from DOM Level 3 Events.
 
-        Database Inspector crashes Safari when table has more than 21 columns
-        https://bugs.webkit.org/show_bug.cgi?id=29924
+        Added fast/events/stop-immediate-propagation.html.
 
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::timeStamp):
+        (WebCore::Event::stopPropagation):
+        (WebCore::Event::stopImmediatePropagation):
+        (WebCore::Event::propagationStopped):
+        (WebCore::Event::immediatePropagationStopped):
+        * dom/Event.idl:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
 
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Unreviewed, build fix.
 
-        Fixes <http://webkit.org/b/14370>.
-        Inspector's timeline should record when certain DOM events fired.
-        
-        This patch adds calls into the Web Inspector when the main frame
-        fires an load event, and when the document fires its DOMContent
-        event. Once these values are passed in, they are sent to the Web Inspector
-        as a timing change, and these are denoted by vertical lines in the resources
-        panel (blue for DOM Content, red for load event).
+        Return frame accessor back to Geolocation, it's used in GeolocationServiceChromium.
+        The accessor was removed in http://trac.webkit.org/changeset/56188.
 
-        * English.lproj/localizedStrings.js: Added tooltip text.
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
-        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
-        * inspector/InspectorController.h:
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::InspectorResource): Added new variables.
-        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
-        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
-        (WebCore::InspectorResource::markLoadEventTime): Ditto.
-        * inspector/InspectorResource.h:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
-        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.updateResource):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+        * page/Geolocation.h:
+        (WebCore::Geolocation::frame): Added back.
 
-2009-10-02  Dave Hyatt  <hyatt@apple.com>
+2010-03-18  Brent Fulgham  <bfulgham@webkit.org>
 
         Reviewed by Adam Roben.
 
-        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
-
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::pageGroupUserSheets):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserScript):
-        (WebCore::PageGroup::addUserStyleSheet):
-        (WebCore::PageGroup::removeUserContentWithURLForWorld):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        * page/PageGroup.h:
-        * page/UserContentURLPattern.cpp:
-        (WebCore::UserContentURLPattern::matchesPatterns):
-        * page/UserContentURLPattern.h:
-        * page/UserScript.h:
-        (WebCore::UserScript::UserScript):
-        (WebCore::UserScript::whitelist):
-        (WebCore::UserScript::blacklist):
-        * page/UserStyleSheet.h:
-        (WebCore::UserStyleSheet::UserStyleSheet):
-        (WebCore::UserStyleSheet::whitelist):
-        (WebCore::UserStyleSheet::blacklist):
-
-2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Build fix when SVG is not enabled
-        https://bugs.webkit.org/show_bug.cgi?id=30011
-
-        Move TextRenderingMode related functions out from
-        the ENABLE(SVG) guard.
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        Help reduce build problems due to font declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=36190
 
-2009-10-02  Kenneth Russell  <kbr@google.com>
+        Functions unchanged, no new tests.
 
-        Reviewed by Oliver Hunt.
+        * WebCore.vcproj/WebCore.vcproj: Add new file, and show
+          movement of FontPlatformData.h to cg/ directory.
+        * platform/graphics/cairo/FontPlatformData.h: Merge in
+          WinCairo-specific declarations.  Correct constructor
+          declaration to use type float for font size.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::fontFace):
+        (WebCore::FontPlatformData::setSize):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        * platform/graphics/cairo/FontPlatformDataCairo.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Correct
+          constructor to accept type float for font size.
+        * platform/graphics/cg/FontPlatformData.h: Copied from WebCore/platform/graphics/win/FontPlatformData.h.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::cgFont):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/win/FontPlatformData.h: Removed.
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::operator==): Move implementation
+          here (previously in header) to match other cairo-based ports.
+        * platform/graphics/win/RefCountedHFONT.h: Added.  This
+          was extracted from win/FontPlatformData.h, and is now shared
+          by the cg/FontPlatformData.h and cairo/FontPlatformData.h
+        (WebCore::RefCountedHFONT::create):
+        (WebCore::RefCountedHFONT::createDeleted):
+        (WebCore::RefCountedHFONT::~RefCountedHFONT):
+        (WebCore::RefCountedHFONT::hfont):
+        (WebCore::RefCountedHFONT::hash):
+        (WebCore::RefCountedHFONT::RefCountedHFONT):
 
-        WebGL crashes with recent CanvasArray change
-        https://bugs.webkit.org/show_bug.cgi?id=30018
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Test: fast/canvas/webgl/array-unit-tests.html
+        No review.
 
-        * html/canvas/CanvasArray.cpp:
-        (WebCore::CanvasArray::CanvasArray):
-        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+        Fix brace style after r56170.
+        
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
 
-2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Dave Hyatt.
 
-        <https://bugs.webkit.org/show_bug.cgi?id=29989>
-        Safari version number shouldn't be exposed in WebKit code
+        https://bugs.webkit.org/show_bug.cgi?id=36274
+        CSS3 :nth-child selector 'odd' keyword case sensitivity test fails
         
-        For a WebKit version of 532.3.4:
-        Product version is: 5.32.3.4 (was 4.0.3.0)
-        File version is: 5.32.3.4 (was 4.532.3.4)
+        The tests for "odd", "even" etc. for nth-child selectors should be case insensitive.
 
-        * WebCore.vcproj/QTMovieWin.rc:
-
-2009-10-02  Stephen White  <senorblanco@chromium.org>
+        Test: fast/css/nth-child-odd-case-insensitive.html
 
-        Reviewed by Dimitri Glazkov.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::RareData::parseNth):
 
-        Enable two point radial gradients in Chromium/Skia.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30017
+        Reviewed by Oliver Hunt.
 
-        Covered by the following tests:
+        https://bugs.webkit.org/show_bug.cgi?id=36265
 
-        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
-        LayoutTests/fast/backgrounds/svg-as-background-3.html
-        LayoutTests/fast/gradients/generated-gradients.html
-        LayoutTests/fast/gradients/simple-gradients.html
+        Add support for event.defaultPrevented from DOM level 3.
+    
+        Added fast/events/defaultprevented.html
 
-        * platform/graphics/skia/GradientSkia.cpp:
-        (WebCore::Gradient::platformGradient):
+        * dom/Event.idl:
 
-2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+2010-03-18  Darin Adler  <darin@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
-        Otherwise, it is inconsistent with class declaration of QCursor.
+        Remove Geolocation.lastPosition, no longer in the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=36255
+        rdar://problem/7746357
 
-        No new tests.
+        * WebCore.base.exp: Updated since Geolocation's destructor is now non-virtual.
 
-        * platform/qt/QWebPageClient.h:
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::lastPosition): Add an assertion; it's only legal to
+        call this if access to the location is allowed.
 
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
+        * page/Geolocation.h: Removed unneeded includes. Made destructor non-virtual,
+        although it will still be virtual if any of the base classes have a virtual
+        destructor. Made lastPosition, isAllowed, and isDenied functions private.
+        Removed unused suspend, resume, setShouldClearCache, shouldClearCache,
+        and frame functions.
 
-        Reviewed by Gustavo Noronha.
+        * page/Geolocation.idl: Removed lastPosition read-only attribute. No longer in
+        the Geolocation specification.
 
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        cleanup of caps handling in the video sink
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_set_caps):
+        Reviewed by Simon Fraser.
 
-2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36275
 
-        Reviewed by Simon Hausmann.
+        Make sure :not does not allow pseudo-elements inside it. (Hooray for another pointless
+        restriction on :not.)
 
-        Fix compiler warnings about unused function arguments.
+        Added fast/css/invalid-not-with-pseudo-element.html
 
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::initializeParserContext):
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontCache::getTraitsInFamily):
-        (WebCore::FontCache::getCachedFontPlatformData):
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::setPlatformFont):
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setURLForRect):
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::createIconForFiles):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-        (WebCore::MediaPlayerPrivate::setEndTime):
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
-        * platform/graphics/qt/StillImageQt.h:
-        (WebCore::StillImage::destroyDecodedData):
-        * platform/network/qt/DnsPrefetchHelper.h:
-        (WebCore::DnsPrefetchHelper::lookedUp):
-        * platform/qt/ContextMenuQt.cpp:
-        (WebCore::ContextMenu::setPlatformDescription):
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::supportsFocusRing):
-        (WebCore::RenderThemeQt::systemFont):
-        (WebCore::RenderThemeQt::adjustButtonStyle):
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
-        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        * platform/qt/SearchPopupMenuQt.cpp:
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::paint):
-        * xml/XSLStyleSheetQt.cpp:
-        (WebCore::XSLStyleSheet::loadChildSheet):
-        (WebCore::XSLStyleSheet::setParentStyleSheet):
-        * xml/XSLTProcessorQt.cpp:
-        (WebCore::XSLTMessageHandler::handleMessage):
-        (WebCore::XSLTProcessor::transformToString):
-
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
+        * css/CSSGrammar.y:
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::matchesPseudoElement):
 
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
+2010-03-18  Dan Bernstein  <mitz@apple.com>
 
-        Scale the cairo surface of the video sink depending on the
-        pixel-aspect-ratio of the video buffer to paint. Also
-        destruct/re-create the surface when setSize() is called with a new
-        size.
+        Reviewed by Darin Adler.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::naturalSize):
-        (WebCore::MediaPlayerPrivate::setSize):
-        (WebCore::MediaPlayerPrivate::paint):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
+        <rdar://problem/7761400> Rework the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=18722
 
-2009-10-02  Ben Murdoch  <benm@google.com>
+        Test: fast/dynamic/float-remove-above-line-2.html
 
-        Reviewed by David Kilzer.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFloatingObject): Treat 0- and less-than-0-height floats
+        as having a height of 1 so that they intersect with the line they originate on.
+        (WebCore::RenderBlock::clearFloats): Use numeric_limits.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Removed the intersection checks here,
+        so that a float is always included in the float list of the line it originates on, even
+        if it does not intersect that line. This ensures that every float is accounted for, which
+        is necessary during incremental layout when adding floats from clean lines.
 
-        Stale database version persists through browser refresh (changeVersion doesn't work)
-        https://bugs.webkit.org/show_bug.cgi?id=27836
+2010-03-18  Antti Koivisto  <koivisto@iki.fi>
 
-        Tests: storage/change-version-handle-reuse.html
-               storage/change-version.html
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
-        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
-        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
-        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
-        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
-        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
-        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+        https://bugs.webkit.org/show_bug.cgi?id=36102
+        [Qt] Scaling control API for tiled backing store
+        
+        Commit the new scale synchronously after unfreeze to avoid ugliness.
 
-2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setContentsScale):
+        (WebCore::TiledBackingStore::commitScaleChange):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h:
 
-        Reviewed by Simon Hausmann.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Partial WINSCW build fix.
+        Reviewed by Simon Fraser.
 
-        Add parentheses around the function pointer declaration, similar to the
-        second hunk in r48825.
+        https://bugs.webkit.org/show_bug.cgi?id=36281
 
-        * loader/CachedResourceHandle.h:
+        Make sure an exception is raised if an @import rule is inserted in the wrong place.
+        
+        Also make sure (so that this particular test case passes) that rgba(0, 0, 0, 0) is dumped
+        as transparent by getComputedStyle, since it most commonly occurs in background-color and
+        that default makes more sense than dumping rgba values.
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
+        Added fast/css/invalid-import-insertion.html
 
-        Unreviewed attempted build fix by Xcode magic.
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::createColor):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::insertRule):
 
-        * WebCore.xcodeproj/project.pbxproj:
+2010-03-18  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix.  Actually add the new files.
-
-        * loader/RedirectScheduler.cpp: Added.
-        (WebCore::ScheduledRedirection::):
-        (WebCore::ScheduledRedirection::ScheduledRedirection):
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        * loader/RedirectScheduler.h: Added.
-
-2009-10-01  Adam Barth  <abarth@webkit.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Adler.
+        Multiselect Popup - Listbox click simulation
+        https://bugs.webkit.org/show_bug.cgi?id=36177
 
-        Move RedirectScheduler to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=29952
+        Listbox popups will need to notify the corresponding select elements that a
+        selection change happened. The current HTMLSelectElement interface does not
+        allow multiple selections.
 
-        This change is purely code motion.
+        The new method  listBoxSelectItem will be used for that. I have refactored part
+        of the mouse handling code in bug 36124 and I am now reusing it here for
+        <select multiple> popups. All the other cases will handled as they were before to be
+        sure that no side effects will show up.
 
-        No behavior change.
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        * dom/SelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxPopupClick):
+        * html/HTMLSelectElement.h:
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/RedirectScheduler.cpp: Added.
-        (WebCore::ScheduledRedirection::):
-        (WebCore::ScheduledRedirection::ScheduledRedirection):
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        * loader/RedirectScheduler.h: Added.
-
-2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+2010-03-12  Ojan Vafai  <ojan@chromium.org>
 
         Reviewed by David Levin.
 
-        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=29971
-
-        Gets rid of warnings on gcc about using anonymous namespaces 
-          warning: 'StringKeyHashTraits' has a base
-          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
-          whose type uses the anonymous namespace
-        and
-          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
-          WTF::HashTraits<PrivateIdentifier*> >' has a base
-          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
-          PrivateIdentifier*> >' whose type uses the anonymous namespace
-
-        No tests required.
-
-        * bindings/v8/npruntime.cpp:
-
-2009-10-01  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-10-01  Chris Marrin  <cmarrin@apple.com>
+        smartdelete should only occur after double-click
+        https://bugs.webkit.org/show_bug.cgi?id=35314
 
-        Reviewed by Oliver Hunt.
-
-        Turn on ENABLE_3D_CANVAS in TOT
-        https://bugs.webkit.org/show_bug.cgi?id=29906
+        1. Consolidate all notions of selection-granularity into SelectionController.
+        2. Now only mouse-based selections store a selection-granularity. This matches NSTextView.
 
-        Fixed a bug found when running tests with flag on
+        New tests were added in http://trac.webkit.org/changeset/55913.
 
-        * Configurations/FeatureDefines.xcconfig:
         * WebCore.base.exp:
-        * bindings/js/JSCanvasArrayBufferConstructor.h:
-        (WebCore::construct):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/canvas/CanvasArray.cpp:
-        (WebCore::CanvasArray::CanvasArray):
-        * html/canvas/CanvasByteArray.cpp:
-        (WebCore::CanvasByteArray::create):
-        * html/canvas/CanvasFloatArray.cpp:
-        (WebCore::CanvasFloatArray::create):
-        * html/canvas/CanvasIntArray.cpp:
-        (WebCore::CanvasIntArray::create):
-        * html/canvas/CanvasShortArray.cpp:
-        (WebCore::CanvasShortArray::create):
-        * html/canvas/CanvasUnsignedByteArray.cpp:
-        (WebCore::CanvasUnsignedByteArray::create):
-        * html/canvas/CanvasUnsignedIntArray.cpp:
-        (WebCore::CanvasUnsignedIntArray::create):
-        * html/canvas/CanvasUnsignedShortArray.cpp:
-        (WebCore::CanvasUnsignedShortArray::create):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setWebGLEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::webGLEnabled):
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
-        shadow (29927)
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29927
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::ShadowParseContext::ShadowParseContext):
-        (WebCore::ShadowParseContext::commitValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::ShadowParseContext::commitColor):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        At bad merge at some point in the development of my patch must have 
-        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
-        back where it belongs!
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-30  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Remove FrameLoader::schedule* APIs
-        https://bugs.webkit.org/show_bug.cgi?id=29950
-
-        Change clients of FrameLoader::schedule* to call redirectScheduler
-        directly.
-
-        No behavior change.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::createWindow):
-        (WebCore::JSDOMWindow::open):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::setLocation):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::navigateIfAllowed):
-        (WebCore::JSLocation::reload):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::navigateIfAllowed):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::processHttpEquiv):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::MoveSelectionCommand):
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/MoveSelectionCommand.h:
+        (WebCore::MoveSelectionCommand::create):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::clear):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::granularity):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::VisibleSelection):
+        (WebCore::VisibleSelection::expandUsingGranularity):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::VisibleSelection::validate):
+        * editing/VisibleSelection.h:
+        (WebCore::operator==):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::receivedFirstData):
-        * loader/FrameLoader.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        * page/History.cpp:
-        (WebCore::History::back):
-        (WebCore::History::forward):
-        (WebCore::History::go):
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Just removing a comment I accidentally committed earlier. 
-
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes):
-
-2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Clean up use of const and mutable in StorageMap
-        https://bugs.webkit.org/show_bug.cgi?id=29933
+        (WebCore::FrameLoader::clear):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::extend):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventTripleClick):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::selectionGranularity):
+        * page/Frame.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
 
-        What's the point of having every single member variable be mutable and nearly
-        every method be const?  Let's clean it up.
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::setIteratorToIndex):
-        (WebCore::StorageMap::key):
-        (WebCore::StorageMap::importItem):
-        * storage/StorageMap.h:
+        Unreviewed, build fix.
 
-2009-10-01  Beth Dakin  <bdakin@apple.com>
+        [V8] Turn npObjectTypeInfo into a function, make everyone happy.
 
-        Reviewed by Dave Hyatt.
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo): Added new function.
+        (npCreateV8ScriptObject):
+        * bindings/v8/NPV8Object.h: Turned npObjectTypeInfo into function.
+        * bindings/v8/V8NPObject.cpp: Replaced references to function
 
-        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
-        ligature
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=6136
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        This patch makes the SVG CSS property text-rendering work with any 
-        HTML, much like it does in Firefox. It accepts four possible input 
-        values: auto, optimizeSpeed, optimizeLegibility, and 
-        geometricPrecision. Right now, in this implementation, here is what 
-        those values correspond to:
+        Reviewed by Simon Fraser.
 
-        auto = optimizeSpeed = what we normally when the value's not set
-        optimizeLegibility = geometricPrecision = ligatures kerning
+        https://bugs.webkit.org/show_bug.cgi?id=36283
+        
+        The wrong constants were being used for the code that attempted to compact the background-repeat shorthand to
+        a single value.
 
-        Add new file TextRenderingMode.h to the project files.
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
+        Added fast/backgrounds/background-repeat-computed-style.html
 
-        CSS support for the new CSSPropertyTextRendering
         * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-
-        All the old SVG CSS support for this property can go away. When 
-        it's used in SVG, it will just fall into the normal HTML case.
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-        * css/SVGCSSParser.cpp:
-        (WebCore::CSSParser::parseSVGValue):
-        * css/SVGCSSPropertyNames.in:
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
-        * css/SVGCSSValueKeywords.in:
-
-        FontDescription stores the m_textRendering bit.
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::FontDescription):
-        (WebCore::FontDescription::textRenderingMode):
-        (WebCore::FontDescription::setTextRenderingMode):
-        (WebCore::FontDescription::operator==):
-
-        We want to fall into the complex text rendering code path if 
-        kerning and ligatures have been enabled with this property.
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::canUseGlyphCache):
-
-        Now takes a TextRenderingMode as a parameter.
-        * platform/graphics/SimpleFontData.h:
-
-        New header for the enum.
-        * platform/graphics/TextRenderingMode.h: Added.
-        (WebCore::):
-
-        getCFStringAttributes() now takes a TextRenderingMode as an 
-        attribute.
-        * platform/graphics/mac/CoreTextController.cpp:
-        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
-
-        Enable kerning and ligatures whenever the TextRenderingMode is 
-        OptimizeLegibility or GeometricPrecision
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::disableLigatures):
-        (WebCore::initializeATSUStyle):
-        (WebCore::ATSULayoutParameters::initialize):
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes):
-
-        More SVG CSS stuff that isn't needed anymore since SVG will use the 
-        new HTML CSS implementation.
-        * rendering/style/SVGRenderStyle.h:
-        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
-        (WebCore::SVGRenderStyle::setBitDefaults):
-        * rendering/style/SVGRenderStyleDefs.h:
+        (WebCore::fillRepeatToCSSValue):
 
-2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dave Hyatt.
 
-        Use isClosure property of scope proxy to decide whether the
-        scope is a closure.
+        https://bugs.webkit.org/show_bug.cgi?id=36273
+        CSS3 :indeterminate and input type=radio test fails
 
-        https://bugs.webkit.org/show_bug.cgi?id=29965
+        The :indeterminate pseudo-class should apply to both radio buttons and checkboxes.
 
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setIndeterminate): Use allowsIndeterminate() to determine if the input
+        supports the indeterminate state.
+        (WebCore::HTMLInputElement::preDispatchEventHandler): Use allowsIndeterminate() to determine whether
+        to handle the indeterminate state.
+        (WebCore::HTMLInputElement::postDispatchEventHandler): Ditto.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::allowsIndeterminate): New utility method, returns true for radio buttons
+        and checkboxes.
 
-2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dave Hyatt.
 
-        Odd color transitions on anchors with transition-property: all
-        https://bugs.webkit.org/show_bug.cgi?id=29911
-
-        When transitioning maybe-invalid colors, if the source and destination
-        color are both invalid, then don't animate.
-        
-        This fixes an issue where a child element of an element running a color
-        transition, with -webkit-transition-property:all, would show a color change.
-        This happened because the "maybe invalid color" logic copied the color style
-        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
-        to animate while the transition ran, and to then to disappear when the transition
-        finished.
+        https://bugs.webkit.org/show_bug.cgi?id=36271
+        CSS3 :enabled on an input type=hidden element fails
         
-        Test: transitions/color-transition-all.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
-        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
-
-2009-10-01  Victor Wang  <victorw@chromium.org>
+        The CSS3 selectors spec now makes it clear that hidden inputs should respect
+        the :enabled and :disabled pseudo-classes.
 
-        Reviewed by Oliver Hunt.
+        Test: fast/forms/hidden-input-enabled.html
 
-        Allow dragging a node who has child nodes.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Remove checks for hidden inputs.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28632
+2010-03-18  Enrica Casucci  <enrica@apple.com>
 
-        Test: fast/events/drag-parent-node.html
+        Reviewed by Simon Fraser.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::shouldDragAutoNode):
+        Intro text at Star Wars demo is clipped.
+        <rdar://problem/7560979>
+        https://bugs.webkit.org/show_bug.cgi?id=33909
+        
+        Test: compositing/repaint/layer-repaint.html
+        
+        We are flipping the coordinates for drawing, therefore
+        we must flip them also when we invalidate the rectangles.
 
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::WebLayer::setNeedsDisplay):
 
-        Reviewed by Gustavo Noronha.
+2010-03-18  Nate Chapin  <japhet@chromium.org>
 
-        [GTK] media player: better mute support
-        https://bugs.webkit.org/show_bug.cgi?id=29960
+        Unreviewed, Chromium build fix.
 
-        Handle volume and mute state with the two corresponding properties
-        of playbin2.
+        Missed a #include in V8Collection.h.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::setMuted):
-        (WebCore::MediaPlayerPrivate::setVolume):
+        * bindings/v8/V8Collection.h:
 
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Simon Fraser.
 
-        [GTK] video sink pad template colorspace is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=29953
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=36284.
+        
+        Make sure the CSS parser properly rejects negative border widths.
 
-        Set sink pad template colorspace depending on byte order.
+        Added fast/borders/negative-border-width.html
 
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
 
-2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+2010-03-18  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] Refactored V8 event listeners:
-        (This change should fix http://crbug.com/21079 and
-        https://bugs.webkit.org/show_bug.cgi?id=29093.)
-         o All listeners use weak handles to JS objects to avoid creating
-           cycles and leaking memory.
-         o "Object" variants of listeners removed.
-         o All event accessor callbacks are generated.
-         o Custom event accessors removed.
-         o All wrappers have hidden dependencies on their listeners to
-           prevent listeners from being collected.
-         o All variats of getEventListener function grouped in V8DOMWrapper.
-         o Pointers to C+EventListener wrappers are stored in JS objects
-           instead of event listener lists.
-        https://bugs.webkit.org/show_bug.cgi?id=29825
-
-        * WebCore.gypi: Removed "Object" listeners.
-        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
-        * bindings/v8/DOMObjectsInclude.h:
+        [V8] Remove V8Index.h and all references to V8ClassIndex.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33477
 
-        V8AbstractEventListener manages weak JS handle:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::weakEventListenerCallback):
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        (WebCore::V8AbstractEventListener::setListenerObject):
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::cast):
-        (WebCore::V8AbstractEventListener::isLazy):
-        (WebCore::V8AbstractEventListener::getListenerObject):
-        (WebCore::V8AbstractEventListener::getExistingListenerObject):
-        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
-        (WebCore::V8AbstractEventListener::disconnectFrame):
-        (WebCore::V8AbstractEventListener::disconnected):
-        (WebCore::V8AbstractEventListener::prepareListenerObject):
-        (WebCore::V8AbstractEventListener::lineNumber):
-        (WebCore::V8AbstractEventListener::virtualisAttribute):
-
-        Grouped getEventListener functions:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::getEventListener):
         * bindings/v8/V8DOMWrapper.h:
-
-        Removed most event listener objects bookkeeping:
-        * bindings/v8/V8EventListenerList.cpp:
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findWrapper):
-        (WebCore::V8EventListenerList::clearWrapper):
-        (WebCore::V8EventListenerList::doFindWrapper):
-        (WebCore::V8EventListenerList::getHiddenProperty):
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-
-        Added hidden properties for storing EventListener wrappers:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        (WebCore::V8HiddenPropertyName::listener):
-        (WebCore::V8HiddenPropertyName::attributeListener):
-        * bindings/v8/V8HiddenPropertyName.h:
-
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener):
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        (WebCore::V8LazyEventListener::prepareListenerObject):
-        * bindings/v8/V8LazyEventListener.h:
-        (WebCore::V8LazyEventListener::isLazy):
-        * bindings/v8/V8ObjectEventListener.cpp: Removed.
-        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Helpers.cpp:
+        * bindings/v8/V8Index.h: Removed.
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8NPObject.cpp:
         * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::disconnectFrame):
-        (WebCore::V8Proxy::disconnectEventListeners):
         * bindings/v8/V8Proxy.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
-        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/V8SVGPODTypeWrapper.h:
         * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
         * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        (WebCore::V8EventListener::getListenerFunction):
-        (WebCore::V8EventListener::callListenerFunction):
-        * bindings/v8/custom/V8CustomEventListener.h:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/WrapperTypeInfo.h: Move WrapperTypeInfo struct into its own file from V8Index.h.
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-
-2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Rename QWebGraphicsItem to QGraphicsWebView
-
-        * WebCore.pro:
-
-2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Read-only transactions do not change file sizes and therefore
-        should not trigger quota updates.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29945
-
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::openTransactionAndPreflight):
-        (WebCore::SQLTransaction::runStatements):
-
-2009-09-30  Timothy Hatcher  <timothy@apple.com>
-
-        Fix list box scrolling by correctly overriding the scroll()
-        function on RenderBox.
-
-        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
-        of listboxes is broken (29756)
-
-        Reviewed by Dan Bernstein.
-
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::scroll):
-        * rendering/RenderListBox.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::scroll):
-        * rendering/RenderTextControlSingleLine.h:
-
-2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Make a copy of listeners array before dispatching an event in
-        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
-        listener removes itself from the array next listener will be skipped.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29920
-
-        * inspector/front-end/Object.js:
-        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
-
-2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] GtkIMContext filtering interferes with DOM key events
-        https://bugs.webkit.org/show_bug.cgi?id=28733
-
-        Ensure that keyboard events filtered by the GtkIMContext still create
-        the proper DOM events.
-
-        No tests added. Instead previously skipped tests have been enabled.
-
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
 
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
+2010-03-18  Yury Semikhatsky  <yurys@chromium.org>
 
-        Reviewed by Xan Lopez.
+        Reviewed by Pavel Feldman.
 
-        [GTK] data: uri support in media player
-        https://bugs.webkit.org/show_bug.cgi?id=29842
+        Preserve console history between debugging sessions.
 
-        New GStreamer element to handle data: uris. For now only base64
-        encoded data is supported. Decoded data is handed over to
-        giostreamsrc.
+        https://bugs.webkit.org/show_bug.cgi?id=36223
 
-        * GNUmakefile.am:
-        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
-        (_do_init):
-        (webkit_data_src_base_init):
-        (webkit_data_src_class_init):
-        (webkit_data_src_reset):
-        (webkit_data_src_init):
-        (webkit_data_src_finalize):
-        (webkit_data_src_uri_get_type):
-        (webkit_data_src_uri_get_protocols):
-        (webkit_data_src_uri_get_uri):
-        (webkit_data_src_uri_set_uri):
-        (webkit_data_src_uri_handler_init):
-        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::do_gst_init):
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._settingsLoaded):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed.printResult):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load):
 
-2009-09-30  Daniel Bates  <dbates@webkit.org>
+2010-03-18  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29944
+        [Qt] GraphicsLayer: Pausing and resuming of animations don't work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=36219
         
-        Reduces false positives in the XSSAuditor by explicitly allowing requests
-        that do not contain illegal URI characters.
+        addAnimation and pauseAnimation were handling animation state changes in
+        the wrong way.
+        Apparently WebCore calls addAnimation for resuming, so we have to make 
+        sure to resume an existing animation if that happens. Also, timeOffset 
+        is now used for synchronization of the Qt animation clock with the 
+        WebCore clock, as opposed to using it as a delay timer. 
+        Both those fixes were necessary to get the layout test to work.
         
-        As a side effect of this change, the tests property-inject.html, 
-        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
-        fail because these attacks do not contain any illegal URI characters and 
-        thus are now allowed by the XSSAuditor, where previously they weren't. A future
-        change may reinstate this functionality.
-
-        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
-               http/tests/security/xssAuditor/script-tag-safe3.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isIllegalURICharacter): Added method.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::findInRequest): Added parameter 
-        allowRequestIfNoIllegalURICharacters.
-        * page/XSSAuditor.h:
-
-2009-09-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        reproducible freeze and crash on closing form popup at bosch-home.nl
-        https://bugs.webkit.org/show_bug.cgi?id=28948
-
-        showModalDialog calls getDirect on what is actually a window shell,
-        so ends up not getting a value (since no value can ever be placed
-        directly on the shell), which leads to incorrect behaviour.
-
-        We use a manual test rather than automatic as it was not
-        possible to get a modal run loop to work inside DRT.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::showModalDialog):
-        * manual-tests/showModalDialog-returnValue.html: manual testcase.
-
-2009-09-30  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Adds ValidityState.tooLong support for <input> and <textarea>.
-
-        Introduces tooLong() in HTMLFormControlElement and it always returns false.
-        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
-        length and maxLength.  tooLong() should work only for `dirty' values.
-        So, introduces m_isDirty flag for HTMLTextAreaElement, and
-        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
-
-        Renames parameter names of setMaxLength().
-
-        https://bugs.webkit.org/show_bug.cgi?id=27454
-
-        Tests: fast/forms/ValidityState-tooLong-input.html
-               fast/forms/ValidityState-tooLong-textarea.html
-
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::tooLong):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::tooLong):
-        (WebCore::HTMLInputElement::setMaxLength):
-        * html/HTMLInputElement.h:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::reset):
-        (WebCore::HTMLTextAreaElement::updateValue):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        (WebCore::HTMLTextAreaElement::tooLong):
-        * html/HTMLTextAreaElement.h:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::tooLong):
-
-2009-09-30  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Factor RedirectScheduler out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=29948
-
-        This change introduces a new sub-object of Frame, redirectScheduler.
-        The redirectScheduler is responsible for scheduling redirects.
+        LayoutTests/animations/play-state.html now passed on Qt.
 
-        This change leaves the code for the redirectScheduler in
-        FrameLoader.cpp.  A future change will move the class into its own
-        file.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQtBase::AnimationQtBase):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::addAnimation):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
 
-        No behavior change (hopefully!).
+2010-03-18  Adam Langley  <agl@chromium.org>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::setDefersLoading):
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::didOpenURL):
-        (WebCore::FrameLoader::didExplicitOpen):
-        (WebCore::FrameLoader::cancelAndClear):
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::checkCompleted):
-        (WebCore::FrameLoader::isScheduledLocationChangePending):
-        (WebCore::FrameLoader::scheduleHTTPRedirection):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::FrameLoader::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::FrameLoader::scheduleRefresh):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::FrameLoader::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::FrameLoader::provisionalLoadStarted):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        (WebCore::FrameLoader::completed):
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::redirectScheduler):
-        * page/Frame.h:
+        Reviewed by David Levin.
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        [chromium] Fix inverted logic in per-strike renderer patch.
 
-        Build fix, not reviewed.
+        I screwed up in r55089 and got one of the conditions backwards. Thanks
+        to Roman Tsisyk for pointing it out.
 
-        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+        https://bugs.webkit.org/show_bug.cgi?id=35495
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+        Test: platform/chromium/fast/text/chromium-linux-fontconfig-renderstyle.html
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::querySystemForRenderStyle):
 
-        Build fix, not reviewed.
+2010-03-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+        Reviewed by Timothy Hatcher.
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+        Web Inspector: Show inherited styles for a selected DOM element
 
-2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=28039
 
-        Reviewed by Darin Fisher.
-
-        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
-        Only Audio, Image, and Option should be constructable.
-        https://bugs.webkit.org/show_bug.cgi?id=29940
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylesSidebarPane.prototype._containsInherited):
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
 
-        Test: fast/dom/dom-constructor.html
+2010-03-15  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * WebCore.gypi: Added new files to project.
-        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
-          and HTMLAudioElement construction.
-        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
-        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
-        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
-        * bindings/v8/V8Index.cpp: Added new headers.
-        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
-        * bindings/v8/custom/V8CustomBinding.h: Ditto.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER): Added custom constructors.
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
-        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
-
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Gustavo Noronha.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Reviewed by Brady Eidson.
+        Spatial Navigation: Add isNull() and document() convenience methods to FocusCandidate.
+        https://bugs.webkit.org/show_bug.cgi?id=36167
 
-        307 redirects should pass along http body and Content-Type header
-        https://bugs.webkit.org/show_bug.cgi?id=29943
+        It turns out that Spatial Navigation related code (in FocusController.cpp for
+        instance) can be simplified and look better if FocusCandidate class offer some
+        convenience method. This patch introduces a couple of them (isNull and a Document
+        getter). It also adds another constructor that receives a Node as parameter.
 
-        Follow-up fix for:
-        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
-        
-        Test: http/tests/loading/resources/redirect-methods-result.php
+        A followup refactoring patch will be making use of these helper methods.
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest): Pass along http body and Content-Type header.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+        * page/SpatialNavigation.h:
+        (WebCore::FocusCandidate::FocusCandidate): Added a "Node*" parameter
+        to FocusCandidate's constructor.
+        (WebCore::FocusCandidate::isNull): In the Spatial Navigation logic, a NULL
+        FocusCandidate object is one that does not hold a valid reference to a "Node*".
+        (WebCore::FocusCandidate::document): This method returns a pointer for the FocusCandidate
+        node's document, if |node| is a valid pointer.
 
-2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+2010-03-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Antti Koivisto.
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
-        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+        [Qt] [Performance] GraphicsLayerQt updates the scene too often
+        https://bugs.webkit.org/show_bug.cgi?id=36158
+
+        This fix makes sure that flushChanges is only called when necessary,
+        by calling the notifySync function asynchronously, which makes sure flushChanges() is called
+        after the WebCore compositor has made all its changes.
+
+        This has shown a visual improvement on several test-cases.
+
+        * Makefile:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::):
+        (WebCore::GraphicsLayerQtImpl::notifySyncRequired):
+        (WebCore::GraphicsLayerQtImpl::notifyChange):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setMaskLayer):
+        (WebCore::GraphicsLayerQt::setPosition):
+        (WebCore::GraphicsLayerQt::setAnchorPoint):
+        (WebCore::GraphicsLayerQt::setSize):
+        (WebCore::GraphicsLayerQt::setTransform):
+        (WebCore::GraphicsLayerQt::setChildrenTransform):
+        (WebCore::GraphicsLayerQt::setPreserves3D):
+        (WebCore::GraphicsLayerQt::setMasksToBounds):
+        (WebCore::GraphicsLayerQt::setDrawsContent):
+        (WebCore::GraphicsLayerQt::setBackgroundColor):
+        (WebCore::GraphicsLayerQt::clearBackgroundColor):
+        (WebCore::GraphicsLayerQt::setContentsOpaque):
+        (WebCore::GraphicsLayerQt::setBackfaceVisibility):
+        (WebCore::GraphicsLayerQt::setOpacity):
+        (WebCore::GraphicsLayerQt::setContentsRect):
+
+2010-03-18  Stephen White  <senorblanco@chromium.org>
 
-        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
-        leaking its RefPtr data member.
+        Reviewed by Oliver Hunt.
 
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
-        * bindings/js/JSDOMWindowBase.h:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        Parsing of rgb() colors in HTML canvas is still fairly slow.
+        findNamedColor() was showing up as hot, so this patch attempts to
+        avoid calling it by putting the rgb() check ahead of the named
+        colors.  It also removes a call to Color::Color() from
+        CanvasStyle, which was doing a redundant check for the hex
+        color and named colors, which CSSParser already does.  Finally, it
+        changes the ad-hoc parser to check for negative values, and clamps them
+        at zero.  This avoids the lex/yacc path for rgb() colors with
+        negative color components.
 
-2009-09-30  Dave Hyatt  <hyatt@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36199
 
-        Reviewed by Tim Hatcher.
+        Covered by fast/canvas/set-colors.html.
 
-        Make sure the removal of user stylesheets results in all of the WebViews being updated to
-        reflect the changes.
+        * css/CSSParser.cpp:
+        (WebCore::parseInt):
+        (WebCore::CSSParser::parseColor):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyFillColor):
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::removeUserContentWithURLForWorld):
-        (WebCore::PageGroup::removeUserContentForWorld):
+2010-03-18  David Kilzer  <ddkilzer@apple.com>
 
-2009-09-30  Dan Bernstein  <mitz@apple.com>
+        <http://webkit.org/b/36246> Node::removeAllEventListenersSlowCase is declared but not used
 
         Reviewed by Sam Weinig.
 
-        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
-        https://bugs.webkit.org/show_bug.cgi?id=29209
-
-        Test: fast/inline/relative-positioned-overflow.html
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
-        inlines to overflow to ensure that they are included in hit-testing.
-
-2009-09-30  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        transforms/3d tests are not run in Release builds
-        https://bugs.webkit.org/show_bug.cgi?id=29827
-
-        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
-        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
-        WebCore was built with ENABLE_3D_RENDERING turned on.
-
-        * DerivedSources.make:
-        * WebCore.3DRendering.exp: Added.
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix for QT.  Didn't know WebCore.pro existed.
-
-        * WebCore.pro:
+        * dom/Node.h:
+        (WebCore::Node::removeAllEventListenersSlowCase): Removed
+        declaration.  Implementation was removed in r48701.
 
-2009-09-30  Dave Hyatt  <hyatt@apple.com>
+2010-03-17  Stephan Aßmus  <superstippi@gmx.de>
 
-        Reviewed by Adam Roben.
+        Reviewed by Oliver Hunt.
 
-        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+        [Haiku] Implement ImageBuffer support
+        https://bugs.webkit.org/show_bug.cgi?id=35288
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::removeUserContentURLForWorld):
-        * page/PageGroup.h:
+        Covered by existing tests.
 
-2009-09-30  Chris Hawk  <hawk@chromium.org>
+        The StillImage class implements WebCore::Image by wrapping a native
+        BBitmap. It will be needed to implement WebCore::ImageBuffer. This
+        solution is just like it's done in the Qt port.
 
-        Reviewed by Dimitri Glazkov.
+        * platform/graphics/haiku/StillImageHaiku.cpp: Added.
+        (WebCore::StillImage::StillImage):
+        (WebCore::StillImage::destroyDecodedData):
+        (WebCore::StillImage::decodedSize):
+        (WebCore::StillImage::size):
+        (WebCore::StillImage::nativeImageForCurrentFrame):
+        (WebCore::StillImage::draw):
+        * platform/graphics/haiku/StillImageHaiku.h: Added.
+        (WebCore::StillImage::create):
 
-        Fix for conditionals in the WebCore gyp file, which contained two separate
-        'conditions' values for the webcore target. The first entry was ignored,
-        resulting in some missine defines.
-        https://bugs.webkit.org/show_bug.cgi?id=29907
+2010-03-17  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * WebCore.gyp/WebCore.gyp:
+        Rubber stamped by Gustavo Noronha Silva.
 
-2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+        [Gtk+] Avoid making a copy of the HTTPHeaderMap.
 
-        Reviewed by Adam Barth.
+        ResourceRequest::httpHeaderFields() is returning a const
+        reference but we are storing it as a simple value. This
+        means that we run either the copy constructor or the assignment
+        operator and make a copy of the RefPtrs.
 
-        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
-        https://bugs.webkit.org/show_bug.cgi?id=29265
-
-        DOM Storage needs to be more careful about where "ThreadSafe" objects are
-        destroyed.  With the current code, there actually isn't a race condition, but
-        it sure would be easy for someone to introduce one.  A bunch of
-        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
-        objects.  If it were possible any of these objects' destructors to be fired off
-        the main thread, then the you'd have a race condition.  The code should be more
-        clear and self-documenting about how things related to each other.
-
-        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
-        which is bounded by the StorageSyncManager, StorageAreaImpl, and
-        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
-        than pointers.  By breaking this dependency, we can eliminate the risk.
-
-        Note that we _could_ have LocalStorageThread's task queue just store
-        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
-        manually take care of deleting.  It'd probably also be possible to change
-        LocalStorageThread around so that it needn't hold onto a reference of itself
-        and have a more deterministic shutdown, but my initial attempts to do so
-        failed, and I decided it wasn't worth changing.  The queue is killed before
-        hand, so the thread is 100% impotent before the main thread continues anyway.
-
-        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
-        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
-        I'm fairly positive that it'd be impossible to hit these asserts and the fact
-        that these classes are no longer ThreadSafeShared should make it clear how
-        they're meant to be used, but I think it's worth it to be extra sure.  Of
-        course, ideally, we'd have such an assert every time a ref is incremented or
-        decremented.
-
-        Behavior should be unchanged and this is just an internal code cleanup, so no
-        new tests.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::LocalStorageTask):
-        (WebCore::LocalStorageTask::performTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::createImport):
-        (WebCore::LocalStorageTask::createSync):
-        (WebCore::LocalStorageTask::createTerminate):
-        * storage/LocalStorageThread.cpp:
-        (WebCore::LocalStorageThread::scheduleImport):
-        (WebCore::LocalStorageThread::scheduleSync):
-        * storage/LocalStorageThread.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::~StorageAreaImpl):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h:
+        This extra copy can be avoided easily by storing
+        the result as a const reference.
 
-2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponseSoup::toSoupMessage):
 
-        Reviewed by Darin Fisher.
+2010-03-17  Alexander Pavlov  <apavlov@chromium.org>
 
-        Chromium needs to be able to override the way storage events are delivered
-        https://bugs.webkit.org/show_bug.cgi?id=29655
+        Reviewed by Pavel Feldman.
 
-        Chromium needs to be able to override the way storage events are delivered.
-        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
-        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
-        injection).  This is necessary because Chromium needs to transport events across
-        a process barrier and then dispatch them without use of a Frame*.
+        Web Inspector: When switching resources in the Resources panel, the Content tab is always selected
+        https://bugs.webkit.org/show_bug.cgi?id=36222
 
-        Behavior should not change with this, so no updates to tests.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showResource):
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::removeItem):
-        (WebCore::StorageAreaImpl::clear):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
-        (WebCore::StorageEventDispatcher::dispatch):
-        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
-
-2009-09-30  Jian Li  <jianli@chromium.org>
+2010-03-17  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler.
 
-        Need to check NULL frame in EventHandler::updateDragAndDrop.
-        https://bugs.webkit.org/show_bug.cgi?id=29929
-
-        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-
-2009-09-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        ASSERTION FAILED: !repaintContainer || repaintContainer == this
-        https://bugs.webkit.org/show_bug.cgi?id=29755
-        
-        Generalize the fix for this bug to account for cases where there may be multiple
-        containing blocks between the repaint container, and the container of the element
-        being repainted.
-
-        Test: compositing/repaint/opacity-between-absolute2.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::mapLocalToContainer):
-        Call offsetFromAncestorContainer() to get the correct offset.
-        
-        (WebCore::RenderBox::computeRectForRepaint): Ditto
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::computeRectForRepaint): Ditto.
-        
-        * rendering/RenderObject.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::offsetFromAncestorContainer):
-        New method that computes an offset from some object in the ancestor container() chain.
-
-2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
-        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
-
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
-
-2009-09-29  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
-        selector gets constructed so that pattern match testing gets the correct URL.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * page/UserContentURLPattern.cpp:
-        (WebCore::UserContentURLPattern::parse):
-
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+        databaseIdentifiers are not filtered for slashes
+        <rdar://problem/7708789> and https://bugs.webkit.org/show_bug.cgi?id=36243
 
-        Rubber-stamped by Brady Eidson.
+        In addition to filtering for '/' and '\', to remove the directory vulnerability
+        on all platforms, it seems worth it to also escape other characters that are
+        obviously dangerous or illegal to have in a filename (mostly inspired by the 
+        Windows illegal-character list).
 
-        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+        No new tests - It's unclear how a test could possibly work into our testing
+        infrastructure.
 
-        I couldn't find out why this only started to happen now, but it was incorrect to check
-        persistence of a credential returned by CredentialStorage::get() without checking that it
-        was non-null. When there is no credential for the protection space in storage, get()
-        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+        * page/SecurityOrigin.cpp:
+        (WebCore::): Added a 128-bool table "needsEscaping" that has a true/false answer
+          for lower-ASCII.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier): "Unescape" the host
+          component using the KURL utility.
+        (WebCore::shouldEscapeUChar): If the char is lower-ASCII, look it up in the 
+          needsEscaping table. Otherwise, let it pass.
+        (WebCore::encodedHost): Modeled after KURL's host escaping method, but targeted 
+          for the escaping considerations for the host component. We don't use the KURL
+          version because this one is "different" enough because it operates on UTF16 and
+          has its own "is bad character?" decider.
+        (WebCore::SecurityOrigin::databaseIdentifier): Create the escaped host if needed,
+          and use it instead of the unescaped host.
+        * page/SecurityOrigin.h:
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
-        assertion after credential null check.
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
-        assertion, matching sync code (and CF one, as well).
+2010-03-17  Dmitry Titov  <dimich@chromium.org>
 
-2009-09-29  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Darin Adler.
+        [v8] Avoid reentry into v8 after TerminateExecution() on a worker thread.
+        https://bugs.webkit.org/show_bug.cgi?id=36239
 
-        Add an ASSERT for UTF8Encoding().isValid()
-        https://bugs.webkit.org/show_bug.cgi?id=29908
+        Test: fast/workers/termination-with-port-messages.html
 
-        * platform/text/TextEncoding.cpp:
-        (WebCore::UTF8Encoding):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::throwError): Avoid throwing if v8 execution is terminated anyways.
+        * bindings/v8/WorkerScriptController.h:
+        (WebCore::WorkerScriptController::proxy): Return V8 proxy as 0 if execution is terminating. Callers to check for 0 before invoking v8.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval): Bail out if v8 proxy is 0.
+        (WebCore::toV8): Ditto
 
-2009-09-29  Dave Hyatt  <hyatt@apple.com>
+2010-03-17  José Millán Soto  <jmillan@igalia.com>
 
-        Reviewed by Jon Honeycutt.
+        Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29892
-        Add support for whitelist patterns to control conditional injection of user scripts and
-        user stylesheets.
+        Change the way of prefetching DNS to allow prefetching function to use full URL
+        https://bugs.webkit.org/show_bug.cgi?id=35589
 
-        No new tests. Not testable until WebKit portion is added in followup patch.
+        Creates a new function, ResourceHandle::prepareForURL, whose default implementation
+        calls prefetchDNS with the host of the given URL as the parameter.
+        Soup implementation of ResourceHandle::prepareForURL executes soup_session_prepare_for_uri.
+        Soup implementation of prefetchDNS is removed.
+        Changed various prefetchDNS calls to ResourceHandle::prepareForURL calls.
 
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::pageGroupUserSheets):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/UserContentURLPattern.cpp: Added.
-        (WebCore::UserContentURLPattern::matchesPatterns):
-        (WebCore::UserContentURLPattern::parse):
-        (WebCore::UserContentURLPattern::matches):
-        (WebCore::UserContentURLPattern::matchesHost):
-        (WebCore::MatchTester::MatchTester):
-        (WebCore::MatchTester::testStringFinished):
-        (WebCore::MatchTester::patternStringFinished):
-        (WebCore::MatchTester::eatWildcard):
-        (WebCore::MatchTester::eatSameChars):
-        (WebCore::MatchTester::test):
-        (WebCore::UserContentURLPattern::matchesPath):
-        * page/UserContentURLPattern.h: Added.
-        (WebCore::UserContentURLPattern::UserContentURLPattern):
-        (WebCore::UserContentURLPattern::scheme):
-        (WebCore::UserContentURLPattern::host):
-        (WebCore::UserContentURLPattern::path):
-        (WebCore::UserContentURLPattern::matchSubdomains):
-
-2009-09-29  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Reproducible crash pressing return inside quoted content
-        at WebCore::BreakBlockquoteCommand::doApply.
-        <rdar://problem/7085453>
-        In some case, like the one provided in the test case, m_downStreamEnd
-        refers to a node that gets deleted when executing the DeleteSelectionCommand.
-        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
-        pruning is needed, because it may be point to a node that has been deleted, but
-        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
-
-        Test: editing/selection/blockquote-crash.html
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
-        to avoid dereferencing a null node pointer.
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
-        using the value in m_downStreamEnd when it is necessary to prune the start block.
-        
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        Basic authentication credentials are not sent automatically to top resources
-        https://bugs.webkit.org/show_bug.cgi?id=29901
-
-        No new tests - I don't want to pollute root directory of http tests to check for this rather
-        minor issue.
-
-        * platform/network/CredentialStorage.cpp:
-        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
-        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
-        loop more explicit.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * platform/network/DNS.h:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * platform/network/ResourceHandle.h:
+        * platform/network/chromium/DNSChromium.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * platform/network/soup/DNSSoup.cpp: Removed.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
 
-2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-17  Kenneth Russell  <kbr@google.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Fisher.
 
-        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
-        added to the inspector unless the inspector is already open
-        when the profile completes.
+        Revert WebGL context attributes changes 33416 / r56074 and 36200 / r56093
+        https://bugs.webkit.org/show_bug.cgi?id=36233
 
-        https://bugs.webkit.org/show_bug.cgi?id=29897
+        The patch for bug 33416, which added multisampling support to the
+        WebGL back buffer, uncovered some OpenGL driver bugs on the build
+        bots which need further investigation to determine the appropriate
+        workaround. Reverting this change, the minor build fix in 36189,
+        and the skipping of the affected tests in bug 36200.
 
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+        Built and tested WebKit and Chromium and ran all WebGL layout
+        tests in both.
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::readPixels):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
 
-        Rubberstamped by David Hyatt.
+2010-03-17  Yael Aharon  <yael.aharon@nokia.com>
 
-        Fix to logic of earlier commit 48902.
+        Reviewed by Darin Adler.
 
-        When merging two if's before committing, I forgot to invert the
-        bool check.
+        Optimize painting for HTMLProgressElement
+        https://bugs.webkit.org/show_bug.cgi?id=36113
+        Cache the progress bar's position, so it is not required to recalculate
+        it for each repaint. 
+        Call repaintRectangle() when the position changes.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::ignoreHttpError):
+        No new tests, as no new functionality introduced.
 
-2009-09-29  Stephen White  <senorblanco@chromium.org>
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::getNumberOfPixelsForProgressPosition):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::position):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::getNumberOfPixelsForProgressPosition):
+        * rendering/RenderTheme.h:
 
-        Unreviewed, build fix.
+2010-03-17  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Fixing Chromium build, following r48884.
+        Mac Buildfix: Using ASSERT_UNUSED instead of ASSERT.
 
-        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+        Reviewed by Simon fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        * bindings/v8/V8WorkerContextEventListener.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
 
-2009-09-29  Kent Tamura  <tkent@chromium.org>
+2010-03-17  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Darin Adler.
 
-        Follows HTML5's maxLength change in September 2009.
-        - Change HTMLTextAreaElement.maxLength type to signed.
-        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
-        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
-          throw INDEX_SIZE_ERR for setting negative values.
-        https://bugs.webkit.org/show_bug.cgi?id=29796
+        Missing support for showing compositing layers borders and repaint count on Windows.
+        <rdar://problem/7760736>
+        <https://bugs.webkit.org/show_bug.cgi?id=36197>
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setMaxLength):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
-        (WebCore::HTMLTextAreaElement::maxLength):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-
-2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::WebLayer::drawInContext): Modified to use the correct font on Windows.
 
-        No review, rolling out r48894, because review discussion was not complete.
-        http://trac.webkit.org/changeset/48894
+2010-03-16  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::begin):
-
-2009-09-29  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Filter feComposite implementation is missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+        Reviewed by Antti Koivisto.
 
-        feComposite implementation for SVG.
+        [Qt] Multiselect Popup - SelectElement refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=36124
 
-        Test: svg/filters/feComposite.svg
+        As it is today it is not possible to the menulists popups to tell SelectElement
+        that more then one option is selected. If you select one the other ones
+        selected state will turn off.
 
-        * platform/graphics/filters/FEComposite.cpp:
-        (WebCore::arithmetic):
-        (WebCore::FEComposite::apply):
+        For <select multiple> I needed to extend the API used by menulist popups. This
+        is the first step. Just refactoring SelectElement without any behavior change.
+        Separating code that will be reused in future patches.
 
-2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateSelectedState):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * dom/SelectElement.h:
 
-        Reviewed by Dimitri Glazkov.
+2010-03-17  Nate Chapin  <japhet@chromium.org>
 
-        Starting all read-only transactions with an explicit BEGIN
-        DEFERRED command instead of BEGIN, since some ports (chromium)
-        might compile their own SQLite library and set BEGIN to BEGIN
-        IMMEDIATE by default; which would result in a deadlock in case of
-        two concurrent read-only transactions on the same DB, and would
-        unnecessarily delay other potential transactions to the same DB.
+        Unreviewed, Chromium build fix.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29729
+        Delete the correct file this time.
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::begin):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp: Copied from WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp.
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Removed.
 
-2009-09-29  Kenneth Russell  <kbr@google.com>
+2010-03-17  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Add support for run-time flag for 3D canvas
-        https://bugs.webkit.org/show_bug.cgi?id=29826
-
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext): Check page settings for
-        experimental WebGL flag before returning 3D graphics context.
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Initialize new flag to false.
-        (WebCore::Settings::setExperimentalWebGLEnabled):
-        * page/Settings.h: Set new flag.
-        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
-
-2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Chromium needs to be able to override the way storage events are delivered - part 1
-        https://bugs.webkit.org/show_bug.cgi?id=29889
-
-        Chromium needs to be able to override the way storage events are delivered.
-        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
-        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
-        injection).  This is necessary because Chromium needs to transport events across
-        a process barrier and then dispatch them without use of a Frame*.
-
-        This patch should be a no-op for all ports other than Chromium.
+        [V8] Remove custom bindings callbacks that aren't in use.
+        (The relevant .idl doesn't mark them as V8Custom or Custom).
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33066
 
+        * Android.v8bindings.mk:
         * WebCore.gypi:
-        * storage/StorageEventDispatcher.h: Added.
-
-2009-09-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (missed file).
-
-        Adding file missed in previous commit.
-
-        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
-
-2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
-        https://bugs.webkit.org/show_bug.cgi?id=29888
-
-        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
-
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
         * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener): Added isAttribute parameter.
-        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
-        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Removed.
 
-2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+2010-03-17  Steve Block  <steveblock@google.com>
 
-        Reviewed by Eric Seidel.
-
-        Fix corruption for non-square images.
-
-        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
-        https://bugs.webkit.org/show_bug.cgi?id=29654
-
-        Added an additional manual-test for this issue to the existing Gtk
-        cursor image test.
-
-        * manual-tests/gtk/cursor-image.html:
-        * manual-tests/gtk/resources/long_cell.cur: Added.
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::BitmapImage::getGdkPixbuf):
-
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dimitri Glazkov.
 
-        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+        Adds ENABLE(WORKERS) guards to V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=36221
 
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/js/ScriptEventListener.h:
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/v8/ScriptEventListener.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        Build fix only, no new tests.
 
-2009-09-29  Nate Chapin  <japhet@chromium.org>
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::toV8Context):
 
-        Reviewed by Eric Seidel.
+2010-03-17  Yury Semikhatsky  <yurys@chromium.org>
 
-        Ensure that we don't scroll lock to an anchor node after a
-        user-initiated scroll, even if that scroll doesn't propagate
-        all the way up to FrameView.
+        Reviewed by Pavel Feldman.
 
-        Test: fast/events/node-event-anchor-lock.html
+        Remove unused reference to InspectorController from InspectorFrontend.
 
-        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
-        (WebCore::EventHandler::scrollOverflow):
-        (WebCore::EventHandler::handleWheelEvent):
-        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
-        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
+        https://bugs.webkit.org/show_bug.cgi?id=36218
 
-2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+        * inspector/InspectorFrontend.h:
 
-        Reviewed by Darin Adler and Sam Weinig.
+2010-03-17 Ilya Tikhonovsky  <loislo@chromium.org>
 
-        Onclick not fired for an element copied with cloneContents() or cloneNode()
-        https://bugs.webkit.org/show_bug.cgi?id=25130
+        Reviewed by Pavel Feldman.
 
-        The change here is that JS event listeners don't keep a reference to a global object from
-        where they were created, and instead take it as a parameter when parsing source code. Also,
-        the listener creation won't fail just because it happens for an element in a frameless
-        document.
-        Thus, moving nodes between documents no longer results in having incorrect registered
-        lazy event listeners on them.
+        WebInspector: Timeline improvements - next iteration.
 
-        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
-               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
-               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+        The top level records should be collapsed.
+        Virtually linked events should be nested in Timeline like Send Request and
+        corresponding Received Responce, Timer Install and Timer Fire etc.
+        It should be possible to see Main Resource request.
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
-        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
-        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
-        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
-        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
-        (WebCore::JSEventListener::reportError): Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=36122
 
-        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
-        to JSDOMGlobalObject.
-
-        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
-        creation was split between this function and ScriptEventListener; moved it here, as JS
-        global object can be different now.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didReceiveResponse):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype._createTopLevelRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._clean):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.get children):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        * inspector/front-end/inspector.css:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveResponse):
 
-        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
-        which can not be determined at parsing time.
+2010-03-17  Alexander Pavlov  <apavlov@chromium.org>
 
-        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
-        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
-        expect that errors are logged at document parsing time, and because I don't know what other
-        side effects moving it vould have.
+        Reviewed by Pavel Feldman.
 
-        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
-        because JSC needs a global context here.
+        Web Inspector: Reimplement style-related audits using native API
+        https://bugs.webkit.org/show_bug.cgi?id=36172
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getAllStyles):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
         * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::getAllStyles):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
+        (WebCore::InspectorDOMAgent::buildObjectForStyleSheet):
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
         * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        Don't pass global object to JSEventListener::create(), which no longer needs it.
-        Note that some of these functions still have an early return for null global object, which
-        can probably be removed in a later patch.
-        Pass ScriptExecutionContext to EventListener methods that now need it.
-
-        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
-        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
-        any object implementing EventTarget COM interface originated from WebCore).
-
-        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
-        COM bindings.
-
-2009-09-28  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
-        fix-ups when accessing JSGlobalObject::d.
-        
-        Replaced with an explicit destructor function pointer.
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetAllStyles):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-17  Steve Block  <steveblock@google.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Jeremy Orlow.
 
-        Don't rely on QNetworkReply::NetworkError codes, but
-        on HTTP error codes instead.
+        Replace instances of bzero in WebCore/bridge common code with memset
+        https://bugs.webkit.org/show_bug.cgi?id=36214
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::ignoreHttpError):
-        (WebCore::QNetworkReplyHandler::finish):
+        Syntax change only, no new tests.
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::getJNIField):
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::dispatchValueFromInstance):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJValue):
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::AllocJavaNPObject):
 
-        Reviewed by Simon Hausmann.
+2010-03-17  Yury Semikhatsky  <yurys@chromium.org>
 
-        Use const references when using Qt's foreach.
+        Reviewed by Pavel Feldman.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        Mark inspector resources as changed so that they are reloaded on the next frontend connection.
+        
+        Split resetScriptObjects into code specific for page navigation and insepctor frontend disconnection.
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36183
 
-        Reviewed by Simon Hausmann.
+        * WebCore.xcodeproj/project.pbxproj: Added InspectorWorkerResource.h to the project file.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::unbindAllResources):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::releaseScriptObject):
 
-        Fix handling of QNetworkReply errors.
+2010-03-17  Pavel Feldman  <pfeldman@chromium.org>
 
-        In the QNetworkReplyHandler::finish() a response was sent even when
-        the reply contained an error. This resulted in a sendResponseIfNeeded()
-        calling didReceiveResponse on the client, leading to the destruction
-        of the m_resourceHandle, discontinuing further processing in finish(),
-        and thus not calling didFail on the client.
+        Reviewed by Timothy Hatcher.
 
-        Instead it continued as everything went fine, and
-        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
-        policy to PolicyDownload due to not being able to show the non existing
-        MIMEType. As the download also obviously fails, it ended up with a
-        policy change error.
+        Web Inspector: Capture main resource load events in timeline panel.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
+        https://bugs.webkit.org/show_bug.cgi?id=36188
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.FormattedRecord):
 
-        Reviewed by Simon Hausmann.
+2010-03-17  Zoltan Horvath  <zoltan@webkit.org>
 
-        The code for showing error pages when the response was
-        a 401/403/404, was not actually doing so. This patch
-        fixes that.
+        Reviewed by Eric Seidel.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
+        Allow custom memory allocation control for AtomicString class
+        https://bugs.webkit.org/show_bug.cgi?id=35907
 
-2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
 
-        Reviewed by Brady Eidson.
+        class name   - instantiated at: WebCore/'location'
+        AtomicString - WebCore/html/HTMLTableElement.cpp:525
 
-        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
-        is failing/crashing intermittently
-        https://bugs.webkit.org/show_bug.cgi?id=29322
+        * platform/text/AtomicString.h:
 
-        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
-        The code had other issues as well, so I removed it altogether:
-        - it claimed to avoid some buffer copies, but it didn't;
-        - and I don't think that base64 encoding should be part of CString interface.
+2010-03-16  John Abd-El-Malek  <jam@chromium.org>
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
-        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
-        to synchronous case.
-        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
-        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
-
-        * platform/text/CString.cpp:
-        * platform/text/CString.h:
-        (WebCore::CStringBuffer::create):
-        (WebCore::CStringBuffer::CStringBuffer):
-        Removed code that was added for Base64 in r48363.
+        Reviewed by Darin Fisher.
 
-2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+        Give keyboard focus to PluginDocuments by default
+        https://bugs.webkit.org/show_bug.cgi?id=36147
 
-        Reviewed by Simon Hausmann.
+        Test: http/tests/plugins/plugin-document-has-focus.html
 
-        Fix typo in Localizations.cpp
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginDocument::pluginNode):
+        * loader/PluginDocument.h:
+        * page/EventHandler.cpp:
+        (WebCore::eventTargetNodeForDocument):
 
-        https://bugs.webkit.org/show_bug.cgi?id=29872
+2010-03-16  Chris Fleizach  <cfleizach@apple.com>
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaControlElementHelpText):
+        Reviewed by Darin Adler.
 
-2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+        REGRESSION (r53857): Crash when tabbing to <map>
+        https://bugs.webkit.org/show_bug.cgi?id=36017
 
-        Reviewed by Tor Arne Vestbø.
+        Test: fast/events/imagemap-norender-crash.html
 
-        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
-        attribute conditional in the generated files, similar to
-        r44116.
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
 
-        * page/DOMWindow.idl:
+2010-03-16  Brent Fulgham  <bfulgham@webkit.org>
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Build fix.  No Review.
 
-        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+        Correct missing includes in cURL network backend introduced
+        by recent changes in WebKit.
 
-        Use the ResourceError as it is supposed to and handle
-        not HTTP errors from QNetworkReply.
+        * platform/network/curl/ResourceHandleCurl.cpp: Add missing
+          includes for SharedBuffer and PassRefPtr.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Correct
+          constructor signature for ResourceHandle to match @r55688.
+        * platform/network/curl/ResourceHandleManager.cpp: Add missing
+          include for RetainPtr.
 
-        Thanks to Adam Roben for his input.
+2010-03-16  Zhenyao Mo  <zmo@google.com>
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
+        Reviewed by Darin Fisher.
 
-2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+        Hook up WebGLContextAttributes to OpenGL context creation code
+        https://bugs.webkit.org/show_bug.cgi?id=33416
 
-        Reviewed by Timothy Hatcher.
+        Test: fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html
 
-        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp: Fix an index bug.
+        * platform/graphics/GraphicsContext3D.h: Add members/functions for multisampling/stencil buffer purpose.
+        * platform/graphics/mac/Canvas3DLayer.h: Add GraphicsContext3D as a member of Canvas3DLayer.
+        * platform/graphics/mac/Canvas3DLayer.mm: Add multisampling support.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Hook up WebGLContextAttributes to OpenGL context creation code for Mac.
+        * platform/graphics/mac/GraphicsLayerCA.mm: Adjust to modified Canvas3DLayer init call.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29816
+2010-03-16  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/js/ScriptEventListener.h:
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/v8/ScriptEventListener.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        Reviewed by Xan Lopez.
 
-2009-09-29  Xan Lopez  <xlopez@igalia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35504
+        [Gtk] Evaluate and fix AtkTable for layout tables
 
-        Unreviewed attempt to fix the build.
+        Causes "layout tables" to be exposed as AccessibilityTables for Gtk.
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
+        * accessibility/AccessibilityTable.cpp:
+        (AccessibilityTable::isTableExposableThroughAccessibility):
 
-2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Eric Seidel.
+        Unreviewed. Build fix for distcheck.
 
-        Add experimentalWebSocketsEnabled in Settings.
-        https://bugs.webkit.org/show_bug.cgi?id=28941
+        * GNUmakefile.am:
 
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setExperimentalWebSocketsEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::experimentalWebSocketsEnabled):
-        
-2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-15  Darin Fisher  <darin@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Add platform code to support WebSocket for chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=29171
-
-        To build within chromium tree, it requires a patch in bug 29174.
-        Real implementation will be landed in chromium tree.
-
-        * WebCore.gypi:
-        * platform/network/chromium/SocketStreamError.h: Added.
-        (WebCore::SocketStreamError::SocketStreamError):
-        * platform/network/chromium/SocketStreamHandle.h: Added.
-        (WebCore::SocketStreamHandle::create):
-
-2009-09-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
-        when Times New Roman is not installed
-
-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
-        not available, use the Windows default GUI font.
-
-2009-09-28  Jian Li  <jianli@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36152
+        [chromium] Add support for history.pushState and history.replaceState
 
-        Reviewed by David Levin.
+        This is covered by the existing tests in fast/loader/stateobjects
 
-        Do not add platform-specific methods to cross-platform header
-        FileSystem.h per Darin's feedback for 29109.
-        https://bugs.webkit.org/show_bug.cgi?id=29830
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::ZigZag::Deserializer::deserialize):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        Switch to returning v8::Null instead of the empty value to match JSC
+        and the spec.
 
-        * platform/FileSystem.h:
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::asURL):
-        * platform/chromium/FileSystemChromium.cpp:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Call
+        dispatchDidNavigateWithinPage just before dispatching events to the
+        page.  This ordering is important since the event handlers could
+        destroy the page or start another navigation.
 
-2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+        * loader/FrameLoaderClient.h: Add dispatchDidNavigateWithinPage to
+        notify the client whenever a navigation occurs without changing any of
+        the documents in the page.
 
-        Reviewed by Dimitri Glazkov.
+2010-03-16  Adam Roben  <aroben@apple.com>
 
-        Register Chromium's VFSs with a proper sqlite3_io_methods
-        finder. This should only affect the POSIX implementation. The
-        Windows change is included for consistency and in case sqlite
-        starts using something similar in its Windows VFS in the future.
+        Fix linker warnings when building WebCore on Windows
 
-        https://bugs.webkit.org/show_bug.cgi?id=29743
+        Rubber-stamped by Steve Falkenburg.
 
-        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSDOMFormData.cpp from the
+        build, since it's already included in DerivedSources.cpp. Also let VS
+        sort this file as it saw fit.
 
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+2010-03-15  Antti Koivisto  <koivisto@iki.fi>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Hausmann.
 
-        Change the V8 bindings' handling of window.toString(),
-        so we return [object DOMWindow] (like JSC), not [object global].
+        https://bugs.webkit.org/show_bug.cgi?id=36121
+        [Qt] Make WebKit scrollbars work with tiling
+         
+        Translate coordinates correctly.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29742
+        * page/Frame.cpp:
+        (WebCore::Frame::tiledBackingStorePaintEnd):
 
-        This will fix a couple of Chromium port test failures and enable us to
-        use the default expectations for a bunch more.
+2010-03-16  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
-        of the global object wrapper when it's available in the DOMWindow toString callback.
+        Reviewed by Eric Seidel.
 
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+        [Qt] MediaPlayerPrivate: Initialize m_mediaPlayerControl to 0 to avoid crashes
+        when no media services can be found.
 
-        Rubber stamped by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=36142
 
-        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
 
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+2010-03-16  Adam Barth  <abarth@webkit.org>
 
-2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+        Unreviewed.
 
-        Reviewed by Darin Adler.
+        noscript tag should render when @sandbox disables JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=36092
 
-        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
-        https://bugs.webkit.org/show_bug.cgi?id=29822
-        
-        Added NotNullPassRefPtr, and deployed it in all places that initialize
-        JavaScript objects.
+        Add missing "!" in plugin code.  Should fix plugins/embed-inside-object
+        on Gtk and Qt.
 
-        * bindings/js/DOMObjectWithSVGContext.h:
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::cacheDOMStructure):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObject::DOMObject):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        * bridge/runtime_object.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
 
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+2010-03-16  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
-        https://bugs.webkit.org/show_bug.cgi?id=29823
-
-        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+        [V8] Delete DerivedSourcesAllInOne.cpp.
 
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=33048
 
-2009-09-28  Mark Rowe  <mrowe@apple.com>
+        * Android.v8bindings.mk:
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Removed.
 
-        Fix the build by doing something approximating reasonableness in the Xcode project.
+2010-03-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Revert r56006 as it caused functional issues. We will work on a
+        testcase, and rework the fix, and land when we have this a bit
+        more testable.
 
-2009-09-28  Simon Hausmann  <hausmann@webkit.org>
-
-        Prospective Tiger build fix.
-
-        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
 
-2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Add explicit frontend event for commit load.
+        Web Inspector: Errors when inspecting styles of non-renderable elements in XHTML.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29814
+        https://bugs.webkit.org/show_bug.cgi?id=35025
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didCommitLoad):
-        * inspector/InspectorFrontend.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
         * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype._setDocument):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.didCommitLoad):
-
-2009-09-28  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Chromium port - recognize we are being built independently
-        of chromium and look for dependencies under webkit/chromium rather
-        than chromium/src.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29722
-
-        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
-          the sources list, since they are not supposed to be built here.
-
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Implement XSLT support with QtXmlPatterns.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::~Document):
-        (WebCore::Document::setTransformSource):
-        * dom/Document.h:
-        (WebCore::Document::transformSource):
-        * dom/TransformSource.h: Added.
-        (WebCore::TransformSource::platformSource):
-        * dom/TransformSourceLibxslt.cpp: Added.
-        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
-        (WebCore::TransformSource::~TransformSource):
-        * dom/TransformSourceQt.cpp: Added.
-        (WebCore::TransformSource::TransformSource): Wraps a plain string.
-        (WebCore::TransformSource::~TransformSource):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::parseProcessingInstruction):
-        * xml/XSLStyleSheet.h:
-        (WebCore::XSLStyleSheet::sheetString):
-        * xml/XSLStyleSheetLibxslt.cpp:
-        (WebCore::XSLStyleSheet::document):
-        * xml/XSLStyleSheetQt.cpp: Added.
-        * xml/XSLTProcessor.h:
-        * xml/XSLTProcessorLibxslt.cpp:
-        (WebCore::xmlDocPtrFromNode):
-        * xml/XSLTProcessorQt.cpp: Added.
-        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
-        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
-        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
-
-2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28689
-
-        Covered by LayoutTests/media/video-no-audio.html
-
-        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
-        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
-        * rendering/MediaControlElements.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
-        * rendering/RenderThemeChromiumSkia.h:
+        (WebInspector.DOMNode.prototype._addAttribute):
+        (WebInspector.DOMWindow.prototype.Object):
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._update):
 
-2009-09-28  Jian Li  <jianli@chromium.org>
+2010-03-12  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by David Levin.
+        Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        [chromium] DragData::asURL should return file URL.
-        https://bugs.webkit.org/show_bug.cgi?id=29109
+        Spatial Navigation: Add a scrollIntoView call when focusing an element.
+        https://bugs.webkit.org/show_bug.cgi?id=36020
 
-        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+        When focusing an element in Spatial Navigation logic, it is desired to make
+        this element visible in the current viewport. For that to happen, there
+        could be a call to Element's scrollIntoView method at focusing time. However
+        for visual aspects, it is preferable to scroll to an inflated rect of |element|
+        in order to consider the focus outline width.
+        As Element's scrollIntoView method does not provide this flexibility, patch adds
+        a custom scrollIntoView method to SpatialNavigation.h .
 
-        * platform/FileSystem.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::asURL):
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::getAbsolutePath):
-        (WebCore::isDirectory):
-        (WebCore::filePathToURL):
-
-2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollIntoView):
+        * page/SpatialNavigation.h:
 
-        Reviewed by David Levin.
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        [V8] Add a special case to handle index arguments, because we need to be
-        able to see if they're < 0.
-        https://bugs.webkit.org/show_bug.cgi?id=29810
+        Reviewed by Eric Seidel.
 
-        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
-          for index arguments.
+        Normalize timeout priorities through the GStreamer media player as
+        a whole. This should help avoid that any of them is starved.
 
-2009-09-28  Dan Bernstein  <mitz@apple.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_render):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekDataCb):
 
-        Reviewed by Darin Adler.
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
-        https://bugs.webkit.org/show_bug.cgi?id=29792
+        Reviewed by Eric Seidel.
 
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
-        enabled, check if the linked style sheet is one of two versions of the
-        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+        Use default priority also for parsing data: URIs.
 
-        Reviewed by Adam Barth.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startData):
 
-        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
-        unsigned ints are accidentally used as signed.
-        https://bugs.webkit.org/show_bug.cgi?id=29810
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Test: LayoutTests/fast/forms/textarea-maxlength.html
+        Reviewed by Eric Seidel.
 
-        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
-          properly generates on "unsigned" return value.
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+        Normalize SharedTimers priorities to always be
+        G_PRIORITY_DEFAULT. As it is currently, timers that should happen
+        immediately (0 miliseconds delay) end up delayed by a lot of time
+        due to glib starving lower priority sources.
 
-        Reviewed by Simon Hausmann.
+        * platform/gtk/SharedTimerGtk.cpp:
+        (WebCore::setSharedTimerFireTime):
 
-        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
 
-        In preparation for adding XSLT support with QtXmlPatterns to the Qt
-        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
-        have our own implementation which most likely will not share any code
-        with the current one.
+        Reviewed by Gustavo Noronha.
 
-        Additionally, fix some coding style issues.
+        Add support for Fast Mobile Scrolling in the build system.
 
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
-        * xml/XSLStyleSheetLibxslt.cpp: Added.
-
-2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Prospective build fix for r48812.
 
-        Forgot to remove the inline reset() implementation when reverting the indentation
-        changes in the file.
+2010-03-11  Yury Semikhatsky <yurys@chromium.org>
 
-        * xml/XSLTProcessor.h:
-
-2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
-
-        Web Inspector: Follow up to r48809.
-        InspectorController.wrapObject should only be called on the inspectable page side.
-
-        https://bugs.webkit.org/show_bug.cgi?id=17429
-
-        * inspector/front-end/EventListenersSidebarPane.js:
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection):
-        (WebInspector.EventListenersSection.prototype.update):
-        (WebInspector.EventListenerBar):
-        (WebInspector.EventListenerBar.prototype.update):
-
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Move the libxslt specific part of XSLTProcessor to a separate file.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
+        Reviewed by Pavel Feldman.
 
-        In preparation for adding XSLT support with QtXmlPatterns to the Qt
-        port, move the libxslt part of the XSLTProcessor implementation into
-        another file and leave the part that can be reused and shared.
+        Introduce InspectorFrontendClient that provides InspectorFrontend with an interface to the embedder. InspectorClient now serves as a delegate for InspectorController and does not contain methods for managing inspector frontend window. That allows to create remote InspectorFrontendHost.
 
-        Additionally, fix some coding style issues.
+        Introduce InspectorFrontendClient that would provide InspectorFrontend with an interface to the embedder
+        https://bugs.webkit.org/show_bug.cgi?id=35036
 
         * GNUmakefile.am:
+        * WebCore.Inspector.exp:
+        * WebCore.base.exp:
         * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.order:
+        * WebCore.pro:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * xml/XSLTProcessor.cpp:
-        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
-        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
-        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
-        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
-        * xml/XSLTProcessorLibxslt.cpp: Added.
-        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
-        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
-        (WebCore::docLoaderFunc): Moved.
-        (WebCore::setXSLTLoadCallBack): Moved.
-        (WebCore::writeToVector): Moved.
-        (WebCore::saveResultToString): Moved.
-        (WebCore::xsltParamArrayFromParameterMap): Moved.
-        (WebCore::freeXsltParamArray): Moved.
-        (WebCore::xsltStylesheetPointer): Moved.
-        (WebCore::xmlDocPtrFromNode): Moved.
-        (WebCore::resultMIMEType): Moved.
-        (WebCore::XSLTProcessor::transformToString): Moved.
-
-2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Fix the crash of SVG that crashes when use a non-exist symbol
-        https://bugs.webkit.org/show_bug.cgi?id=27693
-
-        Test: svg/custom/use-non-existing-symbol-crash.svg
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::shadowTreeContainsChangedNodes):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowVisible):
+        (WebCore::InspectorController::frontendReady):
+        (WebCore::InspectorController::willCloseFrontend):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::setInspectorFrontendClient):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::setFrontend):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::hasInspectorFrontendClient):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::~InspectorFrontend):
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::bringToFront):
+        (WebCore::InspectorFrontend::inspectedURLChanged):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendClient.h: Added.
+        (WebCore::InspectorFrontendClient::~InspectorFrontendClient):
+        * inspector/InspectorFrontendClientLocal.cpp: Added.
+        (WebCore::FrontendMenuProvider::create):
+        (WebCore::FrontendMenuProvider::disconnect):
+        (WebCore::FrontendMenuProvider::FrontendMenuProvider):
+        (WebCore::FrontendMenuProvider::~FrontendMenuProvider):
+        (WebCore::FrontendMenuProvider::populateContextMenu):
+        (WebCore::FrontendMenuProvider::contextMenuItemSelected):
+        (WebCore::FrontendMenuProvider::contextMenuCleared):
+        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::~InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::windowObjectCleared):
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::canAttachWindow):
+        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::moveWindowBy):
+        (WebCore::InspectorFrontendClientLocal::showContextMenu):
+        (WebCore::InspectorFrontendClientLocal::setAttachedWindow):
+        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowHeight):
+        * inspector/InspectorFrontendClientLocal.h: Added.
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::bringToFront):
+        (WebCore::InspectorFrontendHost::inspectedURLChanged):
+        (WebCore::InspectorFrontendHost::canAttachWindow):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::create):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.bringToFront):
+        (.WebInspector.InspectorFrontendHostStub.prototype.inspectedURLChanged):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.close):
+        (WebInspector.bringToFront):
+        (WebInspector.inspectedURLChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::openInspectorFrontend):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::addInspectElementItem):
 
-2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector Should Show Event Listeners/Handlers Registered on each Node
-        https://bugs.webkit.org/show_bug.cgi?id=17429
-        
-          Extracted a method from dispatchEvent to get the event ancestor chain
-        
-        * dom/Node.cpp:
-        (WebCore::Node::eventAncestors): the extracted method
-        (WebCore::Node::dispatchGenericEvent): use eventAncestors
-        * dom/Node.h:
+        Web Inspector: migrate to native styles inspector in
+        order to inspect styles from foreighn domains.
 
-          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
-          The DOMAgent's getEventListenersForNode handles the logic of finding
-          all the relevant listeners in the event flow.
+        https://bugs.webkit.org/show_bug.cgi?id=36117
 
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getEventListenersForNode):
+        (WebCore::InspectorBackend::getStyles):
+        (WebCore::InspectorBackend::getInlineStyle):
+        (WebCore::InspectorBackend::getComputedStyle):
+        (WebCore::InspectorBackend::applyStyleText):
+        (WebCore::InspectorBackend::setStyleText):
+        (WebCore::InspectorBackend::setStyleProperty):
+        (WebCore::InspectorBackend::toggleStyleEnabled):
+        (WebCore::InspectorBackend::setRuleSelector):
+        (WebCore::InspectorBackend::addRule):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
         * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getEventListenersForNode):
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
-        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::getInlineStyle):
+        (WebCore::InspectorDOMAgent::getComputedStyle):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
+        (WebCore::InspectorDOMAgent::getAttributeStyles):
+        (WebCore::InspectorDOMAgent::applyStyleText):
+        (WebCore::InspectorDOMAgent::setStyleText):
+        (WebCore::InspectorDOMAgent::setStyleProperty):
+        (WebCore::InspectorDOMAgent::toggleStyleEnabled):
+        (WebCore::InspectorDOMAgent::setRuleSelector):
+        (WebCore::InspectorDOMAgent::addRule):
+        (WebCore::InspectorDOMAgent::bindStyle):
+        (WebCore::InspectorDOMAgent::bindRule):
+        (WebCore::InspectorDOMAgent::buildObjectForStyle):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        (WebCore::InspectorDOMAgent::uniqueStyleProperties):
+        (WebCore::InspectorDOMAgent::longhandProperties):
+        (WebCore::InspectorDOMAgent::shorthandPriority):
+        (WebCore::InspectorDOMAgent::ruleAffectsNode):
+        (WebCore::InspectorDOMAgent::toArray):
         * inspector/InspectorDOMAgent.h:
-        (WebCore::EventListenerInfo::EventListenerInfo):
         * inspector/InspectorFrontend.cpp:
         (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetStyles):
+        (WebCore::InspectorFrontend::didGetComputedStyle):
+        (WebCore::InspectorFrontend::didGetInlineStyle):
+        (WebCore::InspectorFrontend::didApplyStyleText):
+        (WebCore::InspectorFrontend::didSetStyleText):
+        (WebCore::InspectorFrontend::didSetStyleProperty):
+        (WebCore::InspectorFrontend::didToggleStyleEnabled):
+        (WebCore::InspectorFrontend::didSetRuleSelector):
+        (WebCore::InspectorFrontend::didAddRule):
         * inspector/InspectorFrontend.h:
-        (WebCore::InspectorFrontend::scriptState):
-        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
-        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
-        (WebInspector.EventListeners.getEventListenersForNodeAsync):
-
-          New Sidebar Pane in the Element's Panel
-          Includes Gear Menu for filtering the Event Listeners on the
-          "Selected Node Only" or "All Nodes"
-
-        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.updateEventListeners):
-        * inspector/front-end/EventListenersSidebarPane.js: Added. 
-        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection): The 2nd level in the Pane
-        (WebInspector.EventListenersSection.prototype.update): filters on Preference
-        (WebInspector.EventListenersSection.prototype.addListener):
-        (WebInspector.EventListenerBar): The 3rd level in the Pane
-        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
-        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
-        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
-        
-          Consolidated "appropriateSelectorForNode"
-
-        * inspector/front-end/StylesSidebarPane.js:
-        * inspector/front-end/utilities.js:
-
-          Miscellaneous Updates
-
-        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
-        * WebCore.gypi: included the new inspector files
-        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
-        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
-        * inspector/front-end/inspector.css: reused as much as possible
-        * inspector/front-end/inspector.html: include the new script
-        * inspector/front-end/WebKit.qrc: included the new inspector files
-
-2009-09-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
-        Implement CSSOM Range.getClientRects/getBoundingClientRect 
-
-        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
-               fast/dom/Range/getBoundingClientRect.html
-               fast/dom/Range/getClientRects.html
-
-        * dom/Range.cpp:
-        (WebCore::Range::getClientRects):
-        (WebCore::Range::getBoundingClientRect):
-        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
-        (WebCore::Range::getBorderAndTextQuads):
-        * dom/Range.h:
-        * dom/Range.idl:
-        Implement Range.getClientRects/getBoundingClientRect.
-
-        * dom/Element.cpp:
-        * rendering/RenderObject.h: 
-        (WebCore::adjustForAbsoluteZoom):
-        (WebCore::adjustIntRectForAbsoluteZoom):
-        (WebCore::adjustFloatPointForAbsoluteZoom):
-        (WebCore::adjustFloatQuadForAbsoluteZoom):
-        Move point/quad adjustment methods from Element.cpp to RenderObject.h
-        so that Range.cpp can use them as well.
-
-2009-09-27  Simon Hausmann  <hausmann@webkit.org>
-
-        Unreviewed fix for WebInspector with Qt build.
-
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by nobody (trivial ChangeLog fix).
-
-        Restore WebCore/ChangeLog truncated in r48778.
-
-2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29770
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::unbind):
-
-2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Do not track DOM changes while inspector window is closed.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29769
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-
-2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
-
-        https://bugs.webkit.org/show_bug.cgi?id=29762
-
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        * inspector/front-end/ElementsTreeOutline.js:
         * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleText):
-        (InjectedScript.openInInspectedWindow):
-        * inspector/front-end/InjectedScriptAccess.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-
-2009-09-26  David Kilzer  <ddkilzer@apple.com>
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
 
-        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+2010-03-16  Shinichiro Hamaji  <hamaji@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
-
-        * DerivedSources.make: Moved Platform.h check for
-        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
-        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
-        Added ifndef test to make it possible to override both
-        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
-        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
-        ADDITIONAL_IDL_DEFINES to common section.
-        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
-        it is ever used.
-        * WebCore.pro: Ditto.
-
-2009-09-26  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        Move placeholder-related code to HTMLTextFormControlElement from
-        HTMLInputElement, WMLInputElement, InputElement, and
-        HTMLTextAreaElement.
-        https://bugs.webkit.org/show_bug.cgi?id=28703
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/InputElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
-        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
-        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::HTMLInputElement):
-        (WebCore::HTMLInputElement::handleFocusEvent):
-        (WebCore::HTMLInputElement::handleBlurEvent):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::supportsPlaceholder):
-        (WebCore::HTMLInputElement::isEmptyValue):
-        * html/HTMLIsIndexElement.cpp:
-        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::createRenderer):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
-        (WebCore::HTMLTextAreaElement::isEmptyValue):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::createRenderer):
-        * wml/WMLInputElement.h:
-
-2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Optimize the code so only the text from start to end is scanned.
-        https://bugs.webkit.org/show_bug.cgi?id=29092
-
-        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
-        file improved from 400ms to 40ms (10x faster).
-
-        * dom/Text.cpp:
-        (WebCore::Text::createWithLengthLimit):
-
-2009-09-26  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        This Patch fixes [chromium] the drop-down is always left-aligned even
-        for RTL element.
-        https://bugs.webkit.org/show_bug.cgi?id=29612
-
-        For auto-complete, the items in drop-down should be right-aligned if
-        the directionality of <input> field is RTL.
-        For <select><option>, the items in drop-down should be right-aligned
-        if the directionality of <select> is RTL.
+        RenderText::m_text should be a String, not RefPtr<StringImpl>
+        https://bugs.webkit.org/show_bug.cgi?id=36010
 
-        No automatic test is possible. Manual tests are added.
+        Refactoring only, so no new tests.
 
-        * manual-tests/autofill_alignment.html: Added.
-        * manual-tests/select_alignment.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
-        be paint if it should be right-aligned.
-
-2009-09-25  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
-        to crash on launch
-        https://bugs.webkit.org/show_bug.cgi?id=29759
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
-        property list at the root of FontList.plist, but with an additional
-        key for the last value of the Fonts registry key.
-        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
-        to populatFontDatabaseFromPlist.
-
-2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Build fix. Adding missing header files.
-
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-
-2009-09-25  David Kilzer  <ddkilzer@apple.com>
-
-        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
-
-        Reviewed by Darin Adler.
-
-        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
-        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
-
-2009-09-25  Adam Barth  <abarth@webkit.org>
+        * platform/text/PlatformString.h:
+        (WebCore::String::makeLower):
+        (WebCore::String::makeUpper):
+        (WebCore::String::makeSecure):
+        (WebCore::String::makeCapitalized):
+        (WebCore::String::containsOnlyASCII):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::widthFromCache):
+        (WebCore::RenderText::trimmedPrefWidths):
+        (WebCore::RenderText::containsOnlyWhitespace):
+        (WebCore::RenderText::setTextInternal):
+        (WebCore::RenderText::setText):
+        (WebCore::RenderText::previousOffset):
+        (WebCore::RenderText::previousOffsetForBackwardDeletion):
+        (WebCore::RenderText::nextOffset):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::text):
+        (WebCore::RenderText::characters):
+        (WebCore::RenderText::textLength):
+
+2010-03-16  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Load blocks during unload should not affect targeted loads
-        https://bugs.webkit.org/show_bug.cgi?id=29747
-
-        Move the check of the unload state after checking for targeted links.
-
-        Test: fast/loader/unload-hyperlink-targeted.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
-
-2009-09-25  Kenneth Russell  <kbr@google.com>
+        noscript tag should render when @sandbox disables JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=36092
 
-        Reviewed by Dimitri Glazkov.
-
-        [Chromium] Add initial V8 bindings for WebGL
-        https://bugs.webkit.org/show_bug.cgi?id=29664
+        Instead of talking to Settings directly to figure out if JavaScript is
+        enabled in a frame, we need to talk to the ScriptController.  The
+        ScriptController is better at answering that question because it knows
+        about @sandbox.
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
-        (WebCore::constructCanvasArray):
-        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
-        (WebCore::jsArrayToFloatArray):
-        (WebCore::jsArrayToIntArray):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::):
-        (WebCore::vertexAttribAndUniformHelperf):
-        (WebCore::uniformHelperi):
-        (WebCore::uniformMatrixHelper):
-        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * platform/graphics/GraphicsContext3D.h:
+        Test: fast/frames/sandboxed-iframe-noscript.html
 
-2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createRenderer):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::noscriptCreateErrorCheck):
+        (WebCore::HTMLParser::isInline):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
 
-        This is breaking Chromium try bots, so I'm counting this as a build fix.
+2010-03-15  John Gregg  <johnnyg@google.com>
 
-        Add more svn:ignore exceptions.  On different platforms, these files are
-        generated with different case for WebCore.
+        Reviewed by David Levin.
 
-        * WebCore.gyp: Changed property svn:ignore.
+        Notification object should expose absolute URL of icon
+        https://bugs.webkit.org/show_bug.cgi?id=35800
 
-2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+        Covered by existing tests.
 
-        Reverting r48767, as it broke Windows build in a non-trivial way.
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/Notification.h:
+        (WebCore::Notification::iconURL):
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::jsFunction):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::jsFunction):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError):
-        (WebCore::EventListener::jsFunction):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-09-24  Tony Chang  <tony@chromium.org>
+        Reviewed by Holger Freyther.
 
-        Reviewed by David Levin.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35887
 
-        Add a gyp variable to allow building a debug webcore without debug
-        symbols.  This allows for faster compile, link, and gdb times.
+        * platform/efl/ClipboardEfl.cpp: Added.
+        * platform/efl/PasteboardEfl.cpp: Added.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29721
+2010-03-15  Kent Tamura  <tkent@chromium.org>
 
-        No new tests, build config change.
+        Reviewed by Eric Seidel.
 
-        * WebCore.gyp/WebCore.gyp:
+        Don't submit disabled menu options.
+        https://bugs.webkit.org/show_bug.cgi?id=35056
 
-2009-09-25  Darin Fisher  <darin@chromium.org>
+        Test: fast/forms/menulist-disabled-selected-option.html
 
-        Reviewed by Dimitri Glazkov.
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+         If a selected option is disabled, skip it.
+         Remove code for non-selected menulist because of compatibility with
+         other browsers.
 
-        Declare RegisteredEventListener as a class instead of a struct.
-        This fixes a warning in the Chromium build.
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        * dom/RegisteredEventListener.h:
+        Reviewed by Holger Freyther.
 
-2009-09-25  Dan Bernstein  <mitz@apple.com>
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35884
 
-        Reviewed by Jon Honeycutt.
+        * platform/efl/FileSystemEfl.cpp: Added.
 
-        WebCore part of
-        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
-        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
-
-        When the Windows Fonts directory contains more than one font file for a
-        given font name, which of the fonts gets assigned to the name in the
-        Core Graphics font database was determined arbitrarily and did not
-        always match the font GDI used for the same font name. The mismatch
-        caused character-to-glyph mapping to use one font and glyph rendering to
-        use another.
-
-        The fix is to update the Core Graphics font database from the registry
-        entries (that reflect the name-to-font mapping that GDI uses) after
-        populating it with the result of scanning the Fonts directory. As a
-        consequence, the directory needs to be scanned at startup every time the
-        registry key changes, so the last value of the registry key is kept
-        in the property list on disk so that it could be compared to the current
-        value on startup.
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
-        a parameter and avoids round-tripping through XML by calling
-        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
-        (WebCore::fontFilenamesFromRegistryKey):
-        (WebCore::cgFontDBKey):
-        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
-        list and a property list with the font filenames from the registry and
-        writes a dictionary with those property lists as values.
-        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
-        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
-        registry key.
-        (WebCore::populateFontDatabase): Changed to read the contents of the
-        Fonts registry key and compare it with the last-saved value from the
-        property list, and to call wkAddFontsFromRegistry() after populating the
-        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
-        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
-
-2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Darin Adler.
+        Reviewed by Holger Freyther.
 
-        Inlined some object creation code, including lexicalGlobalObject access
-        https://bugs.webkit.org/show_bug.cgi?id=29750
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35882
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
-        API changes.
+        * platform/efl/ContextMenuItemEfl.cpp: Added.
 
-2009-09-25  Dave Hyatt  <hyatt@apple.com>
+2010-03-15  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Reviewed by Anders Carlsson.
+        Reviewed by Holger Freyther.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24399
-        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
-        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
-        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
-        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
-        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+        https://bugs.webkit.org/show_bug.cgi?id=35502
+        [Gtk] Objects of ATK_ROLE_TABLE should not implement AtkText
 
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
-        (WebCore::CSSStyleSheet::isUserStyleSheet):
-        * dom/Document.cpp:
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::pageGroupUserSheets):
+        Simple change to stop tables from implementing AtkText.
 
-2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (getInterfaceMaskFromObject):
 
-        Reviewed by Darin Adler.
+2010-03-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
 
-        ASSERTION FAILED: !repaintContainer || repaintContainer == this
-        https://bugs.webkit.org/show_bug.cgi?id=29755
-        
-        It's possible for RenderObject::container() to return an object that is higher
-        in the hierarchy than the repaintContainer that is being used to repaint an
-        object. For example, this can happen when running an accelerated opacity
-        transition on an element with a position:absolute parent, and a position:absolute child.
-        
-        In this case we need to detect when RenderObject::container() will skip over
-        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+        Reviewed by Adam Barth.
 
-        Test: compositing/repaint/opacity-between-absolute.html
+        According to the updated specification, a data field should always
+        result in a newline character being appended to the data buffer
+        regardless if the data buffer contains any data or not. However, upon
+        event dispatch, the last newline will be removed. This differs from an
+        older version of the specification where a newline character was
+        appended before the data value only if the buffer already contained
+        data. As a result, EventSource now supports receiving events with empty
+        data or newline characters only.
+        https://bugs.webkit.org/show_bug.cgi?id=33210
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::mapLocalToContainer):
-        (WebCore::RenderBox::computeRectForRepaint):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::computeRectForRepaint):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::container):
-        * rendering/RenderObject.h:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::parseEventStreamLine):
 
-2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+2010-03-15  Valters Svabe  <vsvabe@gmail.com>
 
         Reviewed by Darin Adler.
 
-        Crash with hardware accelerated rotation of a PDF image in a data URL
-        <rdar://problem/7250378>
+        :after selector displays in wrong place with nested div
+        https://bugs.webkit.org/show_bug.cgi?id=32288
         
-        PDF images don't return a color space from CGImageGetColorSpace(),
-        so we need to null-check the return value before use.
-
-        Test: compositing/color-matching/pdf-image-match.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-09-25  Darin Adler  <darin@apple.com>
+        Make sure we don't append things after :after-generated content, if
+        it's inside an anonymous block.
 
-        Reviewed by Geoffrey Garen.
-
-        Null-deref when first access to an Attr node is after its Element is destroyed
-        https://bugs.webkit.org/show_bug.cgi?id=29748
-
-        Test: fast/dom/Attr/access-after-element-destruction.html
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
-        long as the Attr is alive.
+        Test: fast/css-generated-content/block-after.html
 
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
-        long as the NamedNodeMap is alive.
-
-        * dom/Attr.idl: Added CustomMarkFunction attribute.
-
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
-        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
-        have attributes hanging around that might need an Attr node created; that way
-        we won't crash with a null-dereference trying to deal with one of them. This
-        can't happen when working with JavaScript since the Element will be kept
-        alive due to the change above.
-        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
-        missing braces.
-
-        * dom/NamedAttrMap.h: Made the element function public so it can be used by
-        the JavaScript binding to keep the Element alive.
-
-        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
 
-2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Darin Adler and Sam Weinig.
+        Reviewed by Eric Seidel.
 
-        Onclick not fired for an element copied with cloneContents() or cloneNode()
-        https://bugs.webkit.org/show_bug.cgi?id=25130
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35885
 
-        The change here is that JS event listeners don't keep a reference to a global object from
-        where they were created, and instead take it as a parameter when parsing source code. Also,
-        the listener creation won't fail just because it happens for an element in a frameless
-        document.
-        Thus, moving nodes between documents no longer results in having incorrect registered
-        lazy event listeners on them.
+        * platform/efl/KURLEfl.cpp: Added.
 
-        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
-               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
-               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+2010-03-15  Chris Fleizach  <cfleizach@apple.com>
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
-        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
-        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
-        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
-        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
-        (WebCore::JSEventListener::reportError): Ditto.
+        Reviewed by Beth Dakin.
 
-        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
-        to JSDOMGlobalObject.
+        VO not able to perform a VO-spacebar on facebook links
+        https://bugs.webkit.org/show_bug.cgi?id=36132
 
-        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
-        creation was split between this function and ScriptEventListener; moved it here, as JS
-        global object can be different now.
+        When a label element is used as a click event handler, and it doesn't have any
+        corresponding control, it should handle the action itself.
 
-        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
-        which can not be determined at parsing time.
+        Test: accessibility/label-element-press.html
 
-        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
-        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
-        expect that errors are logged at document parsing time, and because I don't know what other
-        side effects moving it vould have.
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::accessKeyAction):
 
-        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
-        because JSC needs a global context here.
+2010-03-15  Cameron Zwarich  <zwarich@apple.com>
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        Don't pass global object to JSEventListener::create(), which no longer needs it.
-        Note that some of these functions still have an early return for null global object, which
-        can probably be removed in a later patch.
-        Pass ScriptExecutionContext to EventListener methods that now need it.
+        Reviewed by Geoff Garen.
 
-2009-09-25  Enrica Casucci  <enrica@apple.com>
+        Bug 36135 - GCController::garbageCollectNow() crashes when called from garbage collection
+        <https://bugs.webkit.org/show_bug.cgi?id=36135>
+        <rdar://problem/7752552>
 
-        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectNow): Fail silently if garbage collection is
+        active rather than hitting the CRASH() reentrancy guard.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
-        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+2010-03-15  Simon Fraser  <simon.fraser@apple.com>
 
-        Change the way style is preserved when inserting a new paragraph.
-        The original code handled insertion at the beginning and at the end of a paragraph as special
-        cases. The newly created paragraph contained a set of nodes generated starting from the
-        computed style of the insertion node. This approach has two problems:
-        1. if the insertion node has a non opaque background color and one of the parent element did have
-        a solid background color the new paragraph did not have the element with the solid color in the tree.
-        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
-        background color and some font attribute was being reproduced as span bold italic font as separate tags.
-        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
-        paragraph where the insertion point is.
+        Reviewed by Dan Bernstein.
 
-        Test: editing/inserting/insert-bg-font.html
+        Drop out of compositing mode when no elements need to composite
+        https://bugs.webkit.org/show_bug.cgi?id=36134
 
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
-        between the insert node and the outer block.
-        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
-        in the new paragraph the same element hierarchy present in the starting paragraph.
-        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
-        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
-        at the end of the paragraph to use the new methods instead of applying the calculated style.
-        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+        When no more elements on the page need to be composited, drop out of compositing
+        mode altogether, including removing the layer-backed view that hosts the layers.
 
-2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers): If the list of child layers to attach at
+        the root is empty, we have no composited layers, and can drop out of compositing mode by calling
+        willMoveOffscreen().
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): In several places,
+        use willBeComposited rather than calling needsToBeComposited(), because it avoids
+        recomputing state that we know already (but assert that we're getting it right).
+        When we're assessing the root layer in post-order, see if we have any child layers that
+        are compositing, and also whether the root itself needs to composite. If neither are
+        true, then we can drop out of compositing mode.
+        
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer): Move the
+        "inCompositingMode() && layer->isRootLayer()" test out of requiresCompositingLayer()
+        and into needsToBeComposited() so that we can call requiresCompositingLayer() separately
+        on the root layer above.
 
-        Reviewed by Timothy Hatcher.
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        Content-type parameters not taken into account when building form-data
-        https://bugs.webkit.org/show_bug.cgi?id=28970
+        Reviewed by Kenneth Rohde Christiansen.
 
-        existing manual test case extended with new tests
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35888
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshFormData):
-        (WebInspector.ResourceView.prototype._refreshParms):
-        * manual-tests/inspector/display-form-data.html:
+        * platform/efl/SoundEfl.cpp: Added.
 
-2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+2010-03-15  Andy Estes  <aestes@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by John Sullivan.
 
-        https://bugs.webkit.org/show_bug.cgi?id=14566
+        For continuous scrolling devices on the Mac (trackpads and Mighty/Magic
+        Mice), set the number of wheel ticks equal to the atomic increment of
+        the device: a pixel.  This ensures that any scrolling action will
+        generate at least one wheel tick, regardless of the speed/length of
+        the gesture.
 
-        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+        https://bugs.webkit.org/show_bug.cgi?id=29601
+        <rdar://problem/7453254>
 
-        Test: fast/js/invalid-domain-change-throws-exception.html
+        Tests: fast/events/continuous-platform-wheelevent-in-scrolling-div.html
+               fast/events/platform-wheelevent-in-scrolling-div.html
 
-        * dom/Document.cpp:
-        (WebCore::Document::setDomain):
-        * dom/Document.h:
-        * dom/Document.idl:
+        * platform/mac/WebCoreSystemInterface.h: Modify method signature.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Call into
+        WebKitSystemInterface to determine both wheelTicksX/Y and deltaX/Y.
+        WKSI will query the event system for number of wheel ticks and
+        pixels/lines scrolled based on the device type.
 
-2009-09-25  Adam Barth  <abarth@webkit.org>
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Gustavo Noronha Silva.
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        [GStreamer] duration query optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=36116
 
-        When setTimeout is called with a string argument in an isolated
-        world, we now compile the string in the isolated world.
+        Don't reattempt duration queries that previously failed and cache
+        media duration only if it's known.
 
-        Last time we tried this change, we got a lot of crashes.  This
-        time we're using a fresh local handle as our context to avoid
-        trouble if the peristent handle gets disposed before we leave
-        the context.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+2010-03-11  Peter Kasting  <pkasting@google.com>
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
+        Reviewed by Adam Barth.
 
-2009-09-25  Paul Godavari  <paul@chromium.org>
+        Clean up more bits of the open-source image decoders.  In addition to
+        simplifying things somewhat, this makes all the decoders the same in
+        terms of how they construct "image reader" subclasses and init scale
+        data.
 
-        Reviewed by Darin Fisher.
+        https://bugs.webkit.org/show_bug.cgi?id=36040
 
-        Fix a regression in Mac Chromium popup menus, where the user's
-        selection was ignored and the popup became unresponsive.
-        https://bugs.webkit.org/show_bug.cgi?id=29726
+        No functional change, so no tests.
 
-        The fix is to notify the popup's client that the popup was hidden,
-        even if the popup has no parent.
+        * platform/image-decoders/ImageDecoder.h: Reorder a few declarations to try and group/order members slightly better.
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Move reader construction into decode().  Prep scale data in setSize().  Remove useless comment.
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::setSize):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h: Prep scale data in setSize().
+        * platform/image-decoders/gif/GIFImageReader.cpp: Prep scale data in setSize().
+        (GIFImageReader::read):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Shorten code.
+        (WebCore::ICOImageDecoder::setSize):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Fix style.  Move reader construction into decode().
+        (WebCore::JPEGImageReader::close):
+        (WebCore::JPEGImageReader::skipBytes):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Move reader construction into decode().
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Move reader construction into decode().  Track completion on decoder, not reader.  Prep scale data in setSize().  Remove useless comment.
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::setSize):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h: Move reader construction into decode().  Track completion on decoder, not reader.  Prep scale data in setSize().
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::isComplete):
 
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::hidePopup):
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Dan Bernstein.
+        [GStreamer] updateStates called for all elements posting a state-change
+        https://bugs.webkit.org/show_bug.cgi?id=36115
 
-        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
-        https://bugs.webkit.org/show_bug.cgi?id=29734
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Update player state
+        only for state-change messages coming from playbin2 directly.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::pipeline): public accessor for the
+        playbin element.
 
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writePlainText):
+2010-03-15  Jian Li  <jianli@chromium.org>
 
-2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        Reviewed by Nate Chapin.
 
-        Reviewed by Ariya Hidayat.
+        [v8] Add V8 bindings for DOMFormData.
+        https://bugs.webkit.org/show_bug.cgi?id=36026
 
-        https://bugs.webkit.org/show_bug.cgi?id=28876
-        [Qt] reduce peak memory consumption of text decoding.
+        Test: http/tests/local/send-form-data.html
 
-        Chop large input buffer into small buffers to reduce peak memory
-        during decoding.
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
 
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
+2010-03-15  Jian Li  <jianli@chromium.org>
 
-2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+        Reviewed by Sam Weinig.
 
-        Add a mechanism for automatically halting plug-ins.
+        Add DOMFormData.idl to expose FormData interface.
+        https://bugs.webkit.org/show_bug.cgi?id=36024
+        
+        The implementation is based on XMLHttpRequest 2 spec:
+        http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#formdata
 
-        Reviewed by Oliver Hunt and Alice Liu.
+        Test: http/tests/local/send-form-data.html
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.jscbindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
-
-        * WebCore.base.exp:
-        Update export of Page constructor.
-
-        * WebCore.gypi:
-
-        * WebCore.pro:
-
+        * WebCore.pri:
         * WebCore.vcproj/WebCore.vcproj:
-        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
-        HaltablePlugin.h.
-
         * WebCore.xcodeproj/project.pbxproj:
-        Add files to Mac project.
-
-        * loader/EmptyClients.h:
-        Added an empty PluginHalterClient.
-        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
-        Return false.
-
-        * page/PluginHalter.cpp: Added.
-        (WebCore::PluginHalter::PluginHalter):
-        (WebCore::PluginHalter::didStartPlugin):
-        Add the object to the plug-in set. If this is the only item in the set,
-        set m_oldestStartTime to this object's time, and start the timer.
-        (WebCore::PluginHalter::didStopPlugin):
-        Remove the plug-in from the set.
-        (WebCore::PluginHalter::timerFired):
-        Find the cut-off time as the current time minus the allowed run time;
-        plug-ins older than this may be halted. Iterate over the plug-ins. Find
-        the object with the oldest start time that is too young to be halted;
-        we'll use its start time to set the timer's next fire time. For all
-        plug-ins that are candidates to be halted, call the
-        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
-        call the plug-in's halt() function. Remove these objects from the set
-        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
-        (WebCore::PluginHalter::startTimerIfNecessary):
-        If the timer is set to fire, or the set of tracked plug-ins is empty,
-        return early. Set the timer to fire after the oldest plug-in has run
-        for the allowed run time.
-
-        * page/PluginHalter.h: Added.
-        (WebCore::PluginHalter::setPluginAllowedRunTime):
-
-        * page/PluginHalterClient.h: Added.
-        (WebCore::PluginHalterClient::~PluginHalterClient):
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
-        to create the PluginHalter if necessary.
-        (WebCore::Page::pluginHalterEnabledStateChanged):
-        If plug-in halting is enabled, create the PluginHalter. If it is
-        disabled, clear it.
-        (WebCore::Page::pluginAllowedRunTimeChanged):
-        If there is a plug-in halter, call its setPluginAllowedRunTime().
-        (WebCore::Page::didStartPlugin):
-        If there is a plug-in halter, call its didStartPlugin().
-        (WebCore::Page::didStopPlugin):
-        If there is a plug-in halter, call its didStopPlugin().
-
-        * page/Page.h:
-        Add a parameter to the Page constructor for the PluginHalterClient.
-        Added declarations for didStartPlugin() and didStopPlugin(), which are
-        called when HaltablePlugins are added to or removed from the page. Adds
-        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
-        notify the Page when these settings are changed. Added members to hold
-        the PluginHalter and the PluginHalterClient.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPluginHalterEnabled):
-        If the enabled state has changed, call the Page's
-        pluginHalterEnabledStateChanged().
-        (WebCore::Settings::setPluginAllowedRunTime):
-        Call the Page's pluginAllowedRunTimeChanged().
-
-        * page/Settings.h:
-        (WebCore::Settings::pluginHalterEnabled):
-        (WebCore::Settings::pluginAllowedRunTime):
-
-        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
-        can be automatically halted.
-        (WebCore::HaltablePlugin::~HaltablePlugin):
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-        Pass a dummy PluginHalterClient.
-
-2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/JSDOMFormDataCustom.cpp: Added.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/DOMFormData.idl: Added.
+        * page/DOMWindow.idl:
 
-        Reviewed by Dan Bernstein.
+2010-03-15  Patrik Persson  <patrik.j.persson@ericsson.com>
 
-        REGRESSION: webkit-transform scale no longer works properly in nightly build
-        https://bugs.webkit.org/show_bug.cgi?id=29730
-        
-        When the initial or final state of a scale animation does not specify a transform,
-        use a default scale of 1, rather than zero.
+        Reviewed by Darin Adler.
 
-        Test: compositing/transitions/scale-transition-no-start.html
+        https://bugs.webkit.org/show_bug.cgi?id=32369
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::getTransformFunctionValue):
+        Revise iframe sandbox behavior to match the updated HTML5 spec.
 
-2009-09-24  John Gregg  <johnnyg@google.com>
+        - Enables window.sessionStorage in sandboxed iframes.
 
-        Reviewed by Eric Seidel.
+        - Raises SECURITY_ERR exceptions when window.localStorage or
+          window.openDatabase() is blocked by iframe sandboxing.
 
-        isEnabled switch for notifications (experimental) in Page Settings
-        https://bugs.webkit.org/show_bug.cgi?id=28930
+          Note: window.sessionStorage does not raise exceptions.
 
-        Adds a run-time flag in Settings object that controls whether
-        to expose desktop notifications.
+        WebKit would previously return null references in these cases.  The
+        new behavior is in accordance with HTML5:
 
-        No new test, but test code also modified to set this preference.
+          http://dev.w3.org/html5/webstorage/   (sections 4.2 and 4.3)
+          http://dev.w3.org/html5/webdatabase/  (section 4.1)
+          http://www.mail-archive.com/whatwg@lists.whatwg.org/msg19786.html
 
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::selectDOMStorage): exception handling
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent): exception handling
         * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setExperimentalNotificationsEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::experimentalNotificationsEnabled):
-
-2009-09-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix <rdar://problem/7162000> Crash while trying to
-        calculate the horizontal position of image
-
-        Test: fast/inline-block/relative-positioned-rtl-crash.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
-        isInline() test to isRenderInline(). This is similar to r41259.
+        (WebCore::DOMWindow::sessionStorage): re-enabled in iframe sandbox
+        (WebCore::DOMWindow::localStorage): raise exception rather than return null
+        (WebCore::DOMWindow::openDatabase): raise exception rather than return null
+        * page/DOMWindow.h: added exceptions to interface
+        * page/DOMWindow.idl: added exceptions to interface
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessLocalStorage): renamed function to reflect its purpose
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch): exception handling
 
-2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+2010-03-15  Alexander Pavlov  <apavlov@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Fix expanding profile call stacks being broken after sorting.
-        https://bugs.webkit.org/show_bug.cgi?id=26423
-
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.sort):
-        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
-        causes the children to be placed in the right positions.
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Stephanie Lewis.
-
-        Fixed sudden termination console spew due to too many calls to
-        enableSuddenTermination.
-        
-        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
-
-        * page/DOMWindow.cpp:
-        (WebCore::removeUnloadEventListener):
-        (WebCore::removeAllUnloadEventListeners):
-        (WebCore::removeBeforeUnloadEventListener):
-        (WebCore::removeAllBeforeUnloadEventListeners): Only
-        enableSuddenTermination if the set of listeners is empty *and* this
-        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
-
-2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        WebKit returns "" instead of null when getting
-        inexistent, forbidden or invalidly named headers.
-        https://bugs.webkit.org/show_bug.cgi?id=29140
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        Changed to return null as it should according to the spec.
-
-2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add GYP generated files to svn:ignore
-        https://bugs.webkit.org/show_bug.cgi?id=29724
-
-        Adding the following files to the svn:ignore list (all in the
-        WebCore/WebCore.gyp directory)
-
-        WebCore.xcodeproj
-        WebCore.sln
-        WebCore.vcproj
-        WebCore_Debug.rules
-        WebCore_Release.rules
-        WebCore_Release - no tcmalloc.rules
-        WebCore_Purify.rules
-        WebCore.mk
-        WebCore_Debug_rules.mk
-        WebCore_Release_rules.mk
-        WebCore_Release - no tcmalloc_rules.mk
-        WebCore_Purify_rules.mk
-        WebCore.scons
-        WebCore_main.scons
-
-        * WebCore.gyp: Changed property svn:ignore.
-
-2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed. Mac build fix.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
-        remove unused parameter from function signature;
-
-2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Oliver Hunt.
-
-        Implement correct horizontal scrollbar behavior for GTKalso on
-        styled scrollbars.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29348
-        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
-
-        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
-        wheel with the pointer on the horizontal scrollbar, scroll
-        horizontally;
-        * platform/PlatformWheelEvent.h:
-        * platform/gtk/WheelEventGtk.cpp:
-        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
-        vertical scroll to the horizontal one;
-
-2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
-        https://bugs.webkit.org/show_bug.cgi?id=29290
-
-        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
-        per http://webkit.org/coding/RefPtr.html
-
-        No behavior change, so no tests.
-
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Added back enable/disableSuddenTermination() functionality I accidentally
-        removed in my last patch.
-
-        * page/DOMWindow.cpp:
-        (WebCore::addUnloadEventListener):
-        (WebCore::removeUnloadEventListener):
-        (WebCore::removeAllUnloadEventListeners):
-        (WebCore::addBeforeUnloadEventListener):
-        (WebCore::removeBeforeUnloadEventListener):
-        (WebCore::removeAllBeforeUnloadEventListeners):
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::addEventListener):
-        (WebCore::DOMWindow::removeEventListener):
-        (WebCore::DOMWindow::removeAllEventListeners):
-
-2009-09-24  Sam Weinig  <sam@webkit.org>
+        Web Inspector: Implement a progress indicator in the Audits panel
+        when resources are reloading
+        https://bugs.webkit.org/show_bug.cgi?id=35971
 
-        Reviewed by Steve Falkenburg and Mark Rowe.
-
-        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
-
-        * DerivedSources.make:
-
-2009-09-24  Sam Weinig  <sam@webkit.org>
-
-        Fix windows build.
-
-        * dom/Element.idl:
-
-2009-09-23  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Revert the relevant parts of r47925, and implement an alternate
-        fix (localize the coordinate check to GraphicsContext::clipPath()).
-        This fixes http://crbug.com/21174.
-
-        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates):
-
-2009-09-24  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Merge changes from Mozilla's FTP directory parser.
-        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
-
-        FTP layout tests not possible at this time.
-        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
-
-        * loader/FTPDirectoryParser.cpp:
-        (WebCore::ParsingFailed):
-        (WebCore::parseOneFTPLine):
-
-2009-09-24  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] re-enable some media tests
-        https://bugs.webkit.org/show_bug.cgi?id=29716
-
-        make canPlayType() return "probably" if mime-type is known
-        and codecs string is not empty. If codecs is empty return
-        "maybe".
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-
-2009-09-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
-        Add a function to element to check whether it matches a CSS selector
-
-        Implement Element.webkitMatchesSelector.
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype.get totalResources):
+        (WebInspector.AuditLauncherView.prototype.set totalResources):
+        (WebInspector.AuditLauncherView.prototype.get loadedResources):
+        (WebInspector.AuditLauncherView.prototype.set loadedResources):
+        (WebInspector.AuditLauncherView.prototype._resetResourceCount):
+        (WebInspector.AuditLauncherView.prototype.resourceStarted):
+        (WebInspector.AuditLauncherView.prototype.resourceFinished):
+        (WebInspector.AuditLauncherView.prototype.reset):
+        (WebInspector.AuditLauncherView.prototype._setAuditRunning):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype._updateResourceProgress):
+        (WebInspector.AuditLauncherView.prototype._updateButton):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype.resourceStarted):
+        (WebInspector.AuditsPanel.prototype.resourceFinished):
+        (WebInspector.AuditsPanel.prototype.reset):
+        * inspector/front-end/Images/spinner.gif: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/audits.css:
+        (.audit-launcher-view .resource-progress > img):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-        * css/CSSSelectorList.cpp:
-        (WebCore::forEachTagSelector):
-        (WebCore::forEachSelector):
-        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
-        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
-        * css/CSSSelectorList.h:
-        Moved code to iterate the CSSSelectorList and determine if any
-        selectors need namespace resolution from a static function in
-        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
-        as well as querySelector/querySelectorAll.
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        * dom/Element.cpp:
-        (WebCore::Element::webkitMatchesSelector):
-        * dom/Element.h: 
-        * dom/Element.idl:
-        Implement the new function. Handles exceptional cases identically to
-        querySelector/querySelectorAll.
+        Reviewed by Gustavo Noronha Silva.
 
-        * dom/Node.cpp:
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+        [GStreamer] replace g_idle_add / g_timeout_add calls with Timers in the gstreamer player
+        https://bugs.webkit.org/show_bug.cgi?id=35735
 
-2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+        Replaced g_idle_add calls with Timers immediately started once
+        only. The g_timeout_add was replaced by a periodic Timer.
 
-        Reviewed by Dimitri Glazkov.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::muteChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
-        https://bugs.webkit.org/show_bug.cgi?id=29713
+2010-03-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Got rid of isWindowEvent in function signatures:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        * bindings/v8/V8LazyEventListener.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        (WebCore::V8WorkerContextEventListener::callListenerFunction):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::callListenerFunction):
-        * bindings/v8/custom/V8CustomEventListener.h:
+        Reviewed by Eric Carlson.
 
-        Switched to EventTarget methods of adding/removing listeners:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-        (WebCore::toEventID):
-        (WebCore::ACCESSOR_SETTER):
+        media/video-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        * dom/EventTarget.h: Some functions were incorrectly marked
-        as JSC-specific.
+        Only effectively load, and start buffering when playing, or when
+        the preload attribute is set.
 
-2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+        Test: media/video-preload.html
 
-        Reviewed by Timothy Hatcher.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::commitLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Web Inspector: Color-code watch expression errors with red.
+2010-03-15  Shu Chang  <Chang.Shu@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29707
+        Reviewed by Holger Freyther.
 
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSection.prototype.update):
-        (WebInspector.WatchExpressionTreeElement.prototype.update):
-        * inspector/front-end/inspector.css:
+        [Qt] The behavior of QGradient with no stops is defined differently from HTML5 spec,
+        where the latter requires the gradient to be transparent black. Explicitly added a
+        transparent black color stop to match the HTML5 behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=36060
 
-2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-        Reviewed by Timothy Hatcher.
+2010-03-11  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Web Inspector: Fix formatting for messages derived from resource warnings,
-        couple of drive-by formatting fixes.
+        Rubber-stamped by Holger Freyther.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29705
+        Some minor code clean ups in SpatialNavigation.cpp
 
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/front-end/ConsoleView.js:
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateAndWrap):
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSection.prototype.update):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
+        (WebCore::deflateIfOverlapped):
 
-2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-13  Ilya Tikhonovsky  <loislo@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Implement InspectorController::copyNode(id).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28357
+        WebInspector: Position of GraphBar elements is calculating more carefully
+        and they fully visible at the bottom of Timeline panel.
+       
+        http://bugs.webkit.org/show_bug.cgi?id=35966
 
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::copyNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
 
-2009-09-24  Oliver Hunt  <oliver@apple.com>
+2010-03-15  MORITA Hajime  <morrita@google.com>
 
-        Reviewed by NOBODY(rollout)
+        Reviewed by Alexey Proskuryakov.
 
-        Roll out r48712 as it is incorrect.
+        Selection.modify extends too far with 'lineboundary'.
+        https://bugs.webkit.org/show_bug.cgi?id=33413
 
-        Overriding getPropertyNames is incorrect.
+        Selection.modify() with 'lineboundary' granularity implies just
+        "Go to the end of the line", unlike selection expansion with
+        other type of granularities. This change handled LineGranularity
+        as special case, to look-up end of line with UPSTREAM affinity. 
+        Doing this prevents look-up algorithm to go next line.
 
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
+        Test: editing/selection/extend-selection-expected.txt
 
-2009-09-24  Xan Lopez  <xlopez@igalia.com>
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+        Handled an edge case for node look-up with UPSTREAM.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward):
+        Added UPSTREAM tweak for the case for LineGranularity.
+        
+2010-03-14  Yuzo Fujishima  <yuzo@google.com>
 
-        Revert r48697, since it broke key handling notification to GTK+.
+        Reviewed by Shinichiro Hamaji.
 
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
+        Always call PrintContext.end() from PrintContext::pageNumberForElement().
 
-2009-09-24  Philippe Normand  <pnormand@igalia.com>
+        Without this change, WebKit remains in printing mode after determining the page number if the specified element is found.
 
-        Reviewed by Xan Lopez.
+        https://bugs.webkit.org/show_bug.cgi?id=36049
 
-        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
-        https://bugs.webkit.org/show_bug.cgi?id=24639
+        Test: printing/return-from-printing-mode.html
 
-        check duration returned by gst_element_query_duration() only
-        when using GStreamer < 0.10.23.
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageNumberForElement):
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
+2010-03-11  Philippe Normand  <pnormand@igalia.com>
 
-2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Eric Seidel.
+        [GStreamer] progressTimer never stopped after EOS
+        https://bugs.webkit.org/show_bug.cgi?id=36007
 
-        The indices of RuntimeArray should be enumerated like for a regular array.
-        https://bugs.webkit.org/show_bug.cgi?id=29005
+        Mark the pipeline as paused only if playback hasn't ended
+        yet. When didEnd() is triggered, the pipeline is paused (but
+        paused() still returns false) and a timeupdate event is fired,
+        those 2 conditions allow the HTMLMediaElement to stop the
+        progressTimer (in updatePlayerState, via mediaPlayerTimeChanged).
 
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::getPropertyNames):
-        * bridge/runtime_array.h:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+2010-03-14  Chang Shu  <chang.shu@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Simon Hausmann.
 
-        Introduce Pasteboard::writePlaintext(const String&) so that copying
-        of the inspected elements HTML will be possible in WebInspector.
-        https://bugs.webkit.org/show_bug.cgi?id=29634
+        [Qt] [Symbian] Added block for ENABLE_SYMBIAN_DIALOG_PROVIDERS
+        on Symbian platform.
+        https://bugs.webkit.org/show_bug.cgi?id=35919
 
-        * platform/Pasteboard.h:
-        * platform/android/TemporaryLinkStubs.cpp:
-        (Pasteboard::writePlainText):
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/haiku/PasteboardHaiku.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        * platform/wince/PasteboardWince.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/wx/PasteboardWx.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-
-2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+        * WebCore.pro:
 
-        Reviewed by Simon Hausmann.
+2010-03-14  Yael Aharon  <yael.aharon@nokia.com>
 
-        Fix QApp::translate() calls to provide the correct class name without
-        a trailing comma.
+        Reviewed by Darin Adler.
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaTimeDescription):
+        Support for HTMLProgressElement
+        https://bugs.webkit.org/show_bug.cgi?id=35937
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+        Added support for HTMLProgressElement.
+        This implementation is enabled only for Qt, because only RenderThemeQt
+        was modified to actually draw the progress element.
+        The labels attribute of the progress element will be implemented in a
+        separate patch.
 
-        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
-        files, since it no longer exists in the repository.
+        Tests: fast/dom/HTMLProgressElement/progress-element.html
+               fast/dom/HTMLProgressElement/set-progress-properties.html
 
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pri:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLProgressElement.cpp: Added.
+        (WebCore::HTMLProgressElement::HTMLProgressElement):
+        (WebCore::HTMLProgressElement::create):
+        (WebCore::HTMLProgressElement::createRenderer):
+        (WebCore::HTMLProgressElement::formControlType):
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        (WebCore::HTMLProgressElement::value):
+        (WebCore::HTMLProgressElement::setValue):
+        (WebCore::HTMLProgressElement::max):
+        (WebCore::HTMLProgressElement::setMax):
+        (WebCore::HTMLProgressElement::position):
+        * html/HTMLProgressElement.h: Added.
+        (WebCore::HTMLProgressElement::isOptionalFormControl):
+        * html/HTMLProgressElement.idl: Added.
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+        * platform/ThemeTypes.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustProgressBarStyle):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isProgress):
+        * rendering/RenderProgress.cpp: Added.
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::baselinePosition):
+        (WebCore::RenderProgress::calcPrefWidths):
+        (WebCore::RenderProgress::layout):
+        (WebCore::RenderProgress::updateFromElement):
+        * rendering/RenderProgress.h: Added.
+        (WebCore::RenderProgress::renderName):
+        (WebCore::RenderProgress::isProgress):
+        (WebCore::toRenderProgress):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        (WebCore::RenderTheme::adjustProgressBarStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintProgressBar):
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Windows build fix: Declare set/unsetPendingActivity public, so
-        SharedWorkerScriptLoader can call them.
-
-        * dom/ActiveDOMObject.h:
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Fixed a bit of the Windows build.
+2010-03-14  Oliver Hunt  <oliver@apple.com>
 
-        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
-        removed this in my last patch.)
-        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
-        to the build. (I accidentally removed this in my last patch.)
+        Reviewed by Darin Adler.
 
-2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+        REGRESSION(r53287): drop event is not fired if dataTransfer.dropEffect is not explicitly set
+        https://bugs.webkit.org/show_bug.cgi?id=36095
 
-        32-bit build fix: restore previous cast that I thought was unnecessary.
+        The issue here is that while dropEffect is meant to be initialized
+        to "none", the behaviour of the drag is differs between dragEffect
+        not being set and dragEffect being explicitly set to "none"
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::didSendData):
-        (WebCore::XMLHttpRequest::didReceiveData):
+        This patch corrects this behaviour by making Clipboard distinguish
+        between the initial "none" value of dropEffect and an explicit "none".
+        This alone is insufficient for correct behaviour, we also need to
+        resurrect the removed defaultOperationForDrag function, but we now
+        use the function only when dragEffect is uninitialized.  There are a
+        few tweaks to the behaviour of the defaultOperationForDrag as well
+        to ensure exactly the same set of outcomes for all cases that we
+        may hit it.
 
-2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::dragOpFromIEOp):
+        (WebCore::Clipboard::destinationOperation):
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dropEffect):
+        (WebCore::Clipboard::dropEffectIsUninitialized):
+        * page/DragController.cpp:
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
 
-        Reviewed by Sam Weinig.
+2010-03-14  Antti Koivisto  <koivisto@iki.fi>
 
-        Bring a little sanity to this crazy EventTarget world of ours
-        https://bugs.webkit.org/show_bug.cgi?id=29701
+        Reviewed by Simon Hausmann.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35146
+        Support tiled backing store
 
-        Lots of EventTarget refactoring to achieve a single shared implementation
-        that fixes some of the performance and correctness bugs of the many individual
-        implementations, and makes reasoning about EventTargets and EventListeners
-        much easier.
+        Implements a basic tiled backing store mechanism. Tiles are created and 
+        deleted on demand. The page content is cached to the tiles. Tile content
+        is kept in sync with the document. Since the backing store covers area
+        larger than the currently visible viewport, the document can be scrolled
+        quickly without having to enter rendering tree painting.
         
-        The basic design is this:
-            - EventTarget manages a set of EventListeners.
-            - onXXX EventListener attributes forward to standard EventTarget APIs.
-            - Since the onXXX code is repetitive, it is usually done with macros
-              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
-            - EventTarget provides a shared implementation of dispatchEvent,
-              which subclasses with special event dispatch rules, like Node, override.
-            - To support Node, which lazily instantiates its EventTarget data,
-              EventTarget has no data members, and instead makes a virtual call
-              to get its data from wherever its subclass chose to store it.
-              
-        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
-        even though no exception could be thrown, has been changed not to do so,
-        to improve clarity and performance.
+        The tile management code is platform independent. This patch has simple QPixmap
+        based tile implementation for Qt.
         
-        Code that used to call a special dispatchXXXEvent function, which just
-        turned around and called dispatchEvent, has been changed to call
-        dispatchEvent, to improve clarity and performance.
-
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
-        engineer.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
-        "is not in the document but is firing event listeners" as a condition
-        that makes a Node observable in the DOM, so that event listeners firing
-        on removed nodes are not destroyed midstream. (This was a long-standing
-        bug that was somewhat hidden by the old implementation's habit of
-        copying the RegisteredEventListener vector before firing events, which
-        would keep almost all the relevant objects from being destroyed.)
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
-        because it was one of the most elaborately planned no-ops in the history
-        of software crime, and one of the reasons clients thought they needed more
-        than one dispatchEvent function even though they didn't.
-        * bindings/js/JSEventListener.h:
+        The feature is behind ENABLE_TILED_BACKING_STORE flag.
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::markChildren):
-        (WebCore::JSMessagePort::markChildren):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        * bindings/js/JSEventSourceCustom.cpp:
-        * bindings/js/JSMessagePortCustom.cpp:
-        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
-        * bindings/js/JSWebSocketCustom.cpp:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::markChildren):
-        * bindings/js/JSWorkerCustom.cpp:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
-        now autogenerated. Classes that still have custom mark functions for other
-        reasons now call a shared EventTarget API to mark their EventListeners.
-
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
-        marking and invalidating event listeners.
-
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::dispatchModifiedEvent):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::insertBefore):
-        (WebCore::ContainerNode::replaceChild):
-        (WebCore::willRemoveChild):
-        (WebCore::ContainerNode::appendChild):
-        (WebCore::dispatchChildInsertionEvents):
-        (WebCore::dispatchChildRemovalEvents):
-        * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListeners):
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::setFocusedNode):
-        (WebCore::Document::dispatchWindowEvent):
-        (WebCore::Document::dispatchWindowLoadEvent):
-        (WebCore::Document::finishedParsing):
-        * dom/Document.h: Use dispatchEvent directly.
-
-        * dom/Element.h: Moved a few event listener attributes down from Node,
-        since they don't apply to all Nodes, only Elements.
-
-        * dom/EventListener.h: Removed isWindowEvent parameter.
-
-        * dom/EventNames.h: Added the "display" event name, so it works correctly
-        with attribute macros, and for performance.
-
-        * dom/EventTarget.cpp:
-        (WebCore::forbidEventDispatch):
-        (WebCore::allowEventDispatch):
-        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
-        safe, since it's now called on multiple threads. (Currently, we only forbid
-        event dispatch on the main thread. If we ever want to forbid event dispatch
-        on secondary threads, we can improve it then.)
-
-        (WebCore::EventTarget::addEventListener):
-        (WebCore::EventTarget::removeEventListener):
-        (WebCore::EventTarget::setAttributeEventListener):
-        (WebCore::EventTarget::getAttributeEventListener):
-        (WebCore::EventTarget::clearAttributeEventListener):
-        (WebCore::EventTarget::dispatchEvent):
-        (WebCore::EventTarget::fireEventListeners):
-        (WebCore::EventTarget::getEventListeners):
-        (WebCore::EventTarget::removeAllEventListeners):
-        * dom/EventTarget.h:
-        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
-        (WebCore::EventTarget::ref):
-        (WebCore::EventTarget::deref):
-        (WebCore::EventTarget::markEventListeners):
-        (WebCore::EventTarget::invalidateEventListeners):
-        (WebCore::EventTarget::isFiringEventListeners):
-        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
-        EventTarget APIs, crafted from an amalgam of all the different versions
-        we used to have. The most significant change here is that we no longer
-        make a copy of an EventListener vector before firing the events in the
-        vector -- instead, we use a reference to the original vector, along with
-        a notification mechanism for the unlikely case when an EventListener is
-        removed from the vector. This substantially reduces malloc, copying, and
-        refcount overhead, and complexity.
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create): Use dispatchEvent directly.
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::eventTargetData):
-        (WebCore::MessagePort::ensureEventTargetData):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::onmessage):
-        * dom/MessagePort.idl: Removed custom EventTarget implementation.
-
-        * dom/MutationEvent.h:
-        (WebCore::MutationEvent::create): Added some default values so callers
-        can construct MutationEvents more easily, without calling a custom dispatch
-        function.
-
-        * dom/Node.cpp:
-        (WebCore::Node::addEventListener):
-        (WebCore::Node::removeEventListener):
-        (WebCore::Node::eventTargetData):
-        (WebCore::Node::ensureEventTargetData):
-        (WebCore::Node::handleLocalEvents):
-        (WebCore::Node::dispatchEvent):
-        (WebCore::Node::dispatchGenericEvent):
-        (WebCore::Node::dispatchSubtreeModifiedEvent):
-        (WebCore::Node::dispatchUIEvent):
-        (WebCore::Node::dispatchKeyEvent):
-        (WebCore::Node::dispatchMouseEvent):
-        (WebCore::Node::dispatchWheelEvent):
-        (WebCore::Node::dispatchFocusEvent):
-        (WebCore::Node::dispatchBlurEvent):
-        * dom/Node.h:
-        (WebCore::Node::preDispatchEventHandler):
-        (WebCore::Node::postDispatchEventHandler):
-        * dom/Node.idl:
-        * dom/NodeRareData.h:
-        (WebCore::NodeRareData::eventTargetData):
-        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
-        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
-        functions that just forwarded to dispatchEvent.
-
-        * dom/RegisteredEventListener.cpp:
-        * dom/RegisteredEventListener.h:
-        (WebCore::RegisteredEventListener::RegisteredEventListener):
-        (WebCore::operator==): This is just a simple struct now, since we no longer
-        do a complicated copy / refCount / isRemoved dance just to honor the rule
-        that an EventListener can be removed during event dispatch.
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
-
-        * html/HTMLBodyElement.cpp:
-        * html/HTMLBodyElement.h: Use the shared EventTarget API.
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
-        (WebCore::HTMLFormControlElement::checkValidity):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::handleLocalEvents):
-        (WebCore::HTMLFormElement::prepareSubmit):
-        (WebCore::HTMLFormElement::reset):
-        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
-
-        * html/HTMLFrameSetElement.cpp:
-        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
-
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::dispatchLoadEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadInternal):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        (WebCore::HTMLScriptElement::dispatchErrorEvent):
-        * html/HTMLSourceElement.cpp:
-        (WebCore::HTMLSourceElement::errorEventTimerFired):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::HashChangeEventTask::performTask):
-        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
-
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::CallCacheListenerTask::performTask):
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
-        * loader/appcache/ApplicationCacheHost.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::eventTargetData):
-        (WebCore::DOMApplicationCache::ensureEventTargetData):
-        * loader/appcache/DOMApplicationCache.h:
-        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
-        EventTarget API. As a part of this, I switched this class from using a
-        custom internal event name enumeration to using the standard EventNames.
-
-        * notifications/Notification.cpp:
-        (WebCore::Notification::eventTargetData):
-        (WebCore::Notification::ensureEventTargetData):
-        * notifications/Notification.h:
-        (WebCore::Notification::scriptExecutionContext):
-        * notifications/Notification.idl: Switched to the standard EventTarget API.
-
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::event):
-        (WebCore::windowsWithUnloadEventListeners):
-        (WebCore::windowsWithBeforeUnloadEventListeners):
-        (WebCore::allowsBeforeUnloadListeners):
-        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
-        (WebCore::DOMWindow::pendingUnloadEventListeners):
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
-        unload / beforeunload listener tracker just to track which windows had
-        such listeners, instead of actually keeping a copy of the listeners. Now,
-        this code can use the standard EventTarget API.
-
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::postMessageTimerFired):
-        (WebCore::DOMWindow::addEventListener):
-        (WebCore::DOMWindow::removeEventListener):
-        (WebCore::DOMWindow::dispatchLoadEvent):
-        (WebCore::DOMWindow::dispatchEvent):
-        (WebCore::DOMWindow::removeAllEventListeners):
-        (WebCore::DOMWindow::captureEvents):
-        (WebCore::DOMWindow::releaseEvents):
-        (WebCore::DOMWindow::eventTargetData):
-        (WebCore::DOMWindow::ensureEventTargetData):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl: Use the standard EventTarget APIs.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::canMouseDownStartSelect):
-        (WebCore::EventHandler::canMouseDragExtendSelect):
-        (WebCore::EventHandler::sendResizeEvent):
-        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
-
-        * page/EventSource.cpp:
-        (WebCore::EventSource::endRequest):
-        (WebCore::EventSource::didReceiveResponse):
-        (WebCore::EventSource::parseEventStreamLine):
-        (WebCore::EventSource::stop):
-        (WebCore::EventSource::createMessageEvent):
-        (WebCore::EventSource::eventTargetData):
-        (WebCore::EventSource::ensureEventTargetData):
-        * page/EventSource.h:
-        * page/EventSource.idl: Use the standard EventTarget APIs.
-
-        * page/FocusController.cpp:
-        (WebCore::dispatchEventsOnWindowAndFocusedNode):
-        (WebCore::FocusController::setFocusedFrame):
+        * WebCore.pri:
+        * WebCore.pro:
         * page/Frame.cpp:
-        (WebCore::Frame::shouldClose):
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::setTiledBackingStoreEnabled):
+        (WebCore::Frame::tiledBackingStorePaintBegin):
+        (WebCore::Frame::tiledBackingStorePaint):
+        (WebCore::Frame::tiledBackingStorePaintEnd):
+        (WebCore::Frame::tiledBackingStoreContentsRect):
         * page/Frame.h:
-        * page/Page.cpp:
-        (WebCore::networkStateChanged):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::valueChanged):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::selectionChanged):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
-
-        * svg/SVGElement.cpp:
-        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::dummyEventTargetData):
-        (WebCore::SVGElementInstance::addEventListener):
-        (WebCore::SVGElementInstance::removeEventListener):
-        (WebCore::SVGElementInstance::removeAllEventListeners):
-        (WebCore::SVGElementInstance::dispatchEvent):
-        (WebCore::SVGElementInstance::eventTargetData):
-        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
-
-        * svg/SVGElementInstance.h:
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::dispatchLoadEvent):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
-        new EventTarget API.
-
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
-
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::eventTargetData):
-        (WebCore::WebSocket::ensureEventTargetData):
-        * websockets/WebSocket.h:
-        * websockets/WebSocket.idl:
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::eventTargetData):
-        (WebCore::AbstractWorker::ensureEventTargetData):
-        * workers/AbstractWorker.h:
-        * workers/AbstractWorker.idl:
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerConnectTask::performTask):
-        (WebCore::SharedWorkerScriptLoader::load):
-        (WebCore::SharedWorkerScriptLoader::notifyFinished):
-        * workers/SharedWorker.idl:
-        * workers/SharedWorkerContext.cpp:
-        (WebCore::createConnectEvent):
-        * workers/SharedWorkerContext.h:
-        * workers/SharedWorkerContext.idl:
-        * workers/Worker.cpp:
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::eventTargetData):
-        (WebCore::WorkerContext::ensureEventTargetData):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerExceptionTask::performTask):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
-        (WebCore::XMLHttpRequest::createRequest):
-        (WebCore::XMLHttpRequest::abort):
-        (WebCore::XMLHttpRequest::networkError):
-        (WebCore::XMLHttpRequest::abortError):
-        (WebCore::XMLHttpRequest::didSendData):
-        (WebCore::XMLHttpRequest::didReceiveData):
-        (WebCore::XMLHttpRequest::eventTargetData):
-        (WebCore::XMLHttpRequest::ensureEventTargetData):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequest.idl:
-        * xml/XMLHttpRequestProgressEvent.h:
-        (WebCore::XMLHttpRequestProgressEvent::create):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::eventTargetData):
-        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
-        * xml/XMLHttpRequestUpload.h:
-        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
-
-2009-09-23  Kent Tamura  <tkent@chromium.org>
+        (WebCore::Frame::tiledBackingStore):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setTiledBackingStoreEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::tiledBackingStoreEnabled):
+        * platform/graphics/Tile.h: Added.
+        (WebCore::Tile::create):
+        (WebCore::Tile::coordinate):
+        (WebCore::Tile::rect):
+        * platform/graphics/TiledBackingStore.cpp: Added.
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::~TiledBackingStore):
+        (WebCore::TiledBackingStore::invalidate):
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        (WebCore::TiledBackingStore::paint):
+        (WebCore::TiledBackingStore::viewportChanged):
+        (WebCore::TiledBackingStore::setContentsScale):
+        (WebCore::TiledBackingStore::tileDistance):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::dropOverhangingTiles):
+        (WebCore::TiledBackingStore::dropTilesOutsideRect):
+        (WebCore::TiledBackingStore::tileAt):
+        (WebCore::TiledBackingStore::setTile):
+        (WebCore::TiledBackingStore::removeTile):
+        (WebCore::TiledBackingStore::mapToContents):
+        (WebCore::TiledBackingStore::mapFromContents):
+        (WebCore::TiledBackingStore::contentsRect):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        (WebCore::TiledBackingStore::tileCoordinateForPoint):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::tileBufferUpdateTimerFired):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        (WebCore::TiledBackingStore::tileCreationTimerFired):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h: Added.
+        (WebCore::TiledBackingStore::contentsScale):
+        (WebCore::TiledBackingStore::contentsFrozen):
+        * platform/graphics/TiledBackingStoreClient.h: Added.
+        * platform/graphics/qt/TileQt.cpp: Added.
+        (WebCore::checkeredPixmap):
+        (WebCore::Tile::Tile):
+        (WebCore::Tile::~Tile):
+        (WebCore::Tile::isDirty):
+        (WebCore::Tile::isReadyToPaint):
+        (WebCore::Tile::invalidate):
+        (WebCore::Tile::updateBackBuffer):
+        (WebCore::Tile::swapBackBufferToFront):
+        (WebCore::Tile::paint):
+        (WebCore::Tile::paintCheckerPattern):
+
+2010-03-14  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        - Support for maxLength of <textarea>
-        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
-        https://bugs.webkit.org/show_bug.cgi?id=29292
-
-        Test: fast/forms/textarea-maxlength.html
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::sanitizeUserInputValue):
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
-        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
-        (WebCore::HTMLTextAreaElement::maxLength):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::numGraphemeClusters):
-        (WebCore::String::numCharactersInGraphemeClusters):
-
-2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
-        https://bugs.webkit.org/show_bug.cgi?id=29654
-
-        Give GDK_Backspace key events the proper text properties.
-
-        Instead of adding new tests, this change removes existing tests
-        from Gtk's skipped list.
-
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
-
-2009-09-23  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
-        Should allow navigation of top-level openers
-        <rdar://problem/7034025>
-
-        Allow navigation of cross-origin window.opener if it is top-level frame.
-
-        Test: http/tests/security/frameNavigation/cross-origin-opener.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::shouldAllowNavigation):
-
-2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
-
-        Reviewed by Eric Seidel.
-
-        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
-        default when the necessary dependencies are extracted into the
-        WebKitLibrariesDir.
-        https://bugs.webkit.org/show_bug.cgi?id=29661
-
-        * WebCore.vcproj/WebCoreCairo.vsprops:
-
-2009-09-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Crash when website does a history.back() followed by an alert()
-        https://bugs.webkit.org/show_bug.cgi?id=29686
-        rdar://problem/6984996
-
-        When loading is deferred, we need to defer timer-based loads
-        too, not just networking-driven loads. Otherwise we can get
-        syncronouse navigation while running a script, which leads to
-        crashes and other badness.
-
-        This patch includes a manual test; an automated test may be
-        possible some time in the future.
-
-        * dom/Document.cpp:
-        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
-        instead of scheduleHTTPRedirection to implement the navigation
-        needed for x-frame-options.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader): Updated for data members with
-        new names and new data members.
-        (WebCore::FrameLoader::setDefersLoading): When turning deferral
-        off, call startRedirectionTimer and startCheckCompleteTimer, since
-        either of them might have been fired and ignored while defersLoading
-        was true.
-        (WebCore::FrameLoader::clear): Updated for replacement of the
-        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
-        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
-        (WebCore::FrameLoader::checkCompleted): Added code to set
-        m_shouldCallCheckCompleted to false. Changed code that calls
-        startRedirectionTimer to call it unconditionally, since that
-        function now knows when to do work and doesn't expect callers
-        to handle that any more.
-        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
-        timer fired callbacks. Calls checkCompleted and checkLoadComplete
-        as appropriate, but not when defersLoading is true.
-        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
-        the two different calls to start timers before. Only starts the
-        timers if they are needed.
-        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
-        startCheckCompleteTimer after setting boolean.
-        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
-        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
-        canGoBackOrForward check. The logic works more naturally when
-        we don't do anything until the timer fires.
-        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
-        defersLoading is true. Also moved canGoBackOrForward check here.
-        (WebCore::FrameLoader::scheduleRedirection): Changed code that
-        calls startRedirectionTimer to do so unconditionally. That
-        function now handles the rules about when to start the timer
-        rather than expecting the caller to do so.
-        (WebCore::FrameLoader::startRedirectionTimer): Added code to
-        handle the case where there is no redirection scheduled,
-        where the timer is already active, or where this is a classic
-        redirection and there is an ancestor that has not yet completed
-        loading.
-        (WebCore::FrameLoader::completed): Call startRedirectionTimer
-        here directly instead of calling a cover named parentCompleted.
-        Hooray! One less function in the giant FrameLoader class!
-        (WebCore::FrameLoader::checkLoadComplete): Added code to set
-        m_shouldCallCheckLoadComplete to false.
-
-        * loader/FrameLoader.h: Replaced the two functions
-        checkCompletedTimerFired and checkLoadCompleteTimerFired with
-        one function, checkTimerFired. Removed the parentCompleted
-        function. Added the startCheckCompleteTimer and
-        allAncestorsAreComplete functions. Replaced the
-        m_checkCompletedTimer and m_checkLoadCompleteTimer data
-        members with m_checkTimer, m_shouldCallCheckCompleted, and
-        m_shouldCallCheckLoadComplete.
-
-        * manual-tests/go-back-after-alert.html: Added.
-        * manual-tests/resources/alert-and-go-back.html: Added.
-
-2009-09-23  David Kilzer  <ddkilzer@apple.com>
-
-        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
-
-        Reviewed by Mark Rowe.
-
-        The "Generate 64-bit Export File" build phase script generated
-        the WebCore.LP64.exp export file used to link 64-bit WebCore.
-        Instead of having a separate build phase script, move its
-        generation into DerivedSources.make where WebCore.exp is
-        generated.
-
-        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
-        Added code to append WebCore.PluginHostProcess.exp to
-        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
-        is set to 1.
-        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
-        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
-        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
-        to WebCore.PluginHostProcess.exp.
-
-2009-09-23  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29694
-        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
-
-        * platform/graphics/skia/ImageSkia.cpp:
-        (WebCore::drawResampledBitmap):
-
-2009-09-22  Timothy Hatcher  <timothy@apple.com>
-
-        Prevent scrolling multiple elements during latched wheel events.
-
-        Reviewed by Anders Carlsson.
-
-        * page/EventHandler.cpp:
-        (WebCore::scrollAndAcceptEvent):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/EventHandler.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scroll):
-        * rendering/RenderBox.h:
-
-2009-09-23  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29523
-        
-        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
-        XSSAuditor.
-        
-        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
-        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
-        Because the XSSAuditor also decodes the URL escape sequences as part of its
-        canonicalization, the double decoding of a JavaScript URL would
-        not match the canonicalization of the input parameters.
-
-        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
-               http/tests/security/xssAuditor/javascript-link-url-encoded.html
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Moved call to 
-        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
-        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
-        decoded.
-
-2009-09-22  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by John Sullivan.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29657
-        Columns don't break properly in positioned elements with a fixed height.  Make sure that
-        a block is still considered to have columns even when the column count is 1 if the column
-        width is non-auto.
-    
-        Added fast/multicol/positioned-with-constrained-height.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
-
-2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Add a null check for the Document*. In the mirror benchmarking
-        application a crash from a call from JavaScript was observed.
-
-        I was not able to come up with a test case for this issue.
-
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::cookieJar):
-
-2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the Qt/Windows build, after the introduction of
-        the page client.
-
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-
-2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] media tests failing after their rework
-        https://bugs.webkit.org/show_bug.cgi?id=29532
-
-        Correctly advertise the mime types used by the common formats used
-        in the tests.
-
-        Tests that regressed, and will pass again:
-
-           media/video-canvas-source.html
-           media/video-controls.html
-           media/video-currentTime-set2.html
-           media/video-dom-autoplay.html
-           media/video-dom-src.html
-           media/video-error-abort.html
-           media/video-load-networkState.html
-           media/video-load-readyState.html
-           media/video-muted.html
-           media/video-no-autoplay.html
-           media/video-pause-empty-events.html
-           media/video-play-empty-events.html
-           media/video-seekable.html
-           media/video-seeking.html
-           media/video-size.html
-           media/video-source-type-params.html
-           media/video-source-type.html
-           media/video-source.html
-           media/video-src-change.html
-           media/video-src-invalid-remove.html
-           media/video-src-remove.html
-           media/video-src-set.html
-           media/video-src-source.html
-           media/video-src.html
-           media/video-timeupdate-during-playback.html
-           media/video-volume.html
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mimeTypeCache):
-
-2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Eric Seidel.
-
-        Fix the crash problem with absolte positioned children in foreignobject
-        htts://bugs.webkit.org/show_bug.cgi?id=26342
-
-        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
-
-        * rendering/RenderForeignObject.h:
-        (WebCore::RenderForeignObject::isSVGForeignObject):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::containingBlock):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isSVGForeignObject):
-
-2009-09-22  Drew Wilson  <atwilson@google.com>
+        WebCore part of removing support for legacy versions of Core Graphics
 
-        Reviewed by David Levin.
-
-        SharedWorkers "name" attribute is now optional.
-        https://bugs.webkit.org/show_bug.cgi?id=28897
-
-        Test: fast/workers/shared-worker-name.html
-
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        (WebCore::constructSharedWorker):
-        Default 'name' attribute to empty string if it is not provided.
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Default 'name' attribute to empty string if it is not provided.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::matches):
-        Now matches URLs if names are empty strings.
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        Pass URL in to SharedWorkerProxy::matches().
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, another build fix.
-
-        [Chromium] Add another missing include.
-        https://bugs.webkit.org/show_bug.cgi?id=29536
-
-        * inspector/InspectorController.cpp: Added DOMWindow.h include.
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Add missing include.
-        https://bugs.webkit.org/show_bug.cgi?id=29536
-
-        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+        * WebCore.vcproj/WebCore.vcproj: Removed FontDatabase.{cpp,h}
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): Removed call to wkCanCreateCGFontWithLOGFONT(),
+        as it is now always true.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Ditto.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Updated for
+        the removal of m_cgFont.
+        (WebCore::FontCustomPlatformData::fontPlatformData): Removed call to
+        wkCanCreateCGFontWithLOGFONT(), as it is now always true.
+        (WebCore::createFontCustomPlatformData): Ditto. Also updated for change to
+        the FontCustomPlatformData constructor.
+        * platform/graphics/win/FontCustomPlatformData.h: Removed m_cgFont member.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData): Removed cgFont
+        parameter.
+        * platform/graphics/win/FontDatabase.cpp: Removed.
+        * platform/graphics/win/FontDatabase.h: Removed.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Removed call to
+        wkCanCreateCGFontWithLOGFONT(), as it is now always true.
+        * platform/win/TemporaryLinkStubs.cpp:
+        (WebCore::populateFontDatabase): Removed stub.
 
-2009-09-22  Darin Adler  <darin@apple.com>
+2010-03-14  Jessie Berlin  <jberlin@webkit.org>
 
         Reviewed by Sam Weinig.
 
-        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
-        https://bugs.webkit.org/show_bug.cgi?id=29663
+        "event.ctrlKey" is always false when dragging an element with "ctrl" key down
+        https://bugs.webkit.org/show_bug.cgi?id=17113
 
-        * loader/FrameLoader.cpp:
-        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
-        initialized to false, to keep track if the redirection has been
-        communicated to the client.
-        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
-        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
-        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
-        (WebCore::FrameLoader::allChildrenAreComplete): Added.
-        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
-        function for clarity.
-        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
-        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
-        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
-        toldClient flag and not call clientRedirected a second time if it is set.
-        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
-        called multiple times and it will call clientRedirectCancelledOrFinished
-        only once.
-
-        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
-        Added allChildrenAreComplete function.
-
-2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Migrate Databases tab to InjectedScript /
-        serialized interaction.
+        No new tests.
 
-        DOMStorage interaction is now serialized into JSON messages
-        and doesn't require quarantined objects.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28873
+        * page/DragController.cpp:
+        (WebCore::createMouseEvent):
+        Use the current state of the shift, ctrl, alt, and meta keys when creating the drag mouse event.
 
-        * dom/EventListener.h:
-        (WebCore::EventListener::):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::selectDOMStorage):
-        (WebCore::InspectorBackend::getDOMStorageEntries):
-        (WebCore::InspectorBackend::setDOMStorageItem):
-        (WebCore::InspectorBackend::removeDOMStorageItem):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::selectDOMStorage):
-        (WebCore::InspectorController::getDOMStorageEntries):
-        (WebCore::InspectorController::setDOMStorageItem):
-        (WebCore::InspectorController::removeDOMStorageItem):
-        (WebCore::InspectorController::getDOMStorageResourceForId):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
-        (WebCore::InspectorDOMStorageResource::bind):
-        (WebCore::InspectorDOMStorageResource::unbind):
-        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        (WebCore::InspectorDOMStorageResource::operator==):
-        * inspector/InspectorDOMStorageResource.h:
-        (WebCore::InspectorDOMStorageResource::cast):
-        (WebCore::InspectorDOMStorageResource::id):
-        (WebCore::InspectorDOMStorageResource::domStorage):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::selectDOMStorage):
-        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
-        (WebCore::InspectorFrontend::didSetDOMStorageItem):
-        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
-        (WebCore::InspectorFrontend::updateDOMStorage):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/DOMStorage.js:
-        (WebInspector.DOMStorage):
-        (WebInspector.DOMStorage.prototype.get id):
-        (WebInspector.DOMStorage.prototype.get domStorage):
-        (WebInspector.DOMStorage.prototype.get isLocalStorage):
-        (WebInspector.DOMStorage.prototype.getEntriesAsync):
-        (WebInspector.DOMStorage.prototype.setItemAsync):
-        (WebInspector.DOMStorage.prototype.removeItemAsync):
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
-        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.show):
-        (WebInspector.StoragePanel.prototype.reset):
-        (WebInspector.StoragePanel.prototype.selectDOMStorage):
-        (WebInspector.StoragePanel.prototype.updateDOMStorage):
-        (WebInspector.StoragePanel.prototype._domStorageForId):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addDOMStorage):
-        (WebInspector.updateDOMStorage):
+2010-03-13  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-09-22  Sam Weinig  <sam@webkit.org>
+        Not reviewed identation fix.
 
-        Reviewed by Alexey Proskuryakov.
+        * manual-tests/spatial-navigation/spatial-navigation-test-cases.html:
 
-        Fix for XMLHttpRequest.abort() should destroy the response text.
-        https://bugs.webkit.org/show_bug.cgi?id=29658
-        <rdar://problem/5301430>
+2010-03-13  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Clearing the response text after calling XMLHttpRequest.abort() is necessary
-        per spec and matches Firefox. It is also a potential memory win.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+        [Qt] GraphicsLayer: Opacity change from zero to non-zero doesn't always have effect with AC
+        https://bugs.webkit.org/show_bug.cgi?id=36034
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
-        keep the actual ResourceReponse around so that the response status and response
-        status text are kept around.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::OpacityAnimationQt::applyFrame):
 
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-13  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        No review, rolling out r48639.
-        http://trac.webkit.org/changeset/48639
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        [Qt] GraphicsLayer: Opacity transitions end with begin value
+        https://bugs.webkit.org/show_bug.cgi?id=36019
 
-2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQt::updateCurrentTime):
 
-        Reviewed by Dimitri Glazkov.
+2010-03-13  Dirk Schulze  <krit@webkit.org>
 
-        Changing the transaction coordinator to (re-)allow multiple read
-        transactions on the same database to run concurrently (without
-        risking a deadlock this time).
+        No review, rolling out r55927.
+        http://trac.webkit.org/changeset/55927
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        https://bugs.webkit.org/show_bug.cgi?id=29115
+        Breaks Gtk build bots.
 
-        Tests: storage/read-and-write-transactions-dont-run-together.html
-               storage/read-transactions-running-concurrently.html
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        * storage/SQLTransaction.h:
-        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
-        transaction.
-        * storage/SQLTransactionCoordinator.cpp:
-        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
-        allow multiple read transactions on the same DB to run
-        concurrently.
-        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
-        allow multiple read transactions on the same DB to run
-        concurrently.
-        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
-        * storage/SQLTransactionCoordinator.h:
+2010-03-12  Dirk Schulze  <krit@webkit.org>
 
-2009-09-22  Peter Kasting  <pkasting@google.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by David Levin.
+        SVG Glyphs - transform path not context
+        https://bugs.webkit.org/show_bug.cgi?id=36070
 
-        https://bugs.webkit.org/show_bug.cgi?id=29652
-        Support true system colors for CSS system colors in Chromium/Win.
+        SVGFont should transform the path of a glyph, not the context. Modifying
+        the context causes wrong gradient transformations. This bug doesn't
+        influence CG because we generally fill or stroke texts with a mask image.
+        All other platforms provide a direct way to make the drawings.
 
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::cssValueIdToSysColorIndex):
-        (WebCore::RenderThemeChromiumWin::systemColor):
-        * rendering/RenderThemeChromiumWin.h:
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
 
-2009-09-22  Beth Dakin  <bdakin@apple.com>
+2010-03-12  Beth Dakin  <bdakin@apple.com>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Simon Fraser.
 
-        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
-        table with fixed layout
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34942 Fullscreen 
+        API naming is inconsistent
         -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29501
-
-        New Tests:
-        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
-        * fast/table/fixed-table-with-small-percent-width.html: Added.
-
-        This new quirk is very similar to an existing one that was 
-        implemented in revision 4316.
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcPrefWidths):
-
-2009-09-22  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        List HTTP status code with response headers in resources tab of Web Inspector.
-        http://webkit.org/b/19945
-
-        This patch adds a new top level list in the resources tab, HTTP Information, that 
-        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
-        Additionally, it adds a colored dot next to the requested URL to show the status 
-        (green for success, orange for redirect, red for error).
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ImageView.js:
-        (WebInspector.ImageView):
-        * inspector/front-end/Images/errorRedDot.png: Added.
-        * inspector/front-end/Images/successGreenDot.png: Added.
-        * inspector/front-end/Images/warningOrangeDot.png: Added.
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.StatusTextForCode):
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView):
-        (WebInspector.ResourceView.prototype._refreshURL):
-        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
-        * inspector/front-end/inspector.css:
-
-2009-09-22  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Back list isn't properly updated for fragment changes after a redirect.
-        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
-
-        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
-          consulting the policy delegate for fragment scrolling.
+        <rdar://problem/7729165>
 
-2009-09-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Drop down selects get stuck in the non-visible state and cannot be opened.
-        https://bugs.webkit.org/show_bug.cgi?id=29645
-
-        All paths that lead to hiding the popup menu must call popupDidHide on
-        the PopupMenuClient.  This change makes it so by moving all of the
-        hiding logic to PopupListBox::hidePopup.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupContainer::hidePopup):
-        (WebCore::PopupListBox::hidePopup):
-        * platform/chromium/PopupMenuChromium.h:
-
-2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
+        This patch changes all occurrences of "fullScreen" to the more 
+        popular "fullscreen." webkitEnterFullScreen and 
+        webkitExitFullScreen have been maintained for now for backwards 
+        compatibility. 
 
-        WebInspector.log() function not protected if console not yet created
-        https://bugs.webkit.org/show_bug.cgi?id=29336
-        
-        No new tests.  Only affects Web Inspector developers adding logging
-        to their code during development.
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.log.isLogAvailable):
-        (WebInspector.log.flushQueue):
-        (WebInspector.log.flushQueueIfAvailable):
-        (WebInspector.log.logMessage):
-        (WebInspector.log):
-
-2009-09-22  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by David Levin.
-
-        Ported chromium.org's webcore.gyp for the webkit chromium port.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29617
-
-        * WebCore.gyp/WebCore.gyp: Added.
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::webkitEnterFullscreen):
+        (WebCore::HTMLVideoElement::webkitExitFullscreen):
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen):
+        (WebCore::HTMLVideoElement::webkitExitFullScreen):
+        * html/HTMLVideoElement.idl:
+        * platform/graphics/mac/MediaPlayerProxy.h:
 
-2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+2010-03-12  James Robinson  <jamesr@chromium.org>
 
         Reviewed by Adam Barth.
 
-        [v8] Don't keep clean wrappers artificially alive        
-        We currently keep all DOM node wrappers alive, even when there are
-        no more references to them from JS, in case they have properties
-        that we need to keep around if new JS references are created.
-        This changes the policy to only keep wrappers artificially alive
-        if they have changed since they were created. Empty wrappers are
-        discarded and recreated as needed.
-        https://bugs.webkit.org/show_bug.cgi?id=29330
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
-
-2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: console.count and console.timeEnd
-        crash when inspector is opened.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29632
-
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-
-2009-09-22  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed.
-
-        Fix bogus build fix I did last night.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-
-2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reivewed by Simon Hausmann.
-
-        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
-
-        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
-        takes a QWidget*, not a QWebPageClient*
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-
-2009-09-21  Adam Barth  <abarth@webkit.org>
-
-        Attempted fix for the V8 build.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-
-2009-09-21  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Don't re-enter JavaScript after performing access checks
-        https://bugs.webkit.org/show_bug.cgi?id=29531
-
-        Moved the access check slightly later in this functions to avoid
-        re-entering the JavaScript interpreter (typically via toString)
-        after performing the access check.
-
-        I can't really think of a meaningful test for this change.  It's more
-        security hygiene.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::JSDOMWindow::open):
-        (WebCore::JSDOMWindow::showModalDialog):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::setHref):
-        (WebCore::JSLocation::replace):
-        (WebCore::JSLocation::assign):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::if):
-        (CALLBACK_FUNC_DECL):
-        (V8Custom::WindowSetLocation):
-        (V8Custom::ClearTimeoutImpl):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+        Add virtual destructor to DOMWrapperWorld
+        https://bugs.webkit.org/show_bug.cgi?id=36077
 
-        Reviewed by Eric Seidel.
-
-        Make all write transaction start with a BEGIN IMMEDIATE command
-        instead of BEGIN.
-
-        We cannot test this change in a layout test, because in order to
-        test it we need to spawn two database threads and execute
-        transaction steps on these two threads in a very specific order,
-        which seems impossible to do when they share the same main thread
-        (as they would in a layout test). The SQLite docs and the case
-        described in the bug though should be enough proof that we do have
-        a problem here and that this patch will fix it.
-
-        Relevant SQLite documentation:
-        http://www.sqlite.org/lang_transaction.html
-        http://www.sqlite.org/lockingv3.html#locking
-
-        https://bugs.webkit.org/show_bug.cgi?id=29218
-
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
-        parameter.
-        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
-        for write transactions.
-        * platform/sql/SQLiteTransaction.h:
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
-        the read-only flag to the SQLiteTransaction instance.
-
-2009-09-21  Brady Eidson  <beidson@apple.com>
+        DOMWrapperWorld is RefCounted<DOMWrapperWorld>.  IsolatedWorld
+        inherits from DOMWrapperWorld and has member variables
+        with destructors, so DOMWrapperWorld needs to have a declared virtual
+        d'tor to ensure that its derived class's destructors are called.
 
-        Rubberstamped by Mark Rowe.
+        No new tests, no change in behavior
 
-        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+        * bindings/v8/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
 
-2009-09-15  John Abd-El-Malek  <jam@chromium.org>
 
-        Reviewed by Darin Fisher.
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-        Prevent sleeps in unload handlers.
-        https://bugs.webkit.org/show_bug.cgi?id=29193
-
-        Test: fast/dom/Window/slow_unload_handler.html
-
-        * WebCore.gypi:
-        * bindings/v8/DateExtension.cpp: Added.
-        (WebCore::DateExtension::DateExtension):
-        (WebCore::DateExtension::get):
-        (WebCore::DateExtension::setAllowSleep):
-        (WebCore::DateExtension::GetNativeFunction):
-        (WebCore::DateExtension::weakCallback):
-        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
-        (WebCore::DateExtension::OnSleepDetected):
-        * bindings/v8/DateExtension.h: Added.
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::registerExtensionWithV8):
-        (WebCore::V8Proxy::registeredExtensionWithV8):
-        * bindings/v8/V8Proxy.h:
-
-2009-09-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Run-time exception in onmessage handler is not forwarded to the
-        worker object.
-        https://bugs.webkit.org/show_bug.cgi?id=28980
-
-        The previous fix was partially reverted due to a reliability build break
-        in chromium. The break happens when an exception is thrown without
-        setting a message. We need to check for this scenario and handle it.
-
-        Tested by worker-close.html.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::reportException):
-
-2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Simon Fraser & Sam Weinig.
-
-        Add ENABLE(ORIENTATION_EVENTS)
-        https://bugs.webkit.org/show_bug.cgi?id=29508
-        
-        See documentation here:
-        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
-
-        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
-        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
-        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
-        * WebCore.OrientationEvents.exp: Added.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
-        * dom/EventNames.h: Add onorientationchange.
-        * html/HTMLAttributeNames.in: Ditto.
-        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
-        (WebCore::HTMLBodyElement::parseMappedAttribute):
-        (WebCore::HTMLBodyElement::onorientationchange):
-        (WebCore::HTMLBodyElement::setOnorientationchange):
-        * html/HTMLBodyElement.h: Ditto.
-        * html/HTMLBodyElement.idl: Ditto.
-        * html/HTMLFrameSetElement.cpp: Ditto.
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        (WebCore::HTMLFrameSetElement::onorientationchange):
-        (WebCore::HTMLFrameSetElement::setOnorientationchange):
-        * html/HTMLFrameSetElement.h: Ditto.
-        * html/HTMLFrameSetElement.idl: Ditto.
-        * page/DOMWindow.cpp: Ditto.
-        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
-        (WebCore::DOMWindow::onorientationchange):
-        (WebCore::DOMWindow::setOnorientationchange):
-        * page/DOMWindow.h: Handle onorientationchange properly.
-        * page/DOMWindow.idl: Ditto.
-        * page/Frame.cpp: Ditto.
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::sendOrientationChangeEvent):
-        * page/Frame.h: Ditto.
-        (WebCore::Frame::orientation):
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Try fixing the build again.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::wndProc):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: completions are always evaluated against
-        window (discarding call frames).
-
-        https://bugs.webkit.org/show_bug.cgi?id=29616
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
-
-2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build fix for Windows (Cairo) target.
-
-        Add stubs for SocketStream classes added in @r47788, which
-        broke the WinCairo build.
-
-        No new tests. (Build failure).
-
-        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
-          to Cairo build, exclude from standard Apple build.
-        * platform/network/curl/SocketStreamError.h: Added.
-        * platform/network/curl/SocketStreamHandle.h: Added.
-        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Expose InspectorResource fields.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29537
-
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::sourceString):
-        (WebCore::InspectorResource::resourceData):
-        * inspector/InspectorResource.h:
-        (WebCore::InspectorResource::requestHeaderFields):
-        (WebCore::InspectorResource::responseHeaderFields):
-        (WebCore::InspectorResource::responseStatusCode):
-        (WebCore::InspectorResource::requestMethod):
-        (WebCore::InspectorResource::requestFormData):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: JS error drilling down childless node.
-        No need to dispatch double click twice - it is already handled
-        in TreeElement.treeElementDoubleClicked.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22144
+        Reviewed by Oliver Hunt.
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline):
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
 
-2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl): Add ASSERT
+        (WebCore::StringImpl::sharedBuffer): Add ASSERT
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Add ASSERT
+        (WebCore::StringImpl::isStatic): added.
 
-        Reviewed by Simon Hausmann.
+2010-03-12  Enrica Casucci  <enrica@apple.com>
 
-        Implement new QWebPageClient class and let our classes
-        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+        Reviewed by Simon Fraser.
 
-        For Qt, platformPageClient() will now return a class derived from
-        the QWebPageClient, so the patch adapts our Qt hooks to go though
-        this class and not depend on the QWebView.
+        Content of 3D tests appears at the bottom right corner sometimes.
+        <rdar://problem/7556244>
+        <https://bugs.webkit.org/show_bug.cgi?id=36027>
 
-        * WebCore.pro:
-        * platform/Widget.h:
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/QWebPageClient.h: Added.
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
+        There were two problems to solve here:
+        - the incorrect anchoring of the rootChildLayer that was causing the composited
+          content to be positioned incorrectly
+        - the failure to paint the non composited content into the backing store when
+          animating composited content.
+          
+        The first problem has been solved by leaving the original anchor point for the
+        rootChildLayer and splitting the tasks of clipping and scrolling using two separate layers.
+        The second problem has been solved leveraging the knowledge that WebView has of the dirty region
+        of the backing store to pass this information to the layer renderer. This allows the renderer to force
+        a paint into the backing store before moving to the compositing.
+        
+        Tests: compositing/geometry/horizontal-scroll-composited.html
+               compositing/geometry/vertical-scroll-composited.html
+
+        * manual-tests/win/horizontal-scroll-composited.html: Removed. This is now a layout test.
+        * manual-tests/win/milliondollar.html: Added.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer): Added initialization of dirty flag.
+        (WebCore::WKCACFLayerRenderer::setScrollFrame): 
+        (WebCore::WKCACFLayerRenderer::updateScrollFrame): Updated to resize and position the clip and scroll layers.
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::createRenderer): Added new layer hierarchy.
+        (WebCore::WKCACFLayerRenderer::destroyRenderer): Remove clip layer on destroy.
+        (WebCore::WKCACFLayerRenderer::resize):
+        (WebCore::WKCACFLayerRenderer::paint): Forcing paint massage to trigger paint into the backing store.
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        (WebCore::WKCACFLayerRenderer::setBackingStoreDirty): Added.
+
+2010-03-12  Robert Hogan  <robert@webkit.org>
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+        Not reviewed, build fix.
 
-        Reviewed by Timothy Hatcher.
+        Revert http://trac.webkit.org/projects/webkit/changeset/55374 which broke
+        the !ENABLE(DATABASE) build on all platforms when attempting to fix the
+        --minimal build on Qt.
 
-        Web Inspector: Evaluating on call frame always returns "undefined".
+        Support for SQLite now seems to be non-negotiable for the Qt build but making
+        it mandatory requires review, so re-break --minimal Qt build for now.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29613
+        Qt build issue now tracked at https://bugs.webkit.org/show_bug.cgi?id=36073
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateAndWrap):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.evaluateInCallFrame):
+        * page/GeolocationPositionCache.cpp:
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Alexey Proskuryakov.
 
-        Web Inspector: Exception formatting is broken in console.
+        <rdar://problem/7709115> REGRESSION: toolbar is missing at http://www.glom.org/
+        https://bugs.webkit.org/show_bug.cgi?id=35507
 
-        https://bugs.webkit.org/show_bug.cgi?id=29608
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Extend the change made in
+        <http://trac.webkit.org/changeset/48818> to detect the two variants of
+        KHTMLFixes.css in @import rules as well as in <link> elements.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleCommandResult):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript.createProxyObject):
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Geoff Garen.
 
-        Reviewed by Timothy Hatcher.
+        Bug 36052 - [Qt] REGRESSION(55878) 63 test cases crash
 
-        Web Inspector: Console object formatting is broken.
+        r55878 changed UStringImpl::empty()->characters() to be non-null,
+        so TextBreakIteratorQt.cpp now should check the length of strings
+        (previously was assuming all strings with a non-null data pointer
+        had a length of at least 1).
 
-        https://bugs.webkit.org/show_bug.cgi?id=29607
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::wordBreakIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype._format):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+2010-03-12  Dirk Schulze  <krit@webkit.org>
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Timothy Hatcher.
+        SVG fallback color doesn't work for bogus gradients.
+        https://bugs.webkit.org/show_bug.cgi?id=35479
 
-        Web Inspector: Crash When Logging an Element Before Opening Inspector
+        Use a given fallback color on ignored gradients if present. Gradients
+        must be ignored, if one dimension of the objects boundingBox is zero.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29514
+        Test: svg/custom/gradient-with-1d-boundingbox.svg
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::strokePaintServer):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
 
-2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+2010-03-12  David Hyatt  <hyatt@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Incorrect clipping with accelerated compositing content, and position:fixed
-        https://bugs.webkit.org/show_bug.cgi?id=29347
+        https://bugs.webkit.org/show_bug.cgi?id=36069
         
-        Fix the compositing clipping logic to behave correctly when position:fixed
-        elements clip, by using the new backgroundClipRect() method to determine
-        when we need to clip, and to compute the clipping layer position.
-
-        Test: compositing/overflow/fixed-position-ancestor-clip.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-
-2009-09-21  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Add back in a special case for window.top in the V8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29605
-
-        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
-
-        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
-
-2009-09-21  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        HTMLMediaElement: media file should not reload when page comes out of page cache
-        https://bugs.webkit.org/show_bug.cgi?id=29604
-
-        Test: media/restore-from-page-cache.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
-        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
-        otherwise set the network state to NETWORK_IDLE.
-
-2009-09-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+        Eliminate InlineRunBox.
 
-        Clarify two FIXMEs.
-
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-
-2009-09-21  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Drop down selects fail to close when a value is selected
-        https://bugs.webkit.org/show_bug.cgi?id=29582
-
-        Implement PopupListBox::hidePopup, which was previously
-        declared but unimplemented.  Removes the declaration of
-        showPopup since that method is not implemented.
-
-        PopupListBox::hidePopup takes care of hiding the popup,
-        by invoking hidePopup on its parent PopupContainer, and
-        then informs the PopupMenuClient that popupDidHide.
-        This mimics the old behavior prior to r48370.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleKeyEvent):
-        (WebCore::PopupListBox::abandon):
-        (WebCore::PopupListBox::acceptIndex):
-        (WebCore::PopupListBox::hidePopup):
-
-2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
-
-        Rubber-stamped by Simon Hausmann.
-
-        [Qt] Windows build fix.
-        https://bugs.webkit.org/show_bug.cgi?id=29535
-
-        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
-
-2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed make dist build fix. Missing files.
-
-        * GNUmakefile.am:
-
-2009-09-20  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Crash when clicking link in unload handler
-        https://bugs.webkit.org/show_bug.cgi?id=29525
-
-        Test that the first navigation always wins when the page tries to start
-        a new navigation in an unload handler.
-
-        Tests: fast/loader/unload-form-about-blank.html
-               fast/loader/unload-form-post-about-blank.html
-               fast/loader/unload-form-post.html
-               fast/loader/unload-form.html
-               fast/loader/unload-hyperlink.html
-               fast/loader/unload-javascript-url.html
-               fast/loader/unload-reload.html
-               fast/loader/unload-window-location.html
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::prevLineBox):
+        (WebCore::InlineFlowBox::nextLineBox):
+        (WebCore::InlineFlowBox::setNextLineBox):
+        (WebCore::InlineFlowBox::setPreviousLineBox):
+        * rendering/InlineRunBox.h: Removed.
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::InlineTextBox):
+        (WebCore::InlineTextBox::prevTextBox):
+        (WebCore::InlineTextBox::nextTextBox):
+        (WebCore::InlineTextBox::setNextTextBox):
+        (WebCore::InlineTextBox::setPreviousTextBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox):
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::deleteLineBoxTree):
+        (WebCore::RenderLineBoxList::extractLineBox):
+        (WebCore::RenderLineBoxList::attachLineBox):
+        (WebCore::RenderLineBoxList::removeLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxes):
+        (WebCore::RenderLineBoxList::dirtyLineBoxes):
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::absoluteRects):
+        (WebCore::RenderSVGInline::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::objectBoundingBox):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::extractTextBox):
+        (WebCore::RenderText::attachTextBox):
+        (WebCore::RenderText::removeTextBox):
+        (WebCore::RenderText::createInlineTextBox):
+        (WebCore::RenderText::positionLineBox):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::loadWithDocumentLoader):
+2010-03-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Reviewed by Eric Carlson.
 
-        Reviewed by Xan Lopez.
+        media/video-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
-        https://bugs.webkit.org/show_bug.cgi?id=29496
+        Only effectively load, and start buffering when playing, or when
+        the preload attribute is set.
 
-        Protect the video sink object, and destroy it in an idle callback
-        to hopefully avoid a race condition that leads to a crash.
+        Test: media/video-preload.html
 
-        This is already tested by media/video-seekable.html
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::commitLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::idleUnref):
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+2010-03-12  Dmitry Titov  <dimich@chromium.org>
 
-2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Not reviewed, build fix.
 
-        Unreviewed build fix for GTKand a blind one for Qt after r48566.
+        Reverts 55920 and 55921. Landing for Jian Li.
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.pro:
-
-2009-09-19  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
-        Remove JSNameNodeCollection and just use StaticNodeList
-
+        * WebCore.gypi:
+        * WebCore.pri:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp: Removed.
-        * bindings/js/JSNamedNodesCollection.h: Removed.
+        * bindings/js/JSDOMFormDataCustom.cpp: Removed.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp: Removed.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * html/DOMFormData.idl: Removed.
+        * page/DOMWindow.idl:
 
-2009-09-19  Daniel Bates  <dbates@webkit.org>
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Dirk Schulze.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29511
-        
-        Fixes an issue where script code that contains non-ASCII characters may bypass the 
-        XSSAuditor.
-        
-        Before performing a comparison between the script source code and input parameters, we
-        remove all non-ASCII characters, including non-printable ASCII characters from the
-        script source code and input parameters.
+        [OpenVG] Add support for drawing text to PainterOpenVG
+        https://bugs.webkit.org/show_bug.cgi?id=35581
 
-        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+        Doesn't come with any actual font classes, as OpenVG
+        by itself doesn't provide any access to platform fonts
+        but just the means to draw glyphs that have been loaded
+        manually before.
 
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
-        including non-printable ASCII characters.
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::copyPaintState):
+        (WebCore::PainterOpenVG::textDrawingMode):
+        (WebCore::PainterOpenVG::setTextDrawingMode):
+        (WebCore::PainterOpenVG::drawText):
+        * platform/graphics/openvg/PainterOpenVG.h:
 
-2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Dirk Schulze.
 
-        Incorrect animation with scale(0) transform (singular matrix)
-        https://bugs.webkit.org/show_bug.cgi?id=29465
-        
-        Make accelerated scale() and translate() animations go through the component animation
-        path (rather than just matrix animation) to avoid problems with singular scale matrices,
-        and be slightly more efficient.
+        [OpenVG] Use masks to implement non-rectilinear clipping
+        https://bugs.webkit.org/show_bug.cgi?id=35544
 
-        Test: compositing/transitions/singular-scale-transition.html
+        Requires some additional context switching logic to
+        make sure the right context is current when dealing
+        with the mask, because we don't store it by ourselves.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::getTransformFunctionValue):
-        (WebCore::getValueFunctionNameForTransformOperation):
+        Initial version of this code was written by
+        Eli Fidler <efidler@rim.com>, I did a couple of
+        bug fixes and efficiency improvements since then.
+
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::~PlatformPainterState):
+        (WebCore::PlatformPainterState::maskingEnabled):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::saveMaskIfNecessary):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        (WebCore::PainterOpenVG::clipPath):
+        (WebCore::PainterOpenVG::save):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        (WebCore::PainterOpenVG::):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        (WebCore::SurfaceOpenVG::):
+
+2010-03-12  Jian Li  <jianli@chromium.org>
 
-2009-09-19  Alex Milowski  <alex@milowski.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Maciej Stachowiak.
+        Add DOMFormData.idl to expose FormData interface.
+        https://bugs.webkit.org/show_bug.cgi?id=36024
+        
+        The implementation is based on XMLHttpRequest 2 spec:
+        http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#formdata
 
-        Adds CSS styling and basic DOM element support for MathML
+        Test: http/tests/local/send-form-data.html
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * DerivedSources.cpp:
         * DerivedSources.make:
-          Added user stylesheet and tag factory generation
-
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-          Added new DOM element code
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseAttr):
-          Added check for document since stylesheet can be added before there is a document
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement):
-          Added check to add MathML user agent stylesheet
-
-        * css/mathml.css: Added.
-          MathML user agent stylesheet
-
-        * dom/Document.cpp:
-        (WebCore::Document::createElement):
-          Added support for creation of MathML DOM objects
-
-        * dom/Node.h:
-        (WebCore::Node::isMathMLElement):
-          Added check method for whether the node is a MathML node
-
-        * mathml: Added.
-        * mathml/MathMLElement.cpp: Added.
-        (WebCore::MathMLElement::MathMLElement):
-        (WebCore::MathMLElement::create):
-        (WebCore::MathMLElement::createRenderer):
-        * mathml/MathMLElement.h: Added.
-        (WebCore::MathMLElement::isMathMLElement):
-          MathML DOM base class
-
-
-        * mathml/MathMLInlineContainerElement.cpp: Added.
-        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
-        (WebCore::MathMLInlineContainerElement::create):
-        (WebCore::MathMLInlineContainerElement::createRenderer):
-        * mathml/MathMLInlineContainerElement.h: Added.
-          Base class for non-text containers
-
-        * mathml/MathMLMathElement.cpp: Added.
-        (WebCore::MathMLMathElement::MathMLMathElement):
-        (WebCore::MathMLMathElement::create):
-        * mathml/MathMLMathElement.h: Added.
-          Root Math element
-
-        * mathml/mathtags.in: Added.
-          Element list mappings
-
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-          Added MathML name initialization
-2009-09-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Oliver Hunt.
+        * bindings/js/JSDOMFormDataCustom.cpp: Added.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/DOMFormData.idl: Added.
+        * page/DOMWindow.idl:
 
-        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
-        https://bugs.webkit.org/show_bug.cgi?id=29305
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        We need to special-case data URLs when tainting a canvas because we
-        treat data URLs has having no security origin, unlike other
-        browsers.  The reason we do this is to help sites avoid XSS via data
-        URLs, but that consideration doesn't apply to canvas taint.
+        Reviewed by Dirk Schulze.
 
-        Also, we were previously incorrectly taking document.domain state
-        into account when tainting canvas.
+        [OpenVG] Add a SurfaceOpenVG constructor for EGL client buffer surfaces
+        https://bugs.webkit.org/show_bug.cgi?id=35538
 
-        Tests: http/tests/security/canvas-remote-read-data-url-image.html
-               http/tests/security/canvas-remote-read-data-url-svg-image.html
-               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+        SurfaceOpenVG can now not only encapsulate pbuffer
+        and window surfaces but also VGImage-based ones.
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::checkOrigin):
-        (WebCore::CanvasRenderingContext2D::createPattern):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::taintsCanvas):
-        * page/SecurityOrigin.h:
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp:
+        (WebCore::EGLDisplayOpenVG::createPbufferFromClientBuffer):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h:
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+2010-03-12  Alpha Lam  <hclam@chromium.org>
 
-        Fix stylistic issue raised in code review for previous commit.
+        Reviewed by Eric Carlson.
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::hasNonZeroTransformOrigin):
+        Fix a crash when resource loading of media element is canceled.
+        https://bugs.webkit.org/show_bug.cgi?id=35992
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+        Use of HTMLMediaElement::duration() after resource loading was canceled
+        will cause a crash. This is because HTMLMediaElement::m_player is used
+        when NULL.
+        Test: http/tests/media/video-cancel-load.html
 
-        Reviewed by Dan Bernstein.
-
-        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
-        https://bugs.webkit.org/show_bug.cgi?id=29495
-        
-        If an element has zero size, but has a transform origin with absolute values,
-        then the transform origin would not be applied because it is implemented via
-        anchorPoint, which is expressed as a fraction of the layer size.
-        
-        Work around this by artificially inflating the size of the backing store when we need to.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::duration):
+        Avoid calling to m_player when it is null.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+        Set m_readyState to HAVE_NOTHING.
 
-        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        Init m_artificiallyInflatedBounds to false.
-        
-        (WebCore::hasNonZeroTransformOrigin):
-        Utility function that describes whether the transform-origin contains non-percentage
-        x or y offsets.
-        
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        New wrapper method around setCompositedBounds() that applies the size inflation
-        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
-        
-        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+        Reviewed by Darin Adler.
 
-2009-09-18  Antti Koivisto  <antti@apple.com>
+        <rdar://problem/7725534> CSSPrimitiveValue::parserValue() returns deleted memory
+        https://bugs.webkit.org/show_bug.cgi?id=20069
 
-        Reviewed by Maciej Stachowiak.
+        No test added, since with the CSS variables feature disabled, the pointer
+        to the freed memory is never dereferenced.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29512
-        Don't recalculate style when restoring from the page cache
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::valueOrPropertyName): Changed to return a const AtomicString& from
+        a static table.
+        (WebCore::CSSPrimitiveValue::parserValue): Updated for the above change.
 
-        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
-        directly to update the scrollbars while keeping the existing style.
-        
-        Makes back/forward really fast on complex pages (in cases where page cache works).
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad):
+        Build fix.
 
-2009-09-18  Oliver Hunt  <oliver@apple.com>
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
 
-        Reviewed by Geoff Garen.
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        Implement ES5 Object.defineProperty function
-        https://bugs.webkit.org/show_bug.cgi?id=29503
+        Reviewed by Darin Adler.
 
-        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
-        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
-        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
-        to ensure correct wrapping semantics of quarantined objects.
+        <rdar://problem/7694674> Hover states not updated when overflow section scrolls under stationary mouse pointer
+        https://bugs.webkit.org/show_bug.cgi?id=35949
 
-        One major caveat in this patch is that it currently disallows the use
-        of Object.defineProperty on DOMObjects other than the window due to
-        the significant work involved in correctly propagating attributes and
-        ensuring correct semantics on dom objects.
+        Test: fast/events/overflow-scroll-fake-mouse-move.html
 
-        Tests: fast/js/Object-defineProperty.html
-               http/tests/security/xss-DENIED-defineProperty.html
+        Soon after an overflow section scrolls under the mouse pointer, dispatch
+        a fake mouse move event. This is similar to how frame scrolling is handled
+        in WebKit, and has the effect of updating hover state, dispatching DOM mouse
+        events, and updating the tool tip.
 
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::DOMObject::defineOwnProperty):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::defineGetter):
-        (WebCore::JSDOMWindow::defineSetter):
-        (WebCore::JSDOMWindow::defineOwnProperty):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::defineOwnProperty):
-        (WebCore::JSDOMWindowShell::defineGetter):
-        (WebCore::JSDOMWindowShell::defineSetter):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::defineGetter):
-        (WebCore::JSLocationPrototype::defineGetter):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
-        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Initialize m_fakeMouseMoveEventTimer.
+        (WebCore::EventHandler::~EventHandler): Assert that the timer is not active.
+        (WebCore::EventHandler::clear): Stop the timer.
+        (WebCore::EventHandler::handleMousePressEvent): Cancel pending fake mouse
+        move events.
+        (WebCore::EventHandler::handleMouseMoveEvent): Ditto.
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoonInQuad): If the mouse
+        is in the passed-in quad, ensure that a fake mouse move event is scheduled
+        to fire soon.
+        (WebCore::EventHandler::cancelFakeMouseMoveEvent): Does what the name says.
+        (WebCore::EventHandler::fakeMouseMoveEventTimerFired): Constructs a
+        PlatformMouseEvent with the current mouse location, modifier key state and
+        time stamp and calls mouseMoved().
+        * page/EventHandler.h:
+        * platform/PlatformKeyboardEvent.h: Declared getCurrentModifierState().
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/brew/PlatformKeyboardEventBrew.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/win/KeyEventWin.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): Call
+        EventHandler::dispatchFakeMouseMoveEventSoonInQuad(). Moved things around
+        a little to avoid computing the repaint rect twice.
 
-2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+2010-03-12  Kent Hansen  <kent.hansen@nokia.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29510
-        Active DOM objects should be suspended while a modal dialog is displayed
+        Webkit doesn't build with workers on and database off
+        https://bugs.webkit.org/show_bug.cgi?id=35997
 
-        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+        Added missing ENABLE(DATABASE) guards.
 
-        * page/PageGroupLoadDeferrer.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
-        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
-        an object twice.        
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
 
-2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+2010-03-12  Dan Winship  <danw@gnome.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Gustavo Noronha.
 
-        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
-        https://bugs.webkit.org/show_bug.cgi?id=29351
+        Make the defaultCookieJar use a no-third-party policy. Most
+        applications set their own cookie jar, but DumpRenderTree doesn't,
+        so it was failing the new third-party-cookie test.
 
-        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
-        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
 
-2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Laszlo Gombos.
 
-        Fix parameter substitutions in console.log().
+        [Qt] Enable network state notifier when compiling against Qt 4.7
+        https://bugs.webkit.org/show_bug.cgi?id=35983
 
-        https://bugs.webkit.org/show_bug.cgi?id=29366
+        * WebCore.pri:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype._format):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getPrototypes):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-        * inspector/front-end/utilities.js:
-        ():
+2010-03-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-2009-09-18  Sam Weinig  <sam@webkit.org>
+        Reviewed by Adam Treat.
 
-        Reviewed by Geoffrey Garen and Brady Eidson.
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
 
-        Temporarily remove an assertion that was getting hit when going
-        back to a page in the page cache while a banner in Safari was visible.
-        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+        The frame view take into acount the list of fixed object when scrolling
+        the view. If the number of object is lower than a certain threshold, the pixel
+        are blitted, and the invalidated area updated.
 
         * page/FrameView.cpp:
-        (WebCore::FrameView::scheduleRelayout):
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Try fixing the build again.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::wndProc):
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Fix windows build.
-        
-        * platform/win/PopupMenuWin.cpp:
-
-2009-09-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin 'BearClaw' Barraclough.
-
-        Convert another callback type object to store the global object
-        instead of the frame.
-
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::create):
-        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSCustomXPathNSResolver.h:
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::positionedObjects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
 
-        https://bugs.webkit.org/show_bug.cgi?id=29332
-        <rdar://problem/7231652> 
-        REGRESSION (r48446): While a <select> popup menu is open, the
-        rest of the WebView doesn't respond to mouse move events.
+2010-03-11  Aaron Boodman  <aa@chromium.org>
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::translatePoint):
-        New helper function that translates a point between HWND coordinates.
-        
-        (WebCore::PopupMenu::show):
-        Protect the PopupMenu if someone removes the <select> in response to a mouse
-        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
-        
-        (WebCore::PopupMenu::wndProc):
-        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
-        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
-        mouse move event.
+        Kill WebDocument::applicationID() (part 1).
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+        Modify interface to WebCore::NotificationPresenter::checkPermission()
+        and remove implementation of WebDocument::applicationID(). Breaking
+        API changes will be in a subsequent change.
+        https://bugs.webkit.org/show_bug.cgi?id=35846
 
-        Reviewed by Dave Hyatt.
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        * notifications/NotificationPresenter.h:
 
-        Compositing layers are incorrectly positioned after scrolling with position:fixed
-        https://bugs.webkit.org/show_bug.cgi?id=29262
-        
-        When scrolling a page with compositing layers inside a position:fixed element,
-        we need to update the compositing layer positions when the scroll position changes.
+2010-03-11  Dmitry Titov  <dimich@chromium.org>
 
-        Test: compositing/geometry/fixed-position.html
+        Reviewed by David Levin.
 
-        * WebCore.base.exp:
-        Export FrameView::scrollPositionChanged()
-        
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollPositionChanged):
-        New method that sends the scroll event, and updates compositing layers positions if necessary.
+        [v8] Remove obsolete code for delayed dereferencing of DOM objects for single-heap, multithread v8 usage.
+        https://bugs.webkit.org/show_bug.cgi?id=36043
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+        No new tests, no changes in functionality.
 
-        Reviewed by Dave Hyatt.
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::DOMData):
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+        * bindings/v8/DOMDataStore.cpp:
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        (WebCore::DOMDataStore::domSvgElementInstanceMap):
+        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
+        * bindings/v8/ScopedDOMDataStore.cpp:
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThread):
 
-        Transformed elements inside position:fixed container are clipped incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=29346
-        
-        Fix clipping and hit testing on transformed elements inside a position:fixed element.
-        Previously, the code used the overflowClipRect of the parent clip rects, but
-        this is not correct for fixed postion elements. Instead, share code that is
-        already present in calculateRects() to get the correct rect.
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-        Test: fast/overflow/position-fixed-transform-clipping.html
+        Rubber stamped by Oliver Hunt.
 
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        Call the new backgroundClipRect() to get the correct clipRect.
-        
-        (WebCore::RenderLayer::backgroundClipRect):
-        New method, factored out of calculateRects(), that computes the clip rect,
-        doing the right thing for fixed position elements.
-        
-        (WebCore::RenderLayer::calculateRects):
-        Call the new backgroundClipRect() method.
-        
-2009-09-18  Dan Bernstein  <mitz@apple.com>
+        Remove nonsense comments used in development & commited in error.
 
-        Reviewed by Darin Adler.
+        * platform/text/StringImpl.h:
 
-        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
-        WebCore::RenderBlock::layoutBlock()
-        https://bugs.webkit.org/show_bug.cgi?id=29498
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-        Test: accessibility/nested-layout-crash.html
+        Reviewed by Oliver Hunt.
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
-            call Document::updateLayoutIgnorePendingStylesheets() instead of
-            calling RenderObject::layoutIfNeeded(). The latter requires that
-            there be no pending style recalc, which allows methods that call
-            Document::updateLayout() to be called during layout without risking
-            re-entry into layout.
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
-            m_object after calling updateBackingStore(), since style recalc may
-            destroy the renderer, which destroys the accessibility object and
-            detaches it from the wrapper.
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-             Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
-            Ditto.
-
-2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
 
-        Reviewed by Simon Hausmann.
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
 
-        Update Qt build system for Web Socket.
-        https://bugs.webkit.org/show_bug.cgi?id=29270
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::empty): Reordered in file, made empty()->characters() return a non-null value to match JSC.
+        (WebCore::StringImpl::createUninitialized): Added overflow check.
+        (WebCore::StringImpl::create): Reordered in file.
+        (WebCore::StringImpl::sharedBuffer): Reordered in file.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::): Remove ThreadGlobalData as friend, move SharableUChar & SharedUChar to WebCore namespace.
+        (WebCore::StringImpl::StringImpl): Made static constructor method (used to create empty string) take arguments, to match JSC & prevent accidental use.
+        (WebCore::StringImpl::setHash): Added missing ASSERT.
+        (WebCore::StringImpl::adopt): Make adpot work with Vectors with a non-zero inline capacity.
+        (WebCore::StringImpl::characters): Mark as const to match JSC.
+        (WebCore::StringImpl::hash): Use !m_hash instead of m_hash == 0.
+        (WebCore::StringImpl::computeHash): Remove redundant 'inline'.
 
-        * WebCore.pro:
-        * platform/network/qt/SocketStreamError.h: Added.
-        * platform/network/qt/SocketStreamHandle.h: Added.
-        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+2010-03-11  Mark Rowe  <mrowe@apple.com>
 
-2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+        Reviewed by David Kilzer.
 
-        Reviewed by Darin Adler.
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
 
-        NULL check HTMLMediaElement::m_playedTimeRanges.
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
-        necessary, add range specified.
-        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
-        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
-        to be more readable.
-        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
-        * html/HTMLMediaElement.h:
+        * Configurations/Base.xcconfig:
 
-2009-09-18  Sam Weinig  <sam@webkit.org>
+2010-03-11  Jungshik Shin  <jshin@chromium.org>
 
-        Reviewed by Adele Peterson.
+        [Chromium]: Plane 2 characters are rendered "blank" 
+         (not even empty boxes) on Windows even when there are fonts to
+         cover them. 
 
-        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
-        REGRESSION(r48334): WebKit crashes on file select by drag
+        https://bugs.webkit.org/show_bug.cgi?id=35605
 
-        Don't use Document.elementFromPoint since it returns null if the point
-        is outside the viewport.  Instead, just hit test ourselves.
+        Test:LayoutTests/fast/text/international/plane2.html 
 
-        Test: fast/events/drag-file-crash.html
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::LookupAltName): Add two ExtB fonts to the array (namePairs) that are used for Plane 2 character rendering.
+        (WebCore::FontCache::getFontDataForCharacters): Add two more fonts to the fallback font list
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::getFallbackFamily): Fix the fallback font lookup to cover Plane 2 (CJK ExtB).
 
-        * page/DragController.cpp:
-        (WebCore::elementUnderMouse):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::concludeEditDrag):
+2010-03-11  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-09-18  Darin Adler  <darin@apple.com>
+        Reviewed by Holger Freyther.
 
-        Reviewed by Sam Weinig.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35889
 
-        Each wrapped Objective-C object should use a single RuntimeObjectImp
-        https://bugs.webkit.org/show_bug.cgi?id=29351
-        rdar://problem/7142294
+        * platform/efl/SystemTimeEfl.cpp: Added.
 
-        * WebCore.base.exp: Added a newly-needed exported symbol.
+2010-03-11  Mark Rowe  <mrowe@apple.com>
 
-        * bindings/objc/DOMInternal.h: Eliminated unused
-        createWrapperCacheWithIntegerKeys; it has not been needed since the
-        RGBColor wrappers were reworked.
-        * bindings/objc/DOMInternal.mm: Ditto.
+        Reviewed by Tim Hatcher.
 
-        * bridge/objc/objc_instance.h: Made the create function non-inline.
-        * bridge/objc/objc_instance.mm:
-        (createInstanceWrapperCache): Added. Creates an appropriate map table.
-        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
-        NSMapInsert to cache the instance in a map table.
-        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
-        the instance from the map table.
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
 
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
-        the instance from cachedObjects, which no longer exists.
-        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
-        bottleneck. Caching is now handled by the base class.
-
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
-        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
-        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
-        if it's already set. Set m_runtimeObject and call addRuntimeObject
-        if it's not.
-        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
-        used only by createRuntimeObject.
-        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
-        Calls removeRuntimeObject and then clears m_runtimeObject.
-        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
-        Clears m_runtimeObject.
-
-        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
-        willDestroyRuntimeObject, willInvalidateRuntimeObject,
-        newRuntimeObject, and m_runtimeObject.
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
 
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
-        call, now handled by caller.
-        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
-        call with willDestroyRuntimeObject call; the latter nows calls
-        removeRuntimeObject.
-        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
-        call.
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
 
-        * bridge/runtime_object.h: Made invalidate non-virtual.
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
 
-2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
 
-        Reviewed by Simon Hausmann.
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
 
-        Make PlatformWindow return something else than PlatformWidget
-        https://bugs.webkit.org/show_bug.cgi?id=29085
+2010-03-11  Anders Carlsson  <andersca@apple.com>
 
-        Make platformWindow return a PlatformPageClient
-        (for now typedef'ed to PlatformWidget)
+        Reviewed by David Hyatt.
 
-        Also, change the name of platformWindow to platformPageClient()
+        Remove invalidateContents, it isn't used and it never makes sense to only invalidate the contents.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getPangoLayoutForAtk):
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
         * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::platformPageClient):
         * page/Chrome.cpp:
-        (WebCore::Chrome::platformPageClient):
         * page/Chrome.h:
         * page/ChromeClient.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::wheelEvent):
-        (WebCore::EventHandler::currentPlatformMouseEvent):
-        (WebCore::EventHandler::sendContextMenuEvent):
-        (WebCore::EventHandler::eventMayStartDrag):
         * platform/HostWindow.h:
-        * platform/Widget.h:
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::getVisual):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        (WebCore::ScrollView::visibleContentRect):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::monitorInfoForWidget):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::calculatePositionAndSize):
-        (WebCore::PopupMenu::wndProc):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::nativeWindowForRenderObject):
-        * platform/wx/ScrollbarThemeWx.cpp:
-        (WebCore::ScrollbarThemeWx::paint):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-
-2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Web inspector UI adjustments specific to the Qt platform:
-        - Hide the close button
-        - Hide the dock button
-        - Disable the draggable toolbar
 
-        https://bugs.webkit.org/show_bug.cgi?id=29384
-
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.toolbarDragStart):
-
-2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        QtWebKit Windows CE compile fixes
-
-        Exclude certain pure-WINCE specific code paths from the Qt build.
-
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/FontCache.h:
-        * platform/graphics/MediaPlayer.cpp:
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
-        the corresponding PluginViewWndProc has the same guard in the header file.
-
-2009-09-18  Steve Block  <steveblock@google.com>
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Geolocation does not correctly handle Infinity for PositionOptions properties.
-        https://bugs.webkit.org/show_bug.cgi?id=29099
-
-        * bindings/js/JSGeolocationCustom.cpp: Modified.
-        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
-        * page/PositionOptions.h: Modified.
-        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
-        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
-        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
-        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
-        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
-
-2009-09-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
-        REGRESSION(r48334): WebKit crashes on file select by drag
-
-        Document.elementFromPoint now takes point in client space, not page space.
-
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::concludeEditDrag):
-
-2009-09-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Reimplement default media UI for Mac Chromium to match the style
-        of the Windows and Linux versions.  Also breaks the dependency
-        on the internal wk* functions that were previously used to
-        render the media controller widgets.
-        https://bugs.webkit.org/show_bug.cgi?id=29161
-
-        No media layout tests are currently enabled in Mac Chromium, so
-        nothing needs rebaselineing, etc.
+        [V8] Remove DOMObjectsInclude.h and update headers accordingly.
 
-        This is a recommit of r48438 with a compile fix and merges of
-        recent changes to the file.
+        https://bugs.webkit.org/show_bug.cgi?id=36036
 
-        * css/mediaControlsChromium.css:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::mediaElementParent):
-        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
-        (WebCore::mediaSliderThumbImage):
-        (WebCore::mediaVolumeSliderThumbImage):
-        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
-        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
-
-2009-09-17  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        The Console scope bar should have a divider between All and the other possible
-        values (Errors, Warnings, Logs). It will look something like:
-        
-        All | Errors Warnings Logs.
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.createDividerElement):
-        (WebInspector.ConsoleView):
-        * inspector/front-end/inspector.css:
+        * WebCore.gypi:
+        * bindings/v8/DOMData.h:
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/DOMObjectsInclude.h: Removed.
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Proxy.cpp:
 
-2009-09-17  Sam Weinig  <sam@webkit.org>
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Mark Rowe.
 
-        Remove additional references to JSVoidCallback which no longer exists.
-
-        * DerivedSources.cpp:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Brady Eidson.
-
-        Remove commented out onhashchange attribute now that it is implemented.
-
-        * page/DOMWindow.idl:
-
-2009-09-17  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/7007541> 
-        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
-        
-        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
-        crashes while we're calling into it).
-        
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
-        (JSC::RuntimeObjectImp::invalidate):
-        (JSC::RuntimeObjectImp::fallbackObjectGetter):
-        (JSC::RuntimeObjectImp::fieldGetter):
-        (JSC::RuntimeObjectImp::methodGetter):
-        (JSC::RuntimeObjectImp::getOwnPropertySlot):
-        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
-        (JSC::RuntimeObjectImp::put):
-        (JSC::RuntimeObjectImp::defaultValue):
-        (JSC::RuntimeObjectImp::getCallData):
-        (JSC::RuntimeObjectImp::getConstructData):
-        (JSC::RuntimeObjectImp::getPropertyNames):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::getInternalInstance):
+        Remove duplicate entries revealed after sorting.
 
-2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Reviewed by Timothy Hatcher.
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
 
-        Wrap primitive values (as objects) in InspectorController::wrap.
+        Reviewed by Mark Rowe.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28983
+        Sort the project file (also removing some bogus spaces that caused Xcode to rewrite the file
+        every time you opened it).
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
-         only object proxies will have objectId.
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
-         that accepts an expression and returns possible completions. This way we don't need to wrap
-         and unwrap the completions result into a proxy object.
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.createProxyObject):
-        * inspector/front-end/InjectedScriptAccess.js:
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-09-17  Nate Chapin  <japhet@chromium.org>
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Wrap PageTransitionEvents properly for V8's use.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29340
-
-        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
-
-2009-09-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Hardware-accelerated opacity transition on inline asserts
-        https://bugs.webkit.org/show_bug.cgi?id=29342
-        
-        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
-        pass an empty size, because the box size is only required for transform animations.
-
-        Test: compositing/transitions/opacity-on-inline.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startTransition):
-
-2009-09-17  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
+        Fix style issues and improve comments from 
+        http://trac.webkit.org/changeset/55853.
 
-        [V8] OwnHandle might get a weak callback after destruction
-        https://bugs.webkit.org/show_bug.cgi?id=29172
+        https://bugs.webkit.org/show_bug.cgi?id=36029
 
-        Be sure to clear out weak reference so we don't get a weak callback
-        after we've destructed ourselves.  Also, removed some tricky methods
-        that had no clients.
+        * platform/animation/TimingFunction.h:
+        (WebCore::TimingFunction::TimingFunction):
 
-        * bindings/v8/OwnHandle.h:
-        (WebCore::OwnHandle::clear):
-
-2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
-        fix crashes that started happening in V8Proxy::getEnteredContext().
-
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-
-2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Beth Dakin.
 
-        AX: labels of checkboxes should, when hit-tested, return the checkbox
-        https://bugs.webkit.org/show_bug.cgi?id=29335
-
-        When an accessibility hit test is done and it hits the label of a control element,
-        the control element should be returned instead of nothing, since the label
-        itself is usually ignored.
+        accessibilityIsIgnoredBase() needs to respect when platform says include
+        https://bugs.webkit.org/show_bug.cgi?id=36025
 
-        Test: accessibility/label-for-control-hittest.html
+        Changed accessibilityIsIgnoredBase() to return a policy instead of a yes/no
+        answer. This allows the platform to make a yes decision on an element.
 
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::accessibilityIsIgnored):
         * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        (WebCore::):
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
         * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase):
         (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
-        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
         * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
 
-2009-09-17  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Dimitri Glazkov, build fix.
-
-        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
-        https://bugs.webkit.org/show_bug.cgi?id=29243
-
-        Covered by existing tests.
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-
-2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
+2010-03-11  Kenneth Russell  <kbr@google.com>
 
-        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
-        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
-        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Reviewed by Dimitri Glazkov.
 
-        Test: fast/dom/DOMImplementation/detached-doctype.html
-              fast/dom/doctype-event-listener-crash.html
+        Fix build breakage with ENABLE_3D_CANVAS=0
+        https://bugs.webkit.org/show_bug.cgi?id=35995
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+        No new tests; verified in Chromium that WebGL is disabled in
+        ENABLE_3D_CANVAS=0 builds.
 
-2009-09-17  Dan Bernstein  <mitz@apple.com>
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
 
-        Reviewed by Simon Fraser.
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
-        FontDescription.h includes RenderStyleConstants.h, which violates layering
-        https://bugs.webkit.org/show_bug.cgi?id=29327
+        Unreviewed, Chromium mac build fix.
 
-        * GNUmakefile.am: Added FontSmoothingMode.h.
-        * WebCore.gypi: Added FontSmoothingMode.h.
-        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
-        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
-            it a private header.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
-            font smoothing mode via the font description.
-        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
-            of FontSmoothing to FontSmoothingMode.
-        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
-            via the font description.
-        * platform/graphics/FontDescription.h: Do not include
-            RenderStyleConstants.h.
-        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
-            FontSmoothing to FontSmoothingMode.
-        (WebCore::FontDescription::setFontSmoothing): Ditto.
-        * platform/graphics/FontSmoothingMode.h: Added.
-        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
-            RenderStyleConstants here and renamed it to this.
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
-            this can be accessed via the font description.
-        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
-            from here to FontSmoothingMode.h.
+        Add an explicit copy constructor to TimingFunction.
+        http://trac.webkit.org/changeset/55835 trigged an inlining
+        bug in gcc that the copy constructor resolves.
 
-2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+        * platform/animation/TimingFunction.h:
+        (WebCore::TimingFunction::TimingFunction):
 
-        wx 2.9 build fix.
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
-        (wxGetGdkWindowForDC):
+        Fixing GTK. No review.
 
-2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+        support lang attribute on <option> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36021
+ 
+        We don't need to cast to AccessibilityRenderObject to get language().
 
-        Reviewed by Dan Bernstein.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
 
-        Elements appear behind <video> when they should be in front sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=29314
-        
-        r45598 added logic that tests for overlap with <video> to determine when to throw
-        a layer into compositing mode. That logic was incorrect in some cases, and this patch
-        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
-        is composited (which adds a rect to the overlay map), and there is overlap.
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-        Test: compositing/geometry/video-opacity-overlay.html
+        Reviewed by Darin Adler.
 
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        support lang attribute on <option> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36021
 
-2009-09-17  Avi Drissman  <avi@google.com>
+        Allow non AccessibilityRenderObject classes to access the lang
+        attribute by moving the useful code into AccessibilityObject.
 
-        Reviewed by Darin Fisher.
+        Test: platform/mac/accessibility/option-with-lang.html
 
-        Update the Chromium Mac theming files (RenderTheme and Theme) to be
-        up-to-date.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=29243
-        http://crbug.com/19604
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::language):
+        * accessibility/AccessibilityListBoxOption.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
 
-        Covered by existing tests.
+2010-03-11  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-        * WebCore.gypi:
-        * platform/chromium/ThemeChromiumMac.h: Added.
-        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
-        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
-        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
-        * platform/chromium/ThemeChromiumMac.mm: Added.
-        (WebCore::):
-        (WebCore::platformTheme):
-        (WebCore::controlSizeForFont):
-        (WebCore::sizeFromFont):
-        (WebCore::setControlSize):
-        (WebCore::updateStates):
-        (WebCore::inflateRect):
-        (WebCore::checkboxSizes):
-        (WebCore::checkboxMargins):
-        (WebCore::checkboxSize):
-        (WebCore::checkbox):
-        (WebCore::paintCheckbox):
-        (WebCore::radioSizes):
-        (WebCore::radioMargins):
-        (WebCore::radioSize):
-        (WebCore::radio):
-        (WebCore::paintRadio):
-        (WebCore::buttonSizes):
-        (WebCore::buttonMargins):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
-        (WebCore::ThemeChromiumMac::controlFont):
-        (WebCore::ThemeChromiumMac::controlSize):
-        (WebCore::ThemeChromiumMac::minimumControlSize):
-        (WebCore::ThemeChromiumMac::controlBorder):
-        (WebCore::ThemeChromiumMac::controlPadding):
-        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
-        (WebCore::ThemeChromiumMac::paint):
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/FloatSize.h:
-        * platform/graphics/IntRect.h:
-        * rendering/RenderThemeChromiumMac.h:
-        (WebCore::RenderThemeChromiumMac::supportsControlTints):
-        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
-        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
-        * rendering/RenderThemeChromiumMac.mm:
-        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
-        (-[RTCMFlippedView isFlipped]):
-        (-[RTCMFlippedView currentEditor]):
-        (WebCore::):
-        (WebCore::FlippedView):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumMac::systemFont):
-        (WebCore::convertNSColorToColor):
-        (WebCore::menuBackgroundColor):
-        (WebCore::RenderThemeChromiumMac::systemColor):
-        (WebCore::RenderThemeChromiumMac::isControlStyled):
-        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
-        (WebCore::RenderThemeChromiumMac::inflateRect):
-        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
-        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
-        (WebCore::RenderThemeChromiumMac::paintTextField):
-        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
-        (WebCore::RenderThemeChromiumMac::paintTextArea):
-        (WebCore::RenderThemeChromiumMac::paintMenuList):
-        (WebCore::TopGradientInterpolate):
-        (WebCore::BottomGradientInterpolate):
-        (WebCore::MainGradientInterpolate):
-        (WebCore::TrackGradientInterpolate):
-        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
-        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintSearchField):
-        (WebCore::RenderThemeChromiumMac::setSearchCellState):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
-        (WebCore::mediaControllerTheme):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
-        (WebCore::getMediaUIPartStateFlags):
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
-        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
-
-2009-09-16  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Darin Adler.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29306
-        
-        Fixes an issue where an attack that contains accented characters can
-        bypass the XSSAuditor.
-        
-        XSSAuditor::decodeURL used the wrong length for the input string. 
-        When the input string was decoded, the decoded result was truncated.
-        Hence, XSSAuditor was comparing the source code of the script to the 
-        truncated input parameters.
+        [Qt] Access key modifier should be Ctrl+Alt for Darwin derived OS and Alt for the others
+        https://bugs.webkit.org/show_bug.cgi?id=35993
 
-        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeURL):
+2010-03-08  Brett Wilson  <brettw@chromium.org>
 
-2009-09-16  Brady Eidson  <beidson@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Sam Weinig.
+        Remove the deprecated argument to url_util::IsStandard in preparation
+        for deleting that version of the function. Pull the latest googleurl
+        with the new version for the Chromium builder.
 
-        Explore allowing pages with unload handlers into the Page Cache
-        https://bugs.webkit.org/show_bug.cgi?id=29021
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::isHierarchical):
 
-        No new tests. (All previous tests continue to pass)
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+        Reviewed by Tor Arne Vestbø.
 
-2009-09-16  Adam Barth  <abarth@webkit.org>
+        [Qt] Make it possible to do builds with separate debug info in packages
 
-        Reviewed by Dimitri Glazkov.
+        * WebCore.pro:
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        We now save a handle to the original context.  We use that handle to
-        call the timeout in the right context / world.
+        Reviewed by Tor Arne Vestbø.
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        [Qt] Avoid double-buffering with Qt image decoders
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        Pass QIODevice::Unbuffered when opening the QBuffer that
+        wraps the image data, to hint to Qt that no extra buffering
+        is needed.
 
-2009-09-16  Adam Barth  <abarth@webkit.org>
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
 
-        Reviewed by Dimitri Glazkov.
+2010-03-10  Ben Murdoch  <benm@google.com>
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        Reviewed by Jeremy Orlow.
 
-        We now save a handle to the original context.  We use that handle to
-        call the timeout in the right context / world.
+        [Android] The platform touch events on Android are missing support
+        for key modifiers.
+        https://bugs.webkit.org/show_bug.cgi?id=35521
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        Add support in PlatformToucHEventAndroid for the platform supplying
+        key modifiers with touch events.
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        Fixes Android so it now passes basic-single-touch-events.html.
 
-2009-09-16  Sam Weinig  <sam@webkit.org>
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Fix two compiler warnings.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Add support for
+            key modifiers on Android.
+        * platform/android/PlatformTouchEventAndroid.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): ditto.
 
-        Reviewed by Anders Carlsson.
+2010-03-10  Steve Block  <steveblock@google.com>
 
-        Add some groups to the xcode project to make the bindings/js/ group
-        a little nicer.
+        Reviewed by Jeremy Orlow.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Implements Geolocation maximumAge property
+        https://bugs.webkit.org/show_bug.cgi?id=30676
 
-2009-09-16  Sam Weinig  <sam@webkit.org>
+        Test: fast/dom/Geolocation/maximum-age.html
 
-        Reviewed by Anders Carlsson.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Adds GeolocationPositionCache.h to Private headers
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::setUseCachedPosition): Added.
+        (WebCore::Geolocation::GeoNotifier::runSuccessCallback): Added.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Added logic to handle using a cached position
+        (WebCore::Geolocation::Watchers::contains): Added. Required to determine if a notifier is a watch request
+        (WebCore::Geolocation::startRequest): Modified. Added logic to check for a cached position
+        (WebCore::Geolocation::requestUsesCachedPosition): Added. Callback to Geolocation object when notifier uses a cached position
+        (WebCore::Geolocation::makeCachedPositionCallbacks): Added.
+        (WebCore::Geolocation::haveSuitableCachedPosition): Added.
+        (WebCore::Geolocation::setIsAllowed): Modified.
+        (WebCore::Geolocation::positionChanged): Modified. Make callbacks using cached position where appropriate
+        (WebCore::Geolocation::geolocationServiceErrorOccurred): Modified. Make callbacks using cached position where appropriate
+        * page/Geolocation.h: Modified.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
-        JS callback objects should store the global object
+2010-03-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        This just changes the callback objects to store the global object instead
-        of the frame. A follow up patch will change them to store the 'current' 
-        global object instead of the lexical or dynamic.
+        Unreviewed buildfix after r55823. (To fix Qt --minimal build.)
+        I have déjà vu, I'm sure that I did it before. (r55598)
 
-        * DerivedSources.make: Remove unused VoidCallback.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h:
-        (WebCore::JSCustomPositionCallback::create):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        (WebCore::JSCustomPositionErrorCallback::create):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        (WebCore::JSCustomSQLStatementCallback::create):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        (WebCore::JSCustomSQLStatementErrorCallback::create):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
-        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
-        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        (WebCore::JSCustomSQLTransactionCallback::create):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        (WebCore::JSCustomSQLTransactionErrorCallback::create):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        (WebCore::JSCustomVoidCallback::create):
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::JSDatabase::changeVersion):
-        (WebCore::createTransaction):
-        (WebCore::JSDatabase::transaction):
-        (WebCore::JSDatabase::readTransaction):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback):
-        (WebCore::createPositionErrorCallback):
-        (WebCore::JSGeolocation::getCurrentPosition):
-        (WebCore::JSGeolocation::watchPosition):
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSDOMWindowCustom.cpp: Missing #if ENABLE(DATABASE) guard added. 
 
-2009-09-15  Kent Tamura  <tkent@chromium.org>
+2010-03-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Eric Seidel.
+        [Qt] Unreviewed buildfix after r55833.
 
-        <input maxlength=> should restrict only values specified by users.
-        https://bugs.webkit.org/show_bug.cgi?id=21271
+        Rename all instances of data() to characters()
 
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::setValueFromRenderer):
-        (WebCore::InputElement::sanitizeValue):
-        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        (WebCore::InputElement::updateValueIfNeeded):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::value):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::sanitizeValue):
-        * html/HTMLInputElement.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::constrainValue):
-        * wml/WMLInputElement.h:
-        (WebCore::WMLInputElement::sanitizeValue):
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
 
-2009-09-16  Enrica Casucci  <enrica@apple.com>
+2010-03-11  Zoltan Horvath  <zoltan@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Simon Hausmann.
 
-        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
-        https://bugs.webkit.org/show_bug.cgi?id=29319
+        Allow custom memory allocation control for RenderLayerBacking class
+        https://bugs.webkit.org/show_bug.cgi?id=35857
 
-        * editing/IndentOutdentCommand.cpp:
-        Removed implementation of isAtUnsplittableElement.
+        Inherits the following class from Noncopyable because it is
+        instantiated by 'new' and no need to be copyable:                                     
 
-        * editing/IndentOutdentCommand.h:
-        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+        class name    - instantiated at: WebCore/'location'
+        RenderLayerBacking - rendering/RenderLayer.cpp:3047
 
-        * editing/htmlediting.cpp:
-        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+        * rendering/RenderLayerBacking.h:
 
-        * editing/htmlediting.h:
-        Reordered functions to group them by type of object returned or operate upon.
-        Added comments.
-        Added isAtUnsplittableElement declaration.
+2010-03-11  Zoltan Horvath  <zoltan@webkit.org>
 
-2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Sam Weinig and Anders Carlsson.
+        Allow custom memory allocation control for TimingFunction struct
+        https://bugs.webkit.org/show_bug.cgi?id=35855
 
-        Removed some vestigial and potentially crashy code that makes consolidating
-        event listeners hard.
+        Inherits the following struct from FastAllocBase because it is 
+        instantiated by 'new':
 
-        * dom/Node.cpp:
-        (WebCore::Node::addEventListener): No need to limit when event listeners
-        can be added. Other EventTargets don't do this.
-        
-        Also, check for null when accessing document(). Technically, the JS bindings
-        do this check for us, but let's not rely on that.
+        class name    - instantiated at: WebCore/'location'
+        TimingFuction - platform/graphics/GraphicsLayer.h:89
 
-2009-09-16  Anders Carlsson  <andersca@apple.com>
+        * platform/animation/TimingFunction.h:
 
-        Reviewed by Adam Roben.
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        <rdar://problem/7155710>
-        HTML selects on windows cause containing window to become inactive when opened
-        
-        Redo the way we handle events when a popup menu is shown, based on
-        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        Rubber stamped by Oliver Hunt.
         
-        Since a non-active window can't capture the mouse, we use the owning window 
-        (the WebView) as the capture window. We then run a recursive message pump that 
-        forwards all mouse and keyboard events to the popup menu.
-        
-        * platform/PopupMenu.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::PopupMenu):
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::hide):
-        (WebCore::PopupMenu::wndProc):
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
 
-2009-09-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Ada Chan.
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaStringImpl::uchars):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
 
-        Speculative fix for
-        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
-        is null. Add two assertions that can help determine how this crash
-        happens (in particular, whether node() becomes null during destroy() or
-        it is null before destroy() is called).
-
-2009-09-16  Beth Dakin  <bdakin@apple.com>
+        Reviewed by Mark Rowe.
 
-        Speculative build fix.
+        Fix for r55825, threadsafeCopy no longer needs to special-case for
+        empty strings (in fact, doing so results in leaks).
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::threadsafeCopy):
 
-2009-09-16  Beth Dakin  <bdakin@apple.com>
+2010-03-10  Chang Shu  <chang.shu@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Fix for <rdar://problem/7083741> Implement a CSS extension to 
-        adjust sub-pixel anti-aliasing for text
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29291
-
-        Added tests:
-        * fast/css/font-smoothing.html: Added.
-        * fast/css/parsing-webkit-font-smoothing.html: Added.
-
-        This patch adds a new CSS property called -webkit-font-smoothing 
-        that accepts the following as valid input: auto | none | 
-        antialiased | subpixel-antialiased
-
-        Return appropriate computed style for -webkit-font-smoothing
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        While calculating alpha channel, convert the floating point value to
+        an integer in [0, 256) with equal distribution.
+        https://bugs.webkit.org/show_bug.cgi?id=22150
 
-        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
-        input.
         * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-        Add mappings for FontSmoothing to the right CSS values.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
-
-        Add -webkit-font-smoothing
-        * css/CSSPropertyNames.in:
-
-        Set fontSmoothing on the FontDescription.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-
-        Add antialiased and subpixel-antialiased as possible new CSS 
-        values.
-        * css/CSSValueKeywords.in:
-        Store the font smoothing CSS value in the FontDescription.
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::FontDescription):
-        (WebCore::FontDescription::fontSmoothing):
-        (WebCore::FontDescription::setFontSmoothing):
-        (WebCore::FontDescription::operator==):
-
-        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
-        based on the CSS fontSmoothing() value.
-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::drawGlyphs):
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::Font::drawGlyphs):
+        (WebCore::CSSParser::parseColorParameters):
 
-        New function fontSmoothing()
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::fontSmoothing):
-
-        New enum FontSmoothing.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
 
-        Remove style property if empty string is entered.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29163
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
-
-2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Always reset m_implicitShorthand to false after parsing
-        background-repeat style property otherwise properties
-        following after it may be erroneously marked as implicit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28972
-        https://bugs.webkit.org/show_bug.cgi?id=28973
-
-        Test: fast/backgrounds/repeat/margin-shorthand.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
-        XMLHttpRequest::getResponseHeader in the
-        HEADERS_RECEIVED readyState.
-        https://bugs.webkit.org/show_bug.cgi?id=29121
-
-        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
-               http/tests/xmlhttprequest/getResponseHeader.html
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::getAllResponseHeaders):
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
 
-2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+        Copy JavaScriptCore in making 'static' strings threadsafe, make the empty string a static,
+        shared by all threads.
 
-        Reviewed by Dimitri Glazkov.
+        ~2% progression on Dromaeo DOM core & JS lib tests.
 
-        [V8] Fix style violation in V8AbstractEventListener.
-        https://bugs.webkit.org/show_bug.cgi?id=29303
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        (WebCore::ThreadGlobalData::eventNames):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::empty):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::deref):
+        (WebCore::StringImpl::hasOneRef):
 
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::operator==):
+2010-03-08  Dumitru Daniliuc  <dumi@chromium.org>
 
-2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Timothy Hatcher.
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        Add Watch Expression support to inspector
-        https://bugs.webkit.org/show_bug.cgi?id=27514
+        Tests: storage/open-database-creation-callback.html
+               storage/open-database-creation-callback-isolated-world.html
 
-        Manual test added.
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
-        * English.lproj/localizedStrings.js:
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
+        * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype._enterKeyPressed):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
-        (WebInspector.ObjectPropertiesSection.CompareProperties):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.reset):
-        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
-        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
-        (WebInspector.WatchExpressionsSidebarPane):
-        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
-        (WebInspector.WatchExpressionsSection):
-        (WebInspector.WatchExpressionsSection.prototype.update):
-        (WebInspector.WatchExpressionsSection.prototype.addExpression):
-        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
-        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
-        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
-        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
-        (WebInspector.WatchExpressionsSection.CompareProperties):
-        (WebInspector.WatchExpressionTreeElement):
-        (WebInspector.WatchExpressionTreeElement.prototype.update):
-        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
-        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
-        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
-        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * manual-tests/inspector/debugger-watch-expressions.html: Added.
-
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Add ENABLE(INSPECTOR)
-        https://bugs.webkit.org/show_bug.cgi?id=29260
-
-        Reviewed by David Kilzer.
-
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
-        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
-        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::JSDOMWindowBase::supportsProfiling):
-        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
-        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
-        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
-        * bindings/js/ScriptObject.h: Ditto.
-        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::Document::recalcStyle):
-        (WebCore::Document::addMessage):
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        (WebCore::Document::scriptImported):
-        * dom/Document.h: Ditto.
-        * dom/Node.cpp: Ditto.
-        (WebCore::Node::dispatchGenericEvent):
-        * dom/ScriptExecutionContext.h: Ditto.
-        (WebCore::):
-        * html/HTMLDocument.cpp: Ditto.
-        (WebCore::HTMLDocument::createTokenizer):
-        * html/HTMLTokenizer.cpp: Ditto.
-        (WebCore::HTMLTokenizer::write):
-        * inspector/ConsoleMessage.cpp: Ditto.
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::isEqual):
-        * inspector/ConsoleMessage.h: Ditto.
-        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * inspector/InspectorBackend.cpp: Ditto.
-        * inspector/InspectorController.cpp: Ditto.
-        * inspector/InspectorDOMAgent.cpp: Ditto.
-        * inspector/InspectorDOMStorageResource.cpp: Ditto.
-        * inspector/InspectorDatabaseResource.cpp: Ditto.
-        * inspector/InspectorFrontend.cpp: Ditto.
-        * inspector/InspectorResource.cpp: Ditto.
-        * inspector/InspectorTimelineAgent.cpp: Ditto.
-        * inspector/TimelineItem.cpp: Ditto.
-        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::FrameLoader::detachFromParent):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        (WebCore::FrameLoader::dispatchDidCommitLoad):
-        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::FrameLoader::dispatchWillSendRequest):
-        (WebCore::FrameLoader::dispatchDidReceiveResponse):
-        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
-        (WebCore::FrameLoader::dispatchDidFinishLoading):
-        * page/Chrome.cpp: Ditto.
-        (WebCore::Chrome::mouseDidMoveOverElement):
-        * page/Console.cpp: Ditto.
-        (WebCore::Console::addMessage):
-        (WebCore::Console::count):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::time):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::group):
-        (WebCore::Console::groupEnd):
-        * page/ContextMenuController.cpp: Ditto.
-        (WebCore::ContextMenuController::handleContextMenuEvent):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        * page/DOMWindow.cpp: Ditto.
-        (WebCore::DOMWindow::sessionStorage):
-        (WebCore::DOMWindow::localStorage):
-        * page/EventHandler.cpp: Ditto.
-        (WebCore::EventHandler::handleMousePressEvent):
-        * page/FrameView.cpp: Ditto.
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        (WebCore::Page::~Page):
-        * page/Page.h: Ditto.
-        * platform/ContextMenu.cpp: Ditto.
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-        * platform/ContextMenuItem.h: Ditto.
-        (WebCore::):
-        * storage/Database.cpp: Ditto.
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
         (WebCore::Database::openDatabase):
-        * workers/WorkerContext.cpp: Ditto.
-        (WebCore::WorkerContext::importScripts):
-        * xml/XMLHttpRequest.cpp: Ditto.
-        (WebCore::XMLHttpRequest::didFinishLoading):
-
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Add ENABLE(CONTEXT_MENUS)
-        https://bugs.webkit.org/show_bug.cgi?id=29225
-
-        Reviewed by David Kilzer.
-
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
-        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
-        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
-        (WebCore::Node::defaultEventHandler):
-        * loader/EmptyClients.h: Ditto.
-        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * page/EventHandler.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        * page/Page.h: Ditto.
-        * page/mac/EventHandlerMac.mm: Ditto.
-        * page/mac/WebCoreViewFactory.h: Ditto.
-        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * platform/mac/ContextMenuMac.mm: Ditto.
-        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * svg/graphics/SVGImage.cpp: Ditto.
-        (WebCore::SVGImage::dataChanged):
-
-2009-09-16  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
-        into ScrollView so that all platforms do it.
-        
-        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
-        the rectangle for repainting.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::repaintContentRectangle):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformRepaintContentRectangle):
-
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Add ENABLE(DRAG_SUPPORT)
-        https://bugs.webkit.org/show_bug.cgi?id=29233
-
-        Reviewed by David Kilzer.
-
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
-        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
-        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
-        * loader/EmptyClients.h: Ditto.
-        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        * page/Page.h: Ditto.
-        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
-        * platform/mac/ClipboardMac.mm: Ditto.
-        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::RenderLayer::autoscroll):
-        * rendering/RenderObject.cpp: Ditto.
-        * rendering/RenderObject.h: Ditto.
-        * svg/graphics/SVGImage.cpp: Ditto.
-        (WebCore::SVGImage::dataChanged):
-
-2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMSW build fix after adding support for high resolution times in Win.
-
-        * page/Settings.cpp:
-        * page/Settings.h:
-
-2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        Reviewed by Dimitri Glazkov.
+2010-03-10  Justin Schuh  <jschuh@chromium.org>
 
-        [V8] Added operator==() to event listeners. This fixes V8 bindings
-        build broken in http://trac.webkit.org/changeset/48402.
-        https://bugs.webkit.org/show_bug.cgi?id=29298
+        Reviewed by Adam Barth.
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
-        uses JSEventListenerType.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::operator==): Only compares
-        pointers since we create at most one wrapper for a JS object.
+        Make Chrome consistently handle leading format characters in URLs
 
-2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=35948
 
-        Reviewed by Xan Lopez.
+        Test: http/tests/security/xss-DENIED-window-open-javascript-url-leading-format-char.html
 
-        [GTK] Crash when visiting http://flipper.googlelabs.com/
-        https://bugs.webkit.org/show_bug.cgi?id=29293
+        * platform/KURLGoogle.cpp:
 
-        Check type for being null or empty before looking it up in the
-        hash of supported types.
+2010-03-10  Jian Li  <jianli@chromium.org>
 
-        Tested by http/tests/loading/redirect-with-no-location-crash.html
+        Reviewed by Dmitry Titov.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
+        Implementing DOMFormData class.
+        https://bugs.webkit.org/show_bug.cgi?id=35707
 
-2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+        This patch only addresses the implementation of DOMFormData class and
+        moves the FormData construction logic from HTMLFormElement::createFormData
+        to FormData::create() so that it can be used by both HTMLFormElement
+        and XMLHttpRequest.
 
-        Reviewed by Sam Weinig.
-        
-        Removed the notion of "disconnected nodes with event listeners" because
-        it was vestigial. The reference cycle it tried to solve was solved another
-        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+        The DOMFormData IDL interface will be exposed in another patch and the
+        test will be added then.
 
-        * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListeners):
-        * dom/Document.h:
-        * dom/Node.cpp:
-        (WebCore::Node::~Node):
-        (WebCore::Node::insertedIntoDocument):
-        (WebCore::Node::removedFromDocument):
-        (WebCore::Node::willMoveToNewOwnerDocument):
-        (WebCore::Node::didMoveToNewOwnerDocument):
-        (WebCore::Node::addEventListener):
-        (WebCore::Node::removeEventListener):
-        (WebCore::Node::clearAttributeEventListener):
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMFormData.cpp: Added.
+        * html/DOMFormData.h: Added.
+        * html/FormDataList.h:
+        (WebCore::FormDataList::encoding):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::create):
+        (WebCore::FormData::createMultiPart):
+        (WebCore::FormData::appendDOMFormData):
+        * platform/network/FormData.h:
+        (WebCore::FormData::boundary):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
 
-2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+2010-03-10  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Beth Dakin.
 
-        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
-        https://bugs.webkit.org/show_bug.cgi?id=28841
+        VoiceOver can navigate to hidden content in widget (WAI-ARIA)
+        https://bugs.webkit.org/show_bug.cgi?id=35986
 
-        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
-        Consolidate increment/decrement/changeValue methods. 
+        Elements that are subclassers of AXRenderObject have not been respecting
+        aria-hidden and other cases that would make them ignored. This applies
+        to tables, rows, cells, select boxes, sliders, and lists. Select boxes
+        also need to make sure their option elements respect aria-hidden as well.
 
-        Test: accessibility/aria-slider-value-change.html
+        Test: accessibility/aria-hidden-with-elements.html
 
-        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::accessibilityIsIgnored):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBox.h:
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBoxOption.h:
         * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::increment):
-        (WebCore::AccessibilityRenderObject::decrement):
-        (WebCore::AccessibilityRenderObject::changeValueByPercent):
-        (WebCore::AccessibilityRenderObject::setValue):
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnoredCommon):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
         * accessibility/AccessibilityRenderObject.h:
         * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
         * accessibility/AccessibilitySlider.h:
-        * dom/Element.cpp:
-        (WebCore::Element::updateAfterAttributeChanged):
-
-2009-09-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
-        creation and destruction of JSDOMGlobalObject and event listeners.
-        
-        Added an abstract operator==() to EventListener, to replace the
-        jsEventListeners set's role in determining if two event listeners are
-        equal from the DOM's perspective.
-        
-        Added a type field to EventListener, and casting operations, to support
-        operator==() and other abstract operations.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        (WebCore::JSEventListener::operator==):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::cast):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        (WebCore::ObjCEventListener::cast):
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::ObjCEventListener):
-        (WebCore::ObjCEventListener::operator==):
-        * dom/EventListener.h:
-        (WebCore::EventListener::):
-        (WebCore::EventListener::type):
-        (WebCore::EventListener::EventListener):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::addEventListener):
-        (WebCore::MessagePort::removeEventListener):
-        * dom/Node.cpp:
-        (WebCore::Node::removeEventListener):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
-        (WebCore::InspectorDOMAgent::mainFrameDocument):
-        (WebCore::InspectorDOMAgent::operator==):
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::InspectorDOMAgent::cast):
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::cast):
-        (WebCore::ImageEventListener::ImageEventListener):
-        (WebCore::ImageEventListener::operator==):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        * notifications/Notification.cpp:
-        (WebCore::Notification::removeEventListener):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::removeEventListener):
-        * page/EventSource.cpp:
-        (WebCore::EventSource::addEventListener):
-        (WebCore::EventSource::removeEventListener):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::cast):
-        (WebCore::ConditionEventListener::ConditionEventListener):
-        (WebCore::ConditionEventListener::operator==):
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::addEventListener):
-        (WebCore::AbstractWorker::removeEventListener):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::addEventListener):
-        (WebCore::WorkerContext::removeEventListener):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::addEventListener):
-        (WebCore::XMLHttpRequest::removeEventListener):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::addEventListener):
-        (WebCore::XMLHttpRequestUpload::removeEventListener):
-
-2009-09-15  Alex Milowski  <alex@milowski.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Added ENABLE_MATHML to feature defines
-
-        * Configurations/FeatureDefines.xcconfig:
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableColumn.h:
+        (WebCore::AccessibilityTableColumn::roleValue):
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableHeaderContainer.h:
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
 
-2009-09-14  Andrew Richards  <randrew@gmail.com>
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Darin Adler.
 
-        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
-        https://bugs.webkit.org/show_bug.cgi?id=29245
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
 
-        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+        Test: existing worker-cloneport.html which was broken by initial patch in http://trac.webkit.org/changeset/55593.
+        Additional test which indirectly verifies the order of execution will come as part of https://bugs.webkit.org/show_bug.cgi?id=34726
 
         * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint):
-        (WebCore::Document::caretRangeFromPoint):
-
-2009-09-15  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel
-
-        http://bugs.webkit.org/show_bug.cgi?id=26660
-
-        Chromium Windows: When rotated, the baseline for a span of complex
-        script is completely misaligned with that of the adjacent 
-        simple script text. It's fixed by not applying the baseline offset for
-        the Skia code path.
+        (WebCore::Document::postTask): Always use the same task queue, independent of what thread is posting the task.
 
-        Test: transforms/2d/hindi-rotated.html
+2010-03-10  Sanjeev Radhakrishnan  <sanjeevr@chromium.org>
 
-        * platform/graphics/chromium/UniscribeHelper.cpp:
-        (WebCore::UniscribeHelper::draw):
+        Reviewed by Darin Fisher.
 
-2009-09-15  Anders Carlsson  <andersca@apple.com>
+        Allow a plugin to participate in the browser's print workflow.
+        https://bugs.webkit.org/show_bug.cgi?id=35550
 
-        Reviewed by Adam Roben.
+        * loader/PluginDocument.cpp:
+        * loader/PluginDocument.h:
 
-        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
-        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::PopupMenuWndProc):
+2010-03-10  Ilya Tikhonovsky  <loislo@loislo-macbookpro.local>
 
-2009-09-15  Drew Wilson  <atwilson@google.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Darin Adler.
+        Sidebar resize element height was adjusted.
+        Display name for Function Call details was adjusted.
 
-        MessageEvent should not be cancelable by default
-        https://bugs.webkit.org/show_bug.cgi?id=27846
+        https://bugs.webkit.org/show_bug.cgi?id=35939
 
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
 
-2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+2010-03-10  Charles Wei  <charles.wei@torchmobile.com.cn>
 
         Reviewed by George Staikos.
 
-        Fix SVG path parsing error if a command starts with dot '.'
-        https://bugs.webkit.org/show_bug.cgi?id=29123
-
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::SVGPathParser::parseSVG):
-
-2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Implement conditional breakpoints in the Web Inspector frontend.
-        https://bugs.webkit.org/show_bug.cgi?id=28908
-
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint.prototype.set condition):
-        * inspector/front-end/Popup.js: Added.
-        (WebInspector.Popup):
-        (WebInspector.Popup.prototype.show):
-        (WebInspector.Popup.prototype.hide):
-        (WebInspector.Popup.prototype.get visible):
-        (WebInspector.Popup.prototype.set element):
-        (WebInspector.Popup.prototype.get element):
-        (WebInspector.Popup.prototype.positionElement):
-        (WebInspector.Popup.prototype.set anchor):
-        (WebInspector.Popup.prototype.get anchor):
-        (WebInspector.Popup.prototype.set autoHide):
-        (WebInspector.Popup.prototype._checkNotVisible):
-        (WebInspector.Popup.prototype._keyEventHandler):
-        (WebInspector.Popup.prototype._mouseDownEventHandler):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.revealLine):
-        (WebInspector.SourceFrame.prototype._loaded):
-        (WebInspector.SourceFrame.prototype._documentContextMenu):
-        (WebInspector.SourceFrame.prototype._documentMouseDown):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
-        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
-        (WebInspector.SourceFrame.prototype._createPopupElement):
-        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
-        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
-        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
-        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.set currentFocusElement):
-        (WebInspector.set currentPanel):
-        (WebInspector.loaded):
-        (WebInspector.contextMenu):
-        (WebInspector.elementDragStart):
-        (WebInspector.updateResource):
-        (WebInspector.drawLoadingPieChart):
-        (WebInspector.linkifyURLAsNode):
-        (WebInspector.startEditing.getContent):
-        (WebInspector.startEditing.editingCancelled):
-        (WebInspector.startEditing.editingCommitted):
-        * inspector/front-end/utilities.js:
-        (Element.prototype.positionAt):
-        (Element.prototype.offsetRelativeToWindow):
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Page cache should support pages with unload handlers as an experiment.
-        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
-
-        For the experiment, only allow pages with unload handlers into the Page Cache on
-        Mac and Windows.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-
-2009-09-14  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the change in r48376 to do a null-check to fix a crashing test.
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Fix https://bugs.webkig.org/show_bug.cgi?id=35207
+        When XHTMLMP is enabled, all xhtml documents fail to render for webkit portings wich use libxml2 tokenizer.
 
-2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+        No new tests as all the xhtml test cases in LayoutTests/dom/xhtml fails without this fix when XHTMLMP is enabled.
 
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
-        
-        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
-        to a list (by setting the 'size' property) inside the event handler.
-
-        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-
-2009-09-14  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        More PopupMenu cleanup.
-        
-        * platform/PopupMenu.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        Call registerClass.
-        
-        (WebCore::PopupMenu::registerClass):
-        Make this a private static member function so it can refer to PopupMenuWndProc.
-        
-        (WebCore::PopupMenu::PopupMenuWndProc):
-        Try to get the PopupMenu and call its wndProc member function.
-        
-        (WebCore::PopupMenu::wndProc):
-        Make this a member function.
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Not reviewed, maybe should've been:
-
-        Cleaning up more Windows-specific fallout from the fix for:
-        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
-          as related checks all look at nullity when they really mean to be looking for emptiness. 
-
-2009-09-14  Anders Carlsson  <andersca@apple.com>
-
-        Speculative Qt build fix.
-        
-        * platform/qt/QWebPopup.cpp:
-        (WebCore::QWebPopup::hidePopup):
+        * dom/Document.cpp:
+        (WebCore::Document::isXHTMLMPDocument):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::externalSubsetHandler):
 
-2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+2010-03-10  Garret Kelly  <gdk@chromium.org>
 
         Reviewed by Darin Fisher.
 
-        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
-        matches the state values (and you get a single classic_state value
-        for a given {part,state} value. This change will be tested by a 
-        chromium patch that will land after this.
+        Adding all of the touch-related sources into Chromium's WebCore build.
+        https://bugs.webkit.org/show_bug.cgi?id=35874
 
-        This will be tested by code landing downstream on Chromium.org; the
-        code does not execute on webkit.org.
+        Patch tested against the try bots, but the feature is exercised in the
+        fast/events/touch tests.
 
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::determineClassicState):
-        (WebCore::RenderThemeChromiumWin::getThemeData):
+        * WebCore.gypi:
 
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Timothy Hatcher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29138
-        Simplify popup menu handling.
+        Web Inspector: now that audits panel is added, add it to the
+        enums (for storing last active, etc.).
 
-        * platform/PopupMenuClient.h:
-        Rename hidePopup to popupDidHide.
-        
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleKeyEvent):        
-        (WebCore::PopupListBox::abandon):
-        (WebCore::PopupListBox::acceptIndex):
-        Call popupDidHide instead of hidePopup.
-        
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::menuUnmapped):
-        Ditto.
-        
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::show):
-        Ditto.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::hide):
-        Call popupDidHide.
-        
-        (WebCore::PopupWndProc):
-        Call PopupMenu::hide.
-        
-        * platform/wx/PopupMenuWx.cpp:
-        (WebCore::PopupMenu::OnMenuItemSelected):
-        Call popupDidHide.
-        
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::hidePopup):
-        (WebCore::RenderMenuList::popupDidHide):
-        * rendering/RenderMenuList.h:
-        Set the "popup is visible" flag in popupDidHide.
-        
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::hidePopup):
-        (WebCore::RenderTextControlSingleLine::popupDidHide):
-        * rendering/RenderTextControlSingleLine.h:
-        Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=35980
 
-2009-09-14  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by David Hyatt.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showAuditsPanel):
 
-        - Fix <rdar://problem/7182275>.
+2010-03-10  Nate Chapin  <japhet@chromium.org>
 
-        Make sure that the newly created scrollbar's style is up to date.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::~PopupMenu):
-        Call setParent so that the scrollbar's parts are torn down correctly.
-        
-        (WebCore::PopupMenu::show):
-        Call styleChanged.
+        Reviewed by Dimitri Glazkov.
 
-2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+        [V8] Instead of describing the type of a wrapped v8 object
+        with an enum value, use a pointer to struct with more complete
+        information.
 
-        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
-        jumping to a named anchor
+        https://bugs.webkit.org/show_bug.cgi?id=35941
 
-        https://bugs.webkit.org/show_bug.cgi?id=28899
+        Refactoring only, so new tests.
 
-        Reviewed by Adam Roben.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DOMData.h:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Helpers.cpp:
+        * bindings/v8/V8Helpers.h:
+        * bindings/v8/V8Index.cpp: Removed.
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
 
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::):
-        Added declaration for handleScrolledToAnchor(). Added a new entry to
-        the enum of accessibility notifications.
+2010-03-10  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
-        Code moved from AccessibilityRenderObject::internalLinkElement() and
-        refactored slightly; walks the tree until it finds a Node (with a
-        renderer) whose accessibility is not ignored.
+        Reviewed by Dave Hyatt.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        * accessibility/AccessibilityObject.h:
-        Added a declaration for firstAccessibleObjectFromNode().
+        Extend keyboard navigation to allow directional navigation (Manual tests)
+        https://bugs.webkit.org/show_bug.cgi?id=18662
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+        Adds a manual tests for the Spatial Navigation feature comprasing varios
+        Html focusable elements (e.g. <a>, <table>, <iframe>) and much of the logic
+        provided by the feature.
 
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
+        * manual-tests/spatial-navigation/links.html: Added.
+        * manual-tests/spatial-navigation/spatial-navigation-test-cases.html: Added.
 
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
+2010-03-10  Leandro Pereira  <leandro@profusion.mobi>
 
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        Add a default case that returns early for notifications that Mac
-        doesn't handle.
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Post an AXScrolledToAnchor notification for the first accessible from
-        the anchor Node.
-        (WebCore::AXObjectCache::postPlatformNotification):
-        If the notification is AXFocusedUIElementChanged, fire an
-        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
-        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        Code moved to postPlatformNotification().
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35890
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor):
-        Call AXObjectCache::handleScrolledToAnchor().
+        * platform/efl/ScrollbarEfl.h: Added.
+        * platform/efl/ScrollbarThemeEfl.h: Added.
 
-2009-09-14  Anthony Ricaud  <rik@webkit.org>
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Cookies are not inspectable after reloading a page
-        https://bugs.webkit.org/show_bug.cgi?id=29222
-
-        Create the cookieTreeElement on initialization instead of when the view is shown.
-        Reset the selected element of the sidebar on reset.
-
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.show):
-        (WebInspector.StoragePanel.prototype.reset):
-
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
+        Web Inspector: Audits panel needs an icon.
+        Landing icon attached by Timothy. Enabling panel!
 
-        Windows build fix.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceHandle::receivedCredential):
-        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
-        (WebCore::WebCoreSynchronousLoader::load):
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
+        https://bugs.webkit.org/show_bug.cgi?id=35945
 
-        Safari 4 cannot be used to update firmware on Linksys routers.
-        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
-
-        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
-        implemented our own in WebCore.
-
-        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
-        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
-
-        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
-        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
-
-        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
-        due to the change in Digest behavior.
-
-        Test: http/tests/loading/basic-credentials-sent-automatically.html
-              http/tests/loading/basic-auth-resend-wrong-credentials.html
-
-        * WebCore.base.exp:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-
-        * platform/network/Credential.cpp:
-        (WebCore::Credential::isEmpty):
-        * platform/network/Credential.h:
-
-        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
-        * platform/network/CredentialStorage.cpp: Added.
-        (WebCore::protectionSpaceToCredentialMap):
-        (WebCore::originToDefaultCredentialMap):
-        (WebCore::originStringFromURL):
-        (WebCore::CredentialStorage::set):
-        (WebCore::CredentialStorage::get):
-        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
-        * platform/network/CredentialStorage.h: Added.
-
-        Allow ProtectionSpace to be a hash key:
-        * platform/network/ProtectionSpace.cpp:
-        (WebCore::ProtectionSpace::ProtectionSpace):
-        * platform/network/ProtectionSpace.h:
-        (WebCore::ProtectionSpace::ProtectionSpace):
-        (WebCore::ProtectionSpace::isHashTableDeletedValue):
-        * platform/network/ProtectionSpaceHash.h: Added.
-        (WebCore::ProtectionSpaceHash::hash):
-        (WebCore::ProtectionSpaceHash::equal):
-
-        Allow ResourceHandles to remember the initial credential they used:
-        * platform/network/ResourceHandleInternal.h:
-
-        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::addHTTPHeaderField):
-
-        Remove WebCoreCredentialStorage:
-        * platform/network/cf/AuthenticationCF.cpp:
-        * platform/network/cf/AuthenticationCF.h:
-        * platform/network/mac/AuthenticationMac.h:
-        * platform/network/mac/AuthenticationMac.mm:
-
-        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::ResourceHandle::receivedCredential):
-        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::WebCoreSynchronousLoader::load):
-
-        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::ResourceHandle::receivedCredential):
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
-          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
-
-        Add base64-ability to CString:
-        * platform/text/CString.cpp:
-        (WebCore::CStringBuffer::base64Encode):
-        (WebCore::CString::base64Encode):
-        * platform/text/CString.h:
-        (WebCore::CStringBuffer::create):
-        (WebCore::CStringBuffer::CStringBuffer):
+        * WebCore.gypi:
+        * inspector/front-end/Images/auditsIcon.png: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-2009-09-12  Mark Rowe  <mrowe@apple.com>
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Dan Bernstein.
+        Roll-out r55657, as Xan noticed a bad degradation in playing
+        youtube HTML5 videos with it, that is fixed with it
+        reverted. Looks like we'll need to work a bit more on this.
 
-        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::muteChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
-        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
-        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        No test is possible until <rdar://problem/7090444> is fixed.
+        Rubber-stamped by Xan Lopez.
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+        Fix ready state when buffering under PLAYING. We should not go
+        back to HaveNothing in that case.
 
-2009-09-12  Mark Rowe  <mrowe@apple.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-        Reviewed by Dan Bernstein.
+2010-03-10  Ada Chan  <adachan@apple.com>
 
-        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
-        duration of a function.  Deploy it within RenderWidget.
+        Reviewed by Adam Roben.
 
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::setWidgetGeometry):
-        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
-        ref'ing and deref'ing the node.
-        * rendering/RenderWidget.h:
-        * rendering/RenderWidgetProtector.h:
-        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
-        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+        https://bugs.webkit.org/show_bug.cgi?id=35976
 
-2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+        Retrieve any dwItemData that's set on the context menu item in contextMenuItemByIdOrPosition().
 
-        Reviewed by Eric Seidel.
+        * platform/win/ContextMenuWin.cpp:
 
-        CodeGenerator.pm needs some cleaning up
-        https://bugs.webkit.org/show_bug.cgi?id=29238
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        * bindings/scripts/CodeGenerator.pm:
-        (FindParentsRecursively): Removed; its functionality is now handled in
-        AddMethodsConstantsAndAttributesFromParentClasses.
-        (ForAllParents): New function that visits an interface's ancestors and
-        invokes a callback for each one.
-        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
-        ForAllParents.
-        (GetMethodsAndAttributesFromParentClasses): Ditto.
-        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
-        this new function, which returns the filename containing a given IDL
-        interface definition.
-        (ParseInterface): Simplified by using IDLFileForInterface.
-        (ScanDirectory): Removed in lieu of IDLFileForInterface.
-        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
-        FindParentsRecursively and get the list of parents from the
-        AddMethodsConstantsAndAttributesFromParentClasses call instead.
-
-2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Tor Arne Vestbø.
+        Add IndexedDatabase class and hook it up.
+        https://bugs.webkit.org/show_bug.cgi?id=35927
 
-        [Qt] Assert hit when dropping a file in QtLauncher
-        https://bugs.webkit.org/show_bug.cgi?id=29242
+        This change is mostly just adding the plumbing necessary for
+        the IndexedDatabaseRequest and IndexedDatabaseSync (not written
+        yet).
 
-        Qt's implementation of DropData::asURL does not return a URL encoded string
-        as expected.
+        This code is non-functional, so no tests (yet).
 
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * storage/IndexedDatabase.cpp: Added.
+        (WebCore::IndexedDatabase::get):
+        * storage/IndexedDatabase.h: Added.
+        (WebCore::IndexedDatabase::~IndexedDatabase):
+        * storage/IndexedDatabaseImpl.cpp: Added.
+        (WebCore::IndexedDatabaseImpl::get):
+        (WebCore::IndexedDatabaseImpl::IndexedDatabaseImpl):
+        (WebCore::IndexedDatabaseImpl::~IndexedDatabaseImpl):
+        (WebCore::IndexedDatabaseImpl::open):
+        * storage/IndexedDatabaseImpl.h: Added.
+        * storage/chromium/IndexedDatabase.cpp: Added.
+        (WebCore::IndexedDatabase::get):
+
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+        Reviewed by Sam Weinig.
 
-        wx build fix, file was missed during TLS.cpp removal.
+        Add one more parent check during node removal.
+        https://bugs.webkit.org/show_bug.cgi?id=35818
 
-        * page/wx/FrameWx.cpp: Added.
-        (WebCore::Frame::dragImageForSelection):
+        Test: fast/dom/Node/mutation-blur.html
 
-2009-09-13  Anthony Ricaud  <rik@webkit.org>
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Added check.
 
-        Reviewed by Oliver Hunt.
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
-        Web Inspector: Add "New Style Rule" to the localizedStrings
-        https://bugs.webkit.org/show_bug.cgi?id=29237
+        Not reviewed: added missing quote into localized strings.
 
         * English.lproj/localizedStrings.js:
 
-2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by Kevin Ollivier.
+        Commit files that were supposed to go in with the last checkin.
 
-        [wx] Implement filesystem functions.
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29196
+        Reviewed by Dimitry Glazkov.
 
-        * platform/wx/FileSystemWx.cpp:
-        (WebCore::fileExists):
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileSize):
-        (WebCore::getFileModificationTime):
-        (WebCore::makeAllDirectories):
-        (WebCore::pathByAppendingComponent):
-        (WebCore::homeDirectoryPath):
-        (WebCore::directoryName):
+        Baby steps towards IndexedDB: Start implementing callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=35911
 
-2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes for wx 2.9.
-
-        * platform/wx/ScrollbarThemeWx.cpp:
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
-        (wxGetGdkWindowForDC):
-
-2009-09-12  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        [ES5] Implement Object.keys
-        https://bugs.webkit.org/show_bug.cgi?id=29170
-
-        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
-        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
-        in order to ensure correct semantics are maintained.
-
-        Test: fast/js/Object-keys.html
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertyNames):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertyNames):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertyNames):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::getOwnPropertyNames):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getPropertyNames):
-        (JSC::RuntimeObjectImp::getOwnPropertyNames):
-        * bridge/runtime_object.h:
-
-2009-09-12  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
-        Document.elementFromPoint() should take page scroll into consideration
-
-        Test: fast/dom/elementFromPoint-relative-to-viewport.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint):
-        (WebCore::Document::caretRangeFromPoint):
+        This patch adds some infastructure for IndexedDB callbacks in V8.
+        It also adds a stub of IDBDatabaseRequest.  In the near future,
+        I'll gut the event based implementation code, flesh out IDBReqest
+        further, and start plumbing IndexedDatabaseRequest.
 
-2009-09-12  Sam Weinig  <sam@webkit.org>
+        Code is not testible because it doesn't work (yet).
 
-        Reviewed by Maciej Stachowiak.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
-        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
-
-        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
-        the point passed to it as relative to the viewport, not the document.
-
-        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
-
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added some manual tests to show WebGL in action
-        https://bugs.webkit.org/show_bug.cgi?id=29215
-
-        * manual-tests/webgl: Added.
-        * manual-tests/webgl/Earth.html: Added.
-        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
-        * manual-tests/webgl/SpinningBox.html: Added.
-        * manual-tests/webgl/TeapotPerPixel.html: Added.
-        * manual-tests/webgl/TeapotPerVertex.html: Added.
-        * manual-tests/webgl/resources: Added.
-        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
-        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
-        * manual-tests/webgl/resources/mars500x250.png: Added.
-        * manual-tests/webgl/resources/teapot.obj: Added.
-        * manual-tests/webgl/resources/utils3d.js: Added.
- 
-2009-09-10  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        aria definition role spelled wrong "defintion"
-        https://bugs.webkit.org/show_bug.cgi?id=28840
-
-        Test: accessibility/aria-slider-value-change.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-
-2009-09-11  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
-        https://bugs.webkit.org/show_bug.cgi?id=29210
-
-        * dom/Node.cpp:
-        (WebCore::Node::isFocusable):
-
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
-        https://bugs.webkit.org/show_bug.cgi?id=29139
-        
-        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
-        to the baseAddress().
-
-        * Configurations/FeatureDefines.xcconfig:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::toArray):
-        (WebCore::):
-        (WebCore::dataFunctionf):
-        (WebCore::dataFunctioni):
-        (WebCore::dataFunctionMatrix):
-        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::data):
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::data):
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::data):
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::uniform1fv):
-        (WebCore::CanvasRenderingContext3D::uniform1iv):
-        (WebCore::CanvasRenderingContext3D::uniform2fv):
-        (WebCore::CanvasRenderingContext3D::uniform2iv):
-        (WebCore::CanvasRenderingContext3D::uniform3fv):
-        (WebCore::CanvasRenderingContext3D::uniform3iv):
-        (WebCore::CanvasRenderingContext3D::uniform4fv):
-        (WebCore::CanvasRenderingContext3D::uniform4iv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::data):
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::data):
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::data):
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::data):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::uniform1fv):
-        (WebCore::GraphicsContext3D::uniform2fv):
-        (WebCore::GraphicsContext3D::uniform3fv):
-        (WebCore::GraphicsContext3D::uniform4fv):
-        (WebCore::GraphicsContext3D::uniform1iv):
-        (WebCore::GraphicsContext3D::uniform2iv):
-        (WebCore::GraphicsContext3D::uniform3iv):
-        (WebCore::GraphicsContext3D::uniform4iv):
-        (WebCore::GraphicsContext3D::uniformMatrix2fv):
-        (WebCore::GraphicsContext3D::uniformMatrix3fv):
-        (WebCore::GraphicsContext3D::uniformMatrix4fv):
-        (WebCore::GraphicsContext3D::vertexAttrib1fv):
-        (WebCore::GraphicsContext3D::vertexAttrib2fv):
-        (WebCore::GraphicsContext3D::vertexAttrib3fv):
-        (WebCore::GraphicsContext3D::vertexAttrib4fv):
-
-2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add ENABLE(WEB_SOCKETS) guards.
-        https://bugs.webkit.org/show_bug.cgi?id=29174
-
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-
-2009-09-11  Eric Seidel  <eric@webkit.org>
-
-        No review, rolling out r48229.
-        http://trac.webkit.org/changeset/48229
-
-        * WebCore.base.exp:
-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::Clipboard):
-        (WebCore::Clipboard::sourceOperation):
-        * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::performDrag):
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::startDrag):
-        * page/DragController.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-        (WebCore::EventHandler::dragSourceMovedTo):
-        (WebCore::EventHandler::handleDrag):
-        * page/EventHandler.h:
-
-2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Fix the build.
-
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
+        * WebCore.gypi:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomIDBCallback.h: Added.
+        (WebCore::V8CustomIDBCallback::create):
+        (WebCore::V8CustomIDBCallback::~V8CustomIDBCallback):
+        (WebCore::V8CustomIDBCallback::handleEvent):
+        (WebCore::V8CustomIDBCallback::V8CustomIDBCallback):
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp:
+        (WebCore::V8IndexedDatabaseRequest::openCallback):
+        * storage/IDBDatabaseRequest.h: Added.
+        (WebCore::IDBDatabaseRequest::request):
+        * storage/IDBDatabaseRequest.idl: Added.
+        * storage/IndexedDatabaseRequest.idl:
 
-2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+2010-03-10  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        Reviewed by Antti Koivisto.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27456
-        Added support for static validation of url in
-        ValidityState, for url state inputs.
-        From HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+        [Qt] Non animated gifs are animated in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=35955
 
-        Test: fast/forms/ValidityState-typeMismatch-url.html
+        Properly map Qt animated and non-animated values to WebCore's
+        understanding of animated and non-animated images. Currently
+        we can not map anything to the cAnimationLoopNone value.
 
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
+        * manual-tests/qt/qt-anim.gif: Added.
+        * manual-tests/qt/qt-gif-test.html: Added.
+        * manual-tests/qt/qt-noanim.gif: Added.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::repetitionCount):
 
-2009-09-11  Evan Stade  <estade@chromium.org>
+2010-03-07  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Reviewed by Darin Adler.
 
-        Revert r47992: Expose functions to change the focus ring color for
-        Linux Chromium.
-
-        As Darin Fisher has pointed out, there is a better way to do this.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+        [CAIRO] DoS on iexploder test with high text stroke width.
+        https://bugs.webkit.org/show_bug.cgi?id=33759
 
-        Reviewed by Geoff Garen.
+        Specifying a big text stroke width can make WebKitGTK+ spend
+        a very long time in the cairo library for stroking the path of
+        the text. The best way to prevent this from happening right now
+        is to not stroke paths with a certain width. Samuel proposed to
+        not stroke with a width that is twice the width of the text. The
+        reason to use twice the text width is that even one stroke of
+        any charachter to be drawn would cover the full width.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29207
-        Add checks for using WebCore JS context on secondary threads
+        Test: fast/text/text-stroke-width-cairo-dos.html
 
-        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
-        Set the new debug-only mainThreadOnly flag.
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
 
-2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+2010-03-10  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        The inspector should have scope bars.
-        https://bugs.webkit.org/show_bug.cgi?id=14353
-        
-        Add scope bars to the console, so the user can choose which category
-        of messages they want to see (All, Errors, Warnings, Logs), and they
-        can choose from one or more of {Errors, Warnings, Logs}.
+        Web Inspector: display list of active workers & support debugging
+        with fake workers.
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.createFilterElement):
-        (WebInspector.ConsoleView):
-        (WebInspector.ConsoleView.prototype._updateFilter):
-        (WebInspector.ConsoleView.prototype.filter):
-        (WebInspector.ConsoleView.prototype.attach):
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::inspectorController):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectScript):
+        (WebCore::InjectedScriptHost::nextWorkerId):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::willDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::willDestroyWorker):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCreateWorker):
+        (WebCore::InspectorFrontend::willDestroyWorker):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorWorkerResource.h: Added.
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::url):
+        (WebCore::InspectorWorkerResource::isSharedWorker):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/Checkbox.js: Added.
+        (WebInspector.Checkbox.callbackWrapper):
+        (WebInspector.Checkbox):
+        (WebInspector.Checkbox.prototype.checked):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.FakeWorker.prototype._expandURLAndCheckOrigin):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.showInheritedToggleFunction):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WorkersSidebarPane.js: Added.
+        (WebInspector.WorkersSidebarPane):
+        (WebInspector.WorkersSidebarPane.prototype.addWorker):
+        (WebInspector.WorkersSidebarPane.prototype.removeWorker):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        (WebInspector.WorkersSidebarPane.prototype.reset):
+        (WebInspector.WorkersSidebarPane.prototype._onTriggerInstrument):
+        (WebInspector.Worker):
+        (WebInspector.didCreateWorker):
+        (WebInspector.willDestroyWorker):
         * inspector/front-end/inspector.css:
         * inspector/front-end/inspector.html:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        (WebCore::AbstractWorker::contextDestroyed):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::id):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-2009-09-11  Yusuke Sato  <yusukes@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [Chromium] Complex text doesn't show up with text stroking
-        https://bugs.webkit.org/show_bug.cgi?id=28707
-
-        Added extra NULL checks for HDC. This is the second fix for issue 28707,
-        and the fix is similar to http://trac.webkit.org/changeset/45482.
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::Font::drawComplexText):
-        * platform/graphics/chromium/UniscribeHelper.cpp:
-        (WebCore::UniscribeHelper::draw):
-
-2009-09-11  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Make ElementTimeControl methods return void and not throw.
-        https://bugs.webkit.org/show_bug.cgi?id=28831
-
-        SVG 1.1 erratum:
-        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
-
-        Test: svg/dom/smil-methods.svg
-
-        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
-        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
-        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
-        (WebCore::SVGAnimationElement::endElement): Ditto.
-        (WebCore::SVGAnimationElement::endElementAt): Ditto.
-        * svg/SVGAnimationElement.h: Ditto.
-
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added support for texImage2D which takes CanvasArray
-        https://bugs.webkit.org/show_bug.cgi?id=29191
-
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::texImage2D):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::texImage2D):
-
-2009-09-11  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Allow WebKit clients to opt out of high resolution timers on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=29192
-
-        * page/Settings.cpp:
-        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
-        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
-        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
-
-2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [v8] Share persistent context handles between events        
-        Change events to use a single ref-counted shared persistent handle
-        to the context in which to run, rather than create a new
-        persistent handle for each new event which puts pressure on the
-        gc.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=29077
-
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/SharedPersistent.h: Added.
-        (WebCore::SharedPersistent::set):
-        (WebCore::SharedPersistent::get):
-        (WebCore::SharedPersistent::disposeHandle):
-        (WebCore::SharedPersistent::create):
-        (WebCore::SharedPersistent::SharedPersistent):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::context):
-        (WebCore::V8IsolatedWorld::shared_context):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
-        (WebCore::V8Proxy::isContextInitialized):
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::clearDocumentWrapperCache):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::clearForClose):
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::setSecurityToken):
-        (WebCore::V8Proxy::updateDocument):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::shared_context):
-        (WebCore::V8Proxy::mainWorldContext):
-        (WebCore::V8Proxy::setContextDebugId):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::shared_context):
-
-2009-09-11  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by David Levin.
-
-        Create a real handle (one which would save an object from GC).
-        https://bugs.webkit.org/show_bug.cgi?id=29150
+2010-03-10  Roland Steiner  <rolandsteiner@chromium.org>
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ExternalString):
+        Unreviewed build fix. Fix variable name change that somehow didn't
+        make it into the patch.
 
-2009-09-11  Anton Muhin  <antonm@chromium.org>
+2010-03-10  Roland Steiner  <rolandsteiner@chromium.org>
 
         Reviewed by David Levin.
 
-        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
-        https://bugs.webkit.org/show_bug.cgi?id=29152
-
-        * bindings/v8/V8Binding.cpp:
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8String):
-
-2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
-        renaming.
-
-        * ChangeLog-2009-06-16:
-
-2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Use LIBS_PRIVATE on Qt/Mac.
-
-        On the Mac, it means "-framework ApplicationServices -framework Carbon
-        -framework AppKit" are no longer part of the default LIBS in Qt
-        applications. This required a lot of fixes where we used Mac-specific
-        code in Qt.
-
-        * WebCore.pro:
-
-2009-09-11  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
-        https://bugs.webkit.org/show_bug.cgi?id=29165
-
-        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
-        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
-
-2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29132
-        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
-
-        Add RegularExpression class qualifier before Private.
-
-        * platform/text/RegularExpression.cpp:
-
-2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29131
-        Use a different variadic macro format for Symbian compiler.
+        Bug 28293 -  [Chromium] event.datatransfer.getdata("text/uri-list") is treated the same as getdata("URL")
+        https://bugs.webkit.org/show_bug.cgi?id=28293
         
-        Use arg... instead of ellipsis in variadic macro.        
+        Change ChromiumDataObject such that it treats types "URL" and "text/uri-list"
+        correctly for event.dataTransfer.getData/setData. Currently both are treated
+        as synonyms, but for "URL", getData is supposed to only return the first valid URL
+        contained within the data for "text/uri-list" (see HTML5 spec).
 
-        * platform/StaticConstructors.h:
+        Tests: editing/pasteboard/dataTransfer-setData-getData.html
 
-2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28806
-
-        [Qt] Make the WebInspector available as a QWidget.
-
-        * WebCore.pro:
-
-2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Unreviewed fix for the Web Inspector with the Qt build.
-
-        Re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build, remove stray semicolon from function definition.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
-
-2009-09-10  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::clearAllExceptFiles):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::clearURL):
+        (WebCore::ChromiumDataObject::hasValidURL):
+        (WebCore::ChromiumDataObject::getURL):
+        (WebCore::ChromiumDataObject::setURL):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::clearData):
+        (WebCore::ClipboardChromium::getData):
+        (WebCore::ClipboardChromium::setData):
+        (WebCore::ClipboardChromium::types):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::canSmartReplace):
 
-        Detect mixed content
-        https://bugs.webkit.org/show_bug.cgi?id=29003
-
-        Detect some basic kinds of mixed content (HTTP content loaded into an
-        HTTPS context).  This new detection logic isn't perfect, but it's a
-        place to start.
-
-        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
-               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
-               http/tests/security/mixedContent/data-url-script-in-iframe.html
-               http/tests/security/mixedContent/insecure-css-in-iframe.html
-               http/tests/security/mixedContent/insecure-css-in-main-frame.html
-               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
-               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
-               http/tests/security/mixedContent/insecure-image-in-iframe.html
-               http/tests/security/mixedContent/insecure-image-in-main-frame.html
-               http/tests/security/mixedContent/insecure-script-in-iframe.html
-               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
-               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
-               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
-               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::canRequest):
-        (WebCore::DocLoader::requestResource):
-        (WebCore::DocLoader::checkCacheObjectStatus):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::isMixedContent):
-        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
-        (WebCore::FrameLoader::checkIfRunInsecureContent):
-        * loader/FrameLoader.h:
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::willSendRequest):
-
-2009-09-10  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Timothy Hatcher.
 
-        Fix the Windows build.
+        Web Inspector: REGRESSION: Tall image resources are cropped over the bottom.
 
-        Restore platform/mock to the header search path after it was removed in r48270.
+        https://bugs.webkit.org/show_bug.cgi?id=34720
 
-        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * inspector/front-end/inspector.css:
 
-2009-09-08  Timothy Hatcher  <timothy@apple.com>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+        Reviewed by Timothy Hatcher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29039
+        Web Inspector: REGRESSION: Pressing up/down arrow key to change numeric
+        value in CSS property takes focus away.
 
-        Reviewed by Sam Weinig.
+        https://bugs.webkit.org/show_bug.cgi?id=34697
 
         * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
-        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
-        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
-        while calling the correct action.
-        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
-        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
-        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
-        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
-        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
-        is remembered by the editing code.
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
-        restored by the editing code.
-        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
-        Remove event listener code.
-        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
-        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
-        override the base class.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
-        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
-        the end to correctly swtich to a real StylePropertiesSection.
-        * inspector/front-end/inspector.js:
-        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
-        (WebInspector.startEditing.editingCommitted): Ditto.
-
-2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Fix comparison between signed and unsigned integer warnings
-        https://bugs.webkit.org/show_bug.cgi?id=29162
-
-        No functional change.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::findMethodIndex):
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypes):
-        (WebCore::initializeSupportedImageMIMETypesForEncoding):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::duration):
-        (WebCore::ImageDecoderQt::imageAtIndex):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-
-2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Build fix for GTKafter r48267.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
-
-2009-09-08  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Remove unneeded define for ActiveX.
-        https://bugs.webkit.org/show_bug.cgi?id=29054
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::createClassIdToTypeMap):
-        (WebCore::serviceTypeForClassId):
-        (WebCore::RenderPartObject::updateWidget):
-
-2009-09-10  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Don't copy IDL files in to the built framework.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-10  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Implment Range.expand().
-        https://bugs.webkit.org/show_bug.cgi?id=27632
-
-        Test: fast/dom/Range/range-expand.html
-
-        * dom/Range.cpp:
-        (WebCore::Range::expand):
-        * dom/Range.h:
-        * dom/Range.idl:
-
-2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        WebSocket API implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=28038
-        
-        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
-        WebCore.vcproj.
-        Add websockets directory and WebSocket.idl in qt build system.
-        Tests will be landed once the code is completed and functional.
-
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toWebSocket):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::isValidProtocolString):
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::eventListeners):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Added.
-        * websockets/WebSocketChannel.h: Added.
-        * websockets/WebSocketChannelClient.h: Added.
-        * websockets/WebSocketHandshake.cpp: Added.
-        * websockets/WebSocketHandshake.h: Added.
-
-2009-09-10  Albert J. Wong  <ajwong@chromium.org>
-
-        No review, windows build fix only.
-        
-        Spurious semicolon causing parse error in chromium build on windows.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
-
-2009-09-10  Albert J. Wong  <ajwong@chromium.org>
-
-        No review, build fix only.
-
-        Adding in a missed include from the last patch that is breaking the
-        chromium build.
-
-        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
-
-2009-09-10  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        HTMLMediaElement buffered attribute should report a list of time ranges
-        https://bugs.webkit.org/show_bug.cgi?id=29041
-
-        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
-        report a list of buffered time ranges as WebCore::TimeRanges. This
-        change also got rid of the maxTimeBuffered() method.
-
-        No new tests since this is a API change.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded):
-        Use MediaPlaier::buffered() instead of maxTimeBuffered().
-        (WebCore::HTMLMediaElement::buffered):
-        ditto.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::buffered):
-        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
-        (WebCore::MediaPlayer::buffered):
-        ditto.
-        * platform/graphics/MediaPlayer.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/MediaPlayerPrivate.h:
-        ditto.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Implements PassRefPtr<TimeRanges> buffered();
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::buffered):
-        Implementation of buffered().
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        Implements PassRefPtr<TimeRanegs> buffered().
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        Implements PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/wince/MediaPlayerPrivateWince.h:
-        ditto.
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        Use buffered() instead of maxTimeBuffered().
-        * rendering/RenderThemeChromiumSkia.cpp:
-        ditto.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        ditto.
-
-2009-09-10  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Make bindings generators more aware of IDL dependencies
-        https://bugs.webkit.org/show_bug.cgi?id=29114
-
-        Make the JS and ObjC bindings generators able to output dependency
-        rules for DerivedSources.make to consume.  These rules make a given
-        generated binding class file header, JSWhatever.h, depend on Whatever's
-        ancestor interfaces.
-
-        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
-        when generating JS and ObjC bindings.  Include dependency fies that are
-        generated due to that.
-        * bindings/scripts/CodeGenerator.pm: Make
-        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
-        the ancestor interfaces that were visited.
-        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
-        file.
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
-        option.
-
-2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Xan Lopez and Dan Winship.
-
-        Give all requests to libsoup, to let it queue, and schedule them
-        itself, instead of throttling the number of requests in WebCore.
-
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
-
-2009-09-10  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Make XMLHttpRequest.send handle File object.
-        https://bugs.webkit.org/show_bug.cgi?id=28924
-
-        Test: http/tests/local/send-dragged-file.html
-
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
-        https://bugs.webkit.org/show_bug.cgi?id=25930
-
-        Change using of operator new to fastNew and operator delete to
-        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
-
-        This change fixes valgrind's 'mismatched free' notification.
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::~CSSParser):
-        (WebCore::CSSParser::createFloatingSelector):
-        * css/CSSSelectorList.cpp:
-        (WebCore::CSSSelectorList::adoptSelectorVector):
-
-2009-09-10  Steve Block  <steveblock@google.com>
-
-        Reviewed by Darin Adler.
-
-        Geolocation does not correctly handle reentrant calls from callbacks.
-        https://bugs.webkit.org/show_bug.cgi?id=29040
-
-        Tests: fast/dom/Geolocation/reentrant-error.html
-               fast/dom/Geolocation/reentrant-success.html
-
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
-        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
-        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
-
-2009-09-10  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
-        https://bugs.webkit.org/show_bug.cgi?id=27105
-
-        Test: fast/events/blur-focus-window-should-blur-focus-element.html
-
-        * page/FocusController.cpp:
-        (WebCore::dispatchEventsOnWindowAndFocusedNode):
-        (WebCore::FocusController::setFocused):
-        (WebCore::FocusController::setActive):
-
-2009-09-10  Adam Roben  <aroben@apple.com>
-
-        Make the play/pause button in <video> controls indicate the button's
-        action, not the movie state
-
-        This matches the Mac behavior, iTunes, and many other media players.
-
-        No test possible.
-
-        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
-        controls shows the wrong image
-
-        Reviewed by Eric Carlson.
-
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
-        we show the play vs. pause artwork, so that the button reflects what
-        will happen when you click it, rather than the current state of the
-        movie.
-
-2009-09-09  Steve Block  <steveblock@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
-        https://bugs.webkit.org/show_bug.cgi?id=29080
-
-        Test: fast/dom/Geolocation/position-string.html
-
-        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * page/Coordinates.cpp: Removed.
-        * page/Coordinates.h: Modified. Removes toString method.
-        * page/Coordinates.idl: Modified. Removes toString method.
-        * page/Geoposition.cpp: Removed.
-        * page/Geoposition.h: Modified. Removes toString method.
-        * page/Geoposition.idl: Modified. Removes toString method.
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
 
-2009-09-09  Steve Block  <steveblock@google.com>
+2010-03-09  Tony Chang  <tony@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Correctly applies the Geolocation timeout property.
-        https://bugs.webkit.org/show_bug.cgi?id=27256
+        https://bugs.webkit.org/show_bug.cgi?id=21840
+        https://bugs.webkit.org/show_bug.cgi?id=23993
 
-        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
-        If a position fix is not obtained within the timeout interval, the position request is cancelled
-        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
-        interval, the timer is stopped. Permissions are then requested from the user if required. See
-        http://www.w3.org/TR/geolocation-API/#position-options.
+        Fix an editing bug where replacing a selection would result in the
+        new text ending up inside nodes that were not visibly included in the
+        selection.  Instead, move our destination position out of nodes that
+        were not visibly included.
 
-        Note that this logic means that the time required to obtain permissions from the user is not
-        included in the timeout interval.
+        Tests: editing/deleting/backspace-avoid-preceding-style.html
+               editing/inserting/replace-at-visible-boundary.html
 
-        Tests: fast/dom/Geolocation/timeout.html
-               fast/dom/Geolocation/timeout-zero.html
-
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
-        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
-        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
-        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
-        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
-        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
-        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
-        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
-        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
-        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
-        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
-        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
-        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
-        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
-        * page/Geolocation.h: Modified.
-        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
-
-2009-09-09  Chris Fleizach  <cfleizach@apple.com>
-
-        AX notifications should be an ENUM type instead of strings
-        https://bugs.webkit.org/show_bug.cgi?id=28963
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::positionAvoidingPrecedingNodes):
+        (WebCore::ReplaceSelectionCommand::doApply):
 
-        Build fix for Qt.
+2010-03-09  Brady Eidson  <beidson@apple.com>
 
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::postNotification):
-        (WebCore::AXObjectCache::postPlatformNotification):
+        Reviewed by Tim Hatcher.
 
-2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+        REGRESSION: WebInspector docking busted on Windows
+        <rdar://problem/7728433> and https://bugs.webkit.org/show_bug.cgi?id=35953
 
-        Reviewed by Darin Adler.
+        First off, a bit of settings-key related cleanup. If they're shared over multiple files, these 
+        things should be properly declared Strings, not random loose char*'s.
 
-        AX notifications should be an ENUM type instead of strings
-        https://bugs.webkit.org/show_bug.cgi?id=28963
+        Along with that change, we move the "inspectorStartsAttachedSettingName" from WebKit down to the
+        InspectorController in WebCore.
 
-        Moves AX notifications over to an ENUM type instead of
-        using the actual string values that are used on OS X.
+        Finally, when the controller is ready to show the WebInspector window, it can use this newly
+        exposed settings key to call "setWindowVisible" directly instead of relying on "showWindow" to do
+        it indirectly.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::postNotification):
-        (WebCore::AXObjectCache::selectedChildrenChanged):
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        * dom/Element.cpp:
-        (WebCore::Element::updateAfterAttributeChanged):
-        * editing/Editor.cpp:
-        (WebCore::Editor::respondToChangedContents):
-        * editing/mac/SelectionControllerMac.mm:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setInnerTextValue):
-
-2009-09-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Missing checkout for getSVGDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=29064
-
-        The V8 code generator didn't understand SVGCheckSecurityDocument.
+        * WebCore.base.exp:
 
-        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
-               http/tests/security/xss-DENIED-getSVGDocument-object.html
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::saveFrontendSettings):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::frontendSettingsSettingName):
+        (WebCore::InspectorController::inspectorStartsAttachedSettingName):
+        (WebCore::InspectorController::scriptObjectReady): Using the new inspectorStartsAttachedSettingName
+          key and some "can I attach this?" logic, call setWindowVisible directly to display the inspector
+          window.
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+2010-03-09  Alexey Proskuryakov  <ap@apple.com>
 
-2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+        Reviewed by Mark Rowe.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=35951
+        <rdar://problem/7327060> Frequent crashes in Dashcode at JSC::Bindings::ObjcInstance::~ObjcInstance + 80
 
-        Make SVGStyleElement inherit from SVGLangSpace
-        https://bugs.webkit.org/show_bug.cgi?id=29058
+        * bridge/objc/objc_instance.mm: (createInstanceWrapperCache): Fix Tiger code path, too.
 
-        Required by SVG 1.1 Second Edition:
-        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+2010-03-09  Alexey Proskuryakov  <ap@apple.com>
 
-        Test: svg/dom/SVGStyleElement/style-langspace.html
+        Reviewed by Oliver Hunt.
 
-        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
-        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
-        initializer.
-        (WebCore::SVGStyleElement::parseMappedAttribute): Call
-        parseMappedAttribute on SVGLangSpace.
-        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
-        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
-        as a superinterface.
+        https://bugs.webkit.org/show_bug.cgi?id=35951
+        <rdar://problem/7327060> Frequent crashes in Dashcode at JSC::Bindings::ObjcInstance::~ObjcInstance + 80
 
-2009-09-09  Nate Chapin  <japhet@chromium.org>
+        * bridge/objc/objc_instance.mm: (createInstanceWrapperCache): It's not correct to use object
+        personality for keys, because the key can be a mutable object, so its hash can change over its
+        lifetime.
 
-        Reviewed by David Levin.
+2010-03-09  Ojan Vafai  <ojan@chromium.org>
 
-        Remove unnecessary includes and forward declarations in V8Proxy.h
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29111
+        Fix review comment accidentally overlooked in bug 35713
+        https://bugs.webkit.org/show_bug.cgi?id=35947
 
-        * bindings/v8/V8Proxy.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::setStartingSelectionOnSmartDelete):
+        * editing/DeleteSelectionCommand.h:
 
-2009-07-30  Eric Seidel  <eric@webkit.org>
+2010-03-03  Ojan Vafai  <ojan@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Add more position constructors
-        positionBeforeNode, positionAfterNode
-        firstPositionInNode, lastPositionInNode
-        https://bugs.webkit.org/show_bug.cgi?id=25494
-
-        I also added a lastOffsetInNode and deployed it to a couple places.
-
-        There are no callers to these new constructors yet, but those
-        will be coming in future patches.
-
-        * dom/Position.cpp:
-        (WebCore::Position::computeOffsetInContainerNode):
-        * dom/Position.h:
-        (WebCore::positionBeforeNode):
-        (WebCore::positionAfterNode):
-        (WebCore::lastOffsetInNode):
-        (WebCore::firstPositionInNode):
-        (WebCore::lastPositionInNode):
-        * editing/ApplyStyleCommand.cpp:
-        * editing/TextIterator.cpp:
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        * editing/htmlediting.cpp:
-        (WebCore::lastOffsetForEditing):
-
-2009-04-30  Eric Seidel  <eric@webkit.org>
+        undo after smartdelete should select the deleted space
+        https://bugs.webkit.org/show_bug.cgi?id=35713
 
-        Reviewed by Adam Barth.
-
-        Rename positionBeforeNode to positionInParentBeforeNode
-        and positionAfterNode to positionInParentAfterNode
-        in preparation for adding a positionBeforeNode
-        which returns a neighbor-anchored position.
-        https://bugs.webkit.org/show_bug.cgi?id=25494
+        TextEdit behavior is to select the deleted space after a smartdelete.
 
-        No functional changes, thus no tests.
+        Tests: editing/undo/undo-smart-delete-reversed-selection.html
+               editing/undo/undo-smart-delete-word.html
 
-        * dom/PositionConstructors.h:
-        (WebCore::positionInParentBeforeNode):
-        (WebCore::positionInParentAfterNode):
-        * dom/PositionIterator.cpp:
-        (WebCore::PositionIterator::operator Position):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyle):
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply):
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::deleteTarget):
         * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::initializeStartEnd):
-        (WebCore::updatePositionForNodeRemoval):
-        * editing/InsertLineBreakCommand.cpp:
-        (WebCore::InsertLineBreakCommand::doApply):
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply):
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::doApply):
-        * editing/InsertTextCommand.cpp:
-        (WebCore::InsertTextCommand::input):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
-        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::DeleteSelectionCommand::setStartingSelectionOnSmartDelete):
+        (WebCore::DeleteSelectionCommand::initializePositionData):
+        * editing/DeleteSelectionCommand.h:
         * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
-        * editing/htmlediting.cpp:
-        (WebCore::firstEditablePositionAfterPositionInRoot):
-        (WebCore::lastEditablePositionBeforePositionInRoot):
-        (WebCore::rangeCompliantEquivalent):
-        (WebCore::positionBeforeContainingSpecialElement):
-        (WebCore::positionAfterContainingSpecialElement):
-        (WebCore::positionBeforeTabSpan):
+        (WebCore::VisibleSelection::setWithoutValidation):
+        This assert looks bogus to me. undo-smart-delete-reversed-selection.html hits it
+        but not as a result of the other changes in this patch. The granularity when
+        deleting after making a wordgranularity selection is wordgranularity, not charactergranularity.
 
-2009-04-30  Eric Seidel  <eric@webkit.org>
+2010-03-09  Steve Falkenburg  <sfalken@apple.com>
 
-        Reviewed by Adam Barth.
+        Rubber stamped by Adam Roben.
 
-        Re-organize position creation functions in preparation for adding more
-        https://bugs.webkit.org/show_bug.cgi?id=25494
+        Load debug version of graphics library in Windows Debug_All builds.
 
-        Make position functions inline to avoid ref-churn.
-        Remove startPosition/endPosition as they were only used in one place.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
 
-        No functional changes, thus no tests.
+2010-03-09  Brady Eidson  <beidson@apple.com>
 
-        * dom/Position.cpp:
-        * dom/Position.h:
-        (WebCore::positionBeforeNode):
-        (WebCore::positionAfterNode):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::moveTo):
-        * editing/TypingCommand.cpp:
-        * editing/htmlediting.cpp:
-        * editing/htmlediting.h:
-        (WebCore::firstDeepEditingPositionForNode):
-        (WebCore::lastDeepEditingPositionForNode):
-        * rendering/RenderObject.cpp:
+        Reviewed by Darin Adler.
 
-2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+        Plug-ins don't always respect the cookie accept policy.
+        <rdar://problem/7338359> and https://bugs.webkit.org/show_bug.cgi?id=26391
 
-        Reviewed by Kevin Ollivier.
-        
-        [wx] Add wxSize conversions for IntSize.
-        https://bugs.webkit.org/show_bug.cgi?id=29104
+        The problem is that the various plug-in implementations call into a ResourceLoader
+        directly instead of filtering the request through FrameLoader. This bypassed the step
+        of adding extra fields to the requests, such as the firstPartyForCookies URL.
 
-        * platform/graphics/IntSize.h:
-        * platform/graphics/wx/IntSizeWx.cpp: Added.
-        (WebCore::IntSize::IntSize):
-        (WebCore::IntSize::operator wxSize):
+        Since plug-in code is currently so strewn about and very platform specific, I
+        think reworking it needs to be a task for domain experts. I don't know the implications
+        of adding *all* the extra fields to plug-in requests, for example.
 
-2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+        There's no harm in this targeted fix for the hole in our cookie accept policy until
+        plug-ins can more fundamentally change.
 
-        Reviewed by David Levin.
-        
-        Chromium uses its own config.h file that was forked from webkit's config.h.
-        By merging in Chromium's defines, Chromium would again be able to use webkit's
-        config.h.
+        Test: http/tests/plugins/third-party-cookie-accept-policy.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28882 
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load): Don't load a resource without first giving the request 
+          a firstPartyForCookies URL.
 
-        * config.h: Added chromium-specific defines. 
+2010-03-09  Andy Estes  <aestes@apple.com>
 
-2009-09-09  Jens Alfke  <snej@chromium.org>
+        Reviewed by Adele Peterson.
 
-        Reviewed by Eric Seidel.
+        Check for null renderer in scrollNode().
+        https://bugs.webkit.org/show_bug.cgi?id=34700
 
-        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
-        according to HTML5 spec (sec. 7.9.2-7.9.3).
-        https://bugs.webkit.org/show_bug.cgi?id=26700
-        - At the start of a drag operation, the value of effectAllowed should be
-          the string "uninitialized".
-        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
-          should be set to "copy".
-        - on dragenter and dragover event, dropEffect should be initialized to a
-          default value based on the value of effectAllowed.
-        - at end of dragenter and dragover the dropEffect should be set to "none"
-          if the value set by the handler doesn't match the effectAllowed.
-        - on dragleave event, dropEffect should be "none".
-        - on drop event, dropEffect should be the previously negotiated value.
-
-        Test: fast/events/drag-dropeffect.html
+        Test: fast/events/remove-child-onscroll.html
 
-        * WebCore.base.exp:
-            Added a parameter to EventHandler::dragSourceMovedTo.
-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::Clipboard):
-            Initialize m_effectAllowed to "uninitialized".
-        (WebCore::Clipboard::sourceOperation):
-            Treat "uninitialized" as meaning no value has been set.
-        * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-            Initialize new member m_destinationDragOperation.
-        (WebCore::DragController::dragExited):
-            Set m_destinationDragOperation to none on dragExit.
-        (WebCore::DragController::performDrag):
-            Set m_destinationDragOperation to current dropEffect.
-        (WebCore::DragController::dragEnteredOrUpdated):
-            Make sure to clear the operation if drag source doesn't allow it.
-        (WebCore::DragController::tryDHTMLDrag):
-            Set a default value for the dst drag op before sending dragEnter/Over.
-        (WebCore::DragController::startDrag):
-            Clear m_destinationDragOperation at start of drag.
-        * page/DragController.h:
-        (WebCore::DragController::destinationDragOperation):
-            Added new member m_destinationDragOperation, and its public getter.
         * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-            dropEffect should be 'none' during dropleave handler, per spec.
-        (WebCore::EventHandler::dragSourceMovedTo):
-            Added DragOperation parameter, so the handler sees the current dropEffect.
-        (WebCore::EventHandler::handleDrag):
-            Assume DragOperationEvery for non-DHTML drags.
-        * page/EventHandler.h:
-            Added DragOperation parameter to dragSourceMovedTo().
+        (WebCore::scrollNode): Return early if node->renderer() == 0
 
-2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        1. Adding support/bindings for read-only transactions.
-        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
-        private browsing mode.
-        3. Adding an authorizer test.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28918
-
-        Test: storage/test-authorizer.html
-
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::createTransaction): Parses all arguments and executes a
-        transaction.
-        (WebCore::JSDatabase::transaction): Refactored to use
-        createTransaction().
-        (WebCore::JSDatabase::readTransaction): Added to execute read-only
-        transactions using createTransaction().
-        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
-        Database::readTransaction().
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::createTransaction): Parses all arguments and executes a
-        transaction.
-        (WebCore::transaction): Refactored to use createTransaction().
-        (WebCore::readTransaction): Added to execute read-only
-        transactions using createTransaction().
-        * storage/Database.cpp:
-        (WebCore::Database::transaction): Added support for read-only
-        transactions.
-        * storage/Database.h: Added support for read-only transactions.
-        * storage/Database.idl: Added support for read-only transactions.
-        * storage/DatabaseAuthorizer.cpp:
-        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
-        that the statement will be denied in private browsing mode and
-        read-only transactions.
-        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
-        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
-        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
-        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
-        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
-        (WebCore::DatabaseAuthorizer::createView): Deny in private
-        browsing mode and read-only transactions.
-        (WebCore::DatabaseAuthorizer::createTempView): Same.
-        (WebCore::DatabaseAuthorizer::dropView): Same.
-        (WebCore::DatabaseAuthorizer::dropTempView): Same.
-        (WebCore::DatabaseAuthorizer::allowReindex): Same.
-        * storage/DatabaseAuthorizer.h:
-        * storage/SQLTransaction.cpp: Added support for read-only
-        transactions.
-        (WebCore::SQLTransaction::create):
-        (WebCore::SQLTransaction::SQLTransaction):
-        (WebCore::SQLTransaction::executeSQL):
-        (WebCore::SQLTransaction::acquireLock):
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCoordinator.cpp:
-        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
-        parameter in preparation for a change that will allow multiple
-        read-only transactions on the same DB to run concurrently.
-        * storage/SQLTransactionCoordinator.h:
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-09-09  Dave Hyatt  <hyatt@apple.com>
+        Unreviewed distcheck fix.
 
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
-        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
-        to all Frames in the PageGroup.
-
-        Added userscripts/simple-stylesheet.html test case.
-
-        * WebCore.base.exp:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        * css/CSSStyleSelector.h:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::attach):
-        (WebCore::Document::pageGroupUserSheets):
-        (WebCore::Document::clearPageGroupUserSheets):
-        (WebCore::Document::recalcStyleSelector):
-        * dom/Document.h:
-        * loader/PlaceholderDocument.cpp:
-        (WebCore::PlaceholderDocument::attach):
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserStyleSheet):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        (WebCore::PageGroup::removeAllUserContent):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userStyleSheets):
-        * page/UserStyleSheet.h: Added.
-        (WebCore::UserStyleSheet::UserStyleSheet):
-        (WebCore::UserStyleSheet::source):
-        (WebCore::UserStyleSheet::url):
-        (WebCore::UserStyleSheet::patterns):
-        (WebCore::UserStyleSheet::worldID):
-        * page/UserStyleSheetTypes.h: Added.
-
-2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
-        Qt platform
-        https://bugs.webkit.org/show_bug.cgi?id=23291
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-         Added the ability to draw shadows for all these curves.
-
-2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * GNUmakefile.am:
 
-        Reviewed by Simon Hausmann.
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Add the qwebgraphicsitem.cpp to the build system.
+        Unreviewed build fix (only exposed by make distcheck). The
+        SharedWorkers files are not built, they need to be distributed.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28862
+        * GNUmakefile.am:
 
-        * WebCore.pro:
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+        Reviewed by Dirk Schulze.
 
-        Reviewed by Kevin Ollivier.
+        [GStreamer] Buffering logic is not correct, and does not work very well
+        https://bugs.webkit.org/show_bug.cgi?id=35706
 
-        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
-        they belong.
+        Fix buffering to match GStreamer expectancies regarding the
+        pipeline state, so that videos which really need buffering to play
+        correctly also work, while maintaining the convenience of
+        on-disk-buffering. This required a bit of shuffling of state
+        change handling.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29088
+        No behaviour change expected.
 
-        * editing/wx/EditorWx.cpp:
-        (WebCore::Editor::showColorPanel):
-        (WebCore::Editor::showFontPanel):
-        (WebCore::Editor::showStylesPanel):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        * platform/graphics/wx/IconWx.cpp: Added.
-        (WebCore::Icon::~Icon):
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::Image::drawPattern):
-        * platform/wx/CursorWx.cpp:
-        (WebCore::moveCursor):
-        * platform/wx/FileChooserWx.cpp: Added.
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/wx/KURLWx.cpp: Added.
-        (WebCore::KURL::fileSystemPath):
-        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/wx/SearchPopupMenuWx.cpp: Added.
-        (WebCore::SearchPopupMenu::SearchPopupMenu):
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        (WebCore::SearchPopupMenu::enabled):
-        * platform/wx/SharedBufferWx.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/wx/SystemTimeWx.cpp: Added.
-        (WebCore::userIdleTime):
-        * platform/wx/TemporaryLinkStubs.cpp: Removed.
-        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
-        (WebCore::currentSearchLocaleID):
-        (WebCore::currentTextBreakLocaleID):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::setIsSelected):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-09-09  Steve Block  <steveblock@google.com>
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Adam Barth.
+        Reviewed by Dirk Schulze.
 
-        Geolocation incorrectly calls error callback in case of exception in success callback.
-        https://bugs.webkit.org/show_bug.cgi?id=27255
+        [GStreamer] Buffering logic is not correct, and does not work very well
+        https://bugs.webkit.org/show_bug.cgi?id=35706
 
-        Test: fast/dom/Geolocation/callback-exception.html
+        Do not call pause(), but set the GStreamer state directly. This is
+        just a GStreamer implementation detail, and this will avoid having
+        side effects in case we change the pause implementation in the
+        future.
 
-        * bindings/js/JSCustomPositionCallback.cpp: Modified.
-        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
-        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
-        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
-        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::load):
 
-2009-09-09  Steve Block  <steveblock@google.com>
+2010-03-09  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Darin Adler.
 
-        When Geolocation permission is denied, stops watches as well as one-shots.
-        https://bugs.webkit.org/show_bug.cgi?id=28305.
-
-        Tests: fast/dom/Geolocation/watch.html
-               fast/dom/Geolocation/permission-denied-stops-watches.html
-
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
-        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
-        * page/PositionError.h: Modified.
-        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
-        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
-
-2009-09-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
-
-        Added getter/setter methods and trivial inline implementations for each.
-        (Note that they are not yet actually used.)
-        Once the Chromium code is changed to use them instead of directly accessing the
-        member variables, the member variables should be made private and cleaned up.
-
-        No new tests (no functional behavior changed).
-
-        * platform/chromium/ChromiumDataObject.h:
-        (WebCore::ChromiumDataObject::mainURL):
-        (WebCore::ChromiumDataObject::setMainURL):
-        (WebCore::ChromiumDataObject::mainURLTitle):
-        (WebCore::ChromiumDataObject::setMainURLTitle):
-        (WebCore::ChromiumDataObject::textPlain):
-        (WebCore::ChromiumDataObject::setTextPlain):
-        (WebCore::ChromiumDataObject::textHTML):
-        (WebCore::ChromiumDataObject::setTextHTML):
-        (WebCore::ChromiumDataObject::htmlBaseURL):
-        (WebCore::ChromiumDataObject::setHTMLBaseURL):
-        (WebCore::ChromiumDataObject::content):
-        (WebCore::ChromiumDataObject::releaseContent):
-        (WebCore::ChromiumDataObject::setContent):
-        (WebCore::ChromiumDataObject::contentFileExtension):
-        (WebCore::ChromiumDataObject::setContentFileExtension):
-        (WebCore::ChromiumDataObject::contentFileName):
-        (WebCore::ChromiumDataObject::setContentFileName):
-        (WebCore::ChromiumDataObject::fileNames):
-        (WebCore::ChromiumDataObject::setFileNames):
-        (WebCore::ChromiumDataObject::takeFileNames):
-
-2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] locale date displays incorrect date format in symbian.
-        https://bugs.webkit.org/show_bug.cgi?id=29032
-
-        strftime() in Symbian does not support #
-        Layout tests cannot be run on Symbian yet, so they are not updated.
-
-        * runtime/DatePrototype.cpp:
-        (JSC::formatLocaleDate):
-
-2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        NPAPI Plugin NPP_AsFile not working on Qt Webkit
-        https://bugs.webkit.org/show_bug.cgi?id=29068
-
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::openTemporaryFile)
-        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
-        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
-
-2009-09-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Remove a few incorrect changes I left in.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-09-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Support numeric index getters in bindings
-        https://bugs.webkit.org/show_bug.cgi?id=29067
-
-        Add HasNumericIndexGetter to indicate a non-custom getter that
-        returns a number.  The numeric index getter also uses PropertySlot's
-        setValue rather than setCustomIndex to avoid an additional indirect
-        call.
-
-        * bindings/js/JSCanvasByteArrayCustom.cpp:
-        * bindings/js/JSCanvasFloatArrayCustom.cpp:
-        * bindings/js/JSCanvasIntArrayCustom.cpp:
-        * bindings/js/JSCanvasShortArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::item):
-        * html/canvas/CanvasByteArray.idl:
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::get):
-        (WebCore::CanvasFloatArray::item):
-        * html/canvas/CanvasFloatArray.idl:
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::get):
-        (WebCore::CanvasIntArray::item):
-        * html/canvas/CanvasIntArray.idl:
-        * html/canvas/CanvasPixelArray.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::get):
-        (WebCore::CanvasShortArray::item):
-        * html/canvas/CanvasShortArray.idl:
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::get):
-        (WebCore::CanvasUnsignedByteArray::item):
-        * html/canvas/CanvasUnsignedByteArray.idl:
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::get):
-        (WebCore::CanvasUnsignedIntArray::item):
-        * html/canvas/CanvasUnsignedIntArray.idl:
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::item):
-        * html/canvas/CanvasUnsignedShortArray.idl:
-
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for 2.8.
-
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-08  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        In Mac Chromium, clicking below the last line of an editable area (textarea or
-        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
-
-        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
-               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+        AX: hit testing a list box doesn't work anymore
+        https://bugs.webkit.org/show_bug.cgi?id=35893
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
-
-2009-09-08  Dave Hyatt  <hyatt@apple.com>
+        Since <option> elements don't have renderers, their hit testing needs
+        to be handled with a special case.
 
-        Reviewed by Mark Rowe.
+        Test: platform/mac/accessibility/listbox-hit-test.html
 
-        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
-        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
 
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-09-08  Sam Weinig  <sam@webkit.org>
+        Reviewed by Timothy Hatcher.
 
-        Fix windows build.
+        Web Inspector: Refactor Audits panel presentation layer.
+        This change removes unnecessary complexity:
+          - Audit scores were not used
+          - Audit rule parameters are passed as rule constructor arguments
+          - View management aligned with the rest of the front-end
+          - Single TreeOutline is used for category results (no need to create sections for those)
+          - Rules code beautified and simplified where possible
+          - Some UI improvements applied (see attached screenshot)
+
+        https://bugs.webkit.org/show_bug.cgi?id=35860
+
+        * inspector/front-end/AuditCategories.js:
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        (WebInspector.AuditCategories.NetworkUtilization.prototype.initialize):
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditCategoryResultPane):
+        (WebInspector.AuditCategoryResultPane.prototype._appendResult):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineExternalResourcesRule):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineJsResourcesRule):
+        (WebInspector.AuditRules.CombineCssResourcesRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.UnusedCssRule):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule):
+        (WebInspector.AuditRules.CacheControlRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule.prototype.execCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ProxyCacheControlRule):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ImageDimensionsRule):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.StylesScriptsOrderRule):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CookieRuleBase):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun.resultCallback):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CookieSizeRule):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel):
+        (WebInspector.AuditsPanel.prototype._executeAudit.ruleResultReadyCallback):
+        (WebInspector.AuditsPanel.prototype._executeAudit):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype._didMainResourceLoad):
+        (WebInspector.AuditsPanel.prototype.showResults):
+        (WebInspector.AuditsPanel.prototype.showLauncherView):
+        (WebInspector.AuditsPanel.prototype.get visibleView):
+        (WebInspector.AuditsPanel.prototype.set visibleView):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype._clearButtonClicked):
+        (WebInspector.AuditCategory.prototype.addRule):
+        (WebInspector.AuditRule):
+        (WebInspector.AuditRule.prototype.set severity):
+        (WebInspector.AuditRule.prototype.run):
+        (WebInspector.AuditRule.prototype.doRun):
+        (WebInspector.AuditCategoryResult):
+        (WebInspector.AuditCategoryResult.prototype.addRuleResult):
+        (WebInspector.AuditRuleResult):
+        (WebInspector.AuditRuleResult.prototype.addChild):
+        (WebInspector.AuditRuleResult.prototype.addURL):
+        (WebInspector.AuditRuleResult.prototype.addURLs):
+        (WebInspector.AuditRuleResult.prototype.addSnippet):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/audits.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentKeyDown):
 
-        * dom/Document.idl:
+2010-03-09  Yury Semikhatsky  <yurys@chromium.org>
 
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+        Reviewed by Pavel Feldman.
+ 
+        When enable resource tracking state changes use the same method as
+        location.reload for reloading inspected page.
 
-        More robust wx build fix for 2.9.
+        https://bugs.webkit.org/show_bug.cgi?id=35923
 
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::reloadPage):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
 
-2009-09-08  Sam Weinig  <sam@webkit.org>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
-        Implement CSSOM DocumentView.caretRangeFromPoint
+        Web Inspector: highlight text node containers while searching for node.
 
-        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
-               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+        https://bugs.webkit.org/show_bug.cgi?id=35912
 
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
-        * dom/Document.h:
-        * dom/Document.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mouseDidMoveOverElement):
 
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+2010-03-09  Philippe Normand  <pnormand@igalia.com>
 
-        wx build fix, generate derived sources earlier in order to make sure
-        they're found by the build system when generating the list of sources to build.
+        Reviewed by Gustavo Noronha Silva.
 
-        * wscript:
+        [GStreamer] player code cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=35868
 
-2009-09-08  Nate Chapin  <japhet@chromium.org>
+        Cleaned up the private instance variables of the player.
 
-        Reviewed by Dimitri Glazkov.
-
-        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Test: Chromium mac canary build is fixed.
+2010-03-09  Philippe Normand  <pnormand@igalia.com>
 
-        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+        Reviewed by Gustavo Noronha Silva.
 
-2009-09-08  Xan Lopez  <xlopez@igalia.com>
+        [GStreamer] player code cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=35868
 
-        Unreviewed attempt to fix the GTKbuild.
+        Splitted GOwnPtrGtk.{cpp,h} to GOwnPtr{Soup,GStreamer}.{cpp,h}.
 
         * GNUmakefile.am:
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
-        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        * css/CSSStyleSelector.h:
-        * dom/Document.cpp:
-        (WebCore::Document::attach):
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::clearPageUserSheet):
-        (WebCore::Document::recalcStyleSelector):
-        * dom/Document.h:
-        * loader/PlaceholderDocument.cpp:
-        (WebCore::PlaceholderDocument::attach):
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
-        * page/Settings.cpp:
-        (WebCore::Settings::setUserStyleSheetLocation):
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Unreviewed buildfix.
-
-        Fix Qt build after 48167, by adding the new cpp/h files
-        added to WebCore.gypi to WebCore.pro as well.
-
-        * WebCore.pro:
-
-2009-09-08  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        should not pass URI fragments to libsoup
-        https://bugs.webkit.org/show_bug.cgi?id=28687
-
-        Strip the fragment from the URI before passing it to soup, since
-        it forwards it to servers in some cases (like when using a proxy)
-        which confuses them and makes them return 403/404.
-
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.cpp: Added.
+        (WTF::GstElement):
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.h: Added.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/gtk/GOwnPtrGtk.cpp: Removed.
+        * platform/gtk/GOwnPtrGtk.h: Removed.
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/soup/DNSSoup.cpp:
+        * platform/network/soup/GOwnPtrSoup.cpp: Added.
+        (WTF::SoupURI):
+        * platform/network/soup/GOwnPtrSoup.h: Added.
         * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Add QGraphicsScene events support to the Qt platform events.
-
-        * platform/PlatformMouseEvent.h:
-        * platform/PlatformWheelEvent.h:
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/WheelEventQt.cpp:
-        (WebCore::PlatformWheelEvent::applyDelta):
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/network/soup/ResourceRequestSoup.cpp:
 
-2009-09-08  Michael Nordman  <michaeln@google.com>
+2010-03-09  Shinichiro Hamaji  <hamaji@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        [Chromium] Cleanup: remove a few deprecated methods.
-        https://bugs.webkit.org/show_bug.cgi?id=28960
-
-        No new tests, just syntactic sugar.
+        [Chromium] Should remove paddings of Win/Linux chromium's buttons
+        https://bugs.webkit.org/show_bug.cgi?id=35629
 
-        * platform/network/chromium/ResourceRequest.h:
-        * platform/network/chromium/ResourceResponse.h:
-
-2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        No new tests, but we may need to rebaseline bunch of expectation
+        images in chromium's tree.
 
-        Reviewed by Ariya Hidayat.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28981
+2010-03-08  Kent Tamura  <tkent@chromium.org>
 
-        [Qt] make npapi.h compile in winscw compiler.
+        Reviewed by Adam Barth.
 
-        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
-        specific changes in npapi.h.
-        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+        Implement HTML5 <hgroup> element.
+        https://bugs.webkit.org/show_bug.cgi?id=33369
 
-        * bridge/npapi.h:
+        <hgroup> should behave the same as <nav>, <section>, <article>, and <aside>.
+        <hgroup> has no specific parsing rules.
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+        Test: fast/html/hgroup-element.html
 
-        Reviewed by Geoff Garen.
+        * css/html.css: Add hgroup as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add hgroupTag.
+        * html/HTMLElement.cpp:
+        (WebCore::createTagPriorityMap): Returns 5 for hgroupTag.
+        (WebCore::blockTagList): Add hgroupTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add hgroupTag.
+        * html/HTMLTagNames.in: Add hgroup.
 
-        Web Inspector assertion failure related to marking
-        https://bugs.webkit.org/show_bug.cgi?id=28997
+2010-03-08  Tony Chang  <tony@chromium.org>
 
-        When wrapping the callback the JSInspectorCallbackWrapper creator was using
-        inheritorID for the prototype structure which is unsafe for anything other
-        than a pure JS object.  Instead we now create a new structure, which while
-        inefficient is not problematic as this code is not hit frequently.
+        Reviewed by Adam Barth.
 
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap):
+        https://bugs.webkit.org/show_bug.cgi?id=32131
+        Crash when inserting an ordered list.
 
-2009-09-08  Kelly Norton  <knorton@google.com>
+        Test: editing/execCommand/insert-ordered-list.html
 
-        Reviewed by Dimitri Glazkov.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
 
-        Add missing extension to the file entry in WebCore.vcproj.
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+        Reviewed by Dan Bernstein.
 
-2009-09-08  Jian Li  <jianli@chromium.org>
+        Added a test for crash when you quit inside an unload handler.
+        rdar://problem/6958347
 
-        Reviewed by David Levin.
+        * manual-tests/quit-inside-unload.html: Added.
 
-        dataTransfer.types() should not return Files if file list is empty in the clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28891
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        We change the behavior to handle the empty file list in order to match the spec.
+        Reviewed by Jon Honeycutt.
 
-        Tested by clipboard-file-access.html.
+        Don't auto-play <audio> and <video> elements loaded in background tabs
+        https://bugs.webkit.org/show_bug.cgi?id=35886
+        rdar://problem/7117745
 
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::addHTMLClipboardTypesForCocoaType):
-        (WebCore::ClipboardMac::types):
+        * manual-tests/video-in-non-frontmost-tab.html: Added.
+        * manual-tests/resources/video-tab.html: Added.
 
-2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+        * html/HTMLMediaElement.h: Added MediaCanStartListener as a base class, and
+        added the mediaCanStart function as well as a boolean,
+        m_isWaitingUntilMediaCanStart.
 
-        Reviewed by Eric Seidel.
-
-        Handle middle click in Chromium like QT
-        https://bugs.webkit.org/show_bug.cgi?id=28696
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize
+        m_isWaitingUntilMediaCanStart.
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Call
+        removeMediaCanStartListener if m_isWaitingUntilMediaCanStart is true. 
+        (WebCore::HTMLMediaElement::loadInternal): Set m_isWaitingUntilMediaCanStart
+        and call addMediaCanStartListener if canStartMedia is false.
+        (WebCore::HTMLMediaElement::mediaCanStart): Clear m_isWaitingUntilMediaCanStart
+        and call loadInternal.
 
-        Tested by middle-click-onpaste.html.
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * platform/Pasteboard.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::getData):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::isSelectionMode):
-        (WebCore::Pasteboard::setSelectionMode):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        * platform/chromium/PasteboardPrivate.h:
-        (WebCore::PasteboardPrivate::):
+        [GTK] Unreviewed buildfix after r55688.
 
-2009-09-08  Kelly Norton  <knorton@google.com>
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcStart):
 
-        Reviewed by Eric Seidel.
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        WebInspector: Adds a timeline agent to InspectorController that collects
-        high-level timing data about event dispatch, layout, painting and HTML
-        parsing and makes it available to Inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=25503
+        [GTK] Unreviewed buildfix after r55688.
 
-        * WebCore.gypi:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
-        * dom/Document.h:
-        (WebCore::Document::inspectorTimelineAgent):
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchGenericEvent):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * inspector/DOMDispatchTimelineItem.cpp: Added.
-        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
-        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
-        * inspector/DOMDispatchTimelineItem.h: Added.
-        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::enableTimeline):
-        (WebCore::InspectorBackend::disableTimeline):
-        (WebCore::InspectorBackend::timelineEnabled):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::enableTimeline):
-        (WebCore::InspectorController::disableTimeline):
-        (WebCore::InspectorController::timelineEnabled):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::timelineAgent):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::timelineWasEnabled):
-        (WebCore::InspectorFrontend::timelineWasDisabled):
-        (WebCore::InspectorFrontend::addItemToTimeline):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorTimelineAgent.cpp: Added.
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
-        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
-        * inspector/InspectorTimelineAgent.h: Added.
-        * inspector/TimelineItem.cpp: Added.
-        (WebCore::TimelineItem::TimelineItem):
-        (WebCore::TimelineItem::addToTimeline):
-        (WebCore::TimelineItem::convertToScriptObject):
-        (WebCore::TimelineItem::convertChildrenToScriptArray):
-        (WebCore::TimelineItem::addChildItem):
-        * inspector/TimelineItem.h: Added.
+        * platform/network/soup/ResourceHandleSoup.cpp:
         (WebCore::):
-        (WebCore::TimelineItem::~TimelineItem):
-        (WebCore::TimelineItem::previous):
-        (WebCore::TimelineItem::releasePrevious):
-        (WebCore::TimelineItem::setEndTime):
-        (WebCore::TimelineItem::type):
-        * inspector/front-end/TimelineAgent.js: Added.
-        (WebInspector.TimelineAgent):
-        (WebInspector.addItemToTimeline):
-        (WebInspector.timelineWasEnabled):
-        (WebInspector.timelineWasDisabled):
-        * inspector/front-end/inspector.html:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h:
-        (WebCore::FrameView::inspectorTimelineAgent):
-        * page/Page.cpp:
-        (WebCore::Page::inspectorTimelineAgent):
-        * page/Page.h:
-
-2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix unused variable warnings
-        https://bugs.webkit.org/show_bug.cgi?id=29018
-
-        No functional change, no tests.
-
-        * history/qt/HistoryItemQt.cpp:
-        (WebCore::HistoryItem::restoreState):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::putImageData):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::paintMenuList):
-
-2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Ariya Hidayat.
 
-        [Qt] Use the declaration order in initializer lists
-        https://bugs.webkit.org/show_bug.cgi?id=29017
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        No functional change, no new tests.
+        [Qt] Unreviewed buildfix after r55688.
 
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-
-2009-09-08  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Implement ValidityState::typeMismatch() for <input type=number>.
-        https://bugs.webkit.org/show_bug.cgi?id=28934
-
-        Test: fast/forms/ValidityState-typeMismatch-number.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::formStringToDouble):
-        * html/HTMLInputElement.h:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
-        * html/ValidityState.h:
-
-2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk] Another attempt of a buildfix.
-
-        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
 
-        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
-        https://bugs.webkit.org/show_bug.cgi?id=28865
+2010-03-08  Alexey Proskuryakov  <ap@apple.com>
 
-        Save the QCursor as a property in WidgetQt::setCursor
-        and actually change the cursor in QWebView::event() by making use
-        of the QEvent::DynamicPropertyChange event type.
-        When unsetCursor() is called on the QWidget we can fallback to
-        the cursor set by WebCore.
+        Reviewed by Darin Adler.
 
-        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
-                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+        https://bugs.webkit.org/show_bug.cgi?id=35879
+        Eliminate m_mightDownloadFromHandle
 
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
+        It was only used on Mac, and unnecessarily complicated the code.
 
-2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        No change in behavior, thus no test.
 
-        Reviewed by Gustavo Noronha.
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::loadNow):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::ResourceHandle):
+        (WebCore::ResourceHandle::create):
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
 
-        [Gtk] Buildfix for build error introduced in r48150.
+2010-03-02  Peter Kasting  <pkasting@google.com>
 
-        * GNUmakefile.am: Modified. Added missing IDL files.
+        Reviewed by Adam Barth.
 
-2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Clean up usage of m_failed in open-source image decoders, part 1.
+        https://bugs.webkit.org/show_bug.cgi?id=35411
+        
+        Makes setFailed() virtual so subclasses can override it (none do yet) to
+        do automatic cleanup on failure; makes it return a bool for easy
+        tailcalling; makes failed() the only way to access m_failed so
+        subclasses are assured setFailed() won't be bypassed.  Plus one or two
+        other tiny cleanup bits.
 
-        Reviewed by Tor Arne Vestbø.
+        Overriding setFailed() is coming in a subsequent patch because it can be
+        hairy and needs close review.
 
-        [Qt] Buildfix. Build error caused by r48150.
+        No functional change, so no tests.
 
-        * WebCore.pro: missing IDL files added
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::clearPointers):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::setSize):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::failed):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::frameBufferAtIndex):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
 
-2009-09-07  Chris Marrin  <cmarrin@apple.com>
+2010-03-08  Chris Marrin  <cmarrin@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Adler.
 
-        Update Canvas 3D implementation to match spec
-        https://bugs.webkit.org/show_bug.cgi?id=29010
+        Disallow WebGL when HW comp is not turned on at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=35759
 
-        This adds several new CanvasXXXArray classes each of which has a custom constructor
-        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
-        to match the new and changed API.
+        When HW comp is turned off with the runtime flag, WebGL would still
+        create a context, but silently fail to render. This prevents that.
+        Now if HW comp is turned off getContext('webgl') will return null.
 
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::bufferData):
-        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
-        (WebCore::JSCanvasRenderingContext3D::texImage2D):
-        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
-        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::canvasArrayBuffer):
-        (WebCore::JSDOMWindow::canvasByteArray):
-        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
-        (WebCore::JSDOMWindow::canvasIntArray):
-        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
-        (WebCore::JSDOMWindow::canvasShortArray):
-        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
-        (WebCore::JSDOMWindow::canvasFloatArray):
         * html/HTMLCanvasElement.cpp:
         (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::paint):
-        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArray.idl: Added.
-        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArrayBuffer.idl: Added.
-        * html/canvas/CanvasByteArray.cpp:
-        * html/canvas/CanvasByteArray.h:
-        * html/canvas/CanvasByteArray.idl:
-        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasFloatArray.idl: Added.
-        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasIntArray.idl: Added.
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
-        (WebCore::CanvasRenderingContext3D::markContextChanged):
-        (WebCore::CanvasRenderingContext3D::beginPaint):
-        (WebCore::CanvasRenderingContext3D::endPaint):
-        (WebCore::CanvasRenderingContext3D::reshape):
-        (WebCore::CanvasRenderingContext3D::sizeInBytes):
-        (WebCore::CanvasRenderingContext3D::bindTexture):
-        (WebCore::CanvasRenderingContext3D::bufferData):
-        (WebCore::CanvasRenderingContext3D::bufferSubData):
-        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
-        (WebCore::CanvasRenderingContext3D::clear):
-        (WebCore::CanvasRenderingContext3D::createBuffer):
-        (WebCore::CanvasRenderingContext3D::createFramebuffer):
-        (WebCore::CanvasRenderingContext3D::createTexture):
-        (WebCore::CanvasRenderingContext3D::createProgram):
-        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::createShader):
-        (WebCore::CanvasRenderingContext3D::deleteBuffer):
-        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
-        (WebCore::CanvasRenderingContext3D::deleteProgram):
-        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::deleteShader):
-        (WebCore::CanvasRenderingContext3D::deleteTexture):
-        (WebCore::CanvasRenderingContext3D::drawArrays):
-        (WebCore::CanvasRenderingContext3D::drawElements):
-        (WebCore::CanvasRenderingContext3D::getBoolean):
-        (WebCore::CanvasRenderingContext3D::getBooleanv):
-        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
-        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
-        (WebCore::CanvasRenderingContext3D::getFloat):
-        (WebCore::CanvasRenderingContext3D::getFloatv):
-        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
-        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
-        (WebCore::CanvasRenderingContext3D::getInteger):
-        (WebCore::CanvasRenderingContext3D::getIntegerv):
-        (WebCore::CanvasRenderingContext3D::getProgrami):
-        (WebCore::CanvasRenderingContext3D::getProgramiv):
-        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
-        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
-        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
-        (WebCore::CanvasRenderingContext3D::getShaderi):
-        (WebCore::CanvasRenderingContext3D::getShaderiv):
-        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
-        (WebCore::CanvasRenderingContext3D::getShaderSource):
-        (WebCore::CanvasRenderingContext3D::getTexParameterf):
-        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
-        (WebCore::CanvasRenderingContext3D::getTexParameteri):
-        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
-        (WebCore::CanvasRenderingContext3D::getUniformf):
-        (WebCore::CanvasRenderingContext3D::getUniformfv):
-        (WebCore::CanvasRenderingContext3D::getUniformi):
-        (WebCore::CanvasRenderingContext3D::getUniformiv):
-        (WebCore::CanvasRenderingContext3D::getUniformLocation):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
-        (WebCore::CanvasRenderingContext3D::texImage2D):
-        (WebCore::CanvasRenderingContext3D::texParameterf):
-        (WebCore::CanvasRenderingContext3D::texParameteri):
-        (WebCore::CanvasRenderingContext3D::texSubImage2D):
-        (WebCore::CanvasRenderingContext3D::uniform1f):
-        (WebCore::CanvasRenderingContext3D::uniform1fv):
-        (WebCore::CanvasRenderingContext3D::uniform1i):
-        (WebCore::CanvasRenderingContext3D::uniform1iv):
-        (WebCore::CanvasRenderingContext3D::uniform2f):
-        (WebCore::CanvasRenderingContext3D::uniform2fv):
-        (WebCore::CanvasRenderingContext3D::uniform2i):
-        (WebCore::CanvasRenderingContext3D::uniform2iv):
-        (WebCore::CanvasRenderingContext3D::uniform3f):
-        (WebCore::CanvasRenderingContext3D::uniform3fv):
-        (WebCore::CanvasRenderingContext3D::uniform3i):
-        (WebCore::CanvasRenderingContext3D::uniform3iv):
-        (WebCore::CanvasRenderingContext3D::uniform4f):
-        (WebCore::CanvasRenderingContext3D::uniform4fv):
-        (WebCore::CanvasRenderingContext3D::uniform4i):
-        (WebCore::CanvasRenderingContext3D::uniform4iv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::CanvasRenderingContext3D::useProgram):
-        (WebCore::CanvasRenderingContext3D::validateProgram):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
-        (WebCore::CanvasRenderingContext3D::viewport):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasShortArray.idl: Added.
-        * html/canvas/CanvasTexture.cpp:
-        (WebCore::CanvasTexture::CanvasTexture):
-        * html/canvas/CanvasTexture.h:
-        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
-        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
-        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
-         * html/canvas/CanvasUnsignedByteArray.idl: Added.
-        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedIntArray.idl: Added.
-        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedShortArray.idl: Added.
-        * page/DOMWindow.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::beginPaint):
-        (WebCore::GraphicsContext3D::endPaint):
-        (WebCore::GraphicsContext3D::bindTexture):
-        (WebCore::GraphicsContext3D::bufferData):
-        (WebCore::GraphicsContext3D::bufferSubData):
-        (WebCore::GraphicsContext3D::checkFramebufferStatus):
-        (WebCore::GraphicsContext3D::drawArrays):
-        (WebCore::GraphicsContext3D::drawElements):
-        (WebCore::GraphicsContext3D::texParameterf):
-        (WebCore::GraphicsContext3D::texParameteri):
-        (WebCore::GraphicsContext3D::uniform1f):
-        (WebCore::GraphicsContext3D::uniform1fv):
-        (WebCore::GraphicsContext3D::uniform2f):
-        (WebCore::GraphicsContext3D::uniform2fv):
-        (WebCore::GraphicsContext3D::uniform3f):
-        (WebCore::GraphicsContext3D::uniform3fv):
-        (WebCore::GraphicsContext3D::uniform4f):
-        (WebCore::GraphicsContext3D::uniform4fv):
-        (WebCore::GraphicsContext3D::uniform1i):
-        (WebCore::GraphicsContext3D::uniform1iv):
-        (WebCore::GraphicsContext3D::uniform2i):
-        (WebCore::GraphicsContext3D::uniform2iv):
-        (WebCore::GraphicsContext3D::uniform3i):
-        (WebCore::GraphicsContext3D::uniform3iv):
-        (WebCore::GraphicsContext3D::uniform4i):
-        (WebCore::GraphicsContext3D::uniform4iv):
-        (WebCore::GraphicsContext3D::uniformMatrix2fv):
-        (WebCore::GraphicsContext3D::uniformMatrix3fv):
-        (WebCore::GraphicsContext3D::uniformMatrix4fv):
-        (WebCore::GraphicsContext3D::vertexAttrib1f):
-        (WebCore::GraphicsContext3D::vertexAttrib1fv):
-        (WebCore::GraphicsContext3D::vertexAttrib2f):
-        (WebCore::GraphicsContext3D::vertexAttrib2fv):
-        (WebCore::GraphicsContext3D::vertexAttrib3f):
-        (WebCore::GraphicsContext3D::vertexAttrib3fv):
-        (WebCore::GraphicsContext3D::vertexAttrib4f):
-        (WebCore::GraphicsContext3D::vertexAttrib4fv):
-        (WebCore::GraphicsContext3D::vertexAttribPointer):
-        (WebCore::GraphicsContext3D::getBoolean):
-        (WebCore::GraphicsContext3D::getBooleanv):
-        (WebCore::GraphicsContext3D::getFloat):
-        (WebCore::GraphicsContext3D::getFloatv):
-        (WebCore::GraphicsContext3D::getInteger):
-        (WebCore::GraphicsContext3D::getIntegerv):
-        (WebCore::GraphicsContext3D::getBufferParameteri):
-        (WebCore::GraphicsContext3D::getBufferParameteriv):
-        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
-        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
-        (WebCore::GraphicsContext3D::getProgrami):
-        (WebCore::GraphicsContext3D::getProgramiv):
-        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
-        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
-        (WebCore::GraphicsContext3D::getShaderi):
-        (WebCore::GraphicsContext3D::getShaderiv):
-        (WebCore::GraphicsContext3D::getTexParameterf):
-        (WebCore::GraphicsContext3D::getTexParameterfv):
-        (WebCore::GraphicsContext3D::getTexParameteri):
-        (WebCore::GraphicsContext3D::getTexParameteriv):
-        (WebCore::GraphicsContext3D::getUniformf):
-        (WebCore::GraphicsContext3D::getUniformfv):
-        (WebCore::GraphicsContext3D::getUniformi):
-        (WebCore::GraphicsContext3D::getUniformiv):
-        (WebCore::GraphicsContext3D::getVertexAttribf):
-        (WebCore::GraphicsContext3D::getVertexAttribfv):
-        (WebCore::GraphicsContext3D::getVertexAttribi):
-        (WebCore::GraphicsContext3D::getVertexAttribiv):
-        (WebCore::GraphicsContext3D::getVertexAttribOffset):
-        (WebCore::GraphicsContext3D::texImage2D):
-        (WebCore::GraphicsContext3D::texSubImage2D):
-        (WebCore::GraphicsContext3D::sizeInBytes):
-
-2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Make m_windowVisible more consistent with the actual visibility of the inspector.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
 
-2009-09-07  Adam Barth  <abarth@webkit.org>
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        Unreviewed speculative build fix for Snow Leopard.
-
-        * platform/GeolocationService.cpp:
-        (WebCore::createGeolocationServiceNull):
-
-2009-09-07  Steve Block  <steveblock@google.com>
-
-        Reviewed by Adam Barth.
-
-        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
-        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
-        Geolocation service with DumpRenderTree.
-        https://bugs.webkit.org/show_bug.cgi?id=28264
-
-        The mock Geolocation service returns a fixed position or error. This position or error can be
-        set through static methods on the GeolocationService class. The position or error is shared
-        between all instances of the mock Geolocation service.
-
-        Implementation details.
-        The GeolocationService object maintains a pointer to a factory function which it uses to create
-        Geolocation service instances. Each platform implementing Geolocation sets this pointer
-        to the factory function for their platform's implementation. When the mock Geolocation service
-        is activated, the factory function pointer is reset to the factory function for the mock service.
-
-        Test: fast/dom/Geolocation/error.html
-
-        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
-        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
-        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
-        * WebCore.pro: Modified. Added GeolocationServiceMock files.
-        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
-        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
-        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
-        * page/ChromeClient.h: Modified. Fixed comment.
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
-        * platform/GeolocationService.cpp: Modified.
-        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
-        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
-        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
-        * platform/GeolocationService.h: Modified.
-        * platform/mock: Added.
-        * platform/mock/GeolocationServiceMock.cpp: Added.
-        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
-        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
-        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
-        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
-        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
-        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
-        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
-        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
-        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
-        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
-        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
-        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
-        * platform/mock/GeolocationServiceMock.h: Added.
-        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
-        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
-        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
-        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
-        * platform/gtk/GeolocationServiceGtk.h: Modified.
-        * platform/mac/GeolocationServiceMac.h: Modified.
-        * platform/mac/GeolocationServiceMac.mm: Modified.
-        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
-
-2009-09-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28985
-
-        We need to be slightly more careful about how we pick up a script
-        execution context.  In particular, we were getting the wrong document
-        for frames that had been navigated somewhere else.
-
-        In the long term, we should think about a better algorithm for
-        computing the script context.
-
-        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::retrieveFrame):
-
-2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for 2.8 compilation.
-
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed build fix.
-
-        Reverting r48121 to fix Windows build errors.
-
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Removed.
-        * websockets/WebSocketChannel.h: Removed.
-        * websockets/WebSocketChannelClient.h: Removed.
-        * websockets/WebSocketHandshake.cpp: Removed.
-        * websockets/WebSocketHandshake.h: Removed.
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed speculative build fix.
-
-        Reverted previous build fix as it didn't fix the problem.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-
-2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed, build fix.
-
-        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
-
-        * WebCore.pro:
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed build fix.
-
-        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Enable SHARED_WORKERS by default.
-        https://bugs.webkit.org/show_bug.cgi?id=28959
-
-        Tests (enabled in a separate patch):
-               fast/workers/shared-worker-constructor.html
-               fast/workers/shared-worker-context-gc.html
-               fast/workers/shared-worker-event-listener.html
-               fast/workers/shared-worker-exception.html
-               fast/workers/shared-worker-frame-lifecycle.html
-               fast/workers/shared-worker-gc.html
-               fast/workers/shared-worker-lifecycle.html
-               fast/workers/shared-worker-load-error.html
-               fast/workers/shared-worker-location.html
-               fast/workers/shared-worker-navigator.html
-               fast/workers/shared-worker-replace-global-constructor.html
-               fast/workers/shared-worker-replace-self.html
-               fast/workers/shared-worker-shared.html
-               fast/workers/shared-worker-simple.html
-               http/tests/workers/shared-worker-importScripts.html
-               http/tests/workers/shared-worker-redirect.html
-               http/tests/xmlhttprequest/workers/shared-worker-close.html
-               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
-               http/tests/xmlhttprequest/workers/shared-worker-methods.html
-               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
-
-        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerScriptLoader::load):
-        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
-        * workers/SharedWorkerContext.cpp:
-        (WebCore::SharedWorkerContext::dispatchConnect):
-        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
-
-2009-09-07  Xan Lopez  <xlopez@igalia.com>
-
-        Unreviewed build fix.
-
-        Add new file to sources list.
-
-        * GNUmakefile.am:
-
-2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes for wx SVN trunk. 
-
-        * config.h:
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::paintButton):
-        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-07  Chris Hills <chaz@chaz6.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Use direct includes for Phonon, not the pretty ones
+        Reviewed by Jon Honeycutt.
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=35876
 
-2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+        Fix minor style issues in HTMLMediaElement and classes derived from it.
+        Made many public members private and protected.
 
-        Reviewed by Alexey Proskuryakov.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::screenRect): Got rid of a stray "const" and
+        retstructured the function to use early return and get rid of a local.
 
-        WebSocket API implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=28038
-        
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
-        Other build systems will be updated once the code is functional.
-        Tests will be landed once the code is completed and functional.
+        * html/HTMLMediaElement.h: Made lots of members private and some
+        protected. Also use private inheritance instead of public. Removed
+        some unneeded includes.
 
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toWebSocket):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::isValidProtocolString):
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::eventListeners):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Added.
-        * websockets/WebSocketChannel.h: Added.
-        * websockets/WebSocketChannelClient.h: Added.
-        * websockets/WebSocketHandshake.cpp: Added.
-        * websockets/WebSocketHandshake.h: Added.
-
-2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Use player() instead
+        of m_player; HTMLMediaElement data members are now private, not protected.
+        (WebCore::HTMLVideoElement::supportsFullscreen): Ditto.
+        (WebCore::HTMLVideoElement::videoWidth): Ditto.
+        (WebCore::HTMLVideoElement::videoHeight): Ditto.
+        (WebCore::HTMLVideoElement::hasAvailableVideoFrame): Ditto.
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen): Use isFullscreen()
+        instead of m_isFullscreen; same reason.
+        (WebCore::HTMLVideoElement::webkitExitFullScreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitDisplayingFullscreen): Ditto.
+
+        * html/HTMLVideoElement.h: Removed an unneeded include. Made many
+        public functions private. Got rid of unused paint function, which was
+        replaced with paintCurrentFrameInContext a while back.
+
+2010-03-08  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
         Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26854
-        [GTK] Needs API to allow more control over outgoing requests
+        https://bugs.webkit.org/show_bug.cgi?id=30895
+        [Gtk] The accessible hierarchy of tables is significantly incorrect for Atk
 
-        Add infrastructure required to provide the new
-        WebKitNetworkResponse object in our API.
+        Gives platforms the ability to exclude parts of an AccessibilityTable
+        from the accessible hierarchy.
 
-        * GNUmakefile.am: Add new files to the build.
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateFromSoupMessage):
-        * platform/network/soup/ResourceResponse.h:
-        * platform/network/soup/ResourceResponseSoup.cpp: Added.
-        (WebCore::ResourceResponse::toSoupMessage):
-
-2009-09-07  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=29009
-
-        Be consistent in document and frame null checks.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityTable.cpp:
+        (AccessibilityTable::addChildren):
+        * accessibility/AccessibilityTableColumn.h:
+        (accessibilityIsIgnored):
+        * accessibility/AccessibilityTableHeaderContainer.h:
+        (accessibilityIsIgnored):
+        * accessibility/AccessibilityTableRow.cpp:
+        (accessibilityIsIgnored):
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
+2010-03-08  Jian Li  <jianli@chromium.org>
 
-2009-09-07  Xan Lopez  <xlopez@igalia.com>
+        No review. Fix build break on Tiger intel release.
 
-        Reviewed by Gustavo Noronha.
+        * html/Blob.cpp:
+        * html/Blob.h:
 
-        [Soup] Limit the number of connections
-        https://bugs.webkit.org/show_bug.cgi?id=18431
+2010-03-02  Adam Treat  <atreat@rim.com>
 
-        Increase the maximum number of per host and total connections to
-        similar values than those used by the other modern browsers. Seems
-        to significantly improve page loading time in many cases.
+        Reviewed by Dave Hyatt.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ensureSessionIsInitialized):
+        Refactor the HostWindow methods for repaint, scroll, invalidate and blit
+        of backingstore and window by eliminating the three bools that currently
+        exist as params of the repaint method.
+        https://bugs.webkit.org/show_bug.cgi?id=34214
 
-2009-09-07  Michael Nordman  <michaeln@google.com>
+        I've added extra methods to provide the hosts with more semantic
+        information of what is being requested thus eliminating the need for
+        these bools.
 
-        Reviewed by Darin Fisher.
+        No tests as this change should not introduce any behavior changes in any
+        of the ports.
 
-        Various minor chromium appcache modifications.
-        https://bugs.webkit.org/show_bug.cgi?id=28960
+        https://bugs.webkit.org/show_bug.cgi?id=34214
 
-        No new tests.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::invalidateContents):
+        (WebCore::EmptyChromeClient::invalidateWindow):
+        (WebCore::EmptyChromeClient::invalidateContentsAndWindow):
+        (WebCore::EmptyChromeClient::invalidateContentsForSlowScroll):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::invalidateContents):
+        (WebCore::Chrome::invalidateWindow):
+        (WebCore::Chrome::invalidateContentsAndWindow):
+        (WebCore::Chrome::invalidateContentsForSlowScroll):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::wheelEvent):
 
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-          Fix a null pointer exception.
-        (WebCore::ACCESSOR_GETTER):
-        * platform/network/chromium/ResourceRequest.h:
-          Switch from appCache 'context' to 'host' terminology.
-          Note: leaving the old deprecated accessors in place until the matching
-          change in chrome is landed to use the new accessors.
-        (WebCore::ResourceRequest::ResourceRequest):
-        (WebCore::ResourceRequest::appCacheHostID):
-        (WebCore::ResourceRequest::setAppCacheHostID):
-        (WebCore::ResourceRequest::appCacheContextID):
-        (WebCore::ResourceRequest::setAppCacheContextID):
-        * platform/network/chromium/ResourceResponse.h:
-          Add an appCacheManifestURL getter/setter.
-          Drop the 'get' prefix from the appCacheID getter.
-          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
-          change in chrome is landed to use the new accessor.
-        (WebCore::ResourceResponse::appCacheID):
-        (WebCore::ResourceResponse::appCacheManifestURL):
-        (WebCore::ResourceResponse::setAppCacheManifestURL):
-        (WebCore::ResourceResponse::getAppCacheID):
+2010-03-08  Adam Barth  <abarth@webkit.org>
 
-2009-09-07  Michael Nordman  <michaeln@google.com>
+        Reviewed by Nate Chapin.
 
-        Reviewed by Alexey Proskuryakov.
+        [V8] Block popups from inline script
+        https://bugs.webkit.org/show_bug.cgi?id=35474
 
-        https://bugs.webkit.org/show_bug.cgi?id=28359
-        Cleanup: Undo some accidental changes around DOMApplicationCache.
-        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
-        - Return a non-null object for window.applicationCache when the feature is disabled.
-        - Simplify the swapCache method.
+        Apparently, we're supposed to look at the sourceURL to figure out
+        whether we're running a script tag or a hyperlink.  This logic is
+        copied from the JSC version.
 
-        Test: http/tests/appcache/disabled.html
+        Test: http/tests/security/popup-blocked-from-window-open.html
 
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::DOMApplicationCache):
-        (WebCore::DOMApplicationCache::swapCache):
-        (WebCore::DOMApplicationCache::scriptExecutionContext):
-        * loader/appcache/DOMApplicationCache.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::applicationCache):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
 
-2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
 
         Reviewed by Darin Adler.
 
-        hostname and host are mixed up when manipulating anchor elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28954
-
-        handle the case of port 0.
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::host):
-
-2009-09-06  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Make hidden elements not focusable.
-
-        Clean up supportsFocus and isFocusable.
-        supportsFocus now strictly means that the node can be focused by default.
-        This is true for links, form controls and content editable elements for example.
-        isFocusable means that the user can actually focus it.
-        All (2) calls to supportsFocus have been updated to take this into account.
-        
-        Make a elements without href work correctly as well.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27099
-
-        Tests: fast/events/click-focus-anchor.html
-               fast/events/tab-focus-anchor.html
-               fast/events/tab-focus-hidden.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::focus):
-        * dom/Node.cpp:
-        (WebCore::Node::supportsFocus):
-        (WebCore::Node::isFocusable):
-        * dom/Node.h:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::supportsFocus):
-        (WebCore::HTMLAnchorElement::isMouseFocusable):
-        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
-        * html/HTMLAnchorElement.h:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::supportsFocus):
-        * html/HTMLAreaElement.h:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::supportsFocus):
-        * html/HTMLElement.h:
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::supportsFocus):
-        * html/HTMLFieldSetElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::supportsFocus):
-        (WebCore::HTMLFormControlElement::isFocusable):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::supportsFocus):
-        * html/HTMLFrameElementBase.h:
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::supportsFocus):
-        * html/HTMLLegendElement.h:
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::supportsFocus):
-        (WebCore::HTMLOptGroupElement::isFocusable):
-        * html/HTMLOptGroupElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::supportsFocus):
-        (WebCore::HTMLOptionElement::isFocusable):
-        * html/HTMLOptionElement.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dispatchMouseEvent):
-        * page/FocusController.cpp:
-        (WebCore::FocusController::advanceFocus):
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::supportsFocus):
-        (WebCore::SVGAElement::isFocusable):
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::supportsFocus):
-        * wml/WMLAElement.h:
-        * wml/WMLFormControlElement.cpp:
-        (WebCore::WMLFormControlElement::supportsFocus):
-        (WebCore::WMLFormControlElement::isFocusable):
-        * wml/WMLFormControlElement.h:
-
-2009-09-06  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by Dimitri Glazkov.
-
-        Expose functions to set the caret blink interval for Linux Chromium.
-        Default value is set to that of RenderTheme::caretBlankInterval().
-        Uses caretBlinkIntervalInternal to avoid overriding
-        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
-        of blinking caret required for layout tests.
-        https://bugs.webkit.org/show_bug.cgi?id=28931
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
-        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-06  Ada Chan  <adachan@apple.com>
-
-        Remove an extra </File> in WebCore.vcproj.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-06  Timothy Hatcher  <timothy@apple.com>
-
-        Adds a persistent setting for color format in the Web Inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28889
-
-        Reviewed by Dan Bernstein.
-
-        * English.lproj/localizedStrings.js: New strings.
-        * inspector/front-end/Color.js: Minor style fixes.
-        (WebInspector.Color.prototype.toString): Added. Replaces the individual
-        "toFoo" functions. Takes a optional arguments for the color format to return.
-        * inspector/front-end/Images/paneSettingsButtons.png: Added.
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
-        the new color format.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
-        Use the new toString function on Color.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
-        to format colors by default. Add a tooltip for the color swatch.
-        * inspector/front-end/inspector.css: New styles for the settings menu.
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded): Initilize the colorFormat preference.
-
-2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
-        https://bugs.webkit.org/show_bug.cgi?id=28993
-
-        * platform/network/qt/DnsPrefetchHelper.cpp:
-        * platform/network/qt/DnsPrefetchHelper.h:
-
-2009-09-06  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Drop <definition-src> support
-        https://bugs.webkit.org/show_bug.cgi?id=28991
-
-        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+        Move the details of secure text mode into WebCore/platform.
+        Move the higher-level logic for secure text mode from Frame
+        to SelectionController.
 
-        * DerivedSources.cpp: Remove references to definition-src.
-        * DerivedSources.make: Ditto.
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * bindings/objc/DOM.mm:
-        (WebCore::createElementClassMap): Ditto.
-        * bindings/objc/DOMSVG.h: Ditto.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
-        * bindings/v8/V8DOMWrapper.cpp: Ditto.
-        * bindings/v8/V8Index.cpp: Ditto.
-        * bindings/v8/V8Index.h: Ditto.
-        * svg/SVGAllInOne.cpp: Ditto.
-        * svg/SVGDefinitionSrcElement.cpp: Removed.
-        * svg/SVGDefinitionSrcElement.h: Removed.
-        * svg/SVGDefinitionSrcElement.idl: Removed.
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
-        definition-src child.
-        * svg/svgtags.in: Remove definition-src.
-
-2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
-        logic of retrieving default caret blink interval was incorrect (non-existent)
-        and caused layout test flakiness.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-05  Jian Li  <jianli@chromium.org>
-
-        Reviewed by NOBODY (Chromium reliability build break).
-
-        Back up partial change in r48072 in order to fix chromium reliability build break.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-
-2009-09-05  Nicolas Weber  <thakis@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28975
-        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
-        such as screenshots by default, can now be uploaded to sites such as
-        imgur.com.
-
-        * platform/FileSystem.h:
-        Add pathGetDisplayFileName().
-        * platform/chromium/FileChooserChromium.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-        Call pathGetDisplayFileName() instead of pathGetFileName().
-        * platform/chromium/FileSystemChromiumLinux.cpp:
-        (WebCore::pathGetDisplayFileName):
-        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
-        * platform/chromium/FileSystemChromiumMac.mm:
-        (WebCore::pathGetFileName):
-        Now returns a real filename instead of a presentational one, which
-        fixes the problem addressed by this change.
-        (WebCore::pathGetDisplayFileName):
-        New function that returns a presentational filename; does what
-        pathGetDisplayFileName() did prior to this patch.
-        * platform/chromium/FileSystemChromiumWin.cpp:
-        (WebCore::pathGetDisplayFileName):
-        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
-
-2009-09-05  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by David Levin.
-
-        Expose functions to set the caret blink interval for Linux Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=28931
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
-        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-04  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        Prevent UI freeze in case when too many timers are in the timer queue.
-        https://bugs.webkit.org/show_bug.cgi?id=23865
-
-        The fix measures the elapsed time while executing timers. If we have too many
-        timers and it takes significant time to fire, quit the loop and reschedule.
-        This lets the run loop process user input (close the window for example).
-
-        * platform/ThreadTimers.h:
-        * platform/ThreadTimers.cpp:
-        (WebCore::ThreadTimers::sharedTimerFiredInternal):
-        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
-        Removed functions and members used before to grab a list of all expired timers.
-        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
-        * platform/Timer.cpp:
-        (WebCore::TimerBase::isActive):
-        (WebCore::TimerBase::setNextFireTime):
-        Since timers are now fired one by one, there is no need to keep track of updated timers.
-        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
-        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
-        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
-        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
-        eventSender, which does not reproduce the UI freeze that happens with real input.
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/7201063>
-        
-        Detach any custom scrollbars before detaching the document.
-        
-        * page/Frame.cpp:
-        (WebCore::Frame::setView):
-
-2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-                Unreviewed, build fix.
-
-                Remove remaining references to UserStyleSheetLoader after r48075.
-
-                * WebCore.gypi:
-                * WebCore.xcodeproj/project.pbxproj:
-                * page/qt/FrameQt.cpp:
-                * page/wince/FrameWince.cpp:
-
-2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=31265
 
-                Reviewed by David Levin.
+        No new tests: no functional changes.
 
-                https://bugs.webkit.org/show_bug.cgi?id=28988
-                Minor fix: "novalidate" attribute renamed in "noValidate", according to
-                HTML5 specs:
-                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
-
-                * html/HTMLFormElement.cpp:
-                (WebCore::HTMLFormElement::noValidate):
-                (WebCore::HTMLFormElement::setNoValidate):
-                * html/HTMLFormElement.h:
-                * html/HTMLFormElement.idl:
-
-2009-09-04  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        Remove unused line of code from WorkerContext
-        https://bugs.webkit.org/show_bug.cgi?id=28990
-
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-
-2009-09-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix assertion seen when running buildbot.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
-        the HasDefaultMark bit since this has a custom mark function.
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
-        Make sure the other code path (now used by everybody) can handle data URLs.
-
-        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
-        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
-        that anybody is relying on this support.
-        
-        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
-        code.
-
-        * WebCore.pro:
+        * WebCore.gypi:
         * WebCore.xcodeproj/project.pbxproj:
         * dom/Document.cpp:
-        (WebCore::Document::userStyleSheet):
-        * dom/Document.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * loader/UserStyleSheetLoader.cpp: Removed.
-        * loader/UserStyleSheetLoader.h: Removed.
+        (WebCore::Document::setUseSecureKeyboardEntryWhenActive):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        (WebCore::SelectionController::updateSecureKeyboardEntryIfActive):
+        (WebCore::SelectionController::setUseSecureKeyboardEntry):
+        * editing/SelectionController.h:
         * page/Frame.cpp:
-        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::setDocument):
         * page/Frame.h:
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
-        (WebCore::Page::userStyleSheet):
-        * page/mac/FrameMac.mm:
-        * page/qt/FrameQt.cpp:
-
-2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Add "sampling profiler" preference, simplify data display when it's set.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28969
-
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
-        (WebInspector.ProfileDataGridNode.prototype.get data):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView):
-        * inspector/front-end/inspector.js:
+        * platform/SecureTextInput.cpp: Added.
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
+        * platform/SecureTextInput.h: Added.
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
 
-2009-09-04  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
-        https://bugs.webkit.org/show_bug.cgi?id=28980
-
-        Tested by worker-close.html.
-
-        * bindings/v8/ScriptFunctionCall.cpp:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::getScriptExecutionContext):
-        (WebCore::reportException):
-        * bindings/v8/V8Utilities.h:
-        (WebCore::getScriptExecutionContext):
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
+2010-03-08  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Anders Carlsson.
 
-        Remove unused m_sheet variable and setCSSStyleSheet methods.
+        Relax the 3rd party cookie policy in cases where it won't add a new tracking vector.
+        <rdar://problem/7163012> and https://bugs.webkit.org/show_bug.cgi?id=35824
 
-        * dom/Document.cpp:
-        * dom/Document.h:
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by David Hyatt and Adele Peterson.
-
-        (Based on a patch from Adele).
-        
-        Fix <rdar://problem/7185875>.
-        
-        * page/Frame.cpp:
-        (WebCore::Frame::setView):
-        Detach any custom scroll bars from the old view.
-        
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
-        not a RenderPart object.
+        Test: http/tests/cookies/third-party-cookie-relaxing.html
 
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+        If the 3rd-party domain in question already has a cookie set, allow changes
+        by setting the first party url of the request to be the url of the request itself:        
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::makeFinalRequest):
 
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
+        Ditto:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
 
-        Reviewed by Adam Roben.
+        I've filed <rdar://problem/7728508> to track changing the policy in our networking layer.
 
-        Make m_userStyleSheetLoader in Frame an OwnPtr.
+2010-03-08  Jian Li  <jianli@chromium.org>
 
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::~Frame):
-        * page/Frame.h:
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::setUserStyleSheetLocation):
-        (WebCore::Frame::setUserStyleSheet):
-
-2009-09-04  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Dmitry Titov.
 
-        Show color swatches in the Web Inspector before the color text so clicking them will not
-        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+        
+        The following semantic is adopted per the discussions on public-webapps:
+        1) File.slice() does a synchronous IO to capture the current size and
+           modification time and cache them in the resulting Blob.
+        2) Subsequent Blob operations, like Blob.slice and Blob.size simply
+           use the cached values.
+        3) When the underlying file data are accessed, like in XHR.send(), the
+           UA will check the cached modification time against the current
+           modification time to determine if the file has been changed or not.
+           An error or exception will be thrown if needed.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28978
+        Also add ENABLE_BLOB_SLICE feature define.
 
-        Reviewed by Darin Adler.
+        Test: http/tests/local/send-sliced-dragged-file.html
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
-        the processing we do on the property value. This eliminated the old nickname code, since the new
-        WebInspector.Color class handles this. We could also simplify the color regex since more
-        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
-        process a value given a regex and processor functions. 
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
-        URL with "url()" syntax surrounding it.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
-        there was an exception just return a text node.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
-        Moved from later in the file.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
-        * inspector/front-end/inspector.css:
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * html/Blob.cpp:
+        (WebCore::Blob::Blob):
+        (WebCore::Blob::size):
+        (WebCore::Blob::slice):
+        * html/Blob.h:
+        (WebCore::Blob::start):
+        (WebCore::Blob::length):
+        (WebCore::Blob::modificationTime):
+        * html/Blob.idl:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        (WebCore::FormData::appendFile):
+        (WebCore::FormData::appendFileRange):
+        * platform/network/FormData.h:
+        (WebCore::FormDataElement::FormDataElement):
+        (WebCore::operator==):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::openNextStream):
+        (WebCore::formCreate):
+        (WebCore::formOpen):
+        (WebCore::formRead):
+        (WebCore::setHTTPBody):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
 
-2009-09-04  Mark Mentovai  <mark@chromium.org>
+2010-03-08  Daniel Bates  <dbates@rim.com>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28614
+        https://bugs.webkit.org/show_bug.cgi?id=34819
 
-        Account for scrollbar state changes that occur during layout.
+        Fixes an issue where we repaint the caret rectangle even if the associated
+        selection is not in a content editable element. This is extraneous since the
+        caret is only visible when the selection is in a content editable element.
+        Hence, we should only repaint the caret rectangle when the associated selection
+        is in a content editable element.
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
+        Note, we always paint the caret when caret browsing is enabled.
 
-        Perform a layout prior to checking whether the scrollbar modes are
-        off, on, or automatic.  The modes may change during layout.
+        Test: fast/repaint/no-caret-repaint-in-non-content-editable-element.html
 
-        * WebCore.base.exp:
-        * WebCore.order:
-        * page/Frame.cpp:
-        (WebCore::Frame::createView):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::resetScrollbars):
-        (WebCore::FrameView::layout):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-
-        Eliminate duplicated (and incorrect) scrollbar mode tracking between
-        FrameView and ScrollView.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect): Modified to call method
+        SelectionController::shouldRepaintCaret.
+        (WebCore::SelectionController::shouldRepaintCaret): Added.
+        (WebCore::SelectionController::invalidateCaretRect): Modified to call method
+        SelectionController::shouldRepaintCaret.
+        * editing/SelectionController.h:
 
-2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-08  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Darin Adler.
 
-        hostname and host are mixed up when manipulating anchor elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28954
-
-        Swapped the implementation of host and hostname, and made sure not to return
-        the port number if it is default for the given protocol. 
-        FireFox also avoids returning the protocol number if it is default.
+        YouTube HTML5 video never starts playing on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=33954
 
-        Test: fast/dom/Element/hostname-host.html
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::host):
-        (WebCore::HTMLAnchorElement::hostname):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
-        * page/SecurityOrigin.h:
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler and Steve Falkenburg.
-
-        Fix <rdar://problem/7192902>.
-
-        Add the necessary plumbing for having QTMovieWin use WebCore timers.
-        
         * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::TaskTimer::initialize):
-        Create the timer and call QTMovieWin::setTaskTimerFuncs.
-        
-        (WebCore::TaskTimer::setTaskTimerDelay):
-        Start the timer.
-        
-        (WebCore::TaskTimer::stopTaskTimer):
-        Stop the timer.
-        
-        (WebCore::TaskTimer::fired):
-        Call QTMovieWin::taskTimerFired().
-        
-        (WebCore::MediaPlayerPrivate::load):
-        Initialize the Task timer.
-        
-        * platform/graphics/win/QTMovieWin.cpp:
-        (updateTaskTimer):
-        Call the global stopTaskTimer function and setTaskTimerDelay.
-        
-        (QTMovieWin::taskTimerFired):
-        Make this a member function.
-        
-        (QTMovieWin::setTaskTimerFuncs):
-        Set the global function pointers.
-        
-        (QTMovieWin::initializeQuickTime):
-        (DllMain):
-        No need to use the QT shared timer.
-        * platform/graphics/win/QTMovieWin.h:
+        (WebCore::MediaPlayerPrivate::rfc2616DateStringFromTime): New, create an rfc 2616 formatted
+        string for an absolute time value.
+        (WebCore::addCookieParam): New, add a cookie param and value to a string builder.
+        (WebCore::MediaPlayerPrivate::setUpCookiesForQuickTime): Copy cookies for the movie to
+            be loaded from CFNetwork into WinINet so they are available when QuickTime tries to
+            download the movie.
+        (WebCore::MediaPlayerPrivate::load): Call setupCookiesForQuickTime.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
 
-2009-09-04  Tony Chang  <tony@chromium.org>
+2010-03-08  Eric Uhrhane  <ericu@chromium.org>
 
         Reviewed by David Levin.
 
-        Fix Chromium Win compile.  Missing return statement in
-        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
-        https://bugs.webkit.org/show_bug.cgi?id=28974
-
-        No new tests, build fix.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
-
-2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
+        Remove the now-redundant Settings fields for the Database
+        https://bugs.webkit.org/show_bug.cgi?id=35763
 
-        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
-        the build.
-        https://bugs.webkit.org/show_bug.cgi?id=28696
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Fix vcproj file.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-03  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
-        
-        This patch adds new API for adding and removing user scripts from page groups.  User scripts
-        are bundled together in isolated worlds (you can have multiple scripts together in the same
-        world).
-
-        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+        No new tests; this code isn't called.
 
         * WebCore.base.exp:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        * bindings/js/ScriptController.h:
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        * bindings/v8/ScriptController.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScripts):
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/Frame.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::~PageGroup):
-        (WebCore::PageGroup::addUserScript):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        (WebCore::PageGroup::removeAllUserContent):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userScripts):
-        * page/UserScript.h: Added.
-        (WebCore::UserScript::UserScript):
-        (WebCore::UserScript::source):
-        (WebCore::UserScript::url):
-        (WebCore::UserScript::patterns):
-        (WebCore::UserScript::worldID):
-        (WebCore::UserScript::injectionTime):
-        * page/UserScriptTypes.h: Added.
-        (WebCore::):
-
-2009-09-04  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26402
-        Crashes when using a detached DocumentType node
-
-        Test: fast/dom/DOMImplementation/detached-doctype.html
-
-        DocumentType nodes are the only one that can have null document(), and they can never have
-        children, so they are a degenerate case for NodeLists.
-
-        * dom/Node.cpp:
-        (WebCore::Node::childNodes): Don't try register node list with document if there's no
-        document. Since there are no changes possible for a DocumentType's node list, this is not
-        necessary.
-        (WebCore::Node::registerDynamicNodeList): Ditto.
-        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
-        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
-        de-registration code path that I saw taken was via Node destructor, and that already has
-        a null check for document).
-
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
-        if there is no window).
-        (WebCore::JSNode::removeEventListener): Ditto.
-
-2009-09-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] loadFinished never emitted
-        https://bugs.webkit.org/show_bug.cgi?id=28935
-
-        Do not report errors right away from
-        ResourceHandle::start. Instead return true and schedule an error
-        to be reported in the handle later. Otherwise WebCore gets
-        confused and thinks the resource never finished loading, making it
-        not emit the finished status.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-09-04  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Eric Seidel.
-
-        [V8] DOM Storage bindings: Event Handler should create StorageEvents
-        https://bugs.webkit.org/show_bug.cgi?id=28942
-        
-        Tests:
-        Causes the following tests that were failing with V8 to pass:
-        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
-        * storage/domstorage/localstorage/complex-keys.html
-        * storage/domstorage/localstorage/onstorage-attribute-markup.html
-        * storage/domstorage/localstorage/simple-events.html
-        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
-        * storage/domstorage/localstorage/index-get-and-set.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
-        * storage/domstorage/sessionstorage/simple-events.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
-        * storage/domstorage/sessionstorage/index-get-and-set.html
-
-        Code changes:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
-
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28911
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::dispatchOnInjectedScript):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._formatarray):
-        (WebInspector.ConsoleView.prototype._formatnode):
-        * inspector/front-end/DOMAgent.js:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel.prototype.searchCanceled):
-        (WebInspector.ElementsPanel.prototype.performSearch):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.dispatch):
-        * inspector/front-end/InjectedScriptAccess.js: Added.
-        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
-        (InjectedScriptAccess._installHandler):
-        * inspector/front-end/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.html:
-
-2009-09-04  Tony Chang  <tony@chromium.org>
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
 
-        Reviewed by Eric Seidel.
+2010-03-07  David Levin  <levin@chromium.org>
 
-        Implement <input type="range"> for Chromium Linux by painting
-        the slider and the thumb using skia.
-        https://bugs.webkit.org/show_bug.cgi?id=28928
+        Chromium Linux build fix.
 
-        Covered by existing tests (we're currently hitting an assert for them).
+        * platform/graphics/chromium/FontPlatformDataLinux.h: Add "class String" since a debug
+        only method returns a String.
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::drawVertLine):
-        (WebCore::drawHorizLine):
-        (WebCore::drawBox):
-        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
-        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
-        * rendering/RenderThemeChromiumSkia.h:
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-2009-09-04  Kent Tamura  <tkent@chromium.org>
+        Chromium build fix.
 
-        Reviewed by Eric Seidel.
+        * platform/chromium/ClipboardChromium.cpp: Include Image.h since we're using WebCore::Image.
 
-        - Implement <input type=color> as a text field.
-        - ValidityState::typeMismatch supports for type=color.
-        https://bugs.webkit.org/show_bug.cgi?id=28966
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
-               fast/forms/ValidityState-typeMismatch-color.html
+        Gtk build fix.
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::valueMissing):
-        (WebCore::HTMLInputElement::patternMismatch):
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::formControlType):
-        (WebCore::HTMLInputElement::saveFormControlState):
-        (WebCore::HTMLInputElement::restoreFormControlState):
-        (WebCore::HTMLInputElement::accessKeyAction):
-        (WebCore::HTMLInputElement::rendererIsNeeded):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::appendFormData):
-        (WebCore::HTMLInputElement::valueWithDefault):
-        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::isRequiredFormControl):
-        (WebCore::HTMLInputElement::dataList):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::):
-        (WebCore::HTMLInputElement::isTextField):
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
-        (WebCore::ValidityState::isValidColorString):
-        * html/ValidityState.h:
+        * platform/network/soup/ResourceHandleSoup.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-2009-09-04  Mads Ager  <ager@chromium.org>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by David Levin.
+        Gtk build fix.
 
-        [V8] Crash when updating document cache
-        https://bugs.webkit.org/show_bug.cgi?id=28965
+        * platform/graphics/gtk/ImageGtk.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-        Initialization of a V8 JavaScript context can fail.  When that
-        happens, do not attempt to update the document wrapper cache.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+        Fix builds where USE_CG_SHADING is set.
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocument):
+        * platform/graphics/cg/GradientCG.cpp: Include wtf/RetainPtr.h since WTF::RetainPtr is used when USE_CG_SHADING is set.
 
-2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Eric Seidel.
+        Windows build fix.  Add some required includes.
 
-        Two bugs:
+        * platform/graphics/win/ImageCGWin.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/win/ClipboardWin.cpp:
 
-        https://bugs.webkit.org/show_bug.cgi?id=25489
-        CSS property background-position is now serialized in shorthand string as
-        background-position-x background-position-y, as the specification requires
-        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
-        
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26541
-        CSS background-color is now be serialized before other background properties, 
-        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+        Gtk build fix.
 
-        An existing layout test that accepted wrong order and skipped position test 
-        had to be modified.
+        * platform/graphics/GraphicsContext.h: Include wtf/PassOwnPtr.h since some platforms use WTF::PassOwnPtr in this header.
 
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-2009-09-03  Kent Tamura  <tkent@chromium.org>
+        Qt build fix.
 
-        Reviewed by David Levin.
+        * platform/network/qt/ResourceHandleQt.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-        Add support for HTMLTextAreaElement.textLength
-        https://bugs.webkit.org/show_bug.cgi?id=28929
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Test: fast/forms/textarea-textlength.html
+        Gtk build fix.
 
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::textLength):
-        * html/HTMLTextAreaElement.idl:
+        * platform/gtk/ClipboardGtk.cpp: Include Image.h since we're using WebCore::Image.
 
-2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Darin Adler.
+        Rubber-stamped by Cameron Zwarich.
 
-        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
-        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+        Remove unnecessary includes from header files, adding them to the handful of implementation files that need them.
 
-        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+        * loader/CachedCSSStyleSheet.cpp:
+        * loader/CachedFont.cpp:
+        * loader/CachedImage.cpp:
+        * loader/CachedResource.cpp:
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        * loader/CachedXSLStyleSheet.cpp:
+        * loader/icon/IconFetcher.cpp:
+        * loader/loader.cpp:
+        * page/Page.cpp:
+        * platform/graphics/Image.cpp:
+        * platform/graphics/Image.h:
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/mac/ImageMac.mm:
 
-        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
-        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
-        DocumentType node in two documents.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-2009-09-03  Brady Eidson  <beidson@apple.com>
+        Chromium build fix.
 
-        Reviewed by Sam Weinig.
+        * platform/chromium/ChromiumDataObject.h: Include SharedBuffer.h since the inline constructor of this
+        class means that the pointed-to type of the RefPtr member must be available.
 
-        Page Cache should support pages with Frames.
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
-               fast/loader/frames-with-unload-handlers-in-page-cache.html
+        Qt build fix.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * platform/network/qt/DnsPrefetchHelper.cpp: Include PlatformString.h since we're using WebCore::String.
 
-2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+2010-03-07  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Handle middle click in Chromium like QT
-        https://bugs.webkit.org/show_bug.cgi?id=28696
+        Fix a bug that validity.valueMissing for a radio button with required
+        in a form element always returns true.
+        https://bugs.webkit.org/show_bug.cgi?id=35472
 
-        Tested by middle-click-onpaste.html.
+        Test: fast/forms/ValidityState-valueMissing-radio.html
 
-        * platform/Pasteboard.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::getData):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::isSelectionMode):
-        (WebCore::Pasteboard::setSelectionMode):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        * platform/chromium/PasteboardPrivate.h:
-        (WebCore::PasteboardPrivate::):
-
-2009-09-03  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        Fix a bug where subframes weren't asked if they were cacheable.
-
-        No new tests, especially since page caching for frames isn't turned on yet.
-        A layout test will come in my next patch, which enables frames in the page cache.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-
-2009-09-03  Adam Barth  <abarth@webkit.org>
+        * html/HTMLInputElement.cpp:
+        (WebCore::checkedRadioButtons): Move the location to be used by valueMissing().
+        (WebCore::HTMLInputElement::valueMissing):
+          Use checkedRadioButtons() instead of document()->checkedRadioButtons().
 
-        Reviewed by eric@webkit.org.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=24696
+        Rubber-stamped by Cameron Zwarich.
 
-        Added mixed content methods to FrameLoaderClient.
+        Remove unnecessary includes from header files, adding them to the handful of implementation files that need them.
 
+        * bindings/objc/DOM.mm:
+        * loader/CachedImage.h:
         * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
-        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
-        * loader/FrameLoaderClient.h:
-
-2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        * platform/text/CString.h:
+        * platform/text/String.cpp:
+        * platform/text/mac/TextCodecMac.cpp:
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/filters/SVGFEImage.h:
 
-        [wx] Frames support
-        https://bugs.webkit.org/show_bug.cgi?id=19041
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passMousePressEventToSubframe):
-        (WebCore::EventHandler::passMouseMoveEventToSubframe):
-        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::nativeWindowForRenderObject):
-        (WebCore::RenderThemeWx::paintButton):
-        (WebCore::RenderThemeWx::paintTextField):
-        (WebCore::RenderThemeWx::paintMenuList):
-        (WebCore::RenderThemeWx::paintMenuListButton):
-        * platform/wx/ScrollbarThemeWx.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
-        (WebCore::ScrollbarThemeWx::scrollbarThickness):
-        (WebCore::ScrollbarThemeWx::hasThumb):
-        (WebCore::ScrollbarThemeWx::buttonSize):
-        (WebCore::ScrollbarThemeWx::backButtonRect):
-        (WebCore::ScrollbarThemeWx::forwardButtonRect):
-        (WebCore::ScrollbarThemeWx::trackRect):
-        (WebCore::ScrollbarThemeWx::paintScrollCorner):
-        (WebCore::ScrollbarThemeWx::paint):
-        * platform/wx/ScrollbarThemeWx.h: Added.
-        (WebCore::ScrollbarThemeWx::hasButtons):
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
-        (wxStyleForPart):
-        (GetButtonWidget):
-        (wxGetGdkWindowForDC):
-        (wxRenderer_DrawScrollbar):
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
-        (wxScrollbarPartToHIPressedState):
-        (wxRenderer_DrawScrollbar):
-        * platform/wx/wxcode/scrollbar_render.h: Added.
-        (calcThumbStartAndLength):
-        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
-        (GraphicsHDC::GraphicsHDC):
-        (GraphicsHDC::~GraphicsHDC):
-        (GraphicsHDC::operator HDC):
-        (getTSStateForPart):
-        (wxRenderer_DrawScrollbar):
-        * webcore-wx.bkl:
+        Completely remove two files that were deleted in r55635 from the Xcode project.
 
-2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Reviewed by Simon Hausmann.
+2010-03-07  Sam Weinig  <sam@webkit.org>
 
-        [Qt] Page content is not displayed in case of HTTP status error
-        https://bugs.webkit.org/show_bug.cgi?id=28949
+        Reviewed by Dan Bernstein.
 
-        If the server sent content, show it to the user instead of an error,
-        even if the HTTP status code is not success.
+        Remove inconsistent "Too few arguments" handling for window.atob() and window.btoa()
+        https://bugs.webkit.org/show_bug.cgi?id=35848
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::resetState):
-        * platform/network/qt/QNetworkReplyHandler.h:
+        - Take the opportunity to fully autogenerate window.atob() and window.btoa().
 
-2009-09-03  Drew Wilson  <atwilson@google.com>
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+        * page/DOMWindow.idl:
 
-        Reviewed by Dimitri Glazkov.
+2010-03-07  Dan Bernstein  <mitz@apple.com>
 
-        Need to update v8 bindings to support passing multiple ports to postMessage()
-        https://bugs.webkit.org/show_bug.cgi?id=28839
+        Reviewed by Simon Fraser.
 
-        Added support for passing MessagePortArray to v8 bindings.
+        <rdar://problem/7722008> Column breaking ignores floats
+        https://bugs.webkit.org/show_bug.cgi?id=35837
 
-        New tests that now pass with V8:
-               fast/events/message-port-multi.html
-               fast/workers/worker-context-multi-port.html
-               fast/workers/worker-multi-port.html
+        Test: fast/multicol/float-truncation.html
 
-        * WebCore.gypi:
-        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added custom postMessage() handlers for various classes.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::DOMWindowPostMessage):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        (WebCore::DedicatedWorkerContextPostMessage):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
-        (WebCore::MessageEventPorts):
-        Added getter for ports attribute.
-        (WebCore::MessageEventInitMessageEvent):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::MessagePortPostMessage):
-        Added custom handler that supports MessagePortArray.
-        (WebCore::getMessagePortArray):
-        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
-        * bindings/v8/custom/V8MessagePortCustom.h: Added.
-        Added declaration for getMessagePortArray().
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::WorkerPostMessage):
-        Added custom handler that supports MessagePortArray.
+        Introduce an earlier column-break if otherwise a float that could fit
+        inside a single column will be split between columns.
 
-2009-09-03  Drew Wilson  <atwilson@google.com>
+        It is still possible for floats to be needlessly broken if initially
+        they fit in the column, but normal flow truncation then shortens the
+        column.
 
-        Reviewed by Sam Weinig.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::visibleTopOfHighestFloatExtendingBelow): Added.
+        Returns the visible top of the highest descendant float that visibly
+        extends below the given y offset, ignoring floats that are taller than
+        the given maximum height.
+        (WebCore::RenderBlock::layoutColumns): If the initial column height
+        would cause a float to be split, truncate above the float.
+        * rendering/RenderBlock.h:
 
-        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
-        https://bugs.webkit.org/show_bug.cgi?id=28460
+2010-03-07  Dmitry Titov  <dimich@chromium.org>
 
-        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+        Not reviewed. Revert of r55593 which caused a regression of worker-cloneports.html.
 
-        Tests: fast/events/message-port-multi.html
-               fast/workers/worker-context-multi-port.html
-               fast/workers/worker-multi-port.html
+        REGRESSION(55593?): fast/workers/worker-cloneport.html is timing out on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=35819
 
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::toJSSequence):
-        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
-        * bindings/js/JSDOMBinding.h:
         * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArrays.
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        (WebCore::JSDedicatedWorkerContext::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArrays.
-        * bindings/js/JSMessageEventCustom.cpp: Added.
-        (WebCore::JSMessageEvent::ports):
-        Added custom ports() getter that converts from MessagePortArray to JSArray.
-        (WebCore::JSMessageEvent::initMessageEvent):
-        Added support for passing a MessagePortArray.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArray.
-        (WebCore::fillMessagePortArray):
-        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
-        * bindings/js/JSMessagePortCustom.h: Added.
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArray.
-        * dom/MessageEvent.cpp:
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::ports):
-        Changed ports() to return a MessagePortArray* since this value can be null.
-        * dom/MessageEvent.idl:
-        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
-        * dom/MessagePort.cpp:
-        * dom/MessagePort.h:
-        * dom/MessagePort.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * bindings/js/JSDatabaseCallback.cpp: Removed.
+        * bindings/js/JSDatabaseCallback.h: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.h: Removed.
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
         * page/DOMWindow.h:
         * page/DOMWindow.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * workers/Worker.cpp:
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Do not query non-function call frames for function name.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28799
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.CallFrameProxy):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Crash after typing "clear" and pressing return in inspector console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28684
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._clearConsoleMessages):
-        (InjectedScript._inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-
-2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Squeezed out some performance from string conversion.
-        https://bugs.webkit.org/show_bug.cgi?id=28945
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::data):
-        (WebCore::WebCoreStringResource::length):
-        (WebCore::WebCoreStringResource::atomicString):
-        (WebCore::WebCoreStringResource::string):
-        Avoid calling virtual length method. Be more explicit with
-        external memory computation. Avoid function calls in data and
-        length.
-        (WebCore::):
-        (WebCore::v8StringToWebCoreString):
-        (WebCore::v8StringToAtomicWebCoreString):
-        (WebCore::v8NonStringValueToWebCoreString):
-        (WebCore::v8NonStringValueToAtomicWebCoreString):
-        Avoid extra calls of WebCoreStringResource::toString. When
-        AtomicString is computed pass it immediately when constructing
-        WebCoreStringResource. Use inline buffer for small strings.
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8ValueToWebCoreString):
-        (WebCore::v8ValueToAtomicWebCoreString):
-        (WebCore::toString):
-        Inline dispatch of string vs. non-string values.
-
-2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
-        up V8Proxy lookup.
-        https://bugs.webkit.org/show_bug.cgi?id=28946
-
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::getEnteredImpl):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::getEntered):
-
-2009-09-03  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix a regression bug that maxLength doesn't work for IME input.
-        https://bugs.webkit.org/show_bug.cgi?id=25253
-
-        Tests: fast/forms/input-maxlength-ime-completed.html
-               fast/forms/input-maxlength-ime-preedit.html
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::defaultEventHandler):
-
-2009-09-03  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Make SVGStyleElement title/media/type setters do something
-        https://bugs.webkit.org/show_bug.cgi?id=28828
-
-        Test: svg/dom/style-reflect.html
-
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
-        (WebCore::SVGStyleElement::setType): Ditto.
-        (WebCore::SVGStyleElement::setMedia): Ditto.
-        (WebCore::SVGStyleElement::setTitle): Ditto.
-
-2009-09-03  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28872
-        
-        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
-
-        Test: storage/statement-error-callback.html
-
-        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
-        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
-
-2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding three font-specific files to WebCore:
-        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
-        and FontPlatformData.h
-        https://bugs.webkit.org/show_bug.cgi?id=28131
-
-        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
-        * platform/graphics/haiku/FontPlatformData.h: Added.
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::font):
-        (WebCore::FontPlatformData::size):
-        (WebCore::FontPlatformData::bold):
-        (WebCore::FontPlatformData::oblique):
-        (WebCore::FontPlatformData::hashTableDeletedFontValue):
-
-2009-09-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        No new tests. (No change in behavior, current tests pass).
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
-          only unload, or unload and pagehide.
-        (WebCore::FrameLoader::closeURL):
-        (WebCore::FrameLoader::scheduleRedirection):
-        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
-        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
-          where a page is added to the PageCache.
-        * loader/FrameLoader.h:
-
-        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
-
-2009-09-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        - More CachedFrame destruction work.
-        - Including related Frame and FrameLoader changes and cleanup.
-
-        No new tests. (No change in behavior, current tests pass).
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
-        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
-        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
-          the PageCache, do lightweight cleanup to:
-          A - Prevent referring to a stale Page object.
-          B - Prevent World Leaks of WebKit objects.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
-          in the PageCache. ASSERT that fact.
-        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
-          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
-        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
-          referencing it.
-        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
-        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
-        * loader/FrameLoader.h:
-
-        * page/Frame.cpp:
-        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
-        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
-        * page/Frame.h:
-
-2009-09-02  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Dimitri Glazkov
-
-        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
-        in Chromium. This is to fix a new file added in r28742 since the
-        last patch for this issue.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28410
-
-        No change in the test result.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::getNormalizedTextRun):
-
-2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Correct a typo to fix bustage, caused by r47991.
-        https://bugs.webkit.org/show_bug.cgi?id=27933
-
-        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
-
-2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Add a missing include to fix bustage, caused by r47991.
-        https://bugs.webkit.org/show_bug.cgi?id=27933
-
-        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
-
-2009-09-02  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [Chromium] Implement file support for DragData.
-        https://bugs.webkit.org/show_bug.cgi?id=28896
-
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::containsURL):
-        (WebCore::DragData::asURL):
-        (WebCore::DragData::containsCompatibleContent):
-
-2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
-        https://bugs.webkit.org/show_bug.cgi?id=28920
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::sharedResourceMutex):
-        (WebCore::curl_lock_callback):
-        (WebCore::curl_unlock_callback):
-        (WebCore::ResourceHandleManager::ResourceHandleManager):
-
-2009-09-02  Evan Stade  <estade@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Expose functions to change the focus ring color for Linux Chromium
-
-        https://bugs.webkit.org/show_bug.cgi?id=28887
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
-        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-02  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        SVG Filter premultiplied color support for getImageDate/putImageData
-        [https://bugs.webkit.org/show_bug.cgi?id=27933]
-
-        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
-
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::putImageData):
-
-2009-09-02  Brady Eidson  <beidson@apple.com>
-
-        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::open):
-        * history/CachedFrame.h:
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore):
-
-2009-09-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
-        Removing them is a little trouble, but worth it going forward.
-        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
-        was suggested by Darin Adler.
-
-        No new tests. (No change in behavior)
-
-        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::CachedFrameBase):
-        (WebCore::CachedFrameBase::~CachedFrameBase):
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::openInFrameLoader):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrameBase::document):
-        (WebCore::CachedFrameBase::view):
-        (WebCore::CachedFrameBase::domWindow):
-        (WebCore::CachedFrame::create):
-        (WebCore::CachedFrame::documentLoader):
-        (WebCore::CachedFrame::mousePressNode):
-
-        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
-        thing capable of interacting with FrameLoader::open(CachedFrameBase):
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore):
-        * history/CachedPage.h:
-        (WebCore::CachedPage::documentLoader):
-
-        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
-
-2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
-        https://bugs.webkit.org/show_bug.cgi?id=24866
-
-        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
-        (a list to break out of is inside another list item).
-
-        When the empty list item appears at the end of another list item, WebKit breaks out of
-        the outer list item, and adds new item below the outer list item.
-        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
-
-        Test: editing/execCommand/break-out-of-empty-list-item.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
-
-2009-09-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
-        based on whether a CachedFrame is the main frame or a subframe.
-
-        - Store whether a CachedFrame represents the main frame or a subframe.
-        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
-          are reused and need to start new page loads with an empty frame tree.
-        - Reattach the frame tree to the main frame when restoring it.
-        - open() the cached subframes in their respective loaders when restoring.
-        - Properly clear() and destroy() cached subframes.
-        - When committing to a new page load, and after caching the previous page, only clear the
-          FrameView for the main frame.
-
-        Note that all of above will eventually be necessary as I continue to land this work in pieces,
-        but doesn't actually change any behavior right now because we still refuse to even *try* to
-        cache pages with frames.
-
-        No new tests. No change in behavior, and current tests continue to pass.
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::restore):
-        (WebCore::CachedFrame::clear):
-        (WebCore::CachedFrame::destroy):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrame::isMainFrame):
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
-
-2009-09-02  Brady Eidson  <beidson@apple.com>
-
-        No review, build fix.
-
-        http://trac.webkit.org/changeset/47976 broke the build.  
-        Let's try compiling before we land things, shall we?
-
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
-
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
-
-        waf build fixes for Windows/MSVC.
-
-        * wscript:
-
-2009-09-02  Ben Murdoch  <benm@google.com>
-
-        Unreviewed build fix for Chromium.
-
-        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
-
-        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
-
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
-
-        waf build fix, don't define symbols we now grab from other sources.
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        * storage/Database.h:
+        * storage/DatabaseCallback.h: Removed.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        * platform/wx/TemporaryLinkStubs.cpp:
+2010-03-06  Mark Rowe  <mrowe@apple.com>
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        Rubber-stamped by Sam Weinig.
 
-        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop):
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::platformDestroy):
+        * accessibility/AccessibilityObject.h:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerQt.cpp:
+        * editing/TextAffinity.h:
+        * loader/FrameLoaderClient.h:
+        * page/FocusController.cpp:
+        * page/FrameTree.cpp:
+        * page/Geolocation.h:
+        * page/PositionCallback.h:
+        * page/PositionErrorCallback.h:
+        * platform/Cursor.h:
+        * platform/FileSystem.h:
+        * platform/FloatConversion.h:
+        * platform/KeyboardCodes.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformTouchPoint.h:
+        * platform/SuddenTermination.h:
+        * platform/Widget.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/text/Base64.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * xml/XSLTProcessor.cpp:
+        * xml/XSLTProcessorLibxslt.cpp:
+        * xml/XSLTProcessorQt.cpp:
 
-2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+2010-03-06  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Dan Bernstein.
 
-        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+        Move debug only JS wrapper-set tracking code into its own file.
+        https://bugs.webkit.org/show_bug.cgi?id=35839
 
-        No test cases needed since this just fixes the build problem.
+        * GNUmakefile.am: Added new files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
 
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::create):
-        * wml/WMLTableElement.cpp:
-        (WebCore::WMLTableElement::joinSuperflousColumns):
-        (WebCore::WMLTableElement::padWithEmptyColumns):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        Updated for new signature for willCacheWrapper and didUncacheWrapper.
 
-2009-09-02 Yong Li <yong.li@torchmobile.com>
+        * bindings/js/JSDOMWrapper.cpp: Added.
+        (WebCore::DOMObject::~DOMObject):
+        (WebCore::DOMObject::defineOwnProperty):
+        Moved from JSDOMBinding.cpp.
 
-        Reviewed by Adam Barth.
+        * bindings/js/JSDebugWrapperSet.cpp: Added.
+        (WebCore::JSDebugWrapperSet::shared):
+        (WebCore::JSDebugWrapperSet::JSDebugWrapperSet):
+        * bindings/js/JSDebugWrapperSet.h: Added.
+        (WebCore::JSDebugWrapperSet::add):
+        (WebCore::JSDebugWrapperSet::remove):
+        (WebCore::JSDebugWrapperSet::contains):
+        (WebCore::JSDebugWrapperSet::willCacheWrapper):
+        (WebCore::JSDebugWrapperSet::didUncacheWrapper):
+        Moved from JSDOMBinding.cpp.
 
-        WINCE PORT: use shared buffer for custom font data
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+2010-03-06  Sam Weinig  <sam@webkit.org>
 
-        Refactored by Joe Mason <joe.mason@torchmobile.com>
+        Rubber-stamped by Dan Bernstein.
 
-        * loader/CachedFont.cpp:
-        add WINCE to platforms using cached custom data
-        * platform/graphics/opentype/OpenTypeUtilities.cpp:
-        (WebCore::renameFont): implement for WinCE
-        * platform/graphics/opentype/OpenTypeUtilities.h:
-        build fixes
-        * platform/graphics/wince/FontCustomPlatformData.cpp:
-        (WebCore::setCustomFontCache): add accessor
-        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
-        * platform/graphics/wince/FontCustomPlatformData.h:
-        update function signatures 
- 
-2009-09-02 Yong Li <yong.li@torchmobile.com>
+        Move DOMObjectHashTableMap, DOMWrapperWorld and WebCoreJSClientData into
+        their own files.
 
-        Reviewed by Adam Barth.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMObjectHashTableMap.cpp: Copied from bindings/js/JSDOMBinding.cpp.
+        * bindings/js/DOMObjectHashTableMap.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        * bindings/js/DOMWrapperWorld.cpp: Copied from bindings/js/JSDOMBinding.cpp.
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        * bindings/js/DOMWrapperWorld.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::DOMWrapperWorld::create):
+        (WebCore::DOMWrapperWorld::rememberDocument):
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        (WebCore::DOMWrapperWorld::isNormal):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        (WebCore::currentWorld):
+        (WebCore::Document::getWrapperCache):
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/WebCoreJSClientData.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::getAllWorlds):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        * bindings/js/WorkerScriptController.cpp:
 
-        WINCE PORT: font-related build fixes and minor bugfixes
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+2010-03-06  Dan Bernstein  <mitz@apple.com>
 
-        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
-        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+        Rubber-stamped by Sam Weinig.
 
-2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+        Remove an unused method.
 
-        Reviewed by Adam Barth.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Changed comment.
+        (WebCore::RenderBlock::floatRect): Removed.
+        * rendering/RenderBlock.h: Removed floatRect().
 
-        Another pass at releasing the storage mutex.
-        https://bugs.webkit.org/show_bug.cgi?id=28904
+2010-03-06  Pavel Feldman  <pfeldman@chromium.org>
 
-        Another pass at releasing the storage mutex (when applicable) when we finish
-        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
-        describes the required behavior.
+        Reviewed by Timothy Hatcher.
 
-        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
-        the problem correctly.  First of all, I missed that events and timeouts go
-        through a different call path.  Second of all, I didn't consider recursion
-        correctly.  Third of all, my check to see if LocalStorage is alive actually
-        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
-        it.  So I'm reverting that change completely and doing it more cleanly.
-        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
-        implementation for now).
+        Web Inspector: make timeline overview bars transparent to mouse events.
 
-        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
-        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
-        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
-        scenareos where you can have nested callbacks probably should have always been
-        protected by a recursion guard.
+        https://bugs.webkit.org/show_bug.cgi?id=35832
 
-        Unfortunately, this can't be tested without a hook added to the layout test
-        controllers since the lock is (by design) not supposed to be observable by
-        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+        * inspector/front-end/inspector.css:
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): revert
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): revert
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::runScript):
-            Add releaseStorageMutex call.  A small amount of clean up.
-        (WebCore::V8Proxy::callFunction):
-            Add releaseStorageMutex call.  A small amount of clean up.
-        (WebCore::V8Proxy::releaseStorageMutex):
-            Check to see if localStorage has been instantiated.  If so, tell it to
-            unlock all storage areas.
-        * bindings/v8/V8Proxy.h:
-        * page/PageGroup.h:
-        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+2010-03-06  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-09-02  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Adam Barth.
+        Web Inspector: switching to/from Timeline Panel moves scroller.
+        (Also added couple of record details items as I was fixing it).
 
-        WINCE PORT: Implement ImageBuffer for WINCE
-        Implement Image interface with a light class BufferedImage
-        for rendering ImageBuffer
-        https://bugs.webkit.org/show_bug.cgi?id=28167
+        https://bugs.webkit.org/show_bug.cgi?id=35829
 
-        * platform/graphics/wince/ImageBufferData.h: Added.
-        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get defaultFocusedElement):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
 
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
 
         Reviewed by Eric Seidel.
 
-        Join the various PluginView destructors into one shared implementation
+        Removed unnecessary WinCE file.
+        The same functionality is provided by platform/win/SystemTimeWin.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=35799
 
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        * platform/wince/SystemTimeWince.cpp: Removed.
 
-        The Qt port used to delete the platform plugin widget as the last step.
-        Now this is done before cleaning up the script objects and unloading the
-        plugin package, similar to how the Win port does it.
-
-        * plugins/PluginView.cpp:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-03-06  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
         Reviewed by Eric Seidel.
 
-        Share PluginView::init() between ports
+        https://bugs.webkit.org/show_bug.cgi?id=30895
+        [Gtk] The accessible hierarchy of tables is significantly incorrect for Atk
 
-        https://bugs.webkit.org/show_bug.cgi?id=27706
-
-        The port-spesific bits are moved to platformStart(), which now returns
-        a bool based on the success of the platformStart.
-
-        m_hasPendingGeometryChange is now initialized in the initializer list
-        instead of in PluginViewQt's init()
-
-        PluginViewMac (currently used only by the Qt port) used to manually call
-        stop() in the case where an unsupported drawing or event model was detected.
-        This was wrong, as the m_status and m_isStarted fields should be used to
-        guard against doing operations on a plugin in this intermediate state.
-
-        * plugins/PluginView.cpp:
-        * plugins/PluginView.h:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-
-2009-09-02  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28737
-        
-        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
-
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Migrate Databases tab to InjectedScript /
-        serialized interaction.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28873
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/front-end/Database.js:
-        (WebInspector.Database.prototype.isDB):
-        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
-        (WebInspector.Database.prototype.runWithTableNames):
-        (WebInspector.Database.prototype.executeSql):
-        (WebInspector.Database.prototype.executeSql.errorCallback):
-        (WebInspector.Database.prototype.executeSql.queryTransaction):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
-        (WebInspector.DatabaseQueryView.prototype._queryFinished):
-        * inspector/front-end/DatabaseTableView.js:
-        (WebInspector.DatabaseTableView):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.selectDatabase):
-        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
-        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
-        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
-        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
-
-2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed (trivial followup fix). 
-        
-        Web Inspector: Trivial follow up fix to r47944.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::nodeForId):
-
-2009-09-01  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+        This completes the fixing of the Atk table hierarchy which was started
+        in bug #35418.
 
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
         * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (AccessibilityRenderObject::determineAccessibilityRole):
 
-2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28047
-        add utility method to enable logging messages for inspector development
-
-        manual test case added (see below)
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleMessage.prototype.toString):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.log):
-        * manual-tests/inspector/webinspector-log.html: Added.
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        * page/Console.h:
-        (WebCore::):
-
-2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+2010-03-06  MORITA Hajime  <morrita@google.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21990
-        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
-        is mistreated as Shift_JIS
-
-        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
-
-        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
-        This didn't really match any browser, and did cause problems on some sites.
-
-        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
-        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
-        especially in comments. Also, some valid EUC-JP sequences are not known to it.
-
-        Some pages that are fixed by this change:
-
-        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
-        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
-        Firefox and IE.
-
-        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
-        in Safari. There is a stray byte in comments that was makes charset detector think it can't
-        be EUC-JP.
-
-        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
-        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
-        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
-        Shift_JIS in normal HTML view though).
-
-        Test: fast/encoding/japanese-encoding-mix.html
-
-        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
-        detection if there is no solid charset information yet.
-
-2009-09-01  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] FileList cannot be accessed via index in Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=28883
-
-        Tested by clipboard-file-access.html.
-
-        * WebCore.gypi:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8FileListCustom.cpp: Added.
-
-2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Remove the workaround added in r47316.
-
-        Reviewed by Sam Weinig.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::AXObjectCache):
-
-        * accessibility/AXObjectCache.h:
-        Remove the Document argument to the AXObjectCache constructor and the
-        m_document member variable, and replace the no-parameter
-        handleFocusedUIElementChanged() with the two-parameter GTK function.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (fallbackObject):
-        Don't pass a null Document when constructing the AXObjectCache.
-
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        Get the document from the RenderObject; m_document was removed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::axObjectCache):
-        Don't pass the Document when constructing the AXObjectCache.
-        (WebCore::Document::setFocusedNode):
-        Pass the old and new focused RenderObjects when calling
-        handleFocusedUIElementChanged().
-
-2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Check that InspectorDOMAgent and InspectorFrontend are not null
-        before accessing them in InspectorBackend. They may be null if
-        InspectorController is closed before an asynchronous operation is
-        started.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setAttribute):
-        (WebCore::InspectorBackend::removeAttribute):
-        (WebCore::InspectorBackend::setTextNodeValue):
-        (WebCore::InspectorBackend::highlight):
-        (WebCore::InspectorBackend::nodeForId):
-        (WebCore::InspectorBackend::pushNodePathToFrontend):
-        (WebCore::InspectorBackend::addNodesToSearchResult):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::selectDOMStorage):
-        (WebCore::InspectorBackend::inspectorDOMAgent):
-        (WebCore::InspectorBackend::inspectorFrontend):
-        * inspector/InspectorBackend.h:
-
-2009-09-01  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Page Cache should support pages with frames
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        Things learned in the full task that this patch addresses:
-        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
-          needed to be managed separately.
-        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
-          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
-          will be guided by the CachedFrames themselves.
-
-        No new tests. (No change in behavior, current layout tests pass)
+        Moved implementations of window.btoa() and window.atob() from
+        JSDOMWindow to DOMWindow, and make V8DOMWindow use DOMWindow
+        functions instead of having a separate implementation. As a side effect, the
+        error message has changed from "Cannot decode base64" to one that
+        indicates DOM Exception, which is compatible to Firefox.
         
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::~CachedFrame):
-        (WebCore::CachedFrame::clear): Only clear pointers out.
-        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
-          occur simply by navigating back to a page with a CachedFrame.
-        * history/CachedFrame.h:
-
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::~CachedPage):
-        (WebCore::CachedPage::restore): Call clear() after restoring.
-        (WebCore::CachedPage::clear):
-        (WebCore::CachedPage::destroy):
-        * history/CachedPage.h:
-
-        * history/PageCache.cpp:
-        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
-          instead of clearing them.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
-        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
-        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
-          Even though CachedFrame::restore() isn't used for now, it will be soon.
-
-2009-09-01  Andrei Popescu  <andreip@google.com>
+        Refactoring: window.btoa() and window.atob() should be implemented on DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=35723
 
-        Reviewed by David Levin.
+        No new test. No new functionality.
 
-        Add a "lowMemoryNotification" method to the V8 ScriptController class.
-        This is needed in order to allow the host application (Android Web browser in this case)
-        to call the v8::V8::LowMemoryNotification() method added to V8 in
-        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        Moved conversion code to DOMWindow and invoke it. Argument
+        checking remains here.
         
-        https://bugs.webkit.org/show_bug.cgi?id=28776
-
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::lowMemoryNotification):
-        * bindings/v8/ScriptController.h:
-
-2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        V8 Bindings for WebSocket API.
-        https://bugs.webkit.org/show_bug.cgi?id=28844
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Missed a "." -> "->" conversion.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Try to fix Qt build, take 2.  The Qt code had what looks like a
-        broken virtual function override.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-09-01  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Uninitialized variable in XSSAuditor
-        https://bugs.webkit.org/show_bug.cgi?id=28874
-
-        One ought to initialize variables before use even when it doesn't
-        matter.  No behavior change.
-
-        * page/XSSAuditor.h:
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Try to fix Qt build.
-
-        * platform/graphics/ImageSource.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::atobCallback):
+        (WebCore::V8DOMWindow::btoaCallback):
+        Remove conversion code and call DOMWindow APIs. Although argument
+        checking remains here.
+        
+        * page/DOMWindow.cpp:
+        (WebCore::hasMultibyteCharacters):
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+        * page/DOMWindow.h:
+        Moved Conversion code from JSDOMWindow, modifing to fit JSC independent.
 
-2009-08-28  Peter Kasting  <pkasting@google.com>
+2010-03-06  Yuta Kitamura  <yutak@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
-
-        * WebCore.pro:
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Make InjectedScript self-contained (move necessary
-        methods from utilities.js into InjectedScript).
+        Fix decoration position in search input field.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28871
+        This patch fixes rendering of input field of "search" type, whose decoration
+        (loupe icon and close button) was wrongly positioned when the input field was
+        contained in a block with -webkit-transform property.
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-        (InjectedScript.pushNodeToFrontend):
-        (InjectedScript.createProxyObject):
-        (Object.type):
-        (Object.hasProperties):
-        (Object.className):
-        (String.prototype.escapeCharacters):
-        * inspector/front-end/utilities.js:
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: console log message repeat count double.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28856
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateOn):
-
-2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Mark Rowe.
+        Chromium bug: http://crbug.com/20439
 
-        [Gtk] Fix DATALIST build
-        https://bugs.webkit.org/show_bug.cgi?id=28826
+        [Chromium] Decoration of "search" input field is wrongly rendered
+        https://bugs.webkit.org/show_bug.cgi?id=30245
 
-        Add ENABLE_DATALIST to FEATURE_DEFINES.
+        No new tests, since this patch fixes an existing test
+        (fast/forms/search-transformed.html) in Chromium layout tests.
 
-        * GNUmakefile.am:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::convertToPaintingRect): Added. This method
+        does almost the same thing as RenderThemeMac::convertToPaintingRect.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton): The position
+        of the icon should not depend on its absolute position.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton): Ditto.
+        * rendering/RenderThemeChromiumSkia.h: Added new method.
 
-2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+2010-03-06  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Pavel Feldman.
 
-        SVGSVGElement suspend methods argument/return types incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=28860
+        Web Inspector: in Timeline panel, click followed with mouse move resets popover.
 
-        Also fix the style of the argument names.
+        https://bugs.webkit.org/show_bug.cgi?id=35827
 
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::suspendRedraw):
-        (WebCore::SVGSVGElement::unsuspendRedraw):
-        * svg/SVGSVGElement.h:
+        * inspector/front-end/Popover.js:
+        (WebInspector.PopoverHelper.prototype._mouseDown):
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        (WebInspector.PopoverHelper.prototype._handleMouseAction):
 
-2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+2010-03-05  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
-        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+        https://bugs.webkit.org/show_bug.cgi?id=33247
+        Backwards cursor movement incorrect when previous block ends with <br>.
 
-        The bug fix adds an explicit check for the validity of the path when it is 
-        transformed into local coordinates. 
-        This was the most suitable place I could find that didn't cause an inordinate 
-        amount of refactoring. Also, it seems pertinent and may also catch other cases 
-        that are not limited to clipping paths.
+        If the cursor is trying to move into a node that has a height of 0,
+        skip over it.
 
-        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+        Test: editing/execCommand/move-selection-back-line.html
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
-        (WebCore::):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
 
-2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+2010-03-05  Andrey Kosyakov  <caseq@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
-        https://bugs.webkit.org/show_bug.cgi?id=28742 
-
-        Normalize (NFC) a TextRun when the run contains combining diacritical marks
-        so that Skia can pick a correct glyph without relying on GSUB table in a font.
-        This change is for Chromium Linux.
+        Enable resource loading callback while loading worker scripts
+        https://bugs.webkit.org/show_bug.cgi?id=35744
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::getTextRun): Added.
-        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
-
-        This function is called when the run contains U+0300..U+036F and converts characters in
-        the run to the combined form (NFC) using ICU.
-
-2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
-        V8Proxy::createWrapperFromCache.
-        https://bugs.webkit.org/show_bug.cgi?id=28848
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
-        function for document wrapping.
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
-        wrapping a new node.
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
-        path from V8DOMWrapper.cpp.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
-        from V8Proxy.cpp.
-
-2009-09-01  Eric Seidel  <eric@webkit.org>
-
-        No review, windows build fix only.  Clearly I should have read the patch closer. :(
-
-        Allow excluding certain plugins from loading
-        https://bugs.webkit.org/show_bug.cgi?id=28677
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::refresh):
-
-2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Implement conditional breakpoints in the Web Inspector backend
-        and add frontend JavaScript stubs.
-        https://bugs.webkit.org/show_bug.cgi?id=28846
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::profiles):
-        (WebCore::InspectorBackend::addBreakpoint):
-        (WebCore::InspectorBackend::updateBreakpoint):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
-        (WebCore::JavaScriptDebugServer::addBreakpoint):
-        (WebCore::JavaScriptDebugServer::breakpointInfo):
-        (WebCore::JavaScriptDebugServer::updateBreakpoint):
-        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
-        (WebCore::JavaScriptDebugServer::removeBreakpoint):
-        (WebCore::JavaScriptDebugServer::hasBreakpoint):
-        (WebCore::JavaScriptDebugServer::clearBreakpoints):
-        * inspector/JavaScriptDebugServer.h:
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint):
-        (WebInspector.Breakpoint.prototype.get id):
-        (WebInspector.Breakpoint.prototype.get condition):
-        (WebInspector.Breakpoint.prototype.set condition):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.addScript):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
 
-2009-09-01  Marius Renn  <damarvy@gmail.com>
+2010-03-05  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Eric Seidel.
 
-        Added delegate to PluginDatabase to disable loading certain plugins.
-        This is useful when you want to load from the standard plugin
-        directory, but want to exclude certain plugins. Plugins may be
-        excluded early on by name, so that no plugin code is executed (which
-        may have caused a crash).
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::PluginDatabase):
-        (WebCore::PluginDatabase::refresh):
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::setClient):
-        * plugins/PluginDatabaseClient.h: Added.
-        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
-
-2009-08-31  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Sam Weinig
-
-        * WebCore.base.exp: Removed an unneeded symbol export.
+        WAI-ARIA live region doesn't appear when <div> only has a <div> child
+        https://bugs.webkit.org/show_bug.cgi?id=35751
 
-2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28466
-        When downloading a file, two GET requests are sent to the HTTP server
-
-        Can't think of a way to test this.
-
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::releaseResources): only nullify the
-        handle's client when it is the ResourceLoader, to support the case
-        in which a download API uses a different client
+        Elements should not be ignored if they carry ARIA attributes in them.
 
-2009-08-31  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Text Fields and Text Areas are reported as read-only by inspect32.exe.
-        https://bugs.webkit.org/show_bug.cgi?id=28854
-
-        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
-        and texts areas are read-only.
+        Test: platform/mac/accessibility/div-containing-div-with-aria.html
 
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::supportsARIAAttributes):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
         * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
-        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
-
-2009-08-31  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
-        https://bugs.webkit.org/show_bug.cgi?id=28795
-
-        Changed WorkerContext::close() to no longer stop the worker thread.
-        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
 
-        * workers/AbstractWorker.cpp:
-        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::workerContextClosed):
-        Now shuts down the worker thread when notified that the context is closed.
-        (WebCore::SharedWorkerProxy::close):
-        Now handles being invoked when the context is already in the process of shutting down.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::close):
-        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isClosing):
-        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::performTask):
-        Error events should still be delivered even if the worker thread is closing.
-        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
-        (WebCore::WorkerTerminateTask::create):
-        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
-        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
-        (WebCore::WorkerTerminateTask::performTask):
-        (WebCore::WorkerMessagingProxy::workerContextClosed):
-        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
-        * workers/WorkerMessagingProxy.h:
-        WorkerMessagingProxy now overrides workerContextClosed().
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::runInMode):
-        Now drops tasks on the floor if the WorkerContext is closing.
-
-2009-08-31  Ojan Vafai  <ojan@chromium.org>
-
-        Not reviewed (build fix)
-
-        Build fix for Chromium to match r49707.
-
-        * bindings/v8/ScriptCallFrame.cpp:
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        * bindings/v8/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        * platform/KURLGoogle.cpp:
-        (WebCore::KURL::KURL):
-        (WebCore::blankURL):
+2010-03-05  Dmitry Titov  <dimich@chromium.org>
 
-2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Darin Adler.
+        Add a manual test for crash in DOMWindow::clearTimeout when DOMWindow is not connected to Frame
+        https://bugs.webkit.org/show_bug.cgi?id=32353
 
-        https://bugs.webkit.org/show_bug.cgi?id=28858
-        Element.baseURI parses xml:base attribute incorrectly
+        * manual-tests/clearTimeout-crash-bug29832.html: Added.
 
-        Test: fast/dom/base-attribute-parsing.xhtml
+2010-03-05  Dmitry Titov  <dimich@chromium.org>
 
-        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
-        release mode).
+        Reviewed by David Levin.
 
-2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+        [v8] Remove wrong assert in GC callback
+        https://bugs.webkit.org/show_bug.cgi?id=35757
 
-        Reverting http://trac.webkit.org/changeset/47904, because it caused
-        layout test failure.
+        Test: fast/workers/wrapper-map-gc.html
 
-        Test: fast/dom/Window/new-window-opener.html
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject): remove ASSERT(isMainThread()), move another assert up to verify we are on the right thread.
 
-2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+2010-03-05  Alex Milowski  <alex@milowski.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28852
-        Rename KURL single argument constructor to avoid confusion
+        Added support for row layout with stretchy operators and
+        adjusted the over spacing for over and underover accordingly.
 
-        * platform/KURL.h: The constructor that used to be single argument should now be invoked
-        as KURL(ParsedURLString, myString).
+        Tests: mathml/presentation/mo.xhtml
+               mathml/presentation/row.xhtml
 
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * bindings/js/ScriptCallFrame.cpp:
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        * bindings/v8/NPV8Object.cpp:
-        (_NPN_EvaluateHelper):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::isSVGCursorIdentifier):
-        * css/CSSImageValue.cpp:
-        (WebCore::CSSImageValue::cachedImage):
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/StyleBase.cpp:
-        (WebCore::StyleBase::baseURL):
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * dom/Element.cpp:
-        (WebCore::Element::baseURI):
-        * editing/markup.cpp:
-        (WebCore::completeURLs):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::url):
-        (WebCore::HistoryItem::originalURL):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::createCached):
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::requestResource):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::getSubresources):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::init):
-        (WebCore::FrameLoader::iconURL):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::redirectionTimerFired):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::startRedirectionTimer):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        (WebCore::ApplicationCacheStorage::manifestURLs):
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::createResource):
-        (WebCore::LegacyWebArchive::create):
-        * loader/loader.cpp:
-        (WebCore::Loader::load):
-        * notifications/NotificationCenter.h:
-        (WebCore::NotificationCenter::createHTMLNotification):
-        * platform/KURL.cpp:
-        (WebCore::KURL::KURL):
-        (WebCore::blankURL):
-        * platform/KURLHash.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::setData):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-        * platform/network/cf/ResourceErrorCF.cpp:
-        (WebCore::ResourceError::operator CFErrorRef):
-        * platform/network/cf/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/chromium/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::handleLocalReceiveResponse):
-        (WebCore::headerCallback):
-        * platform/network/curl/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/mac/ResourceErrorMac.mm:
-        (WebCore::ResourceError::operator NSError*):
-        * platform/network/mac/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/qt/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/soup/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle):
-        (WebCore::ClipboardWin::setData):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-        * xml/XSLImportRule.cpp:
-        (WebCore::XSLImportRule::loadSheet):
-        * xml/XSLTProcessor.cpp:
-        (WebCore::docLoaderFunc):
-        Adapt to the change everywhere the single argument constructor was used. I did a very
-        cursory check of whether these locations were using this constructor properly, and didn't
-        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
-        better when refactoring any such code.
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        * mathml/MathMLTextElement.cpp:
+        * mathml/RenderMathMLMath.cpp: Added.
+        * mathml/RenderMathMLMath.h: Added.
+        * mathml/RenderMathMLOperator.cpp: Added.
+        * mathml/RenderMathMLOperator.h: Added.
+        * mathml/RenderMathMLRow.cpp: Added.
+        * mathml/RenderMathMLRow.h: Added.
+        * mathml/RenderMathMLUnderOver.cpp:
+        * mathml/mathtags.in:
+
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-2009-08-31  Beth Dakin  <bdakin@apple.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Darin Adler.
+        https://bugs.webkit.org/show_bug.cgi?id=35772
+        Animation fill modes should be supported in the shorthand property
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
-        Backgrounds and Borders] Add support for 2-keyword values for 
-        background-repeat
-
-        This patch allows background-repeat to take two values by making 
-        background-repeat just like background-position internally. There 
-        is a little extra legwork for background-repeat because the spec 
-        indicates that its computed value should be equivalent to how it 
-        was specified. I keep track of the specified thing by setting the 
-        implicit flag whenever background-repeat is defined with only one 
-        value (since internally, we now store this as 2 values.)
-        
-        Here we can't access the implicit flag, so for backwards-
-        compatibility's sake, we always return one value when that makes 
-        sense.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::fillRepeatToCSSValue):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Add CSSPropertyWebkitAnimationFillMode to the list of properties
+        evaluated in the -webkit-animation shorthand.
 
-        Here we check for the implicit flag and return one value when it is 
-        set.
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
-        (WebCore::CSSMutableStyleDeclaration::cssText):
+        Test: animations/animation-shorthand.html
 
-        Add support for CSSPropertyBackgroundRepeatX and 
-        CSSPropertyBackgroundRepeatY
         * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillShorthand):
-        (WebCore::CSSParser::parseFillRepeat):
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSParser.h:
+        (WebCore::CSSParser::parseAnimationShorthand):
 
-        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
-        need those parts of the EFillRepeat enum anymore.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap):
+        Reviewed by Simon Fraser
 
-        Add background-repeat-x and -y.
-        * css/CSSPropertyNames.in:
+        https://bugs.webkit.org/show_bug.cgi?id=35815
+        Animation Fill Modes fail on Windows
 
-        Break repeat into x and y.
+        * css/CSSComputedStyleDeclaration.cpp:
         * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillRepeatX):
-        (WebCore::CSSStyleSelector::mapFillRepeatY):
-        * css/CSSStyleSelector.h:
-
-        There is no more RepeatXFill. Instead, look for 
-        fillLayer->repeatX() == RepeatFill
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-
-        Break m_repeat into m_repeatX and m_repeatY
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer):
-        (WebCore::FillLayer::operator=):
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::fillUnsetProperties):
-        (WebCore::FillLayer::cullEmptyLayers):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::repeatX):
-        (WebCore::FillLayer::repeatY):
-        (WebCore::FillLayer::isRepeatXSet):
-        (WebCore::FillLayer::isRepeatYSet):
-        (WebCore::FillLayer::setRepeatX):
-        (WebCore::FillLayer::setRepeatY):
-        (WebCore::FillLayer::clearRepeatX):
-        (WebCore::FillLayer::clearRepeatY):
-        (WebCore::FillLayer::initialFillRepeatX):
-        (WebCore::FillLayer::initialFillRepeatY):
-
-        Again, break backgroundRepeat into backgroundRepeatX and 
-        backgroundRepeatY
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundRepeatX):
-        (WebCore::InheritedFlags::backgroundRepeatY):
-        (WebCore::InheritedFlags::maskRepeatX):
-        (WebCore::InheritedFlags::maskRepeatY):
-
-        We don't need RepeatXFill or RepeatYFill. Now that we store two 
-        values, they are represented by Repeat-NoRepeat and NoRepeat-
-        Repeat, respectively.
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+            - use new enum value
+        * platform/animation/Animation.h:
+            - change bitfield type
         * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-31  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Compositing layer size needs to take into account software reflections on children.
-        https://bugs.webkit.org/show_bug.cgi?id=28837
-        
-        When computing the bounds of a composited layer, take software-rendered
-        reflections into account.
-
-        Test: compositing/reflections/reflection-in-composited.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-
-2009-08-31  Mark Mentovai  <mark@chromium.org>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28614
-
-        Perform a layout prior to checking whether the scrollbar modes are
-        off, on, or automatic.  The modes may change during layout.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Request Headers Should Show Data Sent With Request
-        https://bugs.webkit.org/show_bug.cgi?id=22920
-
-        Manual test added - see below.
-
-        * English.lproj/localizedStrings.js:
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::updateRequest):
-        (WebCore::InspectorResource::createScriptObject):
-        (WebCore::InspectorResource::updateScriptObject):
-        * inspector/InspectorResource.h:
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource):
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView):
-        (WebInspector.ResourceView.prototype._refreshURL):
-        (WebInspector.ResourceView.prototype._refreshQueryString):
-        (WebInspector.ResourceView.prototype._refreshFormData):
-        (WebInspector.ResourceView.prototype._refreshRequestPayload):
-        (WebInspector.ResourceView.prototype._refreshParms):
-        (WebInspector.ResourceView.prototype._toggleURLdecoding):
-        (WebInspector.ResourceView.prototype._getHeaderValue):
-        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.updateResource):
-        * manual-tests/inspector/display-form-data.html: Added.
-
-2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: pass call frames into the frontend as a part of
-        pausedScript event.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28847
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didPause):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::pausedScript):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
-        * inspector/front-end/inspector.js:
-        (WebInspector.pausedScript):
-
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Un-blacklist Silverlight on Mac
-
-        Does not seem to crash anymore, probably due to how we now handle
-        drawing and event model handshake better.
-
-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2009-08-31  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28827
-        SVGSVGElement.unsuspendRedraw() shouldn't throw
-
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::unsuspendRedraw):
-        * svg/SVGSVGElement.h:
-        * svg/SVGSVGElement.idl:
-
-2009-08-31  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        - Change the reutrn type of HTMLInputElement::list so that it
-          conforms to the standard.
-        - Add HTMLInputElement::dataList()
-        https://bugs.webkit.org/show_bug.cgi?id=28769
-
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::list):
-        (WebCore::HTMLInputElement::dataList):
-        (WebCore::HTMLInputElement::selectedOption):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-
-2009-08-31  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
-        https://bugs.webkit.org/show_bug.cgi?id=28802
-
-        Remove ASSERT because the frame could be null if the
-        ResourceHandle is not associated with any frame, e.g. if we are
-        downloading a file.
-        If the frame is not null but the page is null this must be an
-        attempted load from an onUnload handler, so let's just block it.
-
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::start):
-
-2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Build fix for platforms which don't enable DOM_STORAGE.
-        https://bugs.webkit.org/show_bug.cgi?id=28834
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-
-2009-08-29  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Dan Bernstein.
+            - add new enum for fill mode
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
-        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+2010-03-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Test: accessibility/aria-activedescendant-crash.html
+        Unreviewed buildfix after r55593. (To fix Qt --minimal build.)
 
-        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+        * bindings/js/JSDOMWindowCustom.cpp: Missing #if ENABLE(DATABASE) guard added.
 
-2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Oliver Hunt.
-
-        Gtk Build broken for OSX Quartz
-        https://bugs.webkit.org/show_bug.cgi?id=28727
-
-        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
-        port in Mac and Unix/Linux.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::init):
-
-2009-08-28  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
+        Reviewed by Darin Adler.
 
-        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
-        https://bugs.webkit.org/show_bug.cgi?id=28754
+        ASSERTION FAILED: rootLayer == m_clipRectsRoot at hulu.com
+        https://bugs.webkit.org/show_bug.cgi?id=34065
+        <rdar://problem/7573509>
         
-        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
-        ancestor, since the layer x and y are relative to that ancestor. However, this could
-        skip over the ancestorLayer, thus giving the wrong result.
+        Fix one instance of this assertion (not necessarily the one seen on hulu.com).
         
-        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
-        and checking for ancestorLayer along the way. If found, compute offset of both to
-        the enclosingPositionedAncestor() and subtract.
-        
-        This also fixes a positioning bug with abs. positioned elements in reflections,
-        so there is a new reflection test with a pixel result.
+        If the layer that clippingRoot() is being called on is itself compositing,
+        then it acts as the clipping root. Without this, calls to RenderLayer::childrenClipRect()
+        and RenderLayer::selfClipRect() via FrameView::windowClipRectForLayer(), for plug-ins,
+        caused the caching of an incorrect clip rects root.
 
-        Tests: compositing/geometry/abs-position-inside-opacity.html
-               fast/reflections/abs-position-in-reflection.html
+        Test: compositing/geometry/object-clip-rects-assertion.html
 
         * rendering/RenderLayer.cpp:
-        (WebCore::isPositionedContainer):
-        (WebCore::RenderLayer::enclosingPositionedAncestor):
-        (WebCore::RenderLayer::enclosingTransformedAncestor):
-        (WebCore::RenderLayer::convertToLayerCoords):
-
-2009-08-28  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Mark Rowe
+        (WebCore::RenderLayer::clippingRoot):
 
-        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
-        https://bugs.webkit.org/show_bug.cgi?id=27727
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
-        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
-        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
-        because there is not a unique enum value for WebkitCSSTransformValue.
-
-        * bindings/objc/DOMCSS.mm:
-        (kitClass):
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Jan Michael Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28308
-        Fix some warnings introduced by r47381.
-
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-
-2009-08-28  Ada Chan  <adachan@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21442
-        Make sure filesystemPathFromUrlOrTitle() returns a string with length
-        <= MAX_PATH - 1.
-
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle):
-
-2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adding Chromium's VFS for Linux and Mac.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28750
-
-        * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
-        (WebCore::SQLiteFileSystem::openDatabase):
-        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
-        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-
-2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Made bindings use Node::setOnEvent functions for Node descendants
-        instead of Node::setAttributeEventListener.
-
-        Node::setAttributeEventListener is an internal function and
-        doesn't do the forwarding to DOM window that is required for some
-        HTML elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28709
-
-        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Now generates EventListener accessors for Node descendants instead
-        of using custom callbacks.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
-        signature.
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::createHiddenDependency):
-        (WebCore::removeHiddenDependency):
-        Changed signature to accept Handle instead of Local.
-        * bindings/v8/V8Utilities.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Removed custom callbacks for EventListener accessors.
-
-2009-08-28  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28803
-        
-        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
-
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Not reviewed (build fix).
-
-        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
-        (WebCore::ImageDecoder::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Move ImageDecoder creation function to a factory function on
-        ImageDecoder.  This is arguably where it makes the most sense anyway,
-        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
-        function.
-
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp:
-        * platform/image-decoders/ImageDecoder.h:
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28785
-        Combine duplicated code from ImageDecoder*.cpp into the main
-        ImageDecoder.cpp.
-
-        * platform/image-decoders/ImageDecoder.cpp:
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-
-2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25889
-        [GTK] scrollbar policy for main frame is not implementable
-
-        Override setScrollbarModes to correctly forward scrollbar modes
-        policy changes to client code, via a new platform-specific method,
-        scrollbarsPolicyDidChange.
-
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::createScrollbar):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::setScrollbarModes):
-
-2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
-
-        Reviewed by Tor Arne Vestbø
-
-        [Qt/Mac] Un-blacklist the QuickTime plugin
-
-        https://bugs.webkit.org/show_bug.cgi?id=28768
-
-        Now that the drawing model is properly negotiated, there is no need the
-        blacklist the QuickTime plugin anymore.
-
-        This revealed a bug in PluginView::performRequest: it should not initiate a
-        request if the plugin has been stopped, which is what happens when a plugin
-        only supports the QuickDraw drawing model.
-
-        * plugins/PluginView.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-
-2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Set DOM agent document to 0 in InspectorController::close to
-        make DOM agent remove DOM listeners from the inspected document.
-
-        Replace windowVisible checks with m_frontend checks to as inspector
-        window lives in a different process in Chromium while frontend proxy
-        is in the inspected page process.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspect):
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::pruneResources):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        (WebCore::InspectorController::identifierForInitialRequest):
-        (WebCore::InspectorController::willSendRequest):
-        (WebCore::InspectorController::didReceiveResponse):
-        (WebCore::InspectorController::didReceiveContentLength):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::didFailLoading):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        (WebCore::InspectorController::scriptImported):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::addProfile):
-        * inspector/InspectorController.h:
-
-2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Remove dependency of SummaryBar on WebInspector.resourceCategories.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28801
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
-        * inspector/front-end/SummaryBar.js:
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.update):
-
-2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed (patching in l18n change that was missing due to
-        the git binary diff format).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28429
-
-        * English.lproj/localizedStrings.js:
-
-2009-08-28  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Make XSSAuditor go fast
-        https://bugs.webkit.org/show_bug.cgi?id=28667
-
-        Make the XSSAuditor go faster by implementing two optimizations:
-
-        1) We avoid canonicalizing scripts that are larger than the page's URL.
-           This saves a bunch of time for large inline scripts.
-
-        2) We memoize canonicalizing the page's URL because it's silly to
-           canonicalize repeated for each inline event listener.
-
-        These optimizations have a measurable affect on the intl1 page cycler.
-
-        No behavior change.
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
-        fast/canvas/change-context.html. And it's alright to reach it.
-
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
-
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
-
-        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
-
-        Peter's change forgot one m_decoder->
-
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex):
-
-2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [V8] Add NULL-check, since the context ain't changeable no more, and
-        thus getContext could return 0.
-
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
-
-2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        dataTransfer.types() should include type "Files" when files are present in the clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28780
-
-        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
-        patch for same for the mac port.
-
-        * platform/chromium/ClipboardChromium.cpp:
-
-2009-08-27  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Removed GL_ from all constants, and gl prefix from all calls
-        https://bugs.webkit.org/show_bug.cgi?id=28773
-
-        This was done for the external API in CanvasRenderingContext3D and
-        the internal API in GraphicsContext3D.
-
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.h:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-
-2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Qt and Gtk build fixes. Not reviewed.
-
-        Add CanvasRenderingContext3D.idl to the build scripts.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Release the storage mutex whenever leaving JavaScript execution.
-        https://bugs.webkit.org/show_bug.cgi?id=28789
-
-        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
-        required behavior.  After we leave JavaScript, we must be sure the storage
-        mutex has been released.  At the end of evaluate(), if localStorage has been
-        instantiated, tell it to release any locks that may be applicable.
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-
-2009-08-27  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28753
-        <rdar://problem/7173448> Excessive number of threads (and a crash)
-
-        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
-        - when resolver is idle, the first few requests are sent immediately (they may or may not
-        hit the wire);
-        - if there are a few requests in flight already, coalesce all requests for one second;
-        - to avoid pathological cases with lots of links to different sites on a page, only ask
-        CFHost about a handful of names (dropping the rest).
-
-        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
-        link, and these tend to have identical host name.
-
-        * platform/network/cf/DNSCFNet.cpp:
-        (WebCore::DNSResolveQueue::DNSResolveQueue):
-        (WebCore::DNSResolveQueue::shared):
-        (WebCore::DNSResolveQueue::add):
-        (WebCore::DNSResolveQueue::decrementRequestCount):
-        (WebCore::DNSResolveQueue::fired):
-        (WebCore::clientCallback):
-        (WebCore::DNSResolveQueue::resolve):
-        (WebCore::prefetchDNS):
-
-2009-08-27  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Final patch for Canvas 3D support
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        Reviewed by Dan Bernstein.
 
-        This hooks everything up and provides a working implementation of
-        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
-        passing the opaque context and texture pointers so a Canvas3DLayer can be
-        created (more on that later). It also plumbs changes to the 3D canvas so
-        that Canvas3DLayer can recomposite the results.
-        
-        A 3D Canvas element needs a RenderLayer and compositing layer to render.
-        This is because it renders to an off-screen texture in the GPU and then
-        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
-        render that texture as a 3D quad. This keeps everything in GPU memory to 
-        maximize performance. When a CanvasRenderingContext3D is created it 
-        forces a style recalc which creates the RenderLayer and compositing 
-        layer if needed. 
-        
-        I repurposed an existing flag which was put in place for animation to accomplish 
-        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
-        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
-        to do a complete style recalc, even though the style itself has not really
-        changed.
-        
-        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
-        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
-        This is needed when making a JS wrapper for the object so the prototype 
-        property can be set.
+        Child clipping compositing layers don't show the blue debug color
+        https://bugs.webkit.org/show_bug.cgi?id=35807
 
-        Test: fast/canvas/change-context.html
+        Set a layer owner on the GraphicsLayers created for clipping children,
+        so that they can get to the debug settings that give them the blue color.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
-        * bindings/js/JSCanvasRenderingContextCustom.cpp:
-        (WebCore::toJS):
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle):
-        * dom/Node.cpp:
-        (WebCore::Node::setNeedsStyleRecalc):
-        * dom/Node.h:
-        (WebCore::):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::is3D):
-        * html/HTMLCanvasElement.h:
-        * html/canvas/CanvasBuffer.cpp:
-        (WebCore::CanvasBuffer::create):
-        (WebCore::CanvasBuffer::CanvasBuffer):
-        (WebCore::CanvasBuffer::_deleteObject):
-        * html/canvas/CanvasBuffer.h:
-        * html/canvas/CanvasFramebuffer.cpp:
-        (WebCore::CanvasFramebuffer::create):
-        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
-        (WebCore::CanvasFramebuffer::_deleteObject):
-        * html/canvas/CanvasFramebuffer.h:
-        * html/canvas/CanvasObject.cpp:
-        (WebCore::CanvasObject::CanvasObject):
-        (WebCore::CanvasObject::~CanvasObject):
-        (WebCore::CanvasObject::deleteObject):
-        * html/canvas/CanvasObject.h:
-        (WebCore::CanvasObject::context):
-        * html/canvas/CanvasProgram.cpp:
-        (WebCore::CanvasProgram::create):
-        (WebCore::CanvasProgram::CanvasProgram):
-        (WebCore::CanvasProgram::_deleteObject):
-        * html/canvas/CanvasProgram.h:
-        * html/canvas/CanvasRenderbuffer.cpp:
-        (WebCore::CanvasRenderbuffer::create):
-        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
-        (WebCore::CanvasRenderbuffer::_deleteObject):
-        * html/canvas/CanvasRenderbuffer.h:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::createBuffer):
-        (WebCore::CanvasRenderingContext3D::createFramebuffer):
-        (WebCore::CanvasRenderingContext3D::createTexture):
-        (WebCore::CanvasRenderingContext3D::createProgram):
-        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::createShader):
-        * html/canvas/CanvasRenderingContext3D.h:
-        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
-        * html/canvas/CanvasShader.cpp:
-        (WebCore::CanvasShader::create):
-        (WebCore::CanvasShader::CanvasShader):
-        (WebCore::CanvasShader::_deleteObject):
-        * html/canvas/CanvasShader.h:
-        * html/canvas/CanvasTexture.cpp:
-        (WebCore::CanvasTexture::create):
-        (WebCore::CanvasTexture::CanvasTexture):
-        (WebCore::CanvasTexture::_deleteObject):
-        * html/canvas/CanvasTexture.h:
-        * page/DOMWindow.idl:
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::setNeedsStyleRecalc):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
-        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
-        (WebCore::AnimationController::cancelAnimations):
-        * platform/graphics/GraphicsContext3D.h:
-        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
-        (WebCore::GraphicsContext3D::platformTexture):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
-        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
-        (WebCore::GraphicsContext3D::reshape):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::):
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::commitLayerChanges):
-        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
-        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
-        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
-        * rendering/RenderHTMLCanvas.cpp:
-        (WebCore::RenderHTMLCanvas::requiresLayer):
-        * rendering/RenderHTMLCanvas.h:
-        (WebCore::RenderHTMLCanvas::isCanvas):
         * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
-        (WebCore::RenderLayerBacking::canUseDirectCompositing):
-        (WebCore::RenderLayerBacking::rendererContentChanged):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isCanvas):
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Clean up ImageDecoder*.cpp a bit.
-
-        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
-          order as in the header file.  Also, since there's already an anonymous
-          namespace in this file, use it to enclose the local helper functions.
-        (WebCore::):
-        (WebCore::ImageDecoder::upperBoundScaledX):
-        (WebCore::ImageDecoder::lowerBoundScaledX):
-        (WebCore::ImageDecoder::scaledY):
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        (WebCore::RGBA32Buffer::width): Style fix.
-        (WebCore::RGBA32Buffer::height): Style fix.
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
-        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
-        (WebCore::RGBA32Buffer::operator=): Simplify.
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
-        (WebCore::RGBA32Buffer::width): Style fix.
-        (WebCore::RGBA32Buffer::height): Style fix.
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Clean up ImageSource.* in preparation for more fixes on bug 27965.
-
-        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
-        (WebCore::ImageSource::isSizeAvailable): Shorten.
-        (WebCore::ImageSource::size): Shorten.
-        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
-        (WebCore::ImageSource::repetitionCount): Shorten.
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
+        (WebCore::RenderLayerBacking::updateClippingLayers):
 
-        https://bugs.webkit.org/show_bug.cgi?id=28785
-        Add ImageDecoder.cpp to various build files so platforms will be able to
-        use it.  Move an ENABLE to not cover the whole file, in preparation for
-        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
-        vs. everyone else", which also gives new platforms a reasonable default
-        behavior.
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        * platform/image-decoders/ImageDecoder.cpp:
-        (WebCore::):
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::getAddr):
-
-2009-08-27  Antti Koivisto  <antti@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Dave Kilzer.
+        MobileMe movie page is missing playback controls
+        https://bugs.webkit.org/show_bug.cgi?id=35805
+        <rdar://problem/7653169>
         
-        https://bugs.webkit.org/show_bug.cgi?id=28784
+        On pages with video or plug-ins, we run overlap tests to determine which layers
+        need to be composited. There was an ordering dependency bug in
+        RenderLayerCompositor::computeCompositingRequirements() that caused us to fail
+        to detect that a layer needed to be composited, resulting in page content
+        not being visible.
         
-        Add an exported method to flush pending repaints.
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        (WebCore::FrameView::flushDeferredRepaints):
-        * page/FrameView.h:
-
-2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Expose files from the pasteboard in drop events.
-        https://bugs.webkit.org/show_bug.cgi?id=28782
-
-        Update chromium port to expose dataTransfer.files() as per
-        HTML5 drag drop (Aug 2009 edition).
-
-        * platform/chromium/ClipboardChromium.cpp:
-
-2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Dmitry Glazkov.
-
-        ScriptState now keeps explicit Handle of devtools front-end
-        utility context instead of trying to retrieve it from inspected
-        Frame.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28772
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        * bindings/v8/ScriptController.h:
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptScope.cpp:
-        (WebCore::ScriptScope::ScriptScope):
-        * bindings/v8/ScriptState.cpp:
-        (WebCore::ScriptState::ScriptState):
-        (WebCore::ScriptState::~ScriptState):
-        (WebCore::scriptStateFromPage):
-        * bindings/v8/ScriptState.h:
-        (WebCore::ScriptState::context):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::~ScriptValue):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::frontendScriptState):
+        Specifically, layer->setHasCompositingDescendant() can change the answer
+        to needsToBeComposited(), when a layer has to clip compositing descendants.
+        So if we change setHasCompositingDescendant(), then we need to re-test
+        clipsCompositingDescendants() and add the layer to the overlap map if so.
 
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+        Test: compositing/overflow/overflow-compositing-descendant.html
 
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Console won't close.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28778
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        * inspector/front-end/utilities.js:
-        (Node.prototype.isAncestor):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-2009-08-27  Eric Seidel  <eric@webkit.org>
+2010-03-04  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Fix a typo in files() causing image drags to have junk file arrays.
-        https://bugs.webkit.org/show_bug.cgi?id=28755
-
-        Test: editing/pasteboard/files-during-page-drags.html
-
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::ClipboardMac::files):
-
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
-
-        Not reviewed.  Build fix for Chromium.
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-08-27  Alexey Proskuryakov  <ap@apple.com>
-
-        Windows build fix.
-
-        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
-
-2009-08-26  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Adele Peterson.
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        https://bugs.webkit.org/show_bug.cgi?id=28758
-        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+        Test: storage/open-database-creation-callback.html
 
-        Tests: fast/events/pageshow-pagehide-on-back-cached.html
-               fast/events/pageshow-pagehide-on-back-uncached.html
-               fast/events/pageshow-pagehide.html
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
-        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
-        (this function is called both when a document goes away, and when it goes to b/f cache).
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
-        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
-        that can be installed on Window object.
-        (WebCore::DOMWindow::onpagehide): Ditto.
-        (WebCore::DOMWindow::setOnpagehide): Ditto.
-        (WebCore::DOMWindow::onpageshow): Ditto.
-        (WebCore::DOMWindow::setOnpageshow): Ditto.
-
-        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
-        that isn't being restored from cache.
-
-        * dom/PageTransitionEvent.cpp: Added.
-        (WebCore::PageTransitionEvent::PageTransitionEvent):
-        (WebCore::PageTransitionEvent::~PageTransitionEvent):
-        (WebCore::PageTransitionEvent::initPageTransitionEvent):
-        * dom/PageTransitionEvent.h: Added.
-        (WebCore::PageTransitionEvent::create):
-        (WebCore::PageTransitionEvent::isPageTransitionEvent):
-        (WebCore::PageTransitionEvent::persisted):
-        * dom/PageTransitionEvent.idl: Added.
-        Add event class implementation.
-
-        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
-        inline listener definition (note that adding listeners to document.body programmatically
-        is not supported, matching Firefox).
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
-        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
-        Docuemnt.
-        (WebCore::Document::createEvent): Ditto.
-
-        * dom/Document.h: Added dispatchPageTransitionEvent.
-
-        * DerivedSources.make:
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
-        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
-        * dom/Event.h:
-        * dom/EventNames.h:
-        * html/HTMLAttributeNames.in:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
         * page/DOMWindow.h:
         * page/DOMWindow.idl:
-        Do what it takes to add a new event type.
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by NOBODY (build fix).
-
-        Adding missing file from previous commit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28740
-
-        * inspector/front-end/SummaryBar.js: Added.
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.get calculator):
-        (WebInspector.SummaryBar.prototype.set calculator):
-        (WebInspector.SummaryBar.prototype.reset):
-        (WebInspector.SummaryBar.prototype.update):
-        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
-        (WebInspector.SummaryBar.prototype._drawSwatch):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
-        (WebInspector.SummaryBar.prototype._fadeOutRect):
-        (WebInspector.SummaryBar.prototype._makeLegendElement):
-
-2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Factor out Factor out summary bar from Resources panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28740
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
-        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
-        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
-        * inspector/front-end/SummaryBar.js: Added.
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.get calculator):
-        (WebInspector.SummaryBar.prototype.set calculator):
-        (WebInspector.SummaryBar.prototype.reset):
-        (WebInspector.SummaryBar.prototype.update):
-        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
-        (WebInspector.SummaryBar.prototype._drawSwatch):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
-        (WebInspector.SummaryBar.prototype._fadeOutRect):
-        (WebInspector.SummaryBar.prototype._makeLegendElement):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-
-2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Start adding heap profiler to Inspector (hidden behind a flag.)
-
-        https://bugs.webkit.org/show_bug.cgi?id=28429
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.reset):
-        (WebInspector.ProfilesPanel.prototype.addProfile):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Metrics sidebar editing is broken.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28434
-
-        * inspector/front-end/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-
-2009-08-27  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28767
-
-        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
-        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
-
-        * platform/KURLGoogle.cpp:
-        (WebCore::decodeURLEscapeSequences):
-
-2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Build fix, missing functions after r47763.
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaControlElementString):
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription):
-
-2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Removing trailing whitespaces from all storage classes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28075
-
-        * storage/ChangeVersionWrapper.cpp:
         * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
         * storage/Database.h:
-        * storage/DatabaseDetails.h:
-        * storage/DatabaseThread.cpp:
-        * storage/DatabaseTracker.cpp:
-        * storage/DatabaseTracker.h:
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageTask.h:
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        * storage/OriginQuotaManager.cpp:
-        * storage/OriginUsageRecord.cpp:
-        * storage/OriginUsageRecord.h:
-        * storage/SQLError.h:
-        * storage/SQLResultSetRowList.h:
-        * storage/SQLStatement.cpp:
-        * storage/SQLStatement.h:
-        * storage/SQLStatementCallback.h:
-        * storage/SQLStatementErrorCallback.h:
-        * storage/SQLTransaction.cpp:
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCallback.h:
-        * storage/SQLTransactionErrorCallback.h:
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        * storage/StorageEvent.h:
-        * storage/StorageMap.cpp:
-        * storage/StorageMap.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageSyncManager.cpp:
-        * storage/StorageSyncManager.h:
-
-2009-08-26  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
-
-        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
-        to do this in order for overflow information to be properly recomputed.
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::diff):
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+2010-03-05  Chris Marrin  <cmarrin@apple.com>
 
         Reviewed by Simon Fraser.
 
-        HTMLMediaElement sometimes loses events
-        https://bugs.webkit.org/show_bug.cgi?id=28762
-        <rdar://problem/7172437>
-
-        A media element triggers the resource selection algorithm if 
-        play() is called when the networkState attribute is NETWORK_EMPTY, but
-        it also immediately queues 'play' and either 'waiting' or 'playing' events.
-        One of the steps in preparing to load is to flush pending events, so those 
-        events were lost if the load timer fired quickly enough. Fixed by deleting
-        pending events before scheduling the load timer.
-
-        Test: media/audio-play-event.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::scheduleLoad):
-            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
-            pending events is flushed immediately.
-        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
-            New, start the load timer without flushing pending events.
-        (WebCore::HTMLMediaElement::load):
-            Call prepareForLoad();
-        (WebCore::HTMLMediaElement::prepareForLoad):
-            New, load setup code moved from loadInternal.
-        (WebCore::HTMLMediaElement::loadInternal):
-            Moved some setup code to prepareForLoad so it can be invoked immediately before
-            arming the load timer.
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
-            pending events.
-        * html/HTMLMediaElement.h:
-            Declare scheduleNextSourceChild.
-
-2009-08-26  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Switch ICO decoder from a Vector of raw pointers to a Vector of
-        OwnPtrs now that that is possible.  Makes code slightly simpler.
-
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::decodeAtIndex):
-        (WebCore::ICOImageDecoder::processDirectory):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-
-2009-08-26  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
-        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
-        propagated to parents.
-
-        Added fast/repaint/rel-positioned-inline-with-overflow.html
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-
-2009-08-26  David Levin  <levin@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
-        https://bugs.webkit.org/show_bug.cgi?id=28735
-
-        Renaming the method to imply its wider implications of affecting cookies
-        over any protocol that supports them.
-
-        No change in functionality so no new tests.
-
-        * WebCore.order:
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
-        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::adopt):
-        (WebCore::ResourceRequestBase::copyData):
-        (WebCore::ResourceRequestBase::allowCookies):
-        (WebCore::ResourceRequestBase::setAllowCookies):
-        (WebCore::equalIgnoringHeaderFields):
-        * platform/network/ResourceRequestBase.h:
-        (WebCore::ResourceRequestBase::ResourceRequestBase):
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateFromSoupMessage):
-
-2009-08-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Made RenderInline::clippedOverflowRectForRepaint() actually include
-        overflow.
-
-        Test: fast/repaint/inline-overflow.html
-
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
-            the bounding box of all lines’ visible overflow boxes (under the
-            assumption that the first and last lines determine the top and
-            bottom, respectively).
-        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
-            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
-        * rendering/RenderInline.h:
-
-2009-08-26  John Gregg  <johnnyg@google.com>
+        Fixed infinite recursion of composited video on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=35798
+        
+        Due to a change in the way we get the platformLayer (WKCACFLayer)
+        for video, the mediaplayer was in an infinite loop with WKCACFLayer
+        bouncing notifySyncRequired calls back and forth. After discussion
+        we decided it would be better to avoid notifySyncRequired entirely,
+        which would walk up through WebCore calls and back down through
+        WebKit calls to tell the WKCACFLayerRenderer to kick off a render cycle.
+        
+        I subclassed WKCACFLayer into a WKCACFRootLayer which has a pointer to
+        the WKCACFLayerRenderer. When something changes, we get the rootLayer()
+        by walking up the layers and make a virtual call which WKCACFRootLayer
+        implements to tell WKCACFLayerRenderer to render.
+        
+        I also got rid of GraphicsLayer knowledge from WKCACFLayer. GraphicsLayerCACF
+        now makes a WebLayer subclass which implements the drawInContext()
+        virtual method.
+        
+        I also had to add protection to the platformLayer() call in 
+        MediaPlayerPrivateQuickTimeWin because it gets called earlier than before
+        when the layer is still null.
+
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Implement WebLayer
+        (WebCore::WebLayer::create):
+        (WebCore::WebLayer::drawInContext):
+        (WebCore::WebLayer::WebLayer):
+        (WebCore::GraphicsLayerCACF::GraphicsLayerCACF):
+        (WebCore::GraphicsLayerCACF::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerCACF::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerCACF::updateContentsImage):
+        * platform/graphics/win/GraphicsLayerCACF.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:Protect platformLayer from a null qtLayer
+        (WebCore::MediaPlayerPrivate::platformLayer):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:Got rid of no longer needed method
+        (WebCore::MediaPlayerPrivate::notifyAnimationStarted):
+        * platform/graphics/win/WKCACFLayer.cpp:Got rid of GraphicsLayer dependency. Made virtual.
+        (WebCore::displayCallback):
+        (WebCore::WKCACFLayer::create):
+        (WebCore::WKCACFLayer::WKCACFLayer):
+        (WebCore::WKCACFLayer::setNeedsCommit):
+        (WebCore::WKCACFLayer::setNeedsDisplay):
+        * platform/graphics/win/WKCACFLayer.h:
+        (WebCore::WKCACFLayer::setNeedsRender):
+        (WebCore::WKCACFLayer::drawInContext):
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:Create WKCACFRootLayer which tells WKCACFLayerRenderer to render
+        (WebCore::WKCACFRootLayer::WKCACFRootLayer):
+        (WebCore::WKCACFRootLayer::create):
+        (WebCore::WKCACFRootLayer::setNeedsRender):
+        (WebCore::WKCACFRootLayer::setNeedsDisplay):
+        (WebCore::WKCACFLayerRenderer::rootLayer):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::setNeedsDisplay):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
 
         Reviewed by David Levin.
 
-        minor style correction and include fix for notifications
-        https://bugs.webkit.org/show_bug.cgi?id=28745
+        [Chromium] Missing commas in WebCore.gypi file make building Geo unpossible.
+        https://bugs.webkit.org/show_bug.cgi?id=35797
 
-        No change in behavior, so no tests.
-
-        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
-        * notifications/Notification.cpp: change enum style to InterCaps
-        (WebCore::Notification::Notification):
-        * notifications/NotificationPresenter.h:
-        (WebCore::NotificationPresenter::):
+        No new tests, this is a latent compile break.
 
-2009-08-25  Drew Wilson  <atwilson@google.com>
+        * WebCore.gypi:
 
-        Reviewed by David Levin.
+2010-03-04  Eric Carlson  <eric.carlson@apple.com>
 
-        postMessage() spec now supports sending arrays of ports
-        https://bugs.webkit.org/show_bug.cgi?id=26902
+        Reviewed by Adele Peterson.
 
-        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+        <rdar://problem/7718442> Implement 'preload=none'
+        https://bugs.webkit.org/show_bug.cgi?id=35789
 
-        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+        Don't load any media data when preload is 'none'.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
-        * dom/MessageEvent.cpp:
-        Updated APIs to support passing MessagePortArrays.
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        (WebCore::MessageEvent::messagePort):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::MessageEvent::ports):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::disentanglePorts):
-        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
-        (WebCore::MessagePort::entanglePorts):
-        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
-        * dom/MessagePort.h:
-        * dom/MessagePortChannel.cpp:
-        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::EventData::channels):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-        (WebCore::PostMessageTimer::event):
-        (WebCore::DOMWindow::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        * page/DOMWindow.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::DedicatedWorkerContext::dispatchMessage):
-        * workers/DedicatedWorkerContext.h:
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::Worker::dispatchMessage):
-        * workers/Worker.h:
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
-
-2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+        Test: media/video-preload.html
 
-        Reviewed by Alexey Proskuryakov.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't call player's setPreload method
+            when autoplay is set.
 
-        SocketStreamHandle interface for WebSocket API
-        https://bugs.webkit.org/show_bug.cgi?id=28037
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setPreload): Set m_preload so we have the correct value when
+            the media engine is created.
 
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
-        Other build systems will be updated once the code is functional.
-        Tests will be landed once this code is complete and functional.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_preload.
+        (WebCore::MediaPlayerPrivate::resumeLoad): New, kick off postponed a load.
+        (WebCore::MediaPlayerPrivate::load): Do nothing if preload is 'none'
+        (WebCore::MediaPlayerPrivate::loadInternal): New, complete loading.
+        (WebCore::MediaPlayerPrivate::prepareToPlay): New, resume a postponed load as someone
+            has called play().
+        (WebCore::MediaPlayerPrivate::setPreload): New, set m_preload.
 
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/SocketStreamErrorBase.cpp: Added.
-        * platform/network/SocketStreamErrorBase.h: Added.
-        * platform/network/SocketStreamHandleBase.cpp: Added.
-        * platform/network/SocketStreamHandleBase.h: Added.
-        * platform/network/SocketStreamHandleClient.h: Added.
-        * platform/network/cf/SocketStreamError.h: Added.
-        * platform/network/cf/SocketStreamHandle.h: Added.
-        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
-        * platform/network/soup/SocketStreamError.h: Added.
-        * platform/network/soup/SocketStreamHandle.h: Added.
-        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
-
-2009-08-26  Mads Ager  <ager@chromium.org>
+2010-03-04  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] setTimeout does not convert non-string argument to string
-        https://bugs.webkit.org/show_bug.cgi?id=28739
+        [V8] Give CodeGeneratorV8.pm a much-needed spring cleaning.
 
-        Convert non-string argument to setTimeout to string in the V8
-        bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=35697
 
+        * bindings/scripts/CodeGeneratorV8.pm: Remove unused code, fix style issues, make less hard-coded.
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
 
-2009-08-25  Oliver Hunt  <oliver@apple.com>
+2010-03-05  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Gavin Barraclough.
+        Not reviewed. Roll back r55522 since it regreses performance
+        according to chromium's page cycler.
 
-        [ES5] Implement getOwnPropertyDescriptor
-        https://bugs.webkit.org/show_bug.cgi?id=28724
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        Implement the WebCore side of getOwnPropertyDescriptor.  This
-        requires a custom implementation of getOwnPropertyDescriptor
-        for every class with a custom implementation of getOwnPropertySlot.
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-        The bindings generator has been updated to generate appropriate
-        versions of getOwnPropertyDescriptor for the general case where
-        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
-        about how getOwnPropertyDescriptor should work in the context of
-        "host" functions with polymorphic [[GetOwnProperty]], so it seems
-        okay that occasionally we "guess" what attributes -- eg. determining
-        whether a property is writable.
+        Reviewed by Simon Fraser and Chris Marrin.
 
-        Test: fast/js/getOwnPropertyDescriptor.html
+        Bug 26869: Add fill modes for CSS Animations
+        https://bugs.webkit.org/show_bug.cgi?id=26869
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
-        * bridge/runtime.h:
-        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::getOwnPropertyDescriptor):
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
-        * bridge/runtime_object.h:
-
-2009-08-26  Vincent Untz <vuntz@gnome.org>
-
-        Reviewed by Xan Lopez.
-
-        GObject checks for NULL (and not 0) in g_object_get, so use that
-        as we were already doing elsewhere to make the compiler happy.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-
-2009-08-26  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        RenderThemeMac.mm has incorrect casting for media control element.
-        https://bugs.webkit.org/show_bug.cgi?id=28730
-
-        MediaControlMuteButtonElement was incorrectly casted to
-        MediaControlPlayButtonElement. This is corrected in this patch.
-
-        No new tests because this is code cleanup and is already covered by existing
-        media layout tests.
+        Tests: animations/fill-mode-removed.html
+               animations/fill-mode-transform.html
+               animations/fill-mode.html
 
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-
-2009-08-26  Robert Sesek  <rsesek@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=28670
-
-        Change the condition regarding the key modifier check for non-contiguous
-        selection on a multi-value list from just PLATFORM(MAC) to
-        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
-
-        No new tests. This patch only changes the condition on which a certain mouse
-        event modifier key is used.
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h:
+        * css/CSSValueKeywords.in:
+            - parse, assign and retrieve the value of the new
+              -webkit-animation-fill-mode property
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationBase.h:
+            - new state in animation engine for a finished animation
+              that is "filling" forwards in time. This allows the
+              engine to keep the animation around and not revert to the
+              old style.
+            - update the timer code to indicate it doesn't need to
+              keep animating if it is filling
+            - now that animations can extend beyond their elapsed time,
+              make sure progress works correctly with iteration counts
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+            - ensure correct style value is returned at the right
+              time by checking for fill mode
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+            - continue to send the end event, but only remove the
+              animation if it isn't filling forwards
+        * platform/animation/Animation.cpp:
+        * platform/animation/Animation.h:
+            - new fill mode member property
+        * platform/animation/AnimationList.cpp:
+            - ensure the fill mode is propagated to a list of style valus
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+            - make hardware layers use Core Animation's fill mode
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+2010-03-05  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        Reviewed by Dan Bernstein
+        Reviewed by Pavel Feldman.
 
-        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
-        https://bugs.webkit.org/show_bug.cgi?id=28732
+        Web Inspector: Do not show link helper in popovers and/or for external resources.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
-            Don't call setAttribute from the construtor, any registered mutation event 
-            listener will cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=35785
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createVolumeSlider):
-            Set the maxAttr here instead of in the constructor.
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptOrResourceForURLAndLine):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.hide):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentMouseOver):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addMainEventListeners):
 
-2009-08-25  Dmitry Titov  <dimich@chromium.org>
+2010-03-05  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Alexey Proskuryakov.
 
-        Timers from cached pages fire instantly rather than the after the specified timeout delay
-        https://bugs.webkit.org/show_bug.cgi?id=28683
+        WebSocket onmessageerror event handler
+        https://bugs.webkit.org/show_bug.cgi?id=35570
 
-        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+        Test: websocket/tests/error-detect.html
 
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
-            it should be done only once in FrameLoader::open(cachedFrame)
-        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
-        (WebCore::DOMTimer::DOMTimer): Ditto.
-        (WebCore::DOMTimer::suspend): Ditto.
-        (WebCore::DOMTimer::resume): Ditto.
-        * page/DOMTimer.h: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocketChannel::didConnect): assert scriptExecutionContext.
+        (WebCore::WebSocketChannel::didReceiveMessage): assert scriptExecutionContext.
+        (WebCore::WebSocket::didReceiveMessageError):
+        (WebCore::WebSocket::didClose): assert scriptExecutionContext.
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl: Add onerror event listener
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData): call didReceiveMessageError if unknown frame tye is detected, or frame length overflowed.
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didReceiveMessageError):
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+2010-03-04  Garret Kelly  <gdk@chromium.org>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Darin Fisher.
 
-        Setting the volume of a media element has no effect if called too early
-        https://bugs.webkit.org/show_bug.cgi?id=28731
+        Changing private members from PlatformTouchEvent and PlatformTouchPoint
+        to be protected, so that Chromium's PlatformTouchEventBuilder and
+        PlatformTouchPointBuilder can access them. Exercised by the
+        fast/events/touch tests.
+        https://bugs.webkit.org/show_bug.cgi?id=35760
 
-        * manual-tests/audio-volume.html: 
-            Added.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::~PlatformTouchEvent):
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::~PlatformTouchPoint):
 
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setRate):
-            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
-            volume as soon as the movie has been created.
+2010-03-04  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-08-25  David Levin  <levin@chromium.org>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Maciej Stachowiak.
+        WebSocket crash bug when reloading the page while the WebSocket is busy
+        https://bugs.webkit.org/show_bug.cgi?id=35732
 
-        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
-        https://bugs.webkit.org/show_bug.cgi?id=28728
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::disconnect): clear m_context from WebSocketChannel and WebSocketHandshake.
+        (WebCore::WebSocketChannel::didOpen): check m_context
+        (WebCore::WebSocketChannel::didClose): clear m_context
+        (WebCore::WebSocketChannel::didReceiveData): check m_context, and check m_client early before appending to buffer
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clearScriptExecutionContext): Added.
+        * websockets/WebSocketHandshake.h:
 
-        Test: This code path is exercised while running xhr layout tests in chromium.
+2010-03-04  MORITA Hajime <morrita@google.com>
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
-        back synchronously, the loader is 0, so the assert is changed to allow for that.
-        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
-        done before SubresourceLoader::create finishes, so ensure that any previous loader
-        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+        Reviewed by Alexey Proskuryakov.
 
-2009-08-25  Mark Rowe  <mrowe@apple.com>
+        Refactoring: XMLHTTPRequest.open() should have all overloaded implementations
+        https://bugs.webkit.org/show_bug.cgi?id=35630
 
-        Stop installing IDL files in to the framework.
+        Test: http/tests/xmlhttprequest/open-async-overload.html
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::openCallback):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::open):
+        * xml/XMLHttpRequest.h:
 
-2009-08-25  Kent Tamura  <tkent@chromium.org>
+2010-03-04  James Robinson  <jamesr@google.com>
 
         Reviewed by Eric Seidel.
 
-        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
-        https://bugs.webkit.org/show_bug.cgi?id=27756
+        Styles do not have to be synchronously rematched after every event dispatch
 
-        Tests: fast/forms/input-list.html
-               fast/forms/input-selectedoption.html
+        https://bugs.webkit.org/show_bug.cgi?id=32580
 
-        * html/HTMLAttributeNames.in:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::list):
-        (WebCore::HTMLInputElement::selectedOption):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+2010-03-04  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        <video> and <audio> controller should be accessible (edit)
-        https://bugs.webkit.org/show_bug.cgi?id=28081
+        maemo spelled as mameo in WebCore.pro
+        https://bugs.webkit.org/show_bug.cgi?id=35765
 
-        Test: accessibility/media-element.html
+        Spelling corrected.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-            Add AccessibilityMediaControls.cpp/.h
 
-        * accessibility/AXObjectCache.cpp:
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::getOrCreate):
-            Create AccessibilityMediaControl. Update Copyright
+2010-03-04  Tony Chang  <tony@chromium.org>
 
-        * accessibility/AccessibilityMediaControls.cpp:
-        * accessibility/AccessibilityMediaControls.h:
-            Added.
-
-        * accessibility/AccessibilityObject.cpp:
-        * accessibility/AccessibilityObject.h:
-            Add isMediaTimeline. Update Copyright.
-
-        * accessibility/AccessibilitySlider.h:
-            Make constructor protected instead of private so AccessibilityMediaTimeline can
-            call it.
-
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
-        (-[AccessibilityObjectWrapper subrole]):
-            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
-
-        * dom/Node.h:
-            add isMediaControlElement.
-
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
-        (WebCore::localizedMediaControlElementString): 
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription): 
-            New, return localized media controller strings.
-
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
-            Move inside of "#if ENABLE(VIDEO)"
-        (WebCore::localizedMediaControlElementString):
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription):
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::MediaControlElement):
-            Initialize m_displayType.
-        (WebCore::MediaControlElement::MediaControlElement):
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
-            Fix style.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-            Set m_displayType based on pseudo style ID.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-            rename local "o" to "object".
-        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
-        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
-        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-            Update for MediaControlInputElement constructor change.
-        (WebCore::MediaControlTimeDisplayElement::formatTime):
-            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
-        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
-            New, set text to current time.
-        * rendering/MediaControlElements.h:
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-            Create controls in tab order.
-        (WebCore::RenderMedia::formatTime):
-            Moved to MediaControlTimeDisplayElement::formatTime.
-        (WebCore::RenderMedia::updateTimeDisplay):
-            Call MediaControlTimeDisplayElement::setCurrentValue.
-        * rendering/RenderMedia.h:
-
-2009-08-25  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Fix Canvas layout test failures in Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=28720
-
-        The previous fix r47757 does not handle the V8 object conversion correctly.
-
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-08-25  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
-        https://bugs.webkit.org/show_bug.cgi?id=28717
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-08-25  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] Implement media volume slider for chromium
-        https://bugs.webkit.org/show_bug.cgi?id=28715
-
-        Provided the implementation of the volume slider and its container for
-        chromium port. With this change there will be a usable volume control
-        slider for chromium theme.
-
-        No new tests since this is covered by existing media layout tests.
-
-        * css/mediaControlsChromium.css: CSS style for the volume slider.
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
-        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
-
-2009-08-25  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Missed checking in 2 Canvas3D files
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
-
-2009-08-25  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Exception from JavaScript propagates to main script
-        https://bugs.webkit.org/show_bug.cgi?id=26433
-
-        Make sure that exceptions thrown both at compile time and at
-        runtime in javascript URLs are isolated from the main script.
-
-        Test: fast/dom/javascript-url-exception-isolation.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluate):
-
-2009-08-25  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Added all new Canvas3D files to the build
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        This also hooks up CanvasRenderingContext as the common base class for
-        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
-        of logic throughout to support the new CanvasRenderingContext3D object.
-        But nothing is hooked up yet.
-
-        * DerivedSources.make:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore/GNUmakefile.am:
-        * WebCore/WebCore.gypi:
-        * WebCore/WebCoreSources.bkl:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::fillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillColor):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
-        (WebCore::JSCanvasRenderingContext2D::strokeRect):
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
-        (WebCore::JSCanvasRenderingContext2D::setShadow):
-        (WebCore::JSCanvasRenderingContext2D::createPattern):
-        (WebCore::JSCanvasRenderingContext2D::putImageData):
-        (WebCore::JSCanvasRenderingContext2D::fillText):
-        (WebCore::JSCanvasRenderingContext2D::strokeText):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM):
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSHTMLCanvasElementCustom.cpp:
-        (WebCore::JSHTMLCanvasElement::markChildren):
-        * dom/Document.cpp:
-        (WebCore::Document::getCSSCanvasContext):
-        * dom/Document.h:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::willDraw):
-        (WebCore::HTMLCanvasElement::reset):
-        (WebCore::HTMLCanvasElement::paint):
-        (WebCore::HTMLCanvasElement::is3D):
-        (WebCore::HTMLCanvasElement::context3D):
-        (WebCore::HTMLCanvasElement::texture3D):
-        * html/HTMLCanvasElement.h:
-        (WebCore::HTMLCanvasElement::renderingContext):
-        * html/canvas/CanvasObject.cpp:
-        (WebCore::CanvasObject::~CanvasObject):
-        * html/canvas/CanvasRenderingContext.idl:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
-        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
-        * html/canvas/CanvasRenderingContext2D.h:
-        (WebCore::CanvasRenderingContext2D::is2d):
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.idl:
-
-2009-08-25  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Anders Carlsson.
+        https://bugs.webkit.org/show_bug.cgi?id=18819
+        Pressing option+page{down,up} should move the cursor and scroll in
+        content editable areas.  On other platforms, pressing page{down,up}
+        should move the cursor and scroll in content editable areas.
 
-        REGRESSION (r47630): fast/repaint/background-generated.html is failing
-        https://bugs.webkit.org/show_bug.cgi?id=28704
+        Test: editing/input/option-page-up-down.html
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
-        * rendering/style/FillLayer.h:
-        (WebCore::FillSize::FillSize): Changed assignment to initialization and
-            removed redundant assignment to size.
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
 
-2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+2010-03-03  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Gavin Barraclough.
 
-        [Chromium] Complex text doesn't show up with text stroking
-        https://bugs.webkit.org/show_bug.cgi?id=28707
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
 
-        Skip the NULL check of m_hdc if Windows GDI is not in use.
+        Update the obviously safe getters to allow caching
 
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::Font::drawComplexText):
+        Test: fast/js/pic/cached-named-property-getter.html
 
-2009-08-25  Alpha Lam  <hclam@chromium.org>
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertySlot):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertySlot):
 
-        Reviewed by David Levin.
+2010-03-04  Mark Rowe  <mrowe@apple.com>
 
-        Media controls panel does not have a volume control slider
-        https://bugs.webkit.org/show_bug.cgi?id=28241
+        Reviewed by Sam Weinig.
 
-        Introduced "-webkit-media-controls-volume-slider",
-        "-webkit-media-controls-volume-slider-container" and the supporting
-        implementation. Also added appearances of "media-volume-slider" and
-        "media-volume-slider-container".
+        <rdar://problem/7717249> DOMSVG.h includes a non-existent DOMSVGFEMorphologyElement.h
 
-        The implementation of the controls are in WebCore::MediaControlElements.
-        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+        * WebCore.xcodeproj/project.pbxproj: Copy DOMSVGFEMorphologyElement.h and DOMSVGFEMorphologyElementInternal.h
+        in to the framework wrapper.
 
-        No new tests since this change doesn't have theme implementation and the
-        volume slider is disabled by default.
+2010-03-04  James Robinson  <jamesr@chromium.org>
 
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): ditto.
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::): ditto.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
-        * css/CSSValueKeywords.in: ditto.
-        * css/mediaControls.css: Makes the volume slider disabled by default.
-        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
-        (WebCore::):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
-        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
-        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
-        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
-        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
-        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
-        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
-        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
-        * rendering/MediaControlElements.h:
-        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
-        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
-        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
-        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
-        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
-        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
-        (WebCore::RenderMedia::forwardEvent):
-        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
-        * rendering/RenderMedia.h:
-        Added definition for RenderMedia::updateVolumeSliderContainer().
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
-        (WebCore::RenderSlider::thumbRect): ditto.
-        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
-        (WebCore::RenderSlider::setValueForPosition): ditto.
-        (WebCore::RenderSlider::positionForOffset): ditto.
-        (WebCore::RenderSlider::currentPosition): ditto.
-        (WebCore::RenderSlider::trackSize): ditto.
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
-        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
-        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
-        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::): Constants for volume control parts.
+        Reviewed by Dimitri Glazkov.
 
-2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Handles setting HTMLSelectElement.length with mutation handlers present
+        https://bugs.webkit.org/show_bug.cgi?id=33983
 
-        Reviewed by Ariya Hidayat.
+        When setting an HTMLSelectElement's length attribute, option elements have to be added or removed to the select
+        as appropriate.  This is a little tricky with mutation events since they might add, remove, or reorder elements
+        while option elements are being added or deleted.
 
-        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+        Tests: fast/forms/select-set-length-optgroup.html
+               fast/forms/select-set-length-with-mutation-remove.html
+               fast/forms/select-set-length-with-mutation-reorder.html
+               fast/forms/select-set-length-with-mutation-reparent.html
+               fast/forms/select-set-length-with-mutation.html
+               fast/forms/select-set-length.html
 
-        If no configuration is specified when building WebKit we pass the
-        debug_and_release option to QMake which results in Makefiles for
-        both configurations being generated.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength):
 
-        Previously we built both of these configurations by default, for
-        all targets (both the QtWebKit framework/dyldlib and the various
-        executables such as QtLauncher and tests). This makes sense for
-        the libraries, which get the _debug suffix and can be loaded on
-        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
-        ended up building the same executable twice.
+2010-03-04  Csaba Osztrogonác  <ossy@webkit.org>
 
-        We now only build one instance of each executable, and since this
-        is a developer build we build the debug-version. Passing either
-        --debug or --release to build-webkit will override this, and
-        even in the default case the release version can still be built
-        by running 'make release' in the the build directory of each
-        target.
+        [Qt] Unreviewed buildfix after r55542 on Windows.
 
         * WebCore.pro:
+         - plugins/win/PluginDatabaseWin.cpp removed.
+         - platform/win/WebCoreInstanceHandle.cpp added.
 
-2009-08-25  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28690
-        Build failure in webkitgtk+-1.1.3
-
-        Do not use deprecated function to unref a pixbuf.
-
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::Cursor::Cursor):
-
-2009-08-24  Hironori Bono  <hbono@chromium.org>
+        * platform/win/WebCoreInstanceHandle.cpp: Remove explicit qualification in namespace declaration to make gcc happy.
 
-        Reviewed by Adam Barth.
+2010-03-04  Nate Chapin  <japhet@chromium.org>
 
-        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
-        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
-        Chromium cannot send valid key-codes to JavaScript when a user types
-        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+        Fix the case where we do a same document navigation, scroll,
+        then repeat the same document navigation.  Currently, the second
+        navigation does nothing.
 
-        To write layout tests for this issue, added mappings from function-key
-        names to platform-specific key-codes to EventSendingController objects
-        so that eventSender.keyDown() can send function-key events without using
-        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
-        is only for Mac. So this change adds this new test to Skipped tests for other
-        platforms to prevent this change from crashing the build trees.)
+        https://bugs.webkit.org/show_bug.cgi?id=35547
 
-        Test: fast/events/keydown-function-keys.html
+        Test: fast/loader/repeat-same-document-navigation.html
 
-       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
-        to WebKit key-code for function keys.
-        (WebCore::windowsKeyCodeForKeyEvent):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Call scrollToFragment() whether or not the hash changed.
 
-2009-08-24  Antti Koivisto  <antti@apple.com>
+2010-03-04  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Simon Fraser.
+        Build fix.
         
-        https://bugs.webkit.org/show_bug.cgi?id=28698
-        Avoid unnecessary transformations for the window resizer rect.
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setFrameRect):
+        const long long cMaxDistance = numeric_limits<long long>::max() created global
+        initializers at the call sites, so replace with an inline function.
 
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Anders Carlsson.
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
+        * page/SpatialNavigation.h:
+        (WebCore::maxDistance):
+        (WebCore::FocusCandidate::FocusCandidate):
 
-        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
-        (DNS prefetching support)
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
-        thread on Windows, because there isn't one on main one.
+        Unreviewed attempt to fix Windows build.
 
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+        * page/SpatialNavigation.cpp:
+        (WebCore::spatialDistance):
 
-        Reviewed by Darin Adler.
+2010-03-04  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28374
-        Cross-scheme requests should not be blocked by appcache rules
+        Build fix.
 
-        Test: http/tests/appcache/different-scheme.html
+        Delcare updateFocusCandidateIfCloser static to avoid warning.
 
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
-        Resources with different schemes can never be loaded from appcache.
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
 
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+2010-03-04  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Darin Adler and Sam Weinig.
+        Reviewed by Dmitry Titov.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28688
-        REGRESSION(r24994): Cannot create a frame with a javascript URL
+        [chromium] make history.{push,replace}State enabled at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=35753
 
-        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setPushStateEnabled):
+        (WebCore::RuntimeEnabledFeatures::pushStateEnabled):
+        (WebCore::RuntimeEnabledFeatures::replaceStateEnabled):
+        * page/History.idl:
 
-        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
-        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
-        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
-        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
-        Omit the checks if there is no document in frame yet.
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-08-24  Nate Chapin  <japhet@chromium.org>
+        Unreviewed attempt to (again) fix Mac build.
 
-        Reviewed by Eric Seidel.
+        * page/SpatialNavigation.cpp:
+        (WebCore::spatialDistance):
 
-        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
-        RenderStyle being accessed.
+2010-03-04  Dan Bernstein  <mitz@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28681
-
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
-
-2009-08-24  Dan Bernstein  <mitz@apple.com>
+        Based on a patch from Nick Jong.
 
         Reviewed by Simon Fraser.
 
-        <rdar://problem/5743105> Long freezing during loading and selecting text
-        of a large table
-        https://bugs.webkit.org/show_bug.cgi?id=14918
-
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setSelection): Added calls to
-            beginDeferredRepaints() and endDeferredRepaints() around the
-            invalidation of the selection, in order to better coalesce multiple
-            invalid rectangles.
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+        Improve selection in multi-column blocks when hitting points above or
+        below a column rect.
 
-        Reviewed by Timothy Hatcher.
+        Test: fast/multicol/hit-test-above-or-below.html
 
-        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28680
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
-        * inspector/front-end/treeoutline.js:
-        (TreeOutline.prototype.getCachedTreeElement):
-        (TreeOutline.prototype.findTreeElement):
-        * inspector/front-end/utilities.js:
-        (isAncestorNode):
-        ():
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Do expand local scope when hitting the break
-
-        https://bugs.webkit.org/show_bug.cgi?id=28678
-
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-
-2009-08-24  Ada Chan  <adachan@apple.com>
-
-        Reviewed by Steve Falkenburg.
-
-        Make sure we use the current FrameView's frame rect when
-        going back to a cached page.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28659
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::open):
-
-2009-08-24  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Darin Adler.
-
-        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
-        https://bugs.webkit.org/show_bug.cgi?id=28673
-
-        Test: svg/dom/text-rotate-live.html
-
-        * svg/SVGNumberList.cpp:
-        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
-        numbers.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPointToColumnContents): If the point lies
+        within the horizontal range for a column, constrain it to the column (if
+        it is above) or the next column (if it is below).
 
-2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by NOBODY (build fix)
+        Reviewed by Simon Fraser.
 
-        Turn off ENABLE_3D_CANVAS in the xconfig files.
+        Attempt to fix Mac build.
 
-        * Configurations/FeatureDefines.xcconfig:
+        * page/SpatialNavigation.cpp:
 
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-04  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-        Reviewed by Timothy Hatcher.
+        Add SpatialNavigation header and cpp to Mac XCode project file.
 
-        WebInspector: Only expand local scope when hitting the break
+        Reviewed by Kenneth Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28678
+        * WebCore.xcodeproj/project.pbxproj:
 
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
+2010-03-02  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-08-24  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Simon Fraser, Eric Seidel and Darin Adler.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
+        Based on the initial work of Marco Barisione <marco.barisione@collabora.co.uk>
 
-        Reviewed by Simon Fraser.
+        Extend keyboard navigation to allow directional navigation
+        https://bugs.webkit.org/show_bug.cgi?id=18662
 
-        background-size fails to parse if a single length/percentage/auto is followed by a comma
-        https://bugs.webkit.org/show_bug.cgi?id=28674
+        This patch implements the core logic of the 'Spatial Navigation' feature [1].
+        It improves the accessibility support of WebCore by extending the basic keyboard
+        navigation currently available (based on Tab forward and backward) with the
+        addition of a two-dimensional directional navigation by using Left, Right, Up and
+        Down arrow keys to move to the "nearest" element in the corresponding direction.
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
-            which is set to false when this method consumes a comma. Moved
-            handling of 'contain' and 'cover' from parseFillProperty into this
-            method.
-        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
-            processing the next value, and pass allowComma to parseFillSize.
-        * css/CSSParser.h:
+        Highlights:
+        * Feature is turned off by default in Settings. Port specific APIs need to be added
+          for toggling it on/off.
+        * Only elements viewed in the current viewport can have focus move to it. If the
+          "nearest" is not in viewport dimensions, then a scroll-in-direction action is
+          performed.
 
-2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+        Known issues (to be covered in follow-up bugs):
+        * Add port specific hooks to each DRT to enable/disable Spatial Navigation.
+        * Support for spatial navigation through form elements (<input>, <select>, etc)
+          is be added.
+        * Make navigation keys customizable. It currently works with arrows keys only
+          (up, down, right and left).
+        * Make it support modifiers (Alt, Ctrl and Shift).
+        * Improve support on scrollable content.
 
-        Reviewed by Gustavo Noronha.
+        [1] http://en.wikipedia.org/wiki/Spatial_navigation
 
-        [GTK] Support for cursors that are images
-        https://bugs.webkit.org/show_bug.cgi?id=28346
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        (WebCore::EventHandler::focusDirectionForKey):
+        (WebCore::EventHandler::defaultArrowEventHandler):
+        * page/EventHandler.h:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        (WebCore::FocusController::advanceFocusDirectionally):
+        (WebCore::updateFocusCandidateIfCloser):
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/FocusController.h:
+        * page/FocusDirection.h:
+        (WebCore::):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSpatialNavigationEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::isSpatialNavigationEnabled):
+        * page/SpatialNavigation.cpp: Added.
+        (WebCore::distanceInDirection):
+        (WebCore::renderRectRelativeToRootDocument):
+        (WebCore::alignmentForRects):
+        (WebCore::isHorizontalMove):
+        (WebCore::areRectsFullyAligned):
+        (WebCore::areRectsPartiallyAligned):
+        (WebCore::spatialDistance):
+        (WebCore::isRectInDirection):
+        (WebCore::hasOffscreenRect):
+        (WebCore::scrollInDirection):
+        (WebCore::isInRootDocument):
+        (WebCore::deflateIfOverlapped):
+        * page/SpatialNavigation.h: Added.
+        (WebCore::):
+        (WebCore::FocusCandidate::FocusCandidate):
 
-        Added support for cursors which are images for CursorGtk. Added
-        a manual test for this.
+2010-03-04  Beth Dakin  <bdakin@apple.com>
 
-        * manual-tests/gtk/cursor-image.html: Added.
-        * manual-tests/gtk/resources/redcursor.cur: Added.
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::Cursor::Cursor):
+        Reviewed by Anders Carlsson.
 
-2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+        This fixes the layering violation I committed yesterday by moving 
+        Page::instanceHandle into its own file just in the WebCore 
+        namespace.
 
-        Reviewed by Gustavo Noronha.
+        Added WebCoreInstanceHandle.h + .cpp and removed PageWin.cpp
+        * WebCore.vcproj/WebCore.vcproj:
+        * page/win/PageWin.cpp: Removed.
 
-        [GTK] Integrate GStreamer video with the graphics backend
-        https://bugs.webkit.org/show_bug.cgi?id=16356
+        Remove all instance handle code from Page.
+        * page/Page.h:
 
-        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+        New files.
+        * platform/win/WebCoreInstanceHandle.cpp: Added.
+        * platform/win/WebCoreInstanceHandle.h: Added.
+        (WebCore::setInstanceHandle):
+        (WebCore::instanceHandle):
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
-        error for different GStreamer errors to MediaPlayerPrivate.
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
-        initialization boolean to a better place.
-        (WebCore::MediaPlayerPrivate::play):
-        (WebCore::MediaPlayerPrivate::pause):
-        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
-        consider the source as stream if duration query failed.
-        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
-        an early return.
-        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
-        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
-        function doesn't seem to be used anywhere in WebCore.
-        (WebCore::MediaPlayerPrivate::paused):
-        (WebCore::MediaPlayerPrivate::seeking):
-        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
-        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
-        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
-        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
-        (WebCore::MediaPlayerPrivate::bytesLoaded):
-        (WebCore::MediaPlayerPrivate::totalBytesKnown):
-        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
-        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
-        after seek ended with a successful change
-        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
-        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
-        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
-        (WebCore::MediaPlayerPrivate::getSupportedTypes):
-        (WebCore::MediaPlayerPrivate::supportsType):
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
-        support.
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
-        do not set playbin's audio sink.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
-        queue at the end of the idle function.
-        (webkit_video_sink_render): Increase reference count of async queue.
-        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+        Switch to WebCore::instanceHandle() instead of 
+        Page::instanceHandle() and include the new header.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::registerClass):
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::initializeOffScreenTimerWindow):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::platformStart):
 
-2009-08-23  Chris Marrin  <cmarrin@apple.com>
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Simon Fraser.
+        Unreviewed build fix.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Remaining new files for Canvas3D
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        'glib_file_name' renamed to 'gligFileName'.
 
-        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
-        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
-        * html/canvas/CanvasByteArray.h: Added.
-        * html/canvas/CanvasByteArray.idl: Added.
-        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
-        * html/canvas/CanvasNumberArray.h: Added.
-        * html/canvas/CanvasNumberArray.idl: Added.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::Image::loadPlatformResource):
 
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-04  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+        Web Inspector: Remove two last synchronous calls from front-end to InspectorBackend.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28408
+        https://bugs.webkit.org/show_bug.cgi?id=35720
 
-        * inspector/front-end/CallStackSidebarPane.js:
-        (WebInspector.CallStackSidebarPane.prototype.update):
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleTextMessage):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype.get domWindow):
-        (InspectorController.openInInspectedWindow):
-        (InspectorController.getCallFrames):
-        (InspectorController.evaluateInCallFrame):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableSearchingForNode):
+        (WebCore::InspectorBackend::disableSearchingForNode):
+        (WebCore::InspectorBackend::setPauseOnExceptionsState):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorContorller::setSearchingForNode):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::searchingForNodeWasEnabled):
+        (WebCore::InspectorFrontend::searchingForNodeWasDisabled):
+        (WebCore::InspectorFrontend::updatePauseOnExceptionsState):
+        * inspector/InspectorFrontend.h:
         * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
         (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.openInInspectedWindow):
-        (InjectedScript.getCallFrames):
-        (InjectedScript.evaluateInCallFrame):
-        (InjectedScript._callFrameForId):
-        (InjectedScript._objectForId):
-        (InjectedScript.CallFrameProxy):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype._update):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectPropertyProxy):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane):
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
-        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
-        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        (WebInspector.ElementsPanel.prototype.searchingForNodeWasEnabled):
+        (WebInspector.ElementsPanel.prototype.searchingForNodeWasDisabled):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.enableSearchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.disableSearchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptionsState):
         * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
-
-2009-08-24  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add support for the placeholder attribute and DOM property of the textarea element.
-        https://bugs.webkit.org/show_bug.cgi?id=21248
-
-        A DOM node for an INPUT element doesn't have a flag for placeholder
-        visibility anymore.  This patch also fixes a bug that a renderer
-        doesn't reflect a corresponding DOM value change.
-
-        Tests: fast/forms/textarea-placeholder-dom-property.html
-               fast/forms/textarea-placeholder-pseudo-style.html
-               fast/forms/textarea-placeholder-set-attribute.html
-               fast/forms/textarea-placeholder-set-value.html
-
-        * css/html.css: Add the default style for placeholder of textarea.
-        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::placeholderShouldBeVisible):
-        (WebCore::InputElement::updatePlaceholderVisibility):
-        (WebCore::InputElement::setValueFromRenderer):
-        (WebCore::InputElementData::InputElementData):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::dispatchFocusEvent):
-        (WebCore::HTMLInputElement::dispatchBlurEvent):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        (WebCore::HTMLTextAreaElement::setValue):
-        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
-        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
-        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        (WebCore::RenderTextControl::styleDidChange):
-        (WebCore::RenderTextControl::setInnerTextStyle):
-        (WebCore::RenderTextControl::updatePlaceholderVisibility):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
-        (WebCore::RenderTextControlMultiLine::updateFromElement):
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-        (WebCore::RenderTextControlMultiLine::textBaseStyle):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::textBaseStyle):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::dispatchFocusEvent):
-        (WebCore::WMLInputElement::dispatchBlurEvent):
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::placeholderShouldBeVisible):
-
-2009-08-23  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
-        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
-        files. They are needed there after r47688.
-
-        * dom/Document.cpp:
-        * svg/SVGComponentTransferFunctionElement.h:
-        * svg/SVGFELightElement.h:
-        * svg/SVGFEMergeNodeElement.h:
-        * svg/SVGFilterPrimitiveStandardAttributes.h:
-
-2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Unreviewed, build fix for make distcheck on GTK+.
-
-        * GNUmakefile.am: Added files needed for the build.
-        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
-        with #if clause.
-        * bindings/js/JSEventTarget.cpp: Dito.
-        * dom/Document.cpp: Dito.
-        * loader/FrameLoader.cpp: Dito.
-
-2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Throws an Error on "null"
-        https://bugs.webkit.org/show_bug.cgi?id=28665
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype.updatePauseOnExceptionsState):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        * inspector/front-end/inspector.js:
+        (WebInspector.searchingForNodeWasEnabled):
+        (WebInspector.searchingForNodeWasDisabled):
+        (WebInspector.updatePauseOnExceptionsState):
 
-2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
-
-        https://bugs.webkit.org/show_bug.cgi?id=28666
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getProperties):
-        (InjectedScript.createProxyObject):
-
-2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
-        https://bugs.webkit.org/show_bug.cgi?id=28345
-
-        When doing the conversion between cairo_surface_t* and GdkPixbuf*
-        account for the differences in the respective formats' in-memory
-        image format.
-
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::getCairoSurfacePixel):
-        (WebCore::getGdkPixbufPixel):
-        (WebCore::BitmapImage::getGdkPixbuf):
-
-2009-08-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Make DOM classes start with a reference count of 1, like all other RefCounted
-        
-        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
-        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
-        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
-
-        * DerivedSources.make: Fix error seen every time we build by escaping the $
-        in the build rule, since you have to use $$ for that in make.
-
-        * WebCore.base.exp: Updated.
-
-        * bindings/objc/DOM.mm:
-        Added now-needed include of SVGNames.h.
-
-        * dom/Document.cpp: Added now-needed include of SVGNames.h.
-        (WebCore::Document::createElement): Use create instead of new.
-
-        * dom/Element.cpp:
-        (WebCore::Element::Element): Added ConstructionType argument so the caller
-        can determine whether this starts with a reference count of either 0 or 1.
-        Later we will remove this again once they are all 1.
-        (WebCore::Element::create): Added.
-
-        * dom/Element.h: Added create and made constructor protected.
-
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
-        * dom/StyledElement.h: Made many functions protected or private, including
-        the constructor.
-
-        * dom/make_names.pl: Use create to create the base elements HTMLElement,
-        SVGElement, and WMLElement.
-
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
-        * editing/UnlinkCommand.cpp:
-        (WebCore::UnlinkCommand::doApply): Ditto.
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::create): Added.
-        * html/HTMLAnchorElement.h: Made constructor protected and added create.
-        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
-
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::create): Added.
-        * html/HTMLAppletElement.h: Made constructor private and added create.
-
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::create): Added.
-        * html/HTMLAreaElement.h: Made constructor private and added create.
-
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::create): Added.
-        * html/HTMLElement.h: Made constructor protected and added create.
-        Made other functions protected and private. Also added inline
-        definition of constructor.
-
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::create): Added.
-        * html/HTMLEmbedElement.h: Made constructor private and added create.
-        Made other functions private.
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::create): Added.
-        (WebCore::HTMLFrameElement::parseMappedAttribute):
-        * html/HTMLFrameElement.h: Made constructor private and added create.
-        Made other functions private.
-
-        * html/HTMLFrameElementBase.h: Made functions protected and private.
-
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
-        CreateElement so reference count starts at 1.
-
-        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
-
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::create): Added.
-        * html/HTMLIFrameElement.h: Made constructor private and added create.
-        Made other functions private.
-
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::create): Added.
-        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
-        into a for loop and tweaked formatting.
-
-        * html/HTMLObjectElement.h: Made constructor private and added create.
-        Made other functions private.
-
-        * html/HTMLPlugInElement.h: Made constructor protected.
-        Made other functions protected and private.
-
-        * html/HTMLPlugInImageElement.h: Made constructor and another function
-        protected.
-
-        * html/HTMLTagNames.in: Removed createWithNew from all classes that
-        now have create functions. Moved conditional noscript to a separate
-        paragraph.
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
-        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
-        * page/DragController.cpp:
-        (WebCore::documentFragmentFromDragData): Ditto.
-
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
-        so reference count still starts at 0. Will change this class later.
-        (WebCore::SVGElement::create): Added.
-        * svg/SVGElement.h: Added create, made constructor protected, and
-        made other functions protected and private. Removed unneeded
-        SVGNames.h include.
-
-        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
-        include.
-
-        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
-        Made functions private.
-
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
-        so reference count still starts at 0. Will change this class later.
-        (WebCore::WMLElement::create): Added.
-        * wml/WMLElement.h: Added create and made constructor protected.
+        Web Inspector: Clicking on an error should take me to the error
 
-        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34860
 
-2009-08-22  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
-
-        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
-        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
-
-        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
-
-        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
-          They'll get reattached when the document comes out of the page cache.
-        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
-
-2009-08-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
-        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
-        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
-        
-        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
-        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
-        on it to get comparable results.
-
-        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::MarginInfo::MarginInfo):
-        (WebCore::RenderBlock::collapseMargins):
-        (WebCore::RenderBlock::clearFloatsIfNeeded):
-        (WebCore::RenderBlock::handleBottomOfBlock):
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::MarginInfo::clearMargin):
-        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
-
-2009-08-22  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Need to implement ARIA role="listitem" and role="list"
-        https://bugs.webkit.org/show_bug.cgi?id=28606
-
-        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::getOrCreate):
-        * accessibility/AccessibilityList.cpp:
-        (WebCore::AccessibilityList::isUnorderedList):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-
-2009-08-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Clean up fill image geometry calculation
-        https://bugs.webkit.org/show_bug.cgi?id=28652
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
-            calculateBackgroundSize() to this. Replaced separate scaledWidth and
-            scaledHeight parameters with a single scaledSize parameter. Renamed
-            parameters and local variables.
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
-            to use CSS3 Backgrounds and Borders terminology in comments and
-            local variable names. Renamed, clarified and consolidated some local
-            variables.
-        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
-
-2009-08-22  Chris Marrin  <cmarrin@apple.com>
-
-        Unreviewed, build fix.
-
-        Backing out http://trac.webkit.org/changeset/47669
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        * html/canvas/CanvasRenderingContext2D.h:
-
-2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Backing out http://trac.webkit.org/changeset/47671 in preparation of
-        rolling out http://trac.webkit.org/changeset/47669.
-
-2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Anders Carlsson.
-
-        Build fix, add CanvasRenderingContext to build systems.
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        * DerivedSources.make: Added CanvasRenderinContext.
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-2009-08-21  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        New files implementing GL buffer wrappers, and support to make them platform independent
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
-        * html/canvas/CanvasBuffer.h: Added.
-        * html/canvas/CanvasBuffer.idl: Added.
-        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
-        * html/canvas/CanvasFramebuffer.h: Added.
-        * html/canvas/CanvasFramebuffer.idl: Added.
-        * html/canvas/CanvasObject.h: Expose m_context
-        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
-        * html/canvas/CanvasProgram.h: Added.
-        * html/canvas/CanvasProgram.idl: Added.
-        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
-        * html/canvas/CanvasRenderbuffer.h: Added.
-        * html/canvas/CanvasRenderbuffer.idl: Added.
-        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
-        * html/canvas/CanvasShader.h: Added.
-        * html/canvas/CanvasShader.idl: Added.
-        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
-        * html/canvas/CanvasTexture.h: Added.
-        * html/canvas/CanvasTexture.idl: Added.
-        * platform/graphics/GraphicsContext3D.cpp: Removed.
-        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
-        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
-
-2009-08-21  Darin Adler  <darin@apple.com>
-
-        * WebCore.vcproj/build-generated-files.sh:
-        * make-generated-sources.sh:
-        Removed obsolete code to set up CREATE_HASH_TABLE.
-
-2009-08-21  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
-
-        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
-        No need to open the file with write access.  Only read access is needed.
-
-2009-08-21  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
-
-        Also fixes leaks seen on appcache tests.
-
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
-        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
-        to call, and we do not think that the leak occurs there anyway.
-
-2009-08-21  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28650
-        Remove cross-thread code from CrossOriginPreflightResultCache.
-        Removed mutexes, atomic initializer and string copy.
-
-        No new tests, the worker tests cover this.
-
-        * loader/CrossOriginPreflightResultCache.cpp:
-        (WebCore::addToAccessControlAllowList):
-        (WebCore::CrossOriginPreflightResultCache::shared):
-        (WebCore::CrossOriginPreflightResultCache::appendEntry):
-        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
-        (WebCore::CrossOriginPreflightResultCache::empty):
-        * loader/CrossOriginPreflightResultCache.h:
-
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        Buildfix after http://trac.webkit.org/changeset/47655.
-
-        * html/HTMLFormControlElement.h:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._selectTab):
+        (WebInspector.ResourceView.prototype.selectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showResource):
 
-2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Improve Cookie DataGrid to Show Hidden Data
-        https://bugs.webkit.org/show_bug.cgi?id=28269
+        Web Inspector: Remove sync access to resourceTrackingEnabled.
 
-          Removed Custom Bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35693
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
         * inspector/InspectorBackend.cpp:
-
-          Made Non-Custom Bindings in the Backend
-
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::deleteCookie):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::deleteCookie):
-        * inspector/InspectorController.h:
-
-          Build the Cookie ScriptObjects, handles using document.cookie in
-          case the platform hasn't implemented raw cookie access.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getCookies):
-        (WebCore::InspectorDOMAgent::buildObjectForCookie):
-        (WebCore::InspectorDOMAgent::buildArrayForCookies):
-        * inspector/InspectorDOMAgent.h:
-
-          Complete the Asynchronous Calls
-
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didGetCookies):
-        * inspector/InspectorFrontend.h:
-
-          Asynchronous Functions to get Cookie Data
-
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.Cookies.getCookiesAsync):
-        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
-
-          Refactor to use the Asynchronous Functions
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems):
-        (WebInspector.CookieItemsView.prototype.update.callback):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-
-          Cleaned/Commented Related Code
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype.show):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.get resourceTrackingEnabled):
+        (WebInspector.ResourcesPanel.prototype.get visibleView):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasEnabled):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasDisabled):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
 
-        (InspectorController.searchCanceled):
-        * inspector/front-end/InjectedScript.js:
-        * platform/Cookie.h:
-        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+2010-03-04  Antoine Quint  <ml@graougraou.com>
 
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Adele Peterson.
+        DOM insertion mutation events should dispatch after a node is attached to the render tree
+        https://bugs.webkit.org/show_bug.cgi?id=35590
 
-        https://bugs.webkit.org/show_bug.cgi?id=28145
-        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+        Test: fast/events/domnodeinsertedintodocument-dispatched-post-rendering.html
 
-        Tests: fast/forms/formnovalidate-attribute.html
-               fast/forms/novalidate-attribute.html
+        Split off the internal-to-WebCore node insertion notification code from the DOM mutation
+        event dispatching, originally in dispatchChildInsertionEvents(), to a new static function
+        called notifyChildInserted(). This allows us to dispatch the mutation events at a later
+        time upon insertion of a child into to the tree, specifically _after_ attachment to the render
+        tree.
 
-        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
-        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
-        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::novalidate): attribute getter
-        (WebCore::HTMLFormElement::setNovalidate): attribute setter
-        * html/HTMLFormElement.h:
-        * html/HTMLFormElement.idl: novalidate attribute exposed
-        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::notifyChildInserted):
+        (WebCore::dispatchChildInsertionEvents):
 
-2009-08-21  Dan Bernstein  <mitz@apple.com>
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        Reviewed by Beth Dakin.
+        Reviewed by Holger Freyther.
 
-        Rendering changes to complete
-        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
-        background-size
-        https://bugs.webkit.org/show_bug.cgi?id=27573
-        and
-        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
-        background-size
-        https://bugs.webkit.org/show_bug.cgi?id=27574
+        Make paths relocatable on runtime on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=32711
 
-        Test: fast/backgrounds/size/contain-and-cover.html
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (get_webkit_datadir):
+        (WebCore::Image::loadPlatformResource):
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
+2010-03-04  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Adele Peterson.
+        Web Inspector: Popup for Timeline panel will work in a tooltip mode
+
+        https://bugs.webkit.org/show_bug.cgi?id=35680
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover):
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.hide):
+        (WebInspector.Popover.prototype._positionElement):
+        (WebInspector.PopoverHelper):
+        (WebInspector.PopoverHelper.prototype._mouseDown):
+        (WebInspector.PopoverHelper.prototype._mouseMove.doHide):
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        (WebInspector.PopoverHelper.prototype._resetHoverTimer):
+        (WebInspector.PopoverHelper.prototype.hidePopup):
+        (WebInspector.PopoverHelper.prototype._mouseHover):
+        (WebInspector.PopoverHelper.prototype._killHidePopupTimer):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelinePanel.prototype._getPopoverAnchor):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelinePanel.prototype._closeRecordDetails):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createCell):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createRow):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createLinkRow):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        * inspector/front-end/inspector.css:
 
-        https://bugs.webkit.org/show_bug.cgi?id=27452
-        Add support for checkValidity() method and invalid event, from HTML5
-        specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
-
-        Tests: fast/events/invalid-001.html
-               fast/events/invalid-002.html
-               fast/events/invalid-003.html
-               fast/events/invalid-004.html
-               fast/events/invalid-005.html
-               fast/forms/checkValidity-001.html
-               fast/forms/checkValidity-002.html
-               fast/forms/checkValidity-003.html
-               fast/forms/checkValidity-004.html
-
-        * dom/Document.idl: oninvalid event handler
-        * dom/Element.idl: ditto
-        * dom/EventNames.h: added invalid event
-        * dom/Node.cpp:
-        (WebCore::Node::oninvalid): ditto
-        (WebCore::Node::setOninvalid): ditto
-        * dom/Node.h: ditto
-        * html/HTMLAttributeNames.in: oninvalid attribute
-        * html/HTMLButtonElement.idl: added checkValidity() method
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
-        * html/HTMLFieldSetElement.idl: added checkValidity() method
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
-        implementation
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
-        for form elements
-        * html/HTMLFormElement.h: checkValidity() definition
-        * html/HTMLFormElement.idl: added checkValidity() method
-        * html/HTMLInputElement.idl: added checkValidity() method
-        * html/HTMLSelectElement.idl: added checkValidity() method
-        * html/HTMLTextAreaElement.idl: added checkValidity() method
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::oninvalid): oninvalid event handler
-        (WebCore::DOMWindow::setOninvalid): ditto
-        * page/DOMWindow.h: ditto
-        * page/DOMWindow.idl: ditto
+2010-03-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2009-08-21  Beth Dakin  <bdakin@apple.com>
+        Unreviewed build fix.
 
-        Reviewed by Dan Bernstein.
+        Build fix after r55464.
 
-        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
-        Backgrounds and Borders] Add support for the "round" value for 
-        background-repeat
-        -and-
-        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
-        Borders] Add support for the "space" value for background-repeat
+        No new tests, no new functionality.
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
-        * css/CSSValueKeywords.in:
-        * rendering/style/FillLayer.h:
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
 
-2009-08-21  Chris Marrin  <cmarrin@apple.com>
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        New files for Canvas 3D feature
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        This is all the new files for implementing Canvas 3D. None of them are hooked up and
-        are not even included in the build yet. This incorporates the reviews from Simon
-        and Ollie for these files.
-
-        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
-        * html/CanvasObject.cpp: Added. Base class for all GL object containers
-        * html/CanvasObject.h: Added.
-        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
-        * html/CanvasRenderingContext.h: Added.
-        * html/CanvasRenderingContext.idl: Added.
-        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
-        * html/CanvasRenderingContext3D.h: Added.
-        * html/CanvasRenderingContext3D.idl: Added.
-        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
-        * platform/graphics/GraphicsContext3D.h: Added.
-        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
-        * platform/graphics/mac/Canvas3DLayer.mm: Added.
-        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
-
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+        Add EFL port files to platform/graphics/efl.
+        http://webkit.org/b/35539
 
-        No Review.
+        * platform/graphics/efl/FloatRectEfl.cpp: Added.
+        * platform/graphics/efl/FontEfl.cpp: Added.
+        * platform/graphics/efl/IconEfl.cpp: Added.
+        * platform/graphics/efl/ImageEfl.cpp: Added.
+        * platform/graphics/efl/IntPointEfl.cpp: Added.
+        * platform/graphics/efl/IntRectEfl.cpp: Added.
 
-        Another Windows build fix.
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::diffTextDecorations):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-08-21  David Hyatt  <hyatt@apple.com>
+        Add EFL port files to platform/text/efl.
+        http://webkit.org/b/35740
 
-        Reviewed by Simon Fraser.
+        * platform/text/efl/TextBreakIteratorInternalICUEfl.cpp: Added.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
-        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
-        of the root line box.
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        Covered by existing tests.
+        Reviewed by Holger Freyther.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::addFocusRingRects):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::addFocusRingRects):
-        (WebCore::RenderInline::paintOutline):
+        https://bugs.webkit.org/show_bug.cgi?id=35726
+        Remove orphaned #ifdef WTF_USE_GLIB_ICU_UNICODE_HYBRID
 
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+        Removing orphaned #if USE.
 
-        No Review.
+        * platform/ThreadGlobalData.h:
 
-        Windows build fix.
+2010-03-03  Jeremy Orlow  <jorlow@chromium.org>
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::setTextDecorationProperty): Made it static
-        (WebCore::diffTextDecorations): Made it static
+        Reviewed by Darin Fisher.
 
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+        Throttle sync requests sent to the LocalStorage background thread
+        https://bugs.webkit.org/show_bug.cgi?id=34943
 
-        Reviewed by Eric Seidel.
+        Currently, once a second LocalStorage takes all keys/values which have
+        been changed and sends them to a background thread to sync.  The problem
+        is that this background thread can get overwhelmed and stop being
+        responsive.  This means that if any other page tries to start using
+        LocalStorage (and thus initiates the initial import) that'll block on
+        all the previous syncs completing.
 
-        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
-        https://bugs.webkit.org/show_bug.cgi?id=23892
+        To mitigate this, I'm adding code so that we never schedule another
+        sync task when another is still running.  In order to keep the sync
+        tasks from growing exponentially when they do take longer than the
+        storage sync interval, I've also added a basic rate limiter.  No effort
+        is made to ensure fairness/ordering of what gets synced nor is there
+        any way for this rate to be changed because most normal uses of
+        LocalStorage really shouldn't be hitting these types of limits anyway.
 
-        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
-        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+        The only behavioral change that's observible in JavaScript is time based
+        and thus it's not practical to make new tests that aren't racy.  The
+        existing layout tests cover LocalStorage pretty well, though.
 
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::copy): Added.
-        * css/CSSValueList.h: Added copy.
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::applyUnderline):
-        (WebCore::StyleChange::applyLineThrough):
-        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
-        (WebCore::StyleChange::init): Ditto.
-        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
-        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
-        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performSync):
+        * storage/StorageAreaSync.h:
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-04  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        Inspector: Rename "Databases" Panel as "Storage"
-        https://bugs.webkit.org/show_bug.cgi?id=28620
+        Added support for worker instrumentation in inspector
+        (display list of active workers, allow debugging of workers
+        by injecting fake JS implementation)
 
-          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::inspectorController):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectScript):
+        (WebCore::InjectedScriptHost::nextWorkerId):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::willDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::willDestroyWorker):
         * inspector/InspectorController.h:
-        (WebCore::InspectorController::):
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::showPanel):
-
-          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
-          any DatabasesPanel constructors and appropriate function names.
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._queryFinished):
-        * inspector/front-end/DatabaseTableView.js:
-        (WebInspector.DatabaseTableView.prototype._queryFinished):
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
-        (WebInspector.showStoragePanel):
-        (WebInspector.selectDatabase):
-        (WebInspector.selectDOMStorage):
-        (WebInspector.addDatabase):
-        (WebInspector.addDOMStorage):
-
-          Renamed some files and Updated Accordingly.
-
-        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
-        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
-        * inspector/front-end/WebKit.qrc: use new file names
-        * inspector/front-end/inspector.css: use new images name and class names
-        * inspector/front-end/inspector.html: use new file name
-        * WebCore.gypi: use new file names
-
-          Miscellaneous Updates.
-
-        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
-
-2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        [Haiku] Adding three font-specific files to WebCore:
-        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28131
-
-        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
-        (WebCore::FontCache::platformInit):
-        (WebCore::FontCache::getFontDataForCharacters):
-        (WebCore::FontCache::getSimilarFontPlatformData):
-        (WebCore::FontCache::getLastResortFallbackFont):
-        (WebCore::FontCache::createFontPlatformData):
-        (WebCore::FontCache::getTraitsInFamily):
-        * platform/graphics/haiku/FontHaiku.cpp: Added.
-        (charUnicodeToUTF8HACK):
-        (WebCore::Font::canReturnFallbackFontsForComplexText):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
-        (WebCore::SimpleFontData::platformInit):
-        (WebCore::SimpleFontData::platformCharWidthInit):
-        (WebCore::SimpleFontData::platformDestroy):
-        (WebCore::SimpleFontData::smallCapsFontData):
-        (WebCore::SimpleFontData::containsCharacters):
-        (WebCore::SimpleFontData::determinePitch):
-        (WebCore::SimpleFontData::platformWidthForGlyph):
-
-2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
-
-        Reviewed by Adam Roben.
+        (WebCore::InspectorFrontend::didCreateWorker):
+        (WebCore::InspectorFrontend::willDestroyWorker):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorWorkerResource.h: Added.
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::url):
+        (WebCore::InspectorWorkerResource::isSharedWorker):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/Checkbox.js: Added.
+        (WebInspector.Checkbox.callbackWrapper):
+        (WebInspector.Checkbox):
+        (WebInspector.Checkbox.prototype.checked):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.FakeWorker.prototype._expandURLAndCheckOrigin):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WorkersSidebarPane.js: Added.
+        (WebInspector.WorkersSidebarPane):
+        (WebInspector.WorkersSidebarPane.prototype.addWorker):
+        (WebInspector.WorkersSidebarPane.prototype.removeWorker):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        (WebInspector.WorkersSidebarPane.prototype.reset):
+        (WebInspector.WorkersSidebarPane.prototype._onTriggerInstrument):
+        (WebInspector.Worker):
+        (WebInspector.didCreateWorker):
+        (WebInspector.willDestroyWorker):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        (WebCore::AbstractWorker::contextDestroyed):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::id):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-        Middle click panning icon is offset by 3 pixels
-        https://bugs.webkit.org/show_bug.cgi?id=28611
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * platform/ScrollView.cpp:
-        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
-        * platform/win/CursorWin.cpp:
-        (WebCore::middlePanningCursor):
-        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
-        
-2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
+        Reviewed by Tor Arne Vestbø.
 
-        [Qt] Remove inspector resources for Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=28610
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
 
-        Based on an idea from Simon Hausmann.
+        This also allows shadow builds relying only on qmake to work properly.
 
         * WebCore.pro:
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Inspector: Remove Unused Variable
-        https://bugs.webkit.org/show_bug.cgi?id=28616
+2010-03-02  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype._checkWarning):
+        Reviewed by Simon Hausmann.
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+        [Qt] Avoid calling QFont::detach too often from FontQt
+        https://bugs.webkit.org/show_bug.cgi?id=35569
 
-        Reviewed by Timothy Hatcher.
+        The letter- and wordspacing is inside the WebCore::Font class,
+        our QFont is located in the WebCore::FontPlatformData. Everytime
+        we need to use a QFont inside WebCore::Font we are calling the
+        font method which gets the QFont from the WebCore::FontPlatformData
+        and is applying the letter- and wordspacing. Internally this
+        will attempt to detach the QFont...
 
-        Inspector: Console Array Formatter Shows Extra Properties
-        https://bugs.webkit.org/show_bug.cgi?id=28615
+        Avoid calling setLetterSpacing and setWordSpacing on QFont if
+        the WebCore::Font has the default applied.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
 
-2009-08-21  Beth Dakin  <bdakin@apple.com>
+2010-03-04  Alexander Pavlov  <apavlov@chromium.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Pavel Feldman.
 
-        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
-        Backgrounds and Borders] Add support for the "contain" value for 
-        background-size
-        -and-
-        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
-        Borders] Add support for the "cover" value for background-size
+        Web Inspector: Nothing happens on navigation to resource via a link if resource tracking is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=35574
 
-        Return contain or cover when appropriate, and otherwise do what we 
-        used to do.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentMouseOver):
+        (WebInspector.documentMouseOut):
+        (WebInspector.hideBadLinkPopupIfNecessary):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.showBadLinkPopup.popupOverOut):
+        (WebInspector.showBadLinkPopup):
+        (WebInspector.addMainEventListeners):
 
-        Accept contain and cover as valid values for background-size.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
+2010-03-04  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        Handle setting the size and the sizeLength if appropriate.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillSize):
+        Reviewed by Oliver Hunt.
 
-        Added new keywords contain and cover.
-        * css/CSSValueKeywords.in:
+        getUniformLocation() now returns null if uniform requested 
+        is not found.
+        https://bugs.webkit.org/show_bug.cgi?id=34669
+        
+        Test:LayoutTests/fast/canvas/webgl/uniform-location.html
+        (added missing test)
 
-        Use just sizeLength instead of size to match old behavior.
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
-
-        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
-        a LengthSize (the equivalent of what m_size used to be). I got rid 
-        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
-        struct, FillSize that can be used to set or get m_size and 
-        m_sizeLength both at once. 
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer):
-        (WebCore::FillLayer::operator=):
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::fillUnsetProperties):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillSize::FillSize):
-        (WebCore::FillSize::operator==):
-        (WebCore::FillSize::operator!=):
-        (WebCore::FillLayer::sizeLength):
-        (WebCore::FillLayer::size):
-        (WebCore::FillLayer::isSizeSet):
-        (WebCore::FillLayer::setSizeType):
-        (WebCore::FillLayer::setSizeLength):
-        (WebCore::FillLayer::setSize):
-        (WebCore::FillLayer::clearSize):
-        (WebCore::FillLayer::initialFillSizeType):
-        (WebCore::FillLayer::initialFillSizeLength):
-        (WebCore::FillLayer::initialFillSize):
-
-        This is all boiler-plate stuff to adjust to the new size() vs. 
-        sizeType() vs. sizeLength() distinction.
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundSizeType):
-        (WebCore::InheritedFlags::backgroundSizeLength):
-        (WebCore::InheritedFlags::maskSize):
-        (WebCore::InheritedFlags::setBackgroundSize):
-        (WebCore::InheritedFlags::setBackgroundSizeLength):
-        (WebCore::InheritedFlags::setMaskSize):
-
-        Definition for EBackgroundSizeType.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniformLocation):
 
-2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+2010-03-04  John Abd-El-Malek  <jam@chromium.org>
 
-        Not reviewed, build fix after r47580.
+        Reviewed by Adam Barth.
 
-        [Qt] Adjust the files.
+        Fix incorrect setup of DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=35710
 
-        * inspector/front-end/WebKit.qrc:
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
 
-2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+2010-03-04  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Maciej Stachowiak.
 
-        Enable various "grouping" ARIA roles
-        https://bugs.webkit.org/show_bug.cgi?id=28486
+        https://bugs.webkit.org/show_bug.cgi?id=35603
+        SVG incorrectly allows nested <use> elements in a <use> shadow tree
 
-        Test: platform/mac/accessibility/aria-grouping-roles.html
+        Simplify the handling of invalid or missing use-targets by cloning them
+        to empty <g> elements rather than just allowing the <use> element to
+        be copied into the shadow tree, as this violates a number of assumptions
+        in the shadow tree handling code.
 
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
+        Tests: svg/custom/use-nested-disallowed-target.svg
+               svg/custom/use-nested-missing-target-added.svg
+               svg/custom/use-nested-missing-target-removed.svg
+               svg/custom/use-nested-missing-target.svg
+               svg/custom/use-nested-notarget.svg
 
-2009-08-20  David Levin  <levin@chromium.org>
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
 
-        Unreviewed trivial comment fix.
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        Update a bug link in a comment due to bugzilla amnesia.
+        Reviewed by Gustavo Noronha Silva.
 
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::setResourceToRevalidate):
+        Move Cairo-related font code from platform/graphics/gtk to
+        platform/graphics/cairo, so other ports may use them.
+        http://webkit.org/b/35539
 
-2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+        * GNUmakefile.am:
+        * platform/graphics/cairo/FontCacheCairo.cpp: Copied from WebCore/platform/graphics/gtk/FontCacheGtk.cpp.
+        * platform/graphics/cairo/FontCustomPlatformData.cpp: Copied from WebCore/platform/graphics/gtk/FontCustomPlatformData.cpp.
+        * platform/graphics/cairo/FontCustomPlatformData.h: Copied from WebCore/platform/graphics/gtk/FontCustomPlatformData.h.
+        * platform/graphics/cairo/FontPlatformData.h: Copied from WebCore/platform/graphics/gtk/FontPlatformData.h.
+        * platform/graphics/cairo/FontPlatformDataCairo.cpp: Copied from WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp.
+        * platform/graphics/cairo/GlyphPageTreeNodeCairo.cpp: Copied from WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp.
+        * platform/graphics/cairo/SimpleFontDataCairo.cpp: Copied from WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp.
+        * platform/graphics/gtk/FontCacheGtk.cpp: Removed.
+        * platform/graphics/gtk/FontCustomPlatformData.cpp: Removed.
+        * platform/graphics/gtk/FontCustomPlatformData.h: Removed.
+        * platform/graphics/gtk/FontPlatformData.h: Removed.
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp: Removed.
+        * platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp: Removed.
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp: Removed.
+
+2010-03-04  Evan Stade  <estade@chromium.org>
 
         Reviewed by David Levin.
 
-        HTML5 media elements do not fire waiting events correctly
-        https://bugs.webkit.org/show_bug.cgi?id=28335
-
-        Fire the waiting event before seeking, and fix a case where firing of
-        the seeked event is missed when the ready state is changed during
-        a seek.
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
 
-        Added video-waiting-seeking.html into manual tests because not
-        all platforms allow seeking into non-buffered ranges.
+        This fixes the crash, but the SVG still doesn't render properly.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState): add support for
-        waiting event when seeking.
-        (WebCore::HTMLMediaElement::finishSeek): send seeked event
-        whenever seeking finishes.
-        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
-        new function.
-        * html/HTMLMediaElement.h:
-        * manual-tests/video-waiting-seeking.html: Added.
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix more cases of
-        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
-        the console with certain content
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
 
-        If the border box is empty, simply avoid painting instead of trying to
-        clip to the empty path.
+2010-03-04  Tony Chang  <tony@chromium.org>
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
+        Reviewed by Darin Fisher.
 
-2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+        Initialize m_isMultipartPayload in other ResourceResponse ctor.
+        In r55451 (bug 35628) I added an extra bool, but only initialized
+        it in one constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=35719
 
-        Build fix.  Forgot a svn add for a patch I landed.  :-(
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
 
-        * storage/SQLTransactionClient.cpp: Added.
-        (WebCore::SQLTransactionClient::didCommitTransaction):
-        (WebCore::SQLTransactionClient::didExecuteStatement):
-        (WebCore::SQLTransactionClient::didExceedQuota):
-        * storage/SQLTransactionClient.h: Added.
+2010-03-03  Yuta Kitamura  <yutak@chromium.org>
 
-2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Dimitri Glazkov.
+        Add a new class that stores information about Web Socket handshake request.
 
-        Added a client to SQLTransaction. In addition to being a place to
-        get notifications about certain events in a transaction, it is
-        also an abstraction layer that allows us to plug in different
-        implementations for each port for how transactions interract with
-        the main DB. For example, WebCore's default implementation will
-        make direct calls to DatabaseTracker's methods. At the same time,
-        Chromium's implementation will send IPCs to the browser process
-        whenever a transaction needs something from the main DB.
+        Instances of this class contain the necessary information to send a Web Socket
+        handshake request. In the future, this class will provide request information
+        to the Web Inspector.
 
-        All storage tests pass.
+        WebSocketHandshake needs to provide request information
+        https://bugs.webkit.org/show_bug.cgi?id=34784
 
-        https://bugs.webkit.org/show_bug.cgi?id=27967
+        No new tests, since the current tests will suffice (LayoutTests/websocket/*).
 
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionClient):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionClient):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Added.
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Steve Falkenburg.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
-        Auto scroll speed is faster than in IE, Firefox.
-        
-        Changed pan scrolling speed to match Firefox's algorithm.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::adjustedScrollDelta):
-        (WebCore::RenderLayer::panScrollFromPoint):
-
-2009-08-20  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix for assert in Chromium page cycler:  drawRect() was re-using
-        an SkPaint, but not resetting it before calling
-        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
-        CL fixes drawRect(), and re-enables the assert.
-        http://bugs.webkit.org/show_bug.cgi?id=28172
-        http://crbug.com/19797
-
-        Covered by Chromium page cycler tests.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::drawRect):
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-20  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
-        
-        Revert r47535 which introduced this.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupWndProc):
-
-2009-08-20  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Crashes on sites with lots of images
-        https://bugs.webkit.org/show_bug.cgi?id=28473
-
-        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
-        CachedResource is still referring to it, so it may get deleted before
-        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource): Added assert to verify the resource
-        being revalidated is physically in the cache.
-        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
-        resource to the revalidated resource.  This allows for proper lifetime management of the
-        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
-        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
-        process of being validated (or else they can get added twice: Once through the normal mechanism
-        and then again during revalidateResource).
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::isSafeToMakePurgeable):
-        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
-        who the validating resource (or proxy) is.
-
-        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
-        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
-        as well.
-        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
-        and added a comment about the assert.
-        (WebCore::CachedResource::clearResourceToRevalidate):
-        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
-        is still being referred to by it and the code it robust to this being switched to a new proxy
-        resource without it being cleared first.
-        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
-
-2009-08-20  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix "Chromium RTL autocomplete popup is not layout correctly".
-        https://bugs.webkit.org/show_bug.cgi?id=27889
-
-        The complete fix of the issue consists 2 parts: the patch in webkit
-        and the patch in Chromium's own code.
-
-        This webkit patch only affects Chromium autofill. It
-        1. introduces a new flag in WebCore::PopupContainerSettings to
-           distinguish whether the width of the drop-down should be restricted
-           or not.
-           For autofill, the width of the drop-down is restricted to
-           be the same as that of the input field (the new flag is set in
-           Chromium's own code). But width is not restricted for <select> (same as before).
-        2. introduce a new flag in WebCore::PopContainerSettings to
-           indicate what heuristics to use when displaying text in drop-down menu.
-           For autofill, use drop-down item's directionality to display drop-down items.
-           Previously, drop-down item is displayed in the its first strong
-           directional character's directionality.
-           (drop-down item's directionality is set in Chromium's own code.
-           It is set the same as the directionality of the element. 
-           For autofill, it is the same directionality as that of the input field.)
-           For <select>, still use the text's first strong directional character's
-           directionality to display the text.
-
-
-        Since the patch only affects the chromium client, not webcore part or
-        other clients. No automatic tests is possible.
-
-        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::):
-        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
-        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
-        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
-        * platform/chromium/PopupMenuChromium.h: 
-        (WebCore::PopupItem::PopupItem): style change.
-        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
-        distinguish whether to restrict width of list box and 
-        in what directionality to display the text in drop-down.
-
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
-        Pan Scrolling can scroll while showing the middlePanScroll icon.
-        
-        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
-        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
-        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
-        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
-        the off by one error.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::panScrollFromPoint):
-
-2009-08-20  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
-        layoutBlockChild.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlockChildren):
-        (WebCore::RenderBlock::layoutBlockChild):
-        * rendering/RenderBlock.h:
-
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Made subframeForHitTargetNode a public static method, so WebView can call it
-        during hit testing.
-
-        * page/EventHandler.cpp:
-        (WebCore::subframeForHitTestResult):
-        (WebCore::EventHandler::subframeForTargetNode):
-        * page/EventHandler.h:
-
-2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
-
-        Rubberstamped by Kevin Ollivier.
-
-        Check for null bundle before attempting to use it.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificatePath): Add null check on return of
-          CFBundleGetBundleWithIdentifier.
-
-2009-08-20  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
-
-        Added fast/repaint/inline-block-overflow.html and updated another test.
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
-        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
-        RenderBox has not been updated to the new values yet.
-        
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
-        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::layout):
-        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
-        value around if a box-shadow goes away.
-
-2009-08-20  Dmitry Titov  <dimich@chromium.org>
-
-        Another attempt to fix Chromium build.
-
-        * WebCore.gypi: now use the correct name of the image file.
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Make the Windows build even fixeder
-
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
-
-2009-08-20  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, Chromium build fix.
-
-        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Windows build fix after the last change
-
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::releaseWindowsContext):
-        (WebCore::GraphicsContext::drawWindowsBitmap):
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Replace many manually-released CFTypeRefs with RetainPtrs
-        https://bugs.webkit.org/show_bug.cgi?id=28498
-
-        * platform/graphics/cg/ColorCG.cpp:
-        (WebCore::createCGColor):
-        * platform/graphics/cg/GradientCG.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::applyFillPattern):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setURLForRect):
-        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::setData):
-        (WebCore::ImageSource::isSizeAvailable):
-        (WebCore::ImageSource::frameSizeAtIndex):
-        (WebCore::ImageSource::repetitionCount):
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameDurationAtIndex):
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::createScratchContext):
-        (WebCore::Path::contains):
-        * platform/graphics/mac/FontCustomPlatformData.cpp:
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/mac/ImageMac.mm:
-        (WebCore::BitmapImage::getTIFFRepresentation):
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::cocoaTypeFromMIMEType):
-        (WebCore::MIMETypeFromCocoaType):
-        * platform/mac/WebCoreNSStringExtras.mm:
-        (stringEncodingForResource):
-        * platform/network/mac/FormDataStreamMac.mm:
-        (WebCore::advanceCurrentStream):
-        (WebCore::setHTTPBody):
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::TextCodecMac::encode):
-
-2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Output actual values of counters in showTree
-        https://bugs.webkit.org/show_bug.cgi?id=28481
-
-        No new tests because this patch just improves debugging outputs.
-
-        * rendering/CounterNode.cpp:
-        (WebCore::showTreeAndMark):
-
-2009-08-20  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by NOBODY (build fix).
-
-        Add file missed in last check-in.
-
-        * html/HTMLAttributeNames.in:
-
-2009-08-19  Timothy Hatcher  <timothy@apple.com>
-
-        Adds new icons to the Web Inspector for Local Storage,
-        Session Storage and Cookies.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28470
-
-        Reviewed by Eric Seidel.
-
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
-        (WebInspector.DOMStorageSidebarTreeElement):
-        * inspector/front-end/Images/cookie.png:
-        * inspector/front-end/Images/domStorage.png: Removed.
-        * inspector/front-end/Images/localStorage.png: Added.
-        * inspector/front-end/Images/sessionStorage.png: Added.
-        * inspector/front-end/inspector.css:
-
-2009-08-20  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        HTML5 media elements must fire 'loadend' progress event
-        https://bugs.webkit.org/show_bug.cgi?id=28419
-
-        * dom/EventNames.h:
-            Define loadend.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute):
-            Deal with onloadend.
-        (WebCore::HTMLMediaElement::loadInternal):
-            Post 'loadend' immediately after 'abort'.
-        (WebCore::HTMLMediaElement::noneSupported):
-            Post 'loadend' immediately after 'error'.
-        (WebCore::HTMLMediaElement::mediaEngineError):
-            Ditto.
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Post 'loadend' immediately after 'load'.
-        (WebCore::HTMLMediaElement::userCancelledLoad):
-            Post 'loadend' immediately after 'abort'.
-
-2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
-        https://bugs.webkit.org/show_bug.cgi?id=28474
-
-        This patch fixes a crash when indenting at right after a table.
-        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
-        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
-        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
-
-        Test: editing/execCommand/indent-right-after-table.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
-
-2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by David Levin.
-
-        Render disabled mute button during an error or if no audio is present.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28475
-
-        Covered by existing layout tests:
-        media/video-controls-visible-audio-only.html
-        media/video-no-audio.html
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
-        toolbar go blank
-        and
-        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
-        the console with certain content
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
-        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
-        adjust the radii in case the sides of the rectangle are smaller than sum
-        of the radii, so that the gradient background matches the border (which
-        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
-        to avoid clipping to an empty path.
-        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
-        GraphicContext::save() down to avoid a save/restore imbalance in the
-        early return case.
-
-        * rendering/RenderThemeSafari.cpp: Made the same changes.
-        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
-        (WebCore::RenderThemeSafari::paintMenuListButton):
-
-2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk][REGRESSION] XHR test failures after r45558
-        https://bugs.webkit.org/show_bug.cgi?id=27143
-
-        Disable sniffing if it's explicitly requested. Updated patch
-        originally by Gustavo Noronha.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::statusWillBeHandledBySoup):
-        (WebCore::gotHeadersCallback):
-        (WebCore::contentSniffedCallback):
-        (WebCore::gotChunkCallback):
-        (WebCore::startHttp):
-
-2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Swap the pixels since QImage expect ARGB while ImageData
-        stores them as RGBA.
-
-        This fixes the fast/canvas/canvas-copyPixels.html test.
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::putImageData):
-
-2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by David Levin.
-
-        [v8] Use atomic string caching for createElement
-        Extend atomic string caching to createElement.  Fix a bug in idl
-        parser that caused incorrect parsing if a function argument
-        attribute list contained a comma.
-        https://bugs.webkit.org/show_bug.cgi?id=28449
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/scripts/IDLParser.pm:
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
-        * dom/Document.idl:
-
-2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Not reviewed, build fix after r47515.
-
-        [Qt] There is no Phonon::MediaObject::hasAudio() function.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
-
-2009-08-20  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28483
-        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
-        Widget* instead of void* to avoid the need for manual casting to Widget*
-        at the callsite.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
-        * bindings/v8/ScriptController.h:
-
-2009-08-19  David Levin  <levin@chromium.org>
-
-        Unreviewed speculative build fix for qt.
-
-        * page/OriginAccessEntry.cpp:
-
-2009-08-19  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
-        specify a more granular policy for cross-origin XHR access.
-
-        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
-               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
-               http/tests/xmlhttprequest/origin-whitelisting-https.html
-               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
-               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
-               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
-
-        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
-        testing via layout tests.
-
-        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCoreSources.blk: Ditto.
-
-        * page/SecurityOrigin.h: Implement origin access whitelists.
-        (WebCore::originAccessMap): Static getter for access whitelists.
-        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
-        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
-        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
-
-        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
-        * page/OriginAccessEntry.cpp: Ditto.
-
-2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Non-precomp headers build fix.
-
-        * platform/image-decoders/ImageDecoder.cpp:
-
-2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+        * websockets/WebSocketChannel.cpp:
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+        (WebCore::WebSocketHandshake::clientHandshakeRequest):
+        * websockets/WebSocketHandshake.h:
+        * websockets/WebSocketHandshakeRequest.cpp: Added.
+        (WebCore::WebSocketHandshakeRequest::WebSocketHandshakeRequest):
+        (WebCore::WebSocketHandshakeRequest::~WebSocketHandshakeRequest):
+        (WebCore::WebSocketHandshakeRequest::addExtraHeaderField):
+        (WebCore::WebSocketHandshakeRequest::headerFields):
+        (WebCore::WebSocketHandshakeRequest::host):
+        * websockets/WebSocketHandshakeRequest.h: Added.
+
+2010-03-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Disable a bad SKIA assert
-        https://bugs.webkit.org/show_bug.cgi?id=28482
+        Build fix after r55452.
 
-        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
-        When this was pulled into Chromium, it started breaking the page cycler. 
-        Disable it again until we can figure out what's going on.
+        No new tests, this is a build fix.
 
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
+        * page/Settings.cpp:
+        (WebCore::Settings::setDatabasesEnabled):
 
-2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+2010-03-03  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        queryCommandState('underline') returns false if the selected text is also bold and italic
-        https://bugs.webkit.org/show_bug.cgi?id=11022
+        Make keyIdentifierForQtKeyCode return the unicode backspace value on Qt PlatformKeyboardEvent
 
-        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
-        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
-        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
-        and also u, s, and strike tags.
+        LayoutTests:
+            fast/events/key-events-in-input-text.html
+            fast/events/special-key-events-in-input-text.html
 
-        Test: editing/style/text-decoration-state.html
+        [Qt] Return the unicode backspace value in keyIdentifierForQtKeyCode on Qt PlatformKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=35694
 
-        * editing/EditorCommand.cpp:
-        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
-        (WebCore::stateUnderline): Ditto.
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
 
-2009-08-19  Anders Carlsson  <andersca@apple.com>
+2010-03-03  Chad Faragher  <wyck@chromium.org>
 
         Reviewed by Darin Adler.
+        Changed the double-click framework code to pass adjusted page
+        coordinates for zoomed pages.  Added a new test to expose
+        mistreatment of mouse click coordinates during a double-click.
 
-        - Fix <rdar://problem/7155710>
-        HTML selects on windows cause containing window to become inactive when opened.
-
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
-        SW_SHOWNOACTIVATE to ShowWindow.
-        
-        (WebCore::PopupWndProc):
-        Prevent mouse activation from activating the window.
-
-2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35690
 
-        Reviewed by Darin Adler.
+        Test: fast/events/zoom-dblclick.html
 
-        Images flash as you hover them on http://www.atebits.com/scribbles/
-        <rdar://problem/7143958>
-        
-        Tag images with the device colorspace with the colorspace of the main display, rather than
-        GenericRGB, so that composited images color-match those rendered via Core Graphics.
-        
-        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-08-19  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by David Hyatt and Dan Bernstein.
-
-        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        Initialize m_scrollCorner.
+2010-03-03  David Levin  <levin@chromium.org>
 
-        (WebCore::FrameView::~FrameView):
-        Assert that m_scrollCorner is null.
+        No review, rolling out r55474.
 
-        (WebCore::FrameView::detachCustomScrollbars):
-        Destroy m_scrollCorner.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        (WebCore::FrameView::invalidateScrollCorner):
-        Invalidate the scroll corner.
+        Last one (I hope).
         
-        (WebCore::FrameView::updateScrollCorner):
-        Create/destroy the scroll corner.
-        
-        (WebCore::FrameView::paintScrollCorner):
-        Paint the scroll corner.
-        
-        * page/FrameView.h:
-        (WebCore::FrameView::isFrameViewScrollCorner):
-        Return whether a RenderScrollbarPart is the frame view scroll corner.
-        
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        Go ahead and update the scroll corner.
-        
-        (WebCore::ScrollView::setScrollbarsSuppressed):
-        Pass the scroll corner rect to invalidateRect.
-        
-        (WebCore::ScrollView::scrollCornerRect):
-        Return the scroll corner rect.
-        
-        * platform/ScrollView.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::imageChanged):
-        If this scrollbar part is the frame view scroll corner, invalidate it.
-
-2009-08-19  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        SVG feComponentTransfer needs to be implemented
-        [https://bugs.webkit.org/show_bug.cgi?id=27768]
-
-        Implementation of SVG Filter feComponentTransfer.
-
-        There is already a test case
-        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
-
-        * platform/graphics/filters/FEComponentTransfer.cpp:
-        (WebCore::identity):
-        (WebCore::table):
-        (WebCore::discrete):
-        (WebCore::linear):
-        (WebCore::gamma):
-        (WebCore::FEComponentTransfer::apply):
-
-2009-08-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        <rdar://problem/7141522> Incorrect layout of product table at henry.com
-
-        Test: fast/block/basic/quirk-percent-height-table-cell.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
-        percentage-height children of auto-height blocks to look for an ancestor
-        with non-auto height and compute their height based on it. The change is
-        that if that ancestor is a table cell, it is ignored and the percent
-        height computes to zero (just like in strict mode). This matches Firefox
-        and IE.
-
-2009-08-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add 'icu::' qualifier when refering to ICU C+names to the other
-        file with this issue missed in the previous check-in.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28410
-
-        No change in the test result.
-
-        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
-        (WebCore::):
-
-2009-08-19  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix for Skia).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-
-2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [CAIRO] Remove setFont indirection
-        https://bugs.webkit.org/show_bug.cgi?id=28453
-
-        Remove the indirection and just set the font in Font::drawGlyphs.
-
-        * platform/graphics/SimpleFontData.h:
-        * platform/graphics/cairo/FontCairo.cpp:
-        (WebCore::Font::drawGlyphs):
-        * platform/graphics/gtk/FontPlatformData.h:
-        (WebCore::FontPlatformData::scaledFont):
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::~FontPlatformData):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
-
-2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: When adding style selector, generate default name based
-        on id / class / type.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28468
-
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
-
-2009-08-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        (WebCore::InlineFlowBox::paint):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::topvisibleOverflow):
-        (WebCore::InlineFlowBox::bottomvisibleOverflow):
-        (WebCore::InlineFlowBox::leftvisibleOverflow):
-        (WebCore::InlineFlowBox::rightvisibleOverflow):
-        (WebCore::InlineFlowBox::visibleOverflowRect):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::floatRect):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::layoutInlineChildren):
-        (WebCore::RenderBlock::matchedEndLine):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::clippedOverflowRectForRepaint):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::visibleOverflowRect):
-        (WebCore::RenderBox::topvisibleOverflow):
-        (WebCore::RenderBox::bottomvisibleOverflow):
-        (WebCore::RenderBox::leftvisibleOverflow):
-        (WebCore::RenderBox::rightvisibleOverflow):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::localBoundingBox):
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        (WebCore::RenderLineBoxList::hitTest):
-        * rendering/RenderOverflow.h:
-        (WebCore::RenderOverflow::visibleOverflowRect):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        (WebCore::RenderTable::paint):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
-
-2009-08-19  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Sound button appears in controller with movies that have no audio
-        https://bugs.webkit.org/show_bug.cgi?id=28464
-
-        Test: media/video-no-audio.html
-
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::hasAudio):
-            Added hasAudio.
-
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::hasAudio):
-        (WebCore::MediaPlayer::hasVideo):
-            Make const.
-        (WebCore::MediaPlayer::hasAudio):
-            Added hasAudio.
-
-        * platform/graphics/MediaPlayerPrivate.h:
-            Add hasAudio.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/win/QTMovieWin.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::hasAudio):
-            Ditto.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlMuteButtonElement::disabled):
-            New, return true if media element doesn't have audio.
-        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
-            Renderer is not needed if element has no audio.
-        * rendering/MediaControlElements.h:
-        (WebCore::MediaControlInputElement::disabled):
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::getMediaUIPartStateFlags):
-            Return MediaUIPartDisabledFlag if node is disabled.
-            
-
-2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27357
-        Removed the two unnecessary overridden willValidate() methods introduced
-        in r47444.
-
-        * html/HTMLKeygenElement.h:
-        * html/HTMLObjectElement.h:
-
-2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Allow dumping dangling nodes to the console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28458
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.cpp:
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
-        (WebCore::InspectorDOMAgent::startListening):
-        (WebCore::InspectorDOMAgent::stopListening):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::bind):
-        (WebCore::InspectorDOMAgent::unbind):
-        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::discardBindings):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::setDetachedRoot):
-        (WebCore::InspectorFrontend::childNodeCountUpdated):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatnode):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype._setDetachedRoot):
-        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
-        (WebInspector.setDetachedRoot):
-        (WebInspector.childNodeCountUpdated):
-        (InspectorController.pushNodeToFrontend):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.pushNodeToFrontend):
-        (InjectedScript.createProxyObject):
-
-2009-08-19  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27464
-        Implement application cache online whitelist wildcard flag
-
-        Test: http/tests/appcache/whitelist-wildcard.html
-
-        A "*" in NETWORK section means that network loading needn't be blocked.
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
-        * loader/appcache/ApplicationCache.h:
-        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
-        (WebCore::ApplicationCache::allowsAllNetworkRequests):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::openDatabase):
-        (WebCore::ApplicationCacheStorage::store):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * loader/appcache/ManifestParser.h:
-
-2009-08-19  Brady Eidson <beidson@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
-        
-        Get rid of method swizzling entirely. This created problems when lower level
-        Foundation code would call into our own swizzled method.
-        
-        * platform/network/mac/ResourceHandleMac.mm: 
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (-[NSURLResponse adjustMIMETypeIfNecessary]):
-
-2009-08-19  Adam Roben  <aroben@apple.com>
-
-        Fix linker warnings on Windows
-
-        Reviewed by Anders Carlsson.
-
-        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
-        Windows about multiply-defined JSHTMLDataListElement symbols
-
-        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
-        from the build (just like we do for the other generated bindings
-        files) so that we don't get warnings about multiply-defined symbols in
-        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
-        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
-        reorder a few files.
-
-2009-08-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel
-
-        Add 'icu::' qualifier when refering to ICU C+names.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28410
-
-        No change in the test result.
-
-        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
-        (WebCore::fontContainsCharacter):
-
-2009-08-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
-        move the addition of overflow from children into a separate pass after the height of the section has been
-        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
-        (Not a a correctness issue, just a memory issue.)
-
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::RenderTableSection):
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderTableSection.h:
-
-2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        [Gtk] Remove bogus dependency rules for built sources that derive
-        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
-        header files should be generated regardless of whether the source
-        file changed or not. We should only rely on the *.in files being
-        changed.
-
-        * GNUmakefile.am:
-
-2009-08-18  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        convert FormatBlock candidate tag list from if chain to hash lookup
-        https://bugs.webkit.org/show_bug.cgi?id=28448
-
-        No behavior change, just cleanup.
-
-        * editing/htmlediting.cpp:
-        (WebCore::validBlockTag):
-        * editing/htmlediting.h:
-
-2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update GraphicsContextSkia's version of drawLine to make use of the shared
-        adjustLineToPixelBoundaries function and elimination overlapping code.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-
-2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContextSkia.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::setLineDash):
-        (WebCore::GraphicsContext::setPlatformShadow):
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+2010-03-03  David Levin  <levin@chromium.org>
 
-        Reviewed by Maciej Stachowiak.
+        No review, rolling out r55474.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28446
-        Custom request headers shouldn't be sent with cross-origin preflight request
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
-               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+        Unfortunately, (the webkit-patch rollout and) I missed these in r55485.
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
-        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
-        that they shouldn't be sent, and Firefox doesn't send them.
+        * bindings/js/JSDatabaseCallback.cpp: Removed.
+        * bindings/js/JSDatabaseCallback.h: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.h: Removed.
+        * storage/DatabaseCallback.h: Removed.
 
-2009-08-18  John Gregg  <johnnyg@google.com>
+2010-03-02  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        V8 Bindings for Desktop Notifications feature.
-        https://bugs.webkit.org/show_bug.cgi?id=28271
-
-        * WebCore.gypi: 
-        added notification files to build (all still behind a flag that's not on)
-        * bindings/scripts/CodeGeneratorV8.pm:
-        added special case in DOMWindow/AppCache style for named event handlers
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/V8Proxy.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
-        * notifications/Notification.h:
-        made event handler routines public (as they are in DOMWindow, eg) for
-        binding access.
-        * notifications/NotificationCenter.idl:
-        needed to make methods V8Custom to support different behaviors in 
-        worker/page context in chromium. 
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::getNotificationPresenter):
-        (WebCore::WorkerThread::setNotificationPresenter):
-        needed to make these methods public as well so chromium can inject
-        the notification presenter into the worker thread.
-
-2009-08-13  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
+        Fix a bug that could lead to a crash. Some parts of
+        SQLTransaction::checkAndHandleClosedDatabase() should only be run
+        when that method is invoked on the DB thread.
+
+        We cannot test this fix with a test, because the crash happens
+        only when all of the following conditions are met:
+        1. A database is closing.
+        2. A transaction on that database is in progress.
+        3. The transaction is in a state where a statement/transaction
+        success/error callback needs to be invoked (so there's a task for
+        this transaction pending on the main thread).
+        4. The DB thread finished processing all its tasks and called
+        SQLTransactionCoordinator::shutdown() before the main thread go to
+        that task.
+
+        The closest thing we have to a test is running
+        LayoutTests/storage/database-lock-after-reload.html 1000 times in
+        a row. Without the patch, the probability of a crash happening in
+        one of the runs is very high. With the patch, the test should
+        reliably run 1000 times in a row without a single crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35624
 
-        - Implement HTML5 nav element
-        https://bugs.webkit.org/show_bug.cgi?id=27937
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::checkAndHandleClosedDatabase):
 
-        <nav> should behave essentially the same as <div> for parsing
-        etc. This is implemented by the changes below.
-        
-        Tests: fast/html/nav-element.html
+2010-03-03  Darin Fisher  <darin@chromium.org>
 
-        * css/html.css:
-        * editing/htmlediting.cpp:
-        (WebCore::validBlockTag):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::tagPriority):
-        (WebCore::blockTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::getNode):
-        * html/HTMLTagNames.in:
-
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Mark Rowe.
 
-        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+        Page should not care about Chromium plug-in implementation details
+        https://bugs.webkit.org/show_bug.cgi?id=35623
 
-        - Fix <rdar://problem/7152727>
+        * WebCore.gypi: Compile PluginViewNone.cpp
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Remove conditional
+        compilation for PLATFORM(CHROMIUM).
 
-        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
-        
-        * page/FrameView.cpp:
-        (WebCore::FrameView::hasCustomScrollbars):
-        Check if the frame view or any of its subviews have custom scroll bars.
-        
-        (WebCore::FrameView::updateControlTints):
-        Go ahead and update control tints if the frame view has custom scroll bars.
-        
-        * page/FrameView.h:
+2010-03-03  David Levin  <levin@chromium.org>
 
-2009-08-18  Mark Rowe  <mrowe@apple.com>
+        No review, rolling out r55474.
+        http://trac.webkit.org/changeset/55480
 
-        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
         * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
         * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Removed.
-        * storage/SQLTransactionClient.h: Removed.
-
-2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding the SharedTimer file for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28126
-
-        * platform/haiku/SharedTimerHaiku.cpp: Added.
-        (WebCore::):
-        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
-        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
-        (WebCore::SharedTimerHaiku::instance):
-        (WebCore::SharedTimerHaiku::start):
-        (WebCore::SharedTimerHaiku::stop):
-        (WebCore::SharedTimerHaiku::Filter):
-        (WebCore::setSharedTimerFiredFunction):
-        (WebCore::setSharedTimerFireTime):
-        (WebCore::stopSharedTimer):
-
-2009-08-18  Mark Rowe  <mrowe@apple.com>
-
-        Release build fix.
-
-        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
-
-2009-08-18  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
-
-        No new tests: Already covered by existing tests.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
-        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
-        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
-        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
-
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        Added a client to SQLTransaction. In addition to being a place to
-        get notifications about certain events in a transaction, it is
-        also an abstraction layer that allows us to plug in different
-        implementations for each port for how transactions interract with
-        the main DB. For example, WebCore's default implementation will
-        make direct calls to DatabaseTracker's methods. At the same time,
-        Chromium's implementation will send IPCs to the browser process
-        whenever a transaction needs something from the main DB.
+2010-03-03  David Levin  <levin@chromium.org>
 
-        All storage tests pass.
+        No review, rolling out r55480.
+        http://trac.webkit.org/changeset/55480
 
-        https://bugs.webkit.org/show_bug.cgi?id=27967
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
         * storage/Database.cpp:
-        (WebCore::Database::transactionClient):
         * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionClient):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Added.
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-18  Julie Parent  <jparent@chromium.org>
-
-        Not reviewed, build fix for Chromium.
-
-        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
-
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
-
-2009-08-18  Julie Parent  <jparent@chromium.org>
-
-        Not reviewed, build fix for Chromium.
-
-       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
-
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
-
-2009-08-18  Julie Parent  <jparent@chromium.org>
-
-        Not reviewed, build fix for Chromium.
-
-        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
-
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
-
-2009-08-18  Dan Bernstein  <mitz@apple.com>
-
-        Build fix.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getIdentifierValue):
-
-2009-08-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        More work on making DOM classes start with reference count of 1
-        https://bugs.webkit.org/show_bug.cgi?id=28068
-
-        Some related clean-up and preparation steps so the subsequent
-        patches will be as small as possible.
-
-        * WebCore.base.exp: Sorted this file.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-        Use nameAttr instead of the name function.
-
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::JSHTMLFrameElement::setSrc):
-        Use srcAttr instead of the src function.
-
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc):
-        Use srcAttr instead of the src function.
-
-        * bindings/objc/DOM.mm: Sorted includes.
-        * dom/Document.cpp: Ditto.
-
-        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
-        * dom/StyledElement.h: Ditto.
-
-        * dom/make_names.pl: Changed default of createWithNew to 0.
-        Eventually all elements will be created with create instead of new.
-
-        * html/HTMLTagNames.in:
-        * svg/svgtags.in:
-        * wml/WMLTagNames.in:
-        Added createWithNew for every tag. We'll remove it as we convert
-        element classes to use create.
-
-        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
-        * html/HTMLFrameElement.h: Ditto.
-
-        * html/HTMLEmbedElement.cpp: Removed many attribute get and
-        set functions.
-        * html/HTMLEmbedElement.h: Ditto.
-        * html/HTMLIFrameElement.cpp: Ditto.
-        * html/HTMLIFrameElement.h: Ditto.
-        * html/HTMLObjectElement.cpp: Ditto.
-        * html/HTMLObjectElement.h: Ditto.
-        * html/HTMLPlugInElement.cpp: Ditto.
-        * html/HTMLPlugInElement.h: Ditto.
-
-        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
-        set functions.
-        (WebCore::HTMLFrameElementBase::location): Changed to use
-        srcAttr instead of src.
-        * html/HTMLFrameElementBase.h: Removed many attribute get and set
-        functions.
-
-        * loader/MediaDocument.cpp:
-        (WebCore::MediaDocument::replaceMediaElementTimerFired):
-        Use srcAttr and typeAttr instead of setSrc and setType.
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
-        of name -- this avoids an extra AtomicString round trip and a little
-        ref count churn too.
-
-2009-08-18  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        SharedWorkers need to support loading.
-        https://bugs.webkit.org/show_bug.cgi?id=28342
-
-        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
-
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        Forwards load requests to an arbitrary document from the list of worker's documents.
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
-        Posts responses back to the shared worker thread.
-
-2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        StyleChange::init needs clean up before fixing the bug 23892
-        https://bugs.webkit.org/show_bug.cgi?id=27749
-
-        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
-        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
-
-        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
-        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
-        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
-
-        No test is added since there is no change in behavior.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
-        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
-        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
-        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
-        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
-
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fixing a DB file naming bug in Chromium. The origin should come
-        before the DB name in the file name.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28331
+2010-03-03  Mark Rowe  <mrowe@apple.com>
 
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::fullPathForDatabase):
+        Reviewed by Geoff Garen.
 
-2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
 
-        Reviewed by Eric Seidel.
+        * platform/mac/PurgeableBufferMac.cpp:
+        (WebCore::PurgeableBuffer::create):  Use the VM tag.
 
-        [Haiku] Adding four image-specific files to WebCore:
-        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28130
-
-        * platform/graphics/Icon.h:
-        * platform/graphics/haiku/IconHaiku.cpp: Added.
-        (WebCore::Icon::~Icon):
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-        * platform/graphics/haiku/ImageBufferData.h: Added.
-        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-        (WebCore::ImageBuffer::context):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        (WebCore::ImageBuffer::toDataURL):
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/haiku/ImageHaiku.cpp: Added.
-        (WebCore::FrameData::clear):
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::BitmapImage::initPlatformData):
-        (WebCore::BitmapImage::invalidatePlatformData):
-        (WebCore::BitmapImage::draw):
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::BitmapImage::getBBitmap):
+2010-03-03  Dumitru Daniliuc  <dumi@chromium.org>
 
-2009-08-18  Beth Dakin  <bdakin@apple.com>
+        Reviewed by nobody, build fix.
 
-        Reviewed by Dan Bernstein.
+        Move #include "DatabaseCallback.h" from Database.h to
+        Database.cpp.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
-        Backgrounds and Borders] Drop the prefix from background-size
+        * storage/Database.cpp:
+        * storage/Database.h:
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillProperty):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        (WebCore::ensurePropertyMap):
+2010-03-03  Darin Adler  <darin@apple.com>
 
-2009-08-18  Drew Wilson  <atwilson@google.com>
+        Fixed Mac build.
 
-        Reviewed by David Levin.
+        * WebCore.xcodeproj/project.pbxproj: Marked a couple of headers "private" so they can
+        be used in the WebKit project.
 
-        SharedWorkers need to forward exceptions to parent documents
-        https://bugs.webkit.org/show_bug.cgi?id=28320
+2010-03-03  Alexey Proskuryakov  <ap@apple.com>
 
-        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
-
-        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+        Reviewed by Adele Peterson.
 
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        Cleaned up bitrot - added missing include.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::postExceptionTask):
-        Callback used to deliver exceptions to a document.
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        Forwards exceptions to all parent documents for presentation to the user.
-        (WebCore::postConsoleMessageTask):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        Forwards console messages to all parent documents for presentation to the user.
-        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
-        Grabs the mutex before accessing workerDocuments.
-        (WebCore::SharedWorkerProxy::documentDetached):
-        Grabs the mutex before accessing workerDocuments.
-
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35044
+        Crash in XML tokenizer reloading zoom-coords-viewattr-01-b.svg
 
-        Reviewed by Adele Peterson.
+        I'm often getting a crash even when opening the test for the first time in Safari, but it
+        doesn't seem to crash in DumpRenderTree. Still, I can't think of a stronger way to test for
+        this condition, so no new regression test.
 
-        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
-        
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        Call FrameLoaderClient::shouldLoadMediaElementURL.
-        
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
-        Return true by default.
+        * dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::end): Be prepared that parsing remaining
+        input will pause parsing.
 
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+2010-03-03  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        openDatabase() should not execute any SQL statement on the
-        database it's trying to open, unless there are no other open
-        handles to the same database. Otherwise, we might run into a
-        deadlock.
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        Test: storage/open-database-while-transaction-in-progress.html
+        Test: storage/open-database-creation-callback.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28207
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
         * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
         (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-2009-08-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        SVG Filter feBlend implementation missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28133]
-
-        Implementation of SVG Filter feBlend.
-
-        FilterEffect.cp needed changes to optimize the rendering. With the old code
-        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
-        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
-        PixelArray again. This was unefficient and slow. Now we calculate the requested area
-        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
-        without any drawing operations on GraphicsContext.
+2010-03-03  Alexander Pavlov  <apavlov@chromium.org>
 
-        There is already a test case
-        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+        Reviewed by Pavel Feldman.
 
-        * html/canvas/CanvasPixelArray.h:
-        (WebCore::CanvasPixelArray::set):
-        (WebCore::CanvasPixelArray::get):
-        * platform/graphics/filters/FEBlend.cpp:
-        (WebCore::unknown):
-        (WebCore::normal):
-        (WebCore::multiply):
-        (WebCore::screen):
-        (WebCore::darken):
-        (WebCore::lighten):
-        (WebCore::FEBlend::apply):
-        * platform/graphics/filters/FEBlend.h:
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::calculateDrawingIntRect):
-        * platform/graphics/filters/FilterEffect.h:
-
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+        Web Inspector: resources panel only shows uncompressed resource size.
+        https://bugs.webkit.org/show_bug.cgi?id=35403
 
-        Reviewed by Timothy Hatcher.
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.GzipRule.prototype._shouldCompress):
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get resourceSize):
+        (WebInspector.Resource.prototype.set resourceSize):
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.CompareBySize):
+        (WebInspector.Resource.CompareByTransferSize):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.ResourceTransferSizeCalculator.prototype._value):
+        (WebInspector.ResourceTransferSizeCalculator.prototype._networkBytes):
+        (WebInspector.ResourceSidebarTreeElement.CompareByDescendingTransferSize):
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions):
+        (WebInspector.ResourceGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-        WebInspector: Fix array formatter followup: node formatter.
+2010-03-03  Dan Bernstein  <mitz@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28427
+        Build fix.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._format):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
 
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Metrics sidebar broken
-
-        https://bugs.webkit.org/show_bug.cgi?id=28434
-
-        * inspector/front-end/MetricsSidebarPane.js:
-
-2009-08-18  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28432
-        String::createCFString() returns a non-retained empty string
+        Web Inspector: Get rid of synchronous debuggerEnabled, profilerEnabled calls.
 
-        No known change in functionality, so no test.
+        https://bugs.webkit.org/show_bug.cgi?id=32331
 
-        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
-    
-2009-08-18  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
-        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
-        
-        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
-        it doesn't have to.
-
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::deleteOrigin):
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.profilerWasEnabled):
+        (WebInspector.ProfilesPanel.prototype.profilerWasDisabled):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLine):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
 
-2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+2010-03-03  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Adele Peterson.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27357
-        Support for :valid and :invalid CSS selectors, from HTML5 specs.
-        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
-
-        Tests: fast/css/pseudo-invalid-001.html
-               fast/css/pseudo-invalid-002.html
-               fast/css/pseudo-valid-001.html
-               fast/css/pseudo-valid-002.html
-               fast/css/pseudo-valid-003.html
-               fast/css/pseudo-valid-004.html
-               fast/css/pseudo-valid-005.html
-               fast/css/pseudo-valid-006.html
-               fast/css/pseudo-valid-007.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
-form controls that have different validity states.
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
-        style associated to new pseudo-classes
-        * dom/Element.h:
-        (WebCore::Element::willValidate): pushed up in hierarchy
-        (WebCore::Element::isValidFormControlElement): checks for valid form
-        control elements (wraps ValidityState::valid())
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::willValidate): minor clean up
-        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
-        * html/HTMLFormControlElement.h:
-        * html/HTMLKeygenElement.h:
-        (WebCore::HTMLKeygenElement::willValidate): added
-        * html/HTMLObjectElement.h:
-        (WebCore::HTMLObjectElement::willValidate): added
-        * html/HTMLObjectElement.idl:
+        Replace 'autobuffer' attribute with 'preload' to align with spec revision 4811.
+        https://bugs.webkit.org/show_bug.cgi?id=35385
+        rdar://problem/7689602
 
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix array formatter.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28427
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray):
+        Tests: media/audio-constructor-preload.html
+               media/video-dom-preload.html
 
-2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+        * html/HTMLAttributeNames.in: Remove autobuffer, add preload
 
-        Reviewed by George Staikos
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::createForJSConstructor): set preload to 'auto' instead of 
+            autobuffer to true.
 
-        Replace repeated string of PLATFORM(FOO) with a single define
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_preload.
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Deal with 'preload' attribute.
+        (WebCore::HTMLMediaElement::loadResource): Call setPreload() on the newly created MediaPlayer,
+            before calling load() so it can pass the setting through to the media engine.
+        (WebCore::HTMLMediaElement::preload): New.
+        (WebCore::HTMLMediaElement::setPreload): Ditto
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
 
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_preload.
+        (WebCore::MediaPlayer::load): Pass m_preload to newly created media engine.
+        (WebCore::MediaPlayer::preload): New, return m_preload.
+        (WebCore::MediaPlayer::setPreload): New, set m_preload.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreload):
 
-2009-08-16  David Hyatt  <hyatt@apple.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setPreload): Renamed from setAutoplay, fix logic for preload.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Reviewed by Dan Bernstein.
+2010-03-03  Dan Bernstein  <mitz@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
-        considered part of scrollable overflow.
+        Reviewed by Sam Weinig.
 
-        This patch takes the engine's concept of overflow and splits it into two types:
-        layout overflow and visual overflow.
-        
-        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
-        in the inline flow case a tall image could spill out of a line box. Examples of 
-        visual overflow are shadows, text stroke (and eventually outline and
-        border-image).
-
-        Three objects tracked overflow before this patch: RenderBlock had 
-        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
-        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
-        overflow using a map that cached four values.
-        
-        This patch takes all of these different overflow models and unifies them into a single
-        new class called RenderOverflow.   This class is now a member variable in RenderBox and
-        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
-        four values, it tracks eight: left/top/right/bottom for layout overflow and 
-        left/top/right/bottom for visual overflow.
-        
-        Overflow computation is now done after layout is finished rather than during layout
-        (when child objects can be churning and moving around).  A number of layout tests progressed
-        by deferring overflow computation to a separate pass.
-        
-        All inline flow boxes now track overflow (and not just the root line box).  This allows
-        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
-        doesn't intersect.  The old code always visited all object on a line if the root line box
-        intersected at all.
-        
-        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
-        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
-        
-        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
-        have one reason for continued existence, and that is that they happen to be used in repaint()
-        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
-        visual overflow anyway, so this change tightens that repaint up.
-        
-        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
-        been changed to use these instead of relying on overflow (which was totally wrong).
+        <rdar://problem/7682756> Assertion failure when replacing the contents of a <select>
 
-        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
-        text children have no effect on the height of a line.  Instead of making the height() of the objects
-        variable and dependent on overflow, the objects now have their full height and get placed on
-        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
-        
-        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
-        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
-        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
-        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
-        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
-        sublayers.
+        Test: fast/dom/remove-children-notification-order.html
 
-        * WebCore.xcodeproj/project.pbxproj:
         * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::getUpperLeftCorner):
-        * editing/visible_units.cpp:
-        (WebCore::previousLinePosition):
-        (WebCore::nextLinePosition):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::adjustViewSize):
-        (WebCore::FrameView::adjustPageHeight):
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::height):
-        * rendering/InlineBox.h:
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::adjustPosition):
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        (WebCore::InlineFlowBox::placeBoxesVertically):
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        (WebCore::InlineFlowBox::paint):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::InlineFlowBox):
-        (WebCore::InlineFlowBox::topCombinedOverflow):
-        (WebCore::InlineFlowBox::bottomCombinedOverflow):
-        (WebCore::InlineFlowBox::leftCombinedOverflow):
-        (WebCore::InlineFlowBox::rightCombinedOverflow):
-        (WebCore::InlineFlowBox::combinedOverflowRect):
-        (WebCore::InlineFlowBox::topLayoutOverflow):
-        (WebCore::InlineFlowBox::bottomLayoutOverflow):
-        (WebCore::InlineFlowBox::leftLayoutOverflow):
-        (WebCore::InlineFlowBox::rightLayoutOverflow):
-        (WebCore::InlineFlowBox::layoutOverflowRect):
-        (WebCore::InlineFlowBox::topVisualOverflow):
-        (WebCore::InlineFlowBox::bottomVisualOverflow):
-        (WebCore::InlineFlowBox::leftVisualOverflow):
-        (WebCore::InlineFlowBox::rightVisualOverflow):
-        (WebCore::InlineFlowBox::visualOverflowRect):
-        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
-        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paint):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::RenderBlock):
-        (WebCore::RenderBlock::layout):
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::addOverflowFromBlockChildren):
-        (WebCore::RenderBlock::handleBottomOfBlock):
-        (WebCore::RenderBlock::layoutBlockChildren):
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::fillInlineSelectionGaps):
-        (WebCore::RenderBlock::floatRect):
-        (WebCore::RenderBlock::lowestPosition):
-        (WebCore::RenderBlock::rightmostPosition):
-        (WebCore::RenderBlock::leftmostPosition):
-        (WebCore::RenderBlock::addOverhangingFloats):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::RenderBlock::positionForPointWithInlineChildren):
-        (WebCore::RenderBlock::layoutColumns):
-        (WebCore::getHeightForLineCount):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
-        (WebCore::RenderBlock::computeVerticalPositionsForLine):
-        (WebCore::RenderBlock::layoutInlineChildren):
-        (WebCore::RenderBlock::matchedEndLine):
-        (WebCore::RenderBlock::addOverflowFromInlineChildren):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::destroy):
-        (WebCore::RenderBox::clippedOverflowRectForRepaint):
-        (WebCore::RenderBox::localCaretRect):
-        (WebCore::RenderBox::addShadowAndReflectionOverflow):
-        (WebCore::RenderBox::addOverflowFromChild):
-        (WebCore::RenderBox::addLayoutOverflow):
-        (WebCore::RenderBox::addVisualOverflow):
-        (WebCore::RenderBox::clearLayoutOverflow):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::combinedOverflowRect):
-        (WebCore::RenderBox::topCombinedOverflow):
-        (WebCore::RenderBox::bottomCombinedOverflow):
-        (WebCore::RenderBox::leftCombinedOverflow):
-        (WebCore::RenderBox::rightCombinedOverflow):
-        (WebCore::RenderBox::layoutOverflowRect):
-        (WebCore::RenderBox::topLayoutOverflow):
-        (WebCore::RenderBox::bottomLayoutOverflow):
-        (WebCore::RenderBox::leftLayoutOverflow):
-        (WebCore::RenderBox::rightLayoutOverflow):
-        (WebCore::RenderBox::visualOverflowRect):
-        (WebCore::RenderBox::topVisualOverflow):
-        (WebCore::RenderBox::bottomVisualOverflow):
-        (WebCore::RenderBox::leftVisualOverflow):
-        (WebCore::RenderBox::rightVisualOverflow):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPosition):
-        (WebCore::RenderLayer::localBoundingBox):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        (WebCore::RenderLineBoxList::hitTest):
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::positionListMarker):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::RenderObject):
-        * rendering/RenderObject.h:
-        * rendering/RenderOverflow.h: Added.
-        (WebCore::RenderOverflow::RenderOverflow):
-        (WebCore::RenderOverflow::topLayoutOverflow):
-        (WebCore::RenderOverflow::bottomLayoutOverflow):
-        (WebCore::RenderOverflow::leftLayoutOverflow):
-        (WebCore::RenderOverflow::rightLayoutOverflow):
-        (WebCore::RenderOverflow::topVisualOverflow):
-        (WebCore::RenderOverflow::bottomVisualOverflow):
-        (WebCore::RenderOverflow::leftVisualOverflow):
-        (WebCore::RenderOverflow::rightVisualOverflow):
-        (WebCore::RenderOverflow::setTopLayoutOverflow):
-        (WebCore::RenderOverflow::setBottomLayoutOverflow):
-        (WebCore::RenderOverflow::setLeftLayoutOverflow):
-        (WebCore::RenderOverflow::setRightLayoutOverflow):
-        (WebCore::RenderOverflow::setTopVisualOverflow):
-        (WebCore::RenderOverflow::setBottomVisualOverflow):
-        (WebCore::RenderOverflow::setLeftVisualOverflow):
-        (WebCore::RenderOverflow::setRightVisualOverflow):
-        (WebCore::RenderOverflow::layoutOverflowRect):
-        (WebCore::RenderOverflow::visualOverflowRect):
-        (WebCore::RenderOverflow::combinedOverflowRect):
-        (WebCore::RenderOverflow::move):
-        (WebCore::RenderOverflow::addLayoutOverflow):
-        (WebCore::RenderOverflow::addVisualOverflow):
-        (WebCore::RenderOverflow::resetLayoutOverflow):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::~RenderReplaced):
-        (WebCore::RenderReplaced::layout):
-        (WebCore::RenderReplaced::shouldPaint):
-        (WebCore::RenderReplaced::positionForPoint):
-        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
-        * rendering/RenderReplaced.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::layout):
-        (WebCore::RenderScrollbarPart::paintIntoRect):
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::layout):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        (WebCore::RenderTable::paint):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderTableSection.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::positionForPoint):
-        (WebCore::RenderText::localCaretRect):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::layout):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::addHighlightOverflow):
-        (WebCore::RootInlineBox::adjustPosition):
-        (WebCore::RootInlineBox::verticallyAlignBoxes):
-        (WebCore::RootInlineBox::selectionTop):
-        * rendering/RootInlineBox.h:
-        (WebCore::RootInlineBox::RootInlineBox):
-        (WebCore::RootInlineBox::nextRootBox):
-        (WebCore::RootInlineBox::prevRootBox):
-        (WebCore::RootInlineBox::lineTop):
-        (WebCore::RootInlineBox::lineBottom):
-        (WebCore::RootInlineBox::selectionBottom):
-        (WebCore::RootInlineBox::selectionHeight):
-        (WebCore::RootInlineBox::floats):
-        (WebCore::RootInlineBox::floatsPtr):
-        (WebCore::RootInlineBox::setLineTopBottomPositions):
-        * rendering/SVGRootInlineBox.cpp:
-        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::ContainerNode::removeChildren): Changed to call childrenChanged()
+        before calling removedFromDocument() on each removed child, which matches
+        the order removeChild() does things, and avoids the assertion. This required
+        temporarily storing the removed children in a vector.
+        Also added comments about other discrepancies between this function and
+        removeChild().
 
-2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+2010-03-03  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28431
-        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
-
-        Test: http/tests/appcache/auth.html
-
-        * loader/appcache/ApplicationCacheGroup.h:
-        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
-        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
-        shouldn't ask it, because it's not a document that's loading these resources).
-
-2009-08-18  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by John Sullivan and David Hyatt.
-
-        Fix <rdar://problem/7147996>
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::setHasVerticalScrollbar):
-        Update the style of the scroll bars.
-        
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::RenderScrollbar):
-        Calculate the size of the scrollbar and set it as the frame size.
-
-2009-08-18  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        HTMLMediaElement should fire 'progress' event before 'load'
-        https://bugs.webkit.org/show_bug.cgi?id=28314
-
-        Test: media/progress-event-at-least-one.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Schedule 'progress' event before 'load'.
-
-2009-08-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28415
-        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
-        have it.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        Document cookieURL and firstPartyForCookies
+        https://bugs.webkit.org/show_bug.cgi?id=35613
 
-2009-08-18  Drew Wilson  <atwilson@google.com>
+        Some folks asked what the cookieURL and the firstPartyForCookies were
+        on IRC.  This patch documents these properties in the code so folks
+        don't have to ask on IRC anymore.
 
-        Reviewed by Eric Seidel.
+        * dom/Document.h:
 
-        Need to extend DumpRenderTree to expose number of worker threads
-        https://bugs.webkit.org/show_bug.cgi?id=28292
+2010-03-03  Arno Renevier  <arno@renevier.net>
 
-        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+        Reviewed by Gustavo Noronha Silva.
 
-        Tests: fast/workers/shared-worker-lifecycle.html-disabled
-               fast/workers/worker-lifecycle.html
+        [Gtk]: assertion triggered when geolocation getCurrentPosition without an option argument.
+        https://bugs.webkit.org/show_bug.cgi?id=35666
 
-        * WebCore.base.exp:
-        Exported WorkerThread::workerThreadCount().
-        * WebCore.xcodeproj/project.pbxproj:
-        * workers/WorkerThread.cpp:
-        Added tracking of the number of worker threads.
-        (WebCore::threadCountMutex):
-        (WebCore::WorkerThread::workerThreadCount):
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::~WorkerThread):
-        * workers/WorkerThread.h:
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
 
-2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+2010-03-03  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        Unreviewed, build fix.
+        Reviewed by Xan Lopez.
 
-        [Qt] Add new files I forgot to add in r47424.
+        Miscellaneous little fixes for the windows build of webkit-gtk
+        https://bugs.webkit.org/show_bug.cgi?id=35640
 
-2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+        * GNUmakefile.am: dist two new files concerning mathml support.
 
-        Reviewed by Ariya Hidayat.
+2010-03-03  Xan Lopez  <xlopez@igalia.com>
 
-        [Qt] Implement prefetchDNS() function.
+        Unreviewed distcheck fix.
 
-        * WebCore.pro:
-        * platform/qt/TemporaryLinkStubs.cpp:
+        Add new file to the build.
 
-2009-08-18  Kent Tamura  <tkent@chromium.org>
+        * GNUmakefile.am:
 
-        Reviewed by Eric Seidel.
+2010-03-03  Antti Koivisto  <koivisto@iki.fi>
 
-        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
-        https://bugs.webkit.org/show_bug.cgi?id=26915
+        Reviewed by Oliver Hunt.
 
-        Tests: fast/forms/datalist-nonoption-child.html
-               fast/forms/datalist.html
+        Make IntPoint usable as a hash key
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35586
 
-        * WebCore.gypi:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/html.css:
-        * html/CollectionType.h:
-        (WebCore::):
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::itemAfter):
-        * html/HTMLDataListElement.cpp: Added.
-        (WebCore::HTMLDataListElement::HTMLDataListElement):
-        (WebCore::HTMLDataListElement::~HTMLDataListElement):
-        (WebCore::HTMLDataListElement::checkDTD):
-        (WebCore::HTMLDataListElement::options):
-        * html/HTMLDataListElement.h: Added.
-        * html/HTMLDataListElement.idl: Added.
-        * html/HTMLElement.cpp:
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLTagNames.in:
-
-2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        -webkit-box-orient:horizontal doesn't work on <button> tag
-        https://bugs.webkit.org/show_bug.cgi?id=34445
-
-        Make a flexible button's anonymous child flexible and pass the
-        parent's box-orient to the anonymous child.
-
-        Also, added a renderName for anonymous flexible boxes.
-
-        Test: fast/flexbox/box-orient-button.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::createAnonymousBlock):
-        * rendering/RenderBlock.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::addChild):
-        (WebCore::RenderButton::setupInnerStyle):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::renderName):
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        Render -webkit-mask via compositing layers when possible
-        https://bugs.webkit.org/show_bug.cgi?id=28414
-        
-        Implement accelerated compositing of -webkit-mask, when combined
-        with already-composited content.
-        
-        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
-        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
-        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
-        
-        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
-        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
-        indicates that just the mask is painting.
-        
-        When painting the composited mask, we need to paint with the normal compositing
-        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
-        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
-        need to make transparency layers.
-        
-        We no longer have to throw video rendering into software because of masks.
-        
-        When a masked element has composited descendants, that element needs to
-        become composited so that the mask can be applied via compositing.
+        * platform/graphics/IntPointHash.h: Added.
+        (WTF::IntPointHash::hash):
+        (WTF::IntPointHash::equal):
+        (WTF::):
 
-        Tests: compositing/masks/masked-ancestor.html
-               compositing/masks/simple-composited-mask.html
+2010-03-02  Eric Uhrhane  <ericu@chromium.org>
 
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::maskLayer):
-        (WebCore::GraphicsLayer::setMaskLayer):
-        (WebCore::GraphicsLayer::paintingPhase):
-        (WebCore::GraphicsLayer::setPaintingPhase):
-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::):
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setMaskLayer):
-        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
-        (WebCore::GraphicsLayerCA::commitLayerChanges):
-        (WebCore::GraphicsLayerCA::updateMaskLayer):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintMaskImages):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasCompositedMask):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasCompositedMask):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::~RenderLayerBacking):
-        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        (WebCore::RenderLayerBacking::updateMaskLayer):
-        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::hasMaskLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
-        * rendering/RenderLayerCompositor.h:
+        Reviewed by David Levin.
 
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+        Move database enable bit fully out of settings
+        This is stage one of a three-stage commit [webkit, then chromium, then
+        webkit again].  In this change I'm adding calls to
+        Database::setIsAvailable inside Settings::setDatabaseEnabled and
+        anywhere else that called it, and switching webkit fully over to using
+        that flag [added in a previous checkin].  Phase two will remove
+        Chromium's use of Settings for the Database, and phase three will remove
+        the Setting for the Database enable entirely, leaving only
+        Database::isAvailable/setIsAvailable.
 
-        Reviewed by Dave Hyatt.
+        No new tests; tested by existing storage tests.
 
-        Layer content misplaced with compositing, z-index and overflow
-        https://bugs.webkit.org/show_bug.cgi?id=28361
-        
-        The foreground GraphicsLayer (used to render element foreground when the element has 
-        negative z-order children) was misplaced when there is a clipping layer (which clips
-        children). The foreground layer is parented under the clipping layer so that the foreground
-        depth-sorts with the layer's children, so its geometry needs to be computed relative to
-        that clipping layer.
-        
-        Also clarified some FIXME comments, and corrected a debug-only layer name.
+        https://bugs.webkit.org/show_bug.cgi?id=35310
 
-        Test: compositing/geometry/clipping-foreground.html
+        * WebCore.base.exp: Export Database::setIsAvailable
+        * WebCore.xcodeproj/project.pbxproj: Export needed headers as Private
+        * page/DOMWindow.cpp: Read isAvailable, not Settings::isDatabaseEnabled
+        (WebCore::DOMWindow::openDatabase):
+        * page/Settings.cpp:  Add a call to Database::setIsAvailable.
+        (WebCore::Settings::setDatabasesEnabled):
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::updateSublayerList):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+2010-03-02  Tony Chang  <tony@chromium.org>
 
-2009-08-17  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Sam Weinig.
+        add a flag to WebURLResponse so we can identify multipart content
+        https://bugs.webkit.org/show_bug.cgi?id=35628
 
-        Fix leaks of SVGElementInstance seen during regression tests.
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::isMultipartPayload):
+        (WebCore::ResourceResponse::setIsMultipartPayload):
 
-        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
-        not updated to have a create method that adopted the initial reference.  This lead to the instances
-        of SVGElementInstance allocated by SVGUseElement being leaked.
+2010-03-02  Tony Chang  <tony@chromium.org>
 
-        * svg/SVGElementInstance.h:
-        (WebCore::SVGElementInstance::create):
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::buildPendingResource):
-        (WebCore::SVGUseElement::buildInstanceTree):
-        (WebCore::SVGUseElement::handleDeepUseReferencing):
+        Not reviewed, test fix.
 
-2009-08-17  Brady Eidson  <beidson@apple.com>
+        Revert r55447 because the new layout test is crashing consistently
+        on Leopard Intel Debug (tests).
+        https://bugs.webkit.org/show_bug.cgi?id=35261
 
-        Reviewed by Sam Weinig.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create):
 
-        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
-        Page Cache should support pages with frames.
+2010-03-02  Adam Barth  <abarth@webkit.org>
 
-        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
-          are solely the responsibility of FrameLoader.
-        - Enhance some page cache related Logging to help development.
+        Reviewed by Darin Fisher.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::identifierForInitialRequest):
+        Google Analytics triggers "blocked plugin" UI
+        https://bugs.webkit.org/show_bug.cgi?id=35565
 
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        * loader/DocumentLoader.h:
+        Just like for running script, we need to distinguish between querying
+        whether plug-ins are enabled and actually blocking a page from
+        instantiating a plugin.  We need to issue different callbacks to the
+        FrameLoaderClient so that the client can inform us that plug-ins are
+        disabled in some cases without showing the "plug-in blocked" UI.
 
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::allowPlugins):
         * loader/FrameLoader.h:
-        (WebCore::FrameLoader::isLoadingFromCachedPage):
-
-2009-08-17  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Moved implementation of isAfterContent to RenderObject
-        (as inline method to avoid potential performance regressions).
-
-        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
-        (https://bugs.webkit.org/show_bug.cgi?id=28376)
-
-        * rendering/RenderBox.cpp:
-        * rendering/RenderBox.h:
-        * rendering/RenderInline.cpp:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isAfterContent):
-
-2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Assertion failure in WebCore::RenderHTMLCanvas::layout
-        https://bugs.webkit.org/show_bug.cgi?id=12052
-
-        Don't handle run-in if the element is not a block element.
-
-        Test: fast/runin/nonblock-runin.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::handleRunInChild):
-
-2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
-
-        Reviewed by Darin Adler.
-
-        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
-        either of the arguments are not finite.
-
-        According to
-        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
-        "If any of the arguments to createImageData() or getImageData() are
-        infinite or NaN, or if the createImageData()  method is invoked with
-        only one argument but that argument is null, the method must instead
-        raise a NOT_SUPPORTED_ERR  exception."
-
-        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createImageData):
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
-
-2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Add a way to release the storage lock
-        https://bugs.webkit.org/show_bug.cgi?id=28411
-
-        Two scripts within the same origin that are accessing LocalStorage must not do
-        it simultaneously, according to the spec.  There are some cases, however, where
-        a script might want to override this behavior.  navigator.getStorageUpdates()
-        was added for this reason:
-        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
-
-        Add this function to navigator and hook it up to DOM Storage.
-
-        * page/Navigator.cpp:
-        (WebCore::Navigator::getStorageUpdates):
-        * page/Navigator.h:
-        * page/Navigator.idl:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::unlock):
-        * storage/StorageNamespaceImpl.h:
-
-2009-08-17  Mark Rowe  <mrowe@apple.com>
-
-        Build fix.
-
-        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
-        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
-        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
-        Windows though so we explicitly include this header from the prefix header when on Windows.
-
-        * WebCorePrefix.h:
-        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
-
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
-
-        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
-
-        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
-
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
-
-        Trying to fix Windows build.
-
-        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
-
-2009-08-17  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Steve Falkenburg.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Only add Cygwin to the path when it isn't already there.  This avoids
-        causing problems for people who purposefully have non-Cygwin versions of
-        executables like svn in front of the Cygwin ones in their paths.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28401
-        Add support for DNS prefetching with CFNetwork
-
-        This is just an optimization, no behavior change, so no tests.
-
-        * platform/network/cf/DNSCFNet.cpp:
-        (WebCore::clientCallback):
-        (WebCore::prefetchDNS):
-        Use async CFHostStartInfoResolution() for implementation.
-
-2009-08-17  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
-        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
-
-        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
-        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
-
-        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
-          authorization headers) to a resource on origin A.
-        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
-          authorization headers) to another resource on origin B (this time sending access control authorization headers).
-
-        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
-
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
-        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
-        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
-        * loader/DocumentThreadableLoader.h:
-        * loader/ThreadableLoader.h:
-        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
-        * page/EventSource.cpp:
-        (WebCore::EventSource::connect): Ditto.
-        * workers/Worker.cpp: Ditto.
-        (WebCore::Worker::Worker): Ditto.
-        * workers/WorkerContext.cpp: Ditto.
-        (WebCore::WorkerContext::importScripts): Ditto.
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
-        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
-        * workers/WorkerScriptLoader.h: 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::createRequest): Ditto.
-
-2009-08-17  Adam Langley  <agl@google.com>
-
-        Reviewed by Dan Bernstein (relanding of r47157).
-
-        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28172
-
-        This was originally fixed in r47157, however it triggered a bug in
-        Skia which caused Chromium Linux to fail layout tests in debug mode.
-        It was reverted in r47189 while we sorted it out.
-
-        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
-        Chromium's r23523. This is a reland of the original patch.
-
-        No new tests because it's a just typo fix.
-
-        [1] http://code.google.com/p/skia/source/detail?r=321
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Xan Lopez.
-
-        Protect ResourceHandle for g_file_query_info_async call, using the
-        same technique we already use for HTTP requests that take the soup
-        path.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
-        (WebCore::ResourceHandle::~ResourceHandle):
-        (WebCore::finishedCallback):
         (WebCore::):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didNotAllowPlugins):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::substituteMIMETypeFromPluginDatabase):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * plugins/MimeType.cpp:
+        (WebCore::MimeType::enabledPlugin):
 
-2009-08-17  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
-        appears below the main content
-        https://bugs.webkit.org/show_bug.cgi?id=28350
-
-        A particular version of the MediaWiki software detects WebKit through
-        user agent sniffing and imports a style sheet called KHTMLFixes.css,
-        which contains a single rule that was meant to work around some KHTML
-        bug, but currently has the sole effect of causing the float containing
-        the main article content to extend all the way to the left and thus push
-        down the left navigation pane.
-
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
-        enabled, check if the imported style sheet is the MediaWiki
-        KHTMLFixes.css. If so, remove the offending rule.
-
-2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Kevin Ollivier.
-
-        Correct crash when processing local cancelled requests.
-
-        No new tests. Existing fast/images/favicon-as-image.html
-        displays the problem.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::writeCallback): Add check for m_cancelled after
-          performing local-file processing.
-        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
-          check for m_cancelled after performing local-file processing.
-
-2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed. Reverts 47371, since it breaks GTK+.
-
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp: Removed.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::ImageDecoder):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::headerAvailable):
-        (WebCore::PNGImageDecoder::rowAvailable):
-
-2009-08-17  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Allow image decoders to down-sample the image directly
-        to scaled output buffer. This can be enabled/disabled by
-        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
-        Only JPEG and PNG decoders are modified to support it now.
-        https://bugs.webkit.org/show_bug.cgi?id=28308
-
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp: Added.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::ImageDecoder):
-        (WebCore::ImageDecoder::setMaxNumPixels):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        (WebCore::JPEGImageDecoder::setSize):
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::headerAvailable):
-        (WebCore::PNGImageDecoder::rowAvailable):
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix: fix float literals to avoid casting warnings.
-
-        * rendering/MediaControlElements.cpp:
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Use OwnPtrs for GraphicsLayers
-        https://bugs.webkit.org/show_bug.cgi?id=28399
-
-        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
-        for their references to GraphicsLayers.
-
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayer::create):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateInternalHierarchy):
-        (WebCore::RenderLayerBacking::updateClippingLayers):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::graphicsLayer):
-        (WebCore::RenderLayerBacking::clippingLayer):
-        (WebCore::RenderLayerBacking::ancestorClippingLayer):
-        (WebCore::RenderLayerBacking::foregroundLayer):
-        (WebCore::RenderLayerBacking::parentForSublayers):
-        (WebCore::RenderLayerBacking::childForSuperlayers):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::rootPlatformLayer):
-        (WebCore::RenderLayerCompositor::didMoveOnscreen):
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
-        * rendering/RenderLayerCompositor.h:
-
-2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Reset InjectedScript styles cache on document change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28390
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::resetInjectedScript):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._reset):
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
-        resorted includes, renamed "doc" to "document" and fixed formatting.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed functions now unneeded due to use of Reflect to create
-        language bindings.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
-        Get at usemap attribute directly.
-
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        Get at id attribute directly.
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertHorizontalRule): Ditto.
-
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
-        (WebCore::HTMLDocument::setDir): Ditto.
-
-        * html/HTMLElement.cpp: Deleted unused functions.
-        * html/HTMLElement.h: Ditto.
-
-        * html/HTMLImageElement.cpp: Deleted unused functions.
-        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
-        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
-        get at usemap attribute directly, but added a FIXME because although
-        it is what the old code did, it looks to not be entirely correct.
-
-        * html/HTMLImageElement.h: Deleted unused functions.
-
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
-
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
-        directly.
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
-        explicit HTMLNames namespace qualification.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode): Removed unneeded calls
-        to RefPtr::get.
-
-2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Discard DOM Node bindings on any document change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28389
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-
-2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Improve Cookie DataGrid to Show Hidden Data
-        https://bugs.webkit.org/show_bug.cgi?id=28269
-
-        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
-        * WebCore.gypi: added missing files
-
-          Implemented Bindings for InspectorController.deleteCookie(name)
-
-        * inspector/InspectorBackend.idl:
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        (WebCore::JSInspectorBackend::deleteCookie):
-
-          v8 Bindings Stubs
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-          Removed WebInspector.Cookie
-
-        * inspector/front-end/Cookie.js: Removed.
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/WebKit.qrc:
-
-          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
-          yet provide access to raw cookies.
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.buildCookies):
-        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
-        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
-        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
-        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
-        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-
-          Interaction with the page through Injected Script (for fallback behavior)
-
-        * inspector/front-end/DOMAgent.js:
-        (InspectorController.getCookies):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleProperty): style fix
-        (InjectedScript.getCookies):
-
-          Allow alignment of text inside DataGrids.
-
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid):
-        (WebInspector.DataGridNode.prototype.createCell):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
-        * inspector/front-end/inspector.css:
-
-          Added deleteCookie(., ., String name)
-          Modified getRawCookies to return a bool to know if its implemented
-
-        * platform/CookieJar.h:
-
-
-          Implemented deleteCookie for Macs
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-
-          Stub Implementations for Other Platforms
-
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-
-2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
-
-        Blind build fix for Leopard.
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
-
-2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContextCG.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
-        (WebCore::GraphicsContext::setCompositeOperation):
-
-2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::save):
-        (WebCore::GraphicsContext::restore):
-        (GraphicsContext::drawText):
-        (GraphicsContext::initFocusRing):
-        (GraphicsContext::focusRingBoundingRect):
-        (GraphicsContext::drawImage):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::toCairoOperator):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Change HTMLAreaElement to use OwnArrayPtr
-        https://bugs.webkit.org/show_bug.cgi?id=28386
-
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
-        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
-        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
-        instead of deletion followed by assignment.
-        * html/HTMLAreaElement.h: Use OwnArrayPtr.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Fix Windows build.
-
-        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Move noResize from HTMLFrameElementBase to HTMLFrameElement
-        https://bugs.webkit.org/show_bug.cgi?id=28384
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
-        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
-        here if noresizeAttr is changed. This code was moved here from
-        HTMLFrameElementBase, but I added some FIXME comments.
-        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
-        boolean argument. Moved here from HTMLFrameElementBase.
-
-        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
-        here from HTMLFrameElementBase.
-
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
-        noresizeAttr.
-
-        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Tweak HTMLFrameElementBase so that m_URL can be private
-        https://bugs.webkit.org/show_bug.cgi?id=28385
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
-        taking an argument.
-        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
-        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        HTMLViewSourceDocument should use smart pointers
-        https://bugs.webkit.org/show_bug.cgi?id=28378
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
-        pointers any more since RefPtr starts 0 by default.
-        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
-        types for local variables.
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
-        and use a RefPtr of a more specific type for a local variable.
-        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
-        variables, and use RefPtr as well.
-        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
-        RefPtr of a more specific type for a local variable.
-
-        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
-        data member types to RefPtr.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        Convert 4 more classes. These are classes I am going to make other changes
-        to soon, so it's good to have this use of Reflect in the IDL out of the way.
-
-        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
-        * html/HTMLFrameElement.idl: Ditto.
-        * html/HTMLIFrameElement.idl: Ditto.
-        * html/HTMLObjectElement.idl: Ditto.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Script to create element factory needs changes to accommodate calling create
-        https://bugs.webkit.org/show_bug.cgi?id=28379
-
-        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
-        around names used inside {}. Added new createWithNew property for tags
-        that makes the factory use a create function instead of calling new.
-        Renamed functions with initialize in their name to have default in their
-        name, since they return an array full of default values and don't themselves
-        initialize anything.
+2010-03-02  Andreas Kling  <andreas.kling@nokia.com>
 
-2009-08-16  Darin Adler  <darin@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Dan Bernstein.
+        [Qt] Support the HTTP OPTIONS verb (needed for preflight requests)
 
-        StyledElement should use ASCIICType instead of having its own toHex function
-        https://bugs.webkit.org/show_bug.cgi?id=28377
+        https://bugs.webkit.org/show_bug.cgi?id=34647
 
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
 
-2009-08-16  Darin Adler  <darin@apple.com>
+2010-03-02  Evan Stade  <estade@chromium.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by David Levin.
 
-        execCommand("InsertHorizontalRule") inserts a broken <hr> element
-        https://bugs.webkit.org/show_bug.cgi?id=28375
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
 
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
-        instead of just an HTMLElement.
+        This fixes the crash, but the SVG still doesn't render properly.
 
-2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
 
-        Reviewed by George Staikos.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
 
-        [WML] <option> element & 'onpick' events - history navigation is broken
-        https://bugs.webkit.org/show_bug.cgi?id=28371
+2010-03-02  Arno Renevier  <arno@renevier.net>
 
-        After selecting an option element with an 'onpick' event associated with a 'go' task,
-        the navigation is executed. When going back in history, the same 'onpick' event is fired
-        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+        Reviewed by Gustavo Noronha Silva.
 
-        Test: wml/option-element-onpick-recursion.html
+        [Gtk] use geoclue providers with don't provide update
+        https://bugs.webkit.org/show_bug.cgi?id=35191
 
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLSelectElement.cpp:
-        (WebCore::WMLSelectElement::WMLSelectElement):
-        (WebCore::WMLSelectElement::selectInitialOptions):
-        * wml/WMLSelectElement.h:
-        (WebCore::WMLSelectElement::initialized):
+        No new tests, behaviour depends on system.
 
-2009-08-16  Anthony Ricaud  <rik@webkit.org>
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
 
-        Reviewed by Timothy Hatcher.
+2010-03-02  John Abd-El-Malek  <jam@chromium.org>
 
-        Inspector Resource filtering: keyboard Navigation always uses ALL resources
-        https://bugs.webkit.org/show_bug.cgi?id=28231
-        
-        Determine if a resource is selectable on user action.
-        
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+        Reviewed by Darin Adler.
 
-2009-08-16  David Kilzer  <ddkilzer@apple.com>
+        Remove unnecessary check.
+        https://bugs.webkit.org/show_bug.cgi?id=35513
 
-        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
 
-        Reviewed by Dan Bernstein.
+2010-03-02  Darin Fisher  <darin@chromium.org>
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (AXAttributeStringSetSpelling): Changed MIN() to min().
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
-        max() and MIN() to min().
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
-        std::max statement.
-        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+        Fix chromium build bustage.
 
-2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): PluginView methods may
+        not be called in the Chromium port.
 
-        Reviewed by George Staikos.
+2010-03-02  Beth Dakin  <bdakin@apple.com>
 
-        [WML] Cleanup WMLIntrinsicEventHandling code
-        https://bugs.webkit.org/show_bug.cgi?id=28358
-
-        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::defaultEventHandler):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLGoElement.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLPrevElement.h:
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-        * wml/WMLRefreshElement.h:
-        * wml/WMLTaskElement.h:
-
-2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Darin Adler and Adam Roben.
 
-        Reviewed by Timothy Hatcher.
+        Fix for <rdar://problem/7485289> WebKit crashes on systems that 
+        don't support CoreAnimation
 
-        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+        WKCACFLayerRenderer::acceleratedCompositingAvailable() now creates 
+        a dummy HWND so that it can step through the whole setHostWindow() 
+        and createRenderer() process. createRenderer() also calls a new 
+        function, hardwareCapabilitiesIndicateCoreAnimationSupport() which 
+        can only be called  once we have a d3dDevice.
 
-        - renamed elementId to nodeId in operations on nodes.
-        - added load listeners to frame owners in InspectorDOMAgent.
-        - removed InspectorController::inspectedWindowScriptObjectCleared event.
-        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
-        - removed contentDocument-related logic from ElementsPanel since it is handled in
-            the InspectorDOMAgent.
-        - removed DOM listeners unregistration and corresponding events from InspectorController.
-        - made this.styles 'private' in ElementsPanel.
-        - added TODO for the handleCopy processing.
+        setHostWindow() and createRenderer() now both return bools that 
+        indicate whether or not they have succeeded.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28356
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::hardwareCapabilitiesIndicateCoreAnimationSupport):
+        (WebCore::CoreAnimationTesterWindowWndProc):
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        (WebCore::WKCACFLayerRenderer::shared):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        (WebCore::WKCACFLayerRenderer::setHostWindow):
 
-        * WebCore.order:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setTextNodeValue):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::startListening):
-        (WebCore::InspectorDOMAgent::stopListening):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::getChildNodes):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::setTextNodeValue):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        (WebCore::InspectorDOMAgent::innerParentNode):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMDocument.prototype.addEventListener):
-        (WebInspector.DOMDocument.prototype.removeEventListener):
-        (WebInspector.DOMDocument.prototype._fireDomEvent):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
-        (WebInspector.DOMAgent.prototype._setChildNodes):
-        (WebInspector.CSSStyleDeclaration.parseRule):
-        (WebInspector.childNodeInserted):
-        (WebInspector.childNodeRemoved):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype.addStyleChange):
-        (WebInspector.ElementsPanel.prototype.removeStyleChange):
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
-        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren):
-        (WebInspector.ElementsTreeElement.prototype.onexpand):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.addStyleSelector):
-        (InjectedScript._serializeRule):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection):
-        * inspector/front-end/inspector.js:
-        (WebInspector.set hoveredDOMNode):
-        * inspector/front-end/treeoutline.js:
-        (TreeOutline.prototype.findTreeElement):
-        * inspector/front-end/utilities.js:
-        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
-        (Node.prototype.enclosingNodeOrSelfWithClass):
-        (isAncestorNode):
-        (firstCommonNodeAncestor):
-        (traverseNextNode):
-        (traversePreviousNode):
-        ():
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+        Rubber-stamped by Jon Honeycutt.
 
-        Reviewed by Dave Hyatt
+        ScriptDebugServer shouldn't care that Mac does not use PluginView for plug-ins.
 
-        Optimize updateFillImages() to not add/remove clients every time
-        https://bugs.webkit.org/show_bug.cgi?id=28334
-
-        Optimize the case where old and new just have a single layer pointing to the same (or no)
-        image.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::updateFillImages):
+        * bindings/js/ScriptDebugServer.cpp:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setJavaScriptPaused): Add an empty implementation of setJavaScriptPaused.
 
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Anders Carlsson.
+        Rubber-stamped by Jon Honeycutt.
 
-        Implement animations of multiple text-shadows and -webkit-box-shadows.
-        https://bugs.webkit.org/show_bug.cgi?id=28266
-        
-        Test: transitions/multiple-shadow-transitions.html
+        Clean up the build fix r55437 by adding an empty implementation of privateBrowsingStateChanged in PluginViewNone.cpp
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperShadow::equals):
-        (WebCore::PropertyWrapperShadow::blend):
+        * page/Page.cpp:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::privateBrowsingStateChanged):
 
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Anders Carlsson.
+        Fix the Mac build.
 
-        Make transitions work for position and size of multiple backgrounds and masks.
-        https://bugs.webkit.org/show_bug.cgi?id=28266
-        
-        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
-        properties animatable with multiple backgrounds, rather than just animating the first one.
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Mac doesn't use WebCore's PluginView class
+        for plug-ins, so provide an empty implementation of privateBrowsingStateChanged for Mac.
 
-        Tests: transitions/multiple-background-size-transitions.html
-               transitions/multiple-background-transitions.html
-               transitions/multiple-mask-transitions.html
+2010-03-02  Andy Estes  <aestes@apple.com>
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
-        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
-        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
-        (WebCore::FillLayerPropertyWrapperGetter::equals):
-        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
-        (WebCore::FillLayerPropertyWrapper::blend):
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        (WebCore::FillLayersPropertyWrapper::equals):
-        (WebCore::FillLayersPropertyWrapper::blend):
-        (WebCore::ensurePropertyMap):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::setXPosition):
-        (WebCore::FillLayer::setYPosition):
-        (WebCore::FillLayer::setSize):
-
-2009-08-15  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Jan Alonzo.
-
-        Don't crash in fieldset code when WML is enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=28012
-
-        Test: fast/wml/html-fieldset-crash.html
+        Reviewed by Maciej Stachowiak.
 
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::findLegend): ++brackets
+        Add the capability to create and dispatch a WheelEvent in JavaScript.
+        Ensure the event's default handler is triggered in the same way as it is
+        during a PlatformWheelEvent.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35566
+
+        Test: fast/events/wheelevent-in-scrolling-div.html
+
+        * dom/Node.cpp: Ensure that the default behavior (scrolling) occurs for
+        wheel events originating both from the platform and from
+        JavaScript/ObjC.
+        (WebCore::Node::dispatchWheelEvent): Instantiate new WheelEvent with
+        the graunularity of the PlatformWheelEvent.
+        (WebCore::Node::defaultEventHandler): Add support for mousewheel events.
+        * dom/WheelEvent.cpp: Add three new member variables: m_deltaX, m_deltaY
+        and m_granularity.  m_deltaX and m_deltaY differ from m_wheelDeltaX and
+        m_wheelDeltaY, which are the number of wheel ticks multiplied by 120 for
+        IE compatibility.
+        (WebCore::WheelEvent::WheelEvent): Initialize new member variables.
+        (WebCore::WheelEvent::initWheelEvent): Same.
+        (WebCore::WheelEvent::initWebKitWheelEvent): Same.
+        * dom/WheelEvent.h: See WheelEvent.cpp.
+        (WebCore::WheelEvent::): Add Granularity enum (Pixel, Line, Page).
+        (WebCore::WheelEvent::create): Add new arguments.
+        (WebCore::WheelEvent::deltaX): Amount of scroll in x direction.
+        (WebCore::WheelEvent::deltaY): Amount of scroll in y direction.
+        (WebCore::WheelEvent::granularity): Units of deltaX and deltaY.
+        * dom/WheelEvent.idl: Add initWebKitWheelEvent() to JavaScript.  This is
+        the same as the initWheelEvent ObjC method.  As the DOM Level 3 Events
+        specification is still a working draft and subject to change, prefix
+        'WebKit' to the method signature to indicate experimental support.
+        * page/EventHandler.cpp: Move the scroll handling from
+        handleWheelEvent() to defaultWheelEventHandler(), which is executed on
+        both PlatformWheelEvents and JavaScript WheelEvents.
+        (WebCore::scrollNode): Renamed from scrollAndAcceptEvent().  Remove
+        the PlatformWheelEvent from the argument list and instead return a
+        boolean indicating if the scroll event was accepted.
+        (WebCore::EventHandler::handleWheelEvent): Move scrolling code from here
+        (WebCore::EventHandler::defaultWheelEventHandler): ...to here.
+        * page/EventHandler.h: Add function signature.
+
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-2009-08-15  Sam Weinig  <sam@webkit.org>
+        Reviewed by Darin Adler.
 
-        Try and enable EventSource on Windows.
+        Bug 35576: WebKit should tell plug-in instances when private browsing state changes
+        <http://webkit.org/b/35576>
 
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
+        Notify plug-in instances when the private browsing state changes to match the behavior of the
+        Mac plug-in code.
 
-2009-08-15  Sam Weinig  <sam@webkit.org>
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Walk the frame tree and notify each PluginView that
+        the private browsing state has changed.
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setPrivateBrowsingEnabled): Notify the page that the private browsing state
+        has changed.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::privateBrowsingStateChanged): Notify the plug-in instance of the new private
+        browsing state.
+        * plugins/PluginView.h:
 
-        Reviewed by Dan Bernstein.
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Setting attribute event listeners to the body does not set them on the window
-        https://bugs.webkit.org/show_bug.cgi?id=28343
-
-        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
-               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
-        (WebCore::HTMLBodyElement::setOnerror): Ditto.
-        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
-        (WebCore::HTMLBodyElement::setOnload): Ditto.
-        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
-        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
-        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
-        (WebCore::HTMLBodyElement::setOnonline): Ditto.
-        (WebCore::HTMLBodyElement::setOnresize): Ditto.
-        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
-        (WebCore::HTMLBodyElement::setOnunload): Ditto.
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Dan Bernstein.
+        Bug 30348: Implement private mode for plug-ins on Windows
+        <http://webkit.org/b/30348> / <rdar://problem/7562261>
 
-        Fix up some IDL comments.
+        Rework PluginView::getValue and PluginView::getValueStatic to remove the amount of code that
+        was duplicated across platforms.  getValue and getValueStatic now call in to platform-specific
+        variants that indicate whether they handled the query.  If the query is not handled by the
+        platform-specific variants then the cross-platform handler has a chance to handle it.
 
-        * html/HTMLBodyElement.idl:
-        * html/HTMLFrameSetElement.idl:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::getValueStatic): Give the platform-specific variant a chance to handle the
+        variable lookup.  If it does not handle it, return an error.
+        (WebCore::PluginView::getValue): Give the platform-specific variant and platform-specific static
+        variant a chance to handle the variable lookup.  If they do not handle it, apply the cross-platform
+        handler.  At the moment the cross-platform code handles NPNVWindowNPObject, NPNVPluginElementNPObject,
+        and NPNVprivateModeBool as they have an identical implementation across ports.
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformGetValue): PluginViewNone does not handle any lookups.
+        (WebCore::PluginView::platformGetValueStatic): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        platform-independent implementation.
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue): Fix a bug noticed while updating this code.
+        The Qt implementation of the handler for NPNVToolkit was relying on case fall-through
+        to have some values handled by the static handler.  When NPNVprivateModeBool was added
+        it was placed before the default case, interferring with this fall-through.  It now
+        explicitly indicates in this situation that it was not handled.
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
 
-2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+2010-03-02  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Added implementation of the EventSource object that enables
-        server-sent events from HTML5.
-        http://dev.w3.org/html5/eventsource/
-        https://bugs.webkit.org/show_bug.cgi?id=14997
-
-        Tests: fast/eventsource/eventsource-attribute-listeners.html
-               fast/eventsource/eventsource-constructor.html
-               http/tests/eventsource/eventsource-bad-mime-type.html
-               http/tests/eventsource/eventsource-parse-event-stream.html
-               http/tests/eventsource/eventsource-reconnect.html
-               http/tests/eventsource/eventsource-status-code-states.html
-               http/tests/eventsource/workers/eventsource-simple.html
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::eventSource):
-        * bindings/js/JSEventSourceConstructor.cpp: Added.
-        (WebCore::):
-        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
-        (WebCore::constructEventSource):
-        (WebCore::JSEventSourceConstructor::getConstructData):
-        * bindings/js/JSEventSourceConstructor.h: Added.
-        (WebCore::JSEventSourceConstructor::classInfo):
-        * bindings/js/JSEventSourceCustom.cpp: Added.
-        (WebCore::JSEventSource::markChildren):
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::eventSource):
-        * dom/EventNames.h:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toEventSource):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * page/EventSource.cpp: Added.
-        (WebCore::EventSource::EventSource):
-        (WebCore::EventSource::~EventSource):
-        (WebCore::EventSource::connect):
-        (WebCore::EventSource::endRequest):
-        (WebCore::EventSource::scheduleReconnect):
-        (WebCore::EventSource::reconnectTimerFired):
-        (WebCore::EventSource::url):
-        (WebCore::EventSource::readyState):
-        (WebCore::EventSource::close):
-        (WebCore::EventSource::scriptExecutionContext):
-        (WebCore::EventSource::addEventListener):
-        (WebCore::EventSource::removeEventListener):
-        (WebCore::EventSource::dispatchEvent):
-        (WebCore::EventSource::didReceiveResponse):
-        (WebCore::EventSource::didReceiveData):
-        (WebCore::EventSource::didFinishLoading):
-        (WebCore::EventSource::didFail):
-        (WebCore::EventSource::didFailRedirectCheck):
-        (WebCore::EventSource::parseEventStream):
-        (WebCore::EventSource::parseEventStreamLine):
-        (WebCore::EventSource::dispatchGenericEvent):
-        (WebCore::EventSource::dispatchMessageEvent):
-        (WebCore::EventSource::stop):
-        * page/EventSource.h: Added.
-        (WebCore::EventSource::create):
-        (WebCore::EventSource::):
-        (WebCore::EventSource::setOnopen):
-        (WebCore::EventSource::onopen):
-        (WebCore::EventSource::setOnmessage):
-        (WebCore::EventSource::onmessage):
-        (WebCore::EventSource::setOnerror):
-        (WebCore::EventSource::onerror):
-        (WebCore::EventSource::toEventSource):
-        (WebCore::EventSource::eventListeners):
-        (WebCore::EventSource::refEventTarget):
-        (WebCore::EventSource::derefEventTarget):
-        * page/EventSource.idl: Added.
-        * workers/WorkerContext.idl:
-
-2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Minor DOMAgent bugfixes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28177
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::nodeForId):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-
-2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Evaluating objects while on a breakpoint dumps string
-        representation instead of live object. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=28280
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
-
-2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding two new files to WebCore/platform/haiku:
-        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28129
-
-        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
-        (WebCore::submitButtonDefaultLabel):
-        (WebCore::inputElementAltText):
-        (WebCore::resetButtonDefaultLabel):
-        (WebCore::defaultLanguage):
-        (WebCore::searchableIndexIntroduction):
-        (WebCore::fileButtonChooseFileLabel):
-        (WebCore::fileButtonNoFileSelectedLabel):
-        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
-        (WebCore::contextMenuItemTagDownloadLinkToDisk):
-        (WebCore::contextMenuItemTagCopyLinkToClipboard):
-        (WebCore::contextMenuItemTagOpenImageInNewWindow):
-        (WebCore::contextMenuItemTagDownloadImageToDisk):
-        (WebCore::contextMenuItemTagCopyImageToClipboard):
-        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
-        (WebCore::contextMenuItemTagCopy):
-        (WebCore::contextMenuItemTagGoBack):
-        (WebCore::contextMenuItemTagGoForward):
-        (WebCore::contextMenuItemTagStop):
-        (WebCore::contextMenuItemTagReload):
-        (WebCore::contextMenuItemTagCut):
-        (WebCore::contextMenuItemTagPaste):
-        (WebCore::contextMenuItemTagNoGuessesFound):
-        (WebCore::contextMenuItemTagIgnoreSpelling):
-        (WebCore::contextMenuItemTagLearnSpelling):
-        (WebCore::contextMenuItemTagSearchWeb):
-        (WebCore::contextMenuItemTagLookUpInDictionary):
-        (WebCore::contextMenuItemTagOpenLink):
-        (WebCore::contextMenuItemTagIgnoreGrammar):
-        (WebCore::contextMenuItemTagSpellingMenu):
-        (WebCore::contextMenuItemTagShowSpellingPanel):
-        (WebCore::contextMenuItemTagCheckSpelling):
-        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
-        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
-        (WebCore::contextMenuItemTagFontMenu):
-        (WebCore::contextMenuItemTagBold):
-        (WebCore::contextMenuItemTagItalic):
-        (WebCore::contextMenuItemTagUnderline):
-        (WebCore::contextMenuItemTagOutline):
-        (WebCore::contextMenuItemTagWritingDirectionMenu):
-        (WebCore::contextMenuItemTagDefaultDirection):
-        (WebCore::contextMenuItemTagLeftToRight):
-        (WebCore::contextMenuItemTagRightToLeft):
-        (WebCore::contextMenuItemTagInspectElement):
-        (WebCore::searchMenuNoRecentSearchesText):
-        (WebCore::searchMenuRecentSearchesText):
-        (WebCore::searchMenuClearRecentSearchesText):
-        (WebCore::unknownFileSizeText):
-        (WebCore::AXWebAreaText):
-        (WebCore::AXLinkText):
-        (WebCore::AXListMarkerText):
-        (WebCore::AXImageMapText):
-        (WebCore::AXHeadingText):
-        (WebCore::imageTitle):
-        (WebCore::contextMenuItemTagTextDirectionMenu):
-        (WebCore::AXButtonActionVerb):
-        (WebCore::AXTextFieldActionVerb):
-        (WebCore::AXRadioButtonActionVerb):
-        (WebCore::AXCheckedCheckBoxActionVerb):
-        (WebCore::AXUncheckedCheckBoxActionVerb):
-        (WebCore::AXLinkActionVerb):
-        (WebCore::AXDefinitionListTermText):
-        (WebCore::AXDefinitionListDefinitionText):
-        * platform/haiku/LoggingHaiku.cpp: Added.
-        (WebCore::InitializeLoggingChannelsIfNecessary):
+        Make the default constructor available to all platforms.
 
-2009-08-15  Darin Adler  <darin@apple.com>
+        * platform/PlatformKeyboardEvent.h:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/KeyEventMac.mm:
 
-        Fix GTK build.
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+        Reviewed by David Levin.
 
-2009-08-15  Darin Adler  <darin@apple.com>
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
 
-        Fix Qt build.
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
 
-        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
-        directly to make CDATASection and Comment nodes.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getThreadID):
 
-2009-08-14  Darin Adler  <darin@apple.com>
+2010-03-02  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Make DOM classes start with a reference count of 1, like all other RefCounted
-        https://bugs.webkit.org/show_bug.cgi?id=28068
-
-        First half, everything except for element classes.
-
-        * GNUmakefile.am: Removed DocPtr.h.
-        * WebCore.gypi: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-
-        * dom/Attr.cpp:
-        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
-        have to call it explicitly.
-        (WebCore::Attr::create): Added.
-        (WebCore::Attr::setValue): Changed to take AtomicString.
-        (WebCore::Attr::cloneNode): Use create.
-
-        * dom/Attr.h: Added a create function. Made the constructor private,
-        and a lot of other functions private as well.
-
-        * dom/Attribute.cpp:
-        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
-
-        * dom/CDATASection.cpp:
-        (WebCore::CDATASection::create): Added.
-        (WebCore::CDATASection::cloneNode): Use create.
-        (WebCore::CDATASection::virtualCreate): Ditto.
-
-        * dom/CDATASection.h: Added a create function. Made everything private.
-        Removed unneeded destructor declaration.
-
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
-        with a single one that takes ConstructionType.
-
-        * dom/CharacterData.h: Made more functions be protected and private.
-        Made m_data be private.
-
-        * dom/Comment.cpp:
-        (WebCore::Comment::Comment): Got rid of an extra constructor.
-        (WebCore::Comment::create): Added.
-        (WebCore::Comment::cloneNode): Call create.
-
-        * dom/Comment.h: Added a create function. Made everything private.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
-        (WebCore::dispatchChildRemovalEvents): Ditto.
-
-        * dom/ContainerNode.h: Made the constructor protected and passed
-        ConstructionType instead of an isElement boolean.
-
-        * dom/DocPtr.h: Removed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::Document): Simplified the code that sets m_document
-        since it's no longer a smart pointer.
-        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
-        and selfOnlyDeref instead of a DocPtr in here.
-        (WebCore::Document::~Document): Simplified the code that sets m_document
-        since it's no longer a smart pointer.
-        (WebCore::Document::createDocumentFragment): Call create.
-        (WebCore::Document::createTextNode): Ditto.
-        (WebCore::Document::createComment): Ditto.
-        (WebCore::Document::createCDATASection): Ditto.
-        (WebCore::Document::createProcessingInstruction): Ditto.
-        (WebCore::Document::createEntityReference): Ditto.
-        (WebCore::Document::createEditingTextNode): Ditto.
-        (WebCore::Document::importNode): Call Attr::create.
-        (WebCore::Document::createAttributeNS): Ditto.
-
-        * dom/Document.h: Call adoptRef. Made a lot of functions private and
-        protected and sorted them so public functions come first.
-
-        * dom/DocumentFragment.cpp:
-        (WebCore::DocumentFragment::create): Added.
-        (WebCore::DocumentFragment::cloneNode): Call create.
-        * dom/DocumentFragment.h: Added create.
-
-        * dom/DocumentType.cpp:
-        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
-        (WebCore::DocumentType::cloneNode): Use create.
-        * dom/DocumentType.h:
-        (WebCore::DocumentType::create): Call adoptRef.
-
-        * dom/EditingText.cpp:
-        (WebCore::EditingText::create): Added.
-        * dom/EditingText.h: Added a create function. Made everything private.
-
-        * dom/Element.cpp:
-        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
-        the zero reference count behavior for classes derived from Element.
-
-        * dom/EntityReference.cpp:
-        (WebCore::EntityReference::create): Added.
-        (WebCore::EntityReference::cloneNode): Call create.
-        * dom/EntityReference.h: Added create. Made everything private.
-
-        * dom/Node.cpp:
-        (WebCore::Node::initialRefCount): Added. Inline helper function for
-        the constructor.
-        (WebCore::Node::isContainer): Ditto.
-        (WebCore::Node::isElement): Ditto.
-        (WebCore::Node::isText): Ditto.
-        (WebCore::Node::Node): Changed to take a construction type argument.
-        Since m_document is now a normal pointer, added a call to selfOnlyRef.
-        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
-        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
-        (WebCore::Node::appendTextContent): Use the data function instead of
-        calling nodeValue functions, which do the same thing in a roundabout way.
-
-        * dom/Node.h: Made the constructor protected and replaced the multiple
-        arguments iwth a single ConstructionType argument. Sorted the public
-        things first.
-
-        * dom/Notation.h: Made most things private.
-        * dom/Notation.cpp: Removed extra constructor.
-
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::create): Added.
-        (WebCore::ProcessingInstruction::cloneNode): Call create.
-        * dom/ProcessingInstruction.h: Added create function. Made many other
-        members private.
-
-        * dom/Range.cpp:
-        (WebCore::Range::processContents): Use DocumentFragment::create.
-
-        * dom/Text.cpp:
-        (WebCore::Text::Text): Updated for base class change.
-        (WebCore::Text::create): Added.
-        (WebCore::Text::splitText): Changed to not require access to m_data.
-        (WebCore::Text::cloneNode): Call create.
-        (WebCore::Text::createRenderer): Call dataImpl.
-        (WebCore::Text::attach): Call data.
-        (WebCore::Text::recalcStyle): Call dataImpl.
-        (WebCore::Text::virtualCreate): Call create.
-        (WebCore::Text::createWithLengthLimit): Call create.
-        (WebCore::Text::formatForDebugger): Call data.
-
-        * dom/Text.h: Added a create function. Made many other members private.
-        Renamed createNew to virtualCreate.
-
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::enterText): Call Text::create.
-
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
-        (WebCore::XMLTokenizer::comment): Call Comment::create.
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::deleteInsignificantText):
-        Call data instead of string.
-
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply): Call Text::create.
-
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertNode): Call DocumentFragment::create.
+        Followup for REGRESSION(r51097) - Unable to log in to statefarm.com
+        <rdar://problem/7672667> and https://bugs.webkit.org/show_bug.cgi?id=35556
 
-        * editing/SplitTextNodeCommand.cpp:
-        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
-
-        * editing/markup.cpp:
-        (WebCore::appendStartMarkup): Call data instead of nodeValue.
-
-        * html/HTMLDocument.h:
-        (WebCore::HTMLDocument::create): Call adoptRef.
-
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
-        (WebCore::replaceChildrenWithFragment): Call data instead of string.
-        (WebCore::replaceChildrenWithText): Call Text::create.
-        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
-        Text::create.
-        (WebCore::HTMLElement::setOuterText): Call Text::create.
-
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
-
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::setText): Call Text::create.
-
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
-        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
-        (WebCore::HTMLParser::handleIsindex): Call Text::create.
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
-
-        * html/HTMLViewSourceDocument.h:
-        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
-
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
-        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
-
-        * loader/FTPDirectoryDocument.h:
-        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
-        * loader/ImageDocument.h:
-        (WebCore::ImageDocument::create): Ditto.
-        * loader/MediaDocument.h:
-        (WebCore::MediaDocument::create): Ditto.
-        * loader/PlaceholderDocument.h:
-        (WebCore::PlaceholderDocument::create): Ditto.
-        * loader/PluginDocument.h:
-        (WebCore::PluginDocument::create): Ditto.
-        * loader/TextDocument.h:
-        (WebCore::TextDocument::create): Ditto.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
-        (WebCore::Loader::Host::didFail): Ditto.
-
-        * platform/TreeShared.h:
-        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
-        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
-
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::originalText): Use dataImpl instead of string.
-
-        * rendering/RenderTextFragment.cpp:
-        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
-        (WebCore::RenderTextFragment::previousCharacter): Ditto.
-
-        * svg/SVGDocument.h:
-        (WebCore::SVGDocument::create): Use adoptRef.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
-        PassRefPtr.
-
-        * svg/SVGElementInstance.h: Made everything private.
-
-        * wml/WMLDocument.h:
-        (WebCore::WMLDocument::create): Called adoptRef.
-
-        * xml/XPathNamespace.cpp:
-        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
-        * xml/XPathNamespace.h: Made everything private.
-
-        * xml/XSLTProcessor.cpp:
-        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
-        Text::create.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript): To more perfectly match Gecko's rule,
+          strip whitespace from the attribute values before comparing to window/onload/onload().
 
-2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+2010-03-02  Chris Fleizach  <cfleizach@apple.com>
 
-        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
-        nightly (20866)
+        Reviewed by Beth Dakin.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20866
+        aria-label isn't respected on option elements
+        https://bugs.webkit.org/show_bug.cgi?id=35400
 
-        Reviewed by Oliver Hunt.
+        When aria-label is used on an <option> element, it can take three forms.
+        An option in a multi-select list, a popup button and the menu that is displayed 
+        from the popup button. This patches the three requisite locations so that if
+        aria-label is used, the correct accessibility text is returned.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::AXObjectCache):
-        Changed to take a pointer to its owner document. This is used by
-        AXObjectCache::handleFocusedUIElementChanged().
-        (WebCore::AXObjectCache::focusedUIElementForPage):
-        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
-        to be a static function and to take a pointer to a Page.
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Moved the code to generate the next AXID from getAXID() to here. Added
-        a #if to make this non-WIN only, because Windows has its own
-        implementation.
-        (WebCore::AXObjectCache::getAXID):
-        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
-
-        * accessibility/AXObjectCache.h:
-        Add a declaration for Document and Page. Removed the declaration of
-        AccessibilityObject, because we include the header. Reordered the
-        declaration of Node alphabetically. Moved the typedef for AXID to
-        AccessibilityObject. Removed some trailing whitespace. Added a member
-        variable to hold a pointer to the owner Document.
-        (WebCore::AXObjectCache::AXObjectCache):
-        Changed to take a pointer to its owner Document.
-        (WebCore::AXObjectCache::focusedUIElementForPage):
-        Added; code moved from AccessiblityRenderObject::focusedUIElement().
-        Returns the focused element with respect to accessibility.
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Declare a function to generate an AXID.
-        (WebCore::AXObjectCache::objectFromAXID):
-        Return the AccessibilityObject with the given AXID.
+        Test: platform/mac/accessibility/option-with-arialabel.html
 
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::stringValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::getAttribute):
         * accessibility/AccessibilityObject.h:
-        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
-        member use the typedef.
-        (WebCore::AccessibilityObject::axObjectID):
-        Changed the return type to use the typedef.
-        (WebCore::AccessibilityObject::setAXObjectID):
-        Changed the argument type to use the typedef.
-
         * accessibility/AccessibilityRenderObject.cpp:
-        Removed some unneeded #includes.
-        (WebCore::AccessibilityRenderObject::focusedUIElement):
-        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
-        call.
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        If the Document has no Page, return. If the Page has not focused
-        element (respecting accessibility), return. Assert that the
-        accessibility of the focused element is not ignored, and that the
-        object's AXID will be negative and fit into a LONG when negated.
-        Broadcast a focus event for the object.
-
-        * dom/Document.cpp:
-        (WebCore::Document::axObjectCache):
-        Pass this when creating the AXObjectCache.
-        (WebCore::Document::setFocusedNode):
-        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
-
-2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
-
-        Reviewed by Jan Alonzo.
+        (WebCore::AccessibilityRenderObject::getAttribute):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        * platform/PopupMenuClient.h:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemAccessibilityText):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemAccessibilityText):
 
-        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
-        https://bugs.webkit.org/show_bug.cgi?id=27028
+2010-03-02  Mads Ager  <ager@chromium.org>
 
-        Remove the improper set of enum WebKitWebViewTargetInfo
-        by grabbing the target infos via m_helper.
+        Reviewed by Adam Barth.
 
-        * manual-tests/gtk/copy-htmltext.html: Added.
-        * platform/Pasteboard.h:
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::clipboard_get_contents_cb):
-        * platform/gtk/PasteboardHelper.h:
+        [V8] V8 should be notified of context disposals
+        https://bugs.webkit.org/show_bug.cgi?id=35526
 
-2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+        Notify V8 of context disposals to allow it to clean up memory from those
+        contexts when idle.  When disposing a context, start a timer that will
+        give V8 an idle notification after a while to force cleanup.  Use a timer
+        to avoid performing an idle notification in the middle of navigation where
+        we know we are not idle.
 
-        Reviewed by Dave Hyatt.
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+        * bindings/v8/V8GCForContextDispose.cpp: Added.
+        (WebCore::V8GCForContextDispose::V8GCForContextDispose):
+        (WebCore::V8GCForContextDispose::notifyContextDisposed):
+        (WebCore::V8GCForContextDispose::notifyIdleSooner):
+        (WebCore::V8GCForContextDispose::instance):
+        (WebCore::V8GCForContextDispose::pseudoIdleTimerFired):
+        * bindings/v8/V8GCForContextDispose.h: Added.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
 
-        Fix an assertion when bringing up the Inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=28318
-        
-        The fix for bug 28295 assumed that image clients count the number of times
-        addClient/removeClient is called. That was true for CachedResource clients,
-        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
-        
-        Fix by making CSSImageGeneratorValue count the number of times a client is
-        added/removed.
+2010-03-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        * css/CSSCanvasValue.cpp:
-        (WebCore::CSSCanvasValue::canvasChanged):
-        (WebCore::CSSCanvasValue::canvasResized):
-        * css/CSSImageGeneratorValue.cpp:
-        (WebCore::CSSImageGeneratorValue::addClient):
-        (WebCore::CSSImageGeneratorValue::removeClient):
-        (WebCore::CSSImageGeneratorValue::getImage):
-        * css/CSSImageGeneratorValue.h:
+        Not reviewed: adding missing image files to WebKit.qrc and gypi.
 
-2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+        * WebCore.gypi:
+        * inspector/front-end/WebKit.qrc:
 
-        Reviewed by Kevin Ollivier.
+2010-03-02  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Correct libcurl crash when downloading local files.
-        https://bugs.webkit.org/show_bug.cgi?id=28312
+        Reviewed by Simon Hausmann.
 
-        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+        [Qt] GraphicsLayer: Video element with 3d transform crashes when AC is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=35516
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::handleLocalReceiveResponse): New static function that
-          performs the local setting of valid URL and firing didReceiveResponse.
-          This code was moved from writeCallback.
-        (WebCore::writeCallback): Move local file handling to static function
-          (above) and use the function instead.
-        (WebCore::readCallback): Add check
-          for responseFired, and handle as a local file if it was not.
+        No new tests.
 
-2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQt::setContentsToMedia):
 
-        Reviewed by Oliver Hunt.
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        [Haiku] Fix RenderThemeHaiku build.
-        https://bugs.webkit.org/show_bug.cgi?id=28307
+        Reviewed by Xan Lopez.
 
-        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
-        instead of RenderTheme.h.
-        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
-        before the function.
-        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
-        before the function.
-        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+        Use unsigned instead of uint which does not exist on windows
+        https://bugs.webkit.org/show_bug.cgi?id=35546
 
-2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
 
-        Reviewed by Oliver Hunt.
+2010-03-02  Kenneth Russell  <kbr@google.com>
 
-        [Haiku] Adding SharedBufferHaiku to WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28309
+        Reviewed by Darin Fisher.
 
-        * platform/haiku/SharedBufferHaiku.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
-        and functions.
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::getSupportedKeySizes):
+        Add EnabledAtRuntime attribute to WebGLArray constructors
+        https://bugs.webkit.org/show_bug.cgi?id=35558
+
+        New functionality verified manually in Chromium; not possible to
+        write layout test. Ran WebGL tests in WebKit as well.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setWebGLEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLRenderingContextEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLArrayBufferEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLByteArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedByteArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLShortArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedShortArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLIntArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedIntArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLFloatArrayEnabled):
+        * page/DOMWindow.idl:
 
-2009-08-14  Nate Chapin  <japhet@chromium.org>
+2010-03-02  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+        [V8] Fail gracefully if NPN_GetProperty tries to retrieve a property that doesn't exist.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28311
+        https://bugs.webkit.org/show_bug.cgi?id=35588
 
-        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+        Required for passing LayoutTests/plugins/netscape-plugin-property-access-exception.html on Chromium.
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_GetProperty): If the result is empty, don't try to convert it to an NPVariant and return false.
 
-2009-08-14  Aaron Boodman  <aa@chromium.org>
+2010-03-02  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Nate Chapin.
 
-        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
-        https://bugs.webkit.org/show_bug.cgi?id=28134
-
-        No new tests added since Access Control was already well tested and this is a pure refactor.
-
-        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
-        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
-        path.
-
-        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
-        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
-        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
-        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
-        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
-        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
-        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
-        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
-        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
-        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
-        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
-        * loader/ThreadableLoader.cpp: Ditto.
-        (WebCore::ThreadableLoader::create): Ditto.
-        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
-        * loader/ThreadableLoader.h: Ditto.
-        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
-        * loader/WorkerThreadableLoader.cpp: Ditto.
-        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
-        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
-        * loader/WorkerThreadableLoader.h: Ditto.
-        (WebCore::WorkerThreadableLoader::create): Ditto.
-        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
-        (WebCore::):
-        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
-        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
-        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
-        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
-        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
-        (WebCore::XMLHttpRequest::createRequest): Ditto.
-        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
-        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
-        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
-        * xml/XMLHttpRequest.h: Ditto.
-
-2009-08-14  Darin Adler  <darin@apple.com>
+        [V8] DOMCoreException should be visible as DOMException 
+        https://bugs.webkit.org/show_bug.cgi?id=35552
 
-        Reviewed by Sam Weinig.
+        Fix V8 code generator to use the correct visible name.
 
-        Rename the confusing isObject(<class>) to inherits(<class>).
-        It still works on non-objects, returning false.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback):
-        (WebCore::createPositionErrorCallback):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::toNodeFilter):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        (WebCore::JSXSLTProcessor::importStylesheet):
-        (WebCore::JSXSLTProcessor::transformToFragment):
-        (WebCore::JSXSLTProcessor::transformToDocument):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::callObjCFallbackObject):
-        * bridge/runtime_method.cpp:
-        (JSC::callRuntimeMethod):
-        Updated to new name, inherits, from old name, isObject.
+2010-03-02  Brady Eidson  <beidson@apple.com>
 
-2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Simon Hausmann.
+        REGRESSION(r51097) - Unable to log in to statefarm.com
+        <rdar://problem/7672667> and https://bugs.webkit.org/show_bug.cgi?id=35556
 
-        Allow Qt API to list and to remove URL schemes that were registered as
-        local URL schemes.
-        [Qt] Allow applications to register their own local URL scheme.
-        https://bugs.webkit.org/show_bug.cgi?id=28240
+        Test: fast/loader/for-window-event-onload-scripts.html
 
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
-        (WebCore::SecurityOrigin::localURLSchemes):
-        * page/SecurityOrigin.h:
+        Match Gecko's rules for executing "for/event" scripts:
+          -If there's only a 'for' attribute, execute it.
+          -If there's only an 'event' attribute, execute it.
+          -If there's a 'for=window' and 'event=onload', execute it.
+          -If there's a 'for=window' and 'event=onload()', execute it.
+          -If there's any other combination of both 'for' and 'event', don't execute it.
 
-2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+        * dom/ScriptElement.h:
 
-        Reviewed by Timothy Hatcher.
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::eventAttributeValue):
+        * html/HTMLScriptElement.h:
 
-        WebInspector: Wrap console objects late (in the frontend) so that injected
-        script was already in place.
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::eventAttributeValue):
+        * svg/SVGScriptElement.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28297
+        Add the event attribute name:
+        * html/HTMLAttributeNames.in:
 
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::InspectorFrontend):
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/InspectorFrontend.h:
 
-2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+2010-03-02  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Fix logic in RenderObject::updateFillImages() that led to incorrect client
-        counts if an image was used twice in the background-image property.
-        https://bugs.webkit.org/show_bug.cgi?id=28295
-
-        Test: fast/backgrounds/multiple-backgrounds-assert.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::updateFillImages):
-        Simplify the logic to call addClient()/removeClient() for every background
-        image, but go through the new layers first to avoid removing all the
-        clients of an image.
-
-2009-08-13  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Devirtualise marking
-        https://bugs.webkit.org/show_bug.cgi?id=28294
-
-        Make sure we override the JSObject createStructure method on those
-        objects that have custom marking routines.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-08-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Mark Rowe.
+        https://bugs.webkit.org/show_bug.cgi?id=35555
+        QuickTime plugin content can spill outside the <object> tag
 
-        Follow-up to earlier work to remove dependencies on JavaScriptCore.
-
-        * ForwardingHeaders/parser/Parser.h: Removed.
-        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
-        of Parser.h.
-
-2009-08-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
-        an assertion failure in debug builds
-        https://bugs.webkit.org/show_bug.cgi?id=28279
-
-        Test: fast/flexbox/block-axis.html
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
-        vertical.
-
-2009-08-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix crash when removing reflection on an absolutely-positioned image.
-        https://bugs.webkit.org/show_bug.cgi?id=28289
+        Set -masksToBounds on the layer that is handed to us by plug-ins, to ensure that sublayers
+        of that layer don't spill outside the <object> contents rect.
         
-        Make sure we clean up the reflection layer when removing the reflection,
-        so that the RenderLayer tree does not contain pointers to deleted layers.
+        Manual test because it relies on QuickTime, and pixel results depend on movie loading timing.
 
-        Test: fast/reflections/reflected-img-crash.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::~RenderLayer):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::removeReflection):
-        * rendering/RenderLayer.h:
-
-2009-08-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        misalignment because of float:left of <div> tag
-        https://bugs.webkit.org/show_bug.cgi?id=15869
-
-        One section of http://edgar.sec.gov site draws to the right of the rest
-        of the content
-        <rdar://problem/7135951>
-
-        Tests: fast/block/float/avoidance-percent-width-compat.html
-               fast/block/float/avoidance-percent-width-strict.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
-            avoidance logic in strict mode and in compatibility mode, which
-            matches Firefox and IE. Changed to compute and use the computed
-            width of the child, instead of ignoring non-fixed widths.
+        * manual-tests/plugins/object-clipping.html: Added.
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
 
-2009-08-13  Steve Block  <steveblock@google.com>
+2010-03-02  Adam Roben  <aroben@apple.com>
 
-        Reviewed by Darin Adler.
+        Export SecurityOrigin::registerURLSchemeAsSecure
 
-        Geolocation PositionOptions does not use correct default values.
-        https://bugs.webkit.org/show_bug.cgi?id=27254
+        Fixes <http://webkit.org/b/35580> <rdar://problem/7706407> Expose
+        SecurityOrigin::registerURLSchemeAsSecure as WebKit SPI
 
-        Sets the correct default values for the properties of the PositionOptions object
-        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+        Reviewed by Tim Hatcher.
 
-        Also adds checking to throw an exception if arguments of the incorrect type are
-        passed to Geolocation methods. Adds a layout test to test this. This test should
-        pass on all platforms where Geolocation is implemented.
+        * WebCore.base.exp: Added symbol, sorted file.
 
-        Test: fast/dom/Geolocation/argument-types.html
+2010-03-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback): Added. Creates the callback.
-        (WebCore::createPositionErrorCallback): Added. Creates the calback.
-        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
-        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
-        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
-        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
-        * page/PositionOptions.h:
-        (WebCore::PositionOptions::create): Modified. Creates object with default values.
-        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
-        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
-        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
-        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
-        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
-        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+        Reviewed by Timothy Hatcher.
 
-2009-08-13  David Levin  <levin@chromium.org>
+        Web Inspector: render breakpoints as border images instead of canvas.
 
-        Unreviewed chromium build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=35535
 
-        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+        * inspector/front-end/Images/breakpointBorder.png: Added.
+        * inspector/front-end/Images/breakpointConditionalBorder.png: Added.
+        * inspector/front-end/Images/breakpointConditionalCounterBorder.png: Added.
+        * inspector/front-end/Images/breakpointCounterBorder.png: Added.
+        * inspector/front-end/Images/programCounterBorder.png: Added.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._updateExecutionLine):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype.resize):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextChunk):
+        * inspector/front-end/textViewer.css:
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+2010-01-28  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-2009-08-13  Drew Wilson  <atwilson@google.com>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by David Levin.
+        [Qt] Special case Font::floatWidthForComplexText for single space
+        https://bugs.webkit.org/show_bug.cgi?id=33876
 
-        Merge error in SharedWorker code
-        https://bugs.webkit.org/show_bug.cgi?id=28277
+        For a single space we can go through the QFontMetric::width routine
+        instead of converting the WebCore::String to a QString and then
+        going through the QTextLine.
 
-        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
-        No new tests needed.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
 
-        * workers/DefaultSharedWorkerRepository.cpp:
-        Removed duplicated functions.
+2010-02-28  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-2009-08-13  Kyle Prete  <kylep@chromium.org>
+        Reviewed by Gustavo Noronha.
 
-        Reviewed by Dave Levin.
+        [Gtk] Support private browsing mode in plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=35500
 
-        Chromium: Show a "Playback Disabled" button on media error.
-        https://bugs.webkit.org/show_bug.cgi?id=28196
-        Use a disabled play button when the media file cannot be played.
+        Integrate the PluginViewQt.cpp changes from r55358 into Gtk+.
 
-        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+2010-03-02  Oliver Hunt  <oliver@apple.com>
 
-2009-08-13  Mark Rowe  <mrowe@apple.com>
+        Reviewed by NOBODY (Build fix).
 
-        Try and fix the Qt build.
+        Update Qt bridge to new named getter signature
 
         * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter):
+        * bridge/qt/qt_runtime.h:
 
-2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+2010-03-01  Philippe Normand  <pnormand@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        [GTK] Drag and drop support
-        https://bugs.webkit.org/show_bug.cgi?id=23642
+        [GTK] Move gstreamer-related source files to platform/graphics/gstreamer
+        https://bugs.webkit.org/show_bug.cgi?id=35518
 
-        Utilizes functions that are being called upon drag and drop actions.
-        Uses different GTK clipboards that hold different types
-        of drag data - images, HTML markup, text, URL, URL label.
-        Also clears each clipboard before setting new data to it.
-
-        No new tests - despite some implementations, no new functionality
-        is added until implementations of the GTK drag and drop protocol
-        in WebKit part.
-
-        * platform/gtk/ClipboardGtk.cpp:
-        (WebCore::ClipboardGtk::ClipboardGtk):
-        (WebCore::ClipboardGtk::~ClipboardGtk):
-        (WebCore::getCachedImage):
-        (WebCore::ClipboardGtk::declareAndWriteDragImage):
-        (WebCore::ClipboardGtk::writeURL):
-        (WebCore::ClipboardGtk::writeRange):
-        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+        Moved GStreamer-related files to platform/graphics/gstreamer so
+        other ports could benefit from this media player implementation.
 
-2009-08-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by David Levin.
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/DataSourceGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_change_state):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gstreamer/DataSourceGStreamer.h: Renamed from WebCore/platform/graphics/gtk/DataSourceGStreamer.h.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp.
+        (WebCore::greatestCommonDivisor):
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::notifyMuteIdleCallback):
+        (WebCore::bufferingTimeoutCallback):
+        (WebCore::playbackPosition):
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::doGstInit):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::changePipelineState):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::startEndPointTimerIfNeeded):
+        (WebCore::MediaPlayerPrivate::cancelSeek):
+        (WebCore::MediaPlayerPrivate::endPointTimerFired):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::volumeChangedCallback):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::queryBufferingStats):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytes):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        (WebCore::MediaPlayerPrivate::loadNextLocation):
+        (WebCore::MediaPlayerPrivate::loadStateChanged):
+        (WebCore::MediaPlayerPrivate::sizeChanged):
+        (WebCore::MediaPlayerPrivate::timeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::muteChangedCallback):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        (WebCore::MediaPlayerPrivate::loadingFailed):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::repaint):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::setAutobuffer):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Renamed from WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h.
+        (WebCore::MediaPlayerPrivate::pipelineReset):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp.
+        (webkit_video_sink_base_init):
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.h: Renamed from WebCore/platform/graphics/gtk/VideoSinkGStreamer.h.
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/WebKitWebSourceGStreamer.cpp.
+        (doInit):
+        (webkit_web_src_base_init):
+        (webkit_web_src_class_init):
+        (webkit_web_src_init):
+        (webKitWebSrcFinalize):
+        (webKitWebSrcSetProperty):
+        (webKitWebSrcGetProperty):
+        (webKitWebSrcStop):
+        (webKitWebSrcStart):
+        (webKitWebSrcChangeState):
+        (webKitWebSrcUriGetType):
+        (webKitWebSrcGetProtocols):
+        (webKitWebSrcGetUri):
+        (webKitWebSrcSetUri):
+        (webKitWebSrcUriHandlerInit):
+        (webKitWebSrcNeedDataMainCb):
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataMainCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekMainCb):
+        (webKitWebSrcSeekDataCb):
+        (webKitWebSrcSetFrame):
+        (StreamingClient::StreamingClient):
+        (StreamingClient::~StreamingClient):
+        (StreamingClient::willSendRequest):
+        (StreamingClient::didReceiveResponse):
+        (StreamingClient::didReceiveData):
+        (StreamingClient::didFinishLoading):
+        (StreamingClient::didFail):
+        (StreamingClient::wasBlocked):
+        (StreamingClient::cannotShowURL):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h: Renamed from WebCore/platform/graphics/gtk/WebKitWebSourceGStreamer.h.
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
 
-        JavaScriptCore tweaks to get ready for the parser arena
-        https://bugs.webkit.org/show_bug.cgi?id=28243
+        Reviewed by Maciej Stachowiak.
 
-        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
 
-        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
-        files as Private that are now needed to compile Mac WebKit.
+        Fix up WebCore to use the new named getter function signature, update the
+        codegenerator to the new calling convention, and fix the custom bindings.
 
-        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
         * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
         * bindings/js/JSDOMBinding.h:
         * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::childFrameGetter):
+        (WebCore::namedItemGetter):
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        (WebCore::JSDataGridColumnList::nameGetter):
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::JSHTMLCollection::nameGetter):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
         * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSImageConstructor.cpp:
-        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
         * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        * bindings/js/JSOptionConstructor.cpp:
-        * bindings/js/JSWebSocketConstructor.cpp:
-        * bindings/js/JSWebSocketCustom.cpp:
-        * bindings/js/JSWorkerConstructor.cpp:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        Updated includes.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::sourceParsed):
-        Change to not assert if this is called with no listeners.
-        I don't think this was guaranteed before, and we now use
-        this code path when recompiling. Slightly less efficient,
-        but this is a one-time cost when turning on the debugger.
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        Change to call Debugger::recompileAllJSFunctions.
-
-2009-08-13  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
-        onhashchange property cannot be set from javascript.
-
-        Test: fast/loader/onhashchange-attribute-listeners.html
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::onhashchange):
-        (WebCore::HTMLBodyElement::setOnhashchange):
-        * html/HTMLBodyElement.h:
-        * html/HTMLBodyElement.idl:
-
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::onhashchange):
-        (WebCore::HTMLFrameSetElement::setOnhashchange):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLFrameSetElement.idl:
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::onhashchange):
-        (WebCore::DOMWindow::setOnhashchange):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
-
-        * svg/SVGColor.cpp:
-        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
-        RGBColor is cleaned up by the caller.
-        * svg/SVGColor.h:
-
-2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Migrate to DOMAgent (serialized access to DOM).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28177
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::highlightDOMNode):
-        (WebCore::JSInspectorBackend::nodeForId):
-        (WebCore::JSInspectorBackend::idForNode):
-        (WebCore::JSInspectorBackend::wrapObject):
-        (WebCore::JSInspectorBackend::unwrapObject):
-        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
-        (WebCore::JSInspectorBackend::selectDatabase):
-        (WebCore::JSInspectorBackend::selectDOMStorage):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptObjectQuarantine.h:
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::isObject):
-        * bindings/js/ScriptValue.h:
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptObjectQuarantine.h:
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::isObject):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::clearMessages):
-        (WebCore::InspectorBackend::loaded):
-        (WebCore::InspectorBackend::highlight):
-        (WebCore::InspectorBackend::nodeForId):
-        (WebCore::InspectorBackend::idForNode):
-        (WebCore::InspectorBackend::wrapObject):
-        (WebCore::InspectorBackend::unwrapObject):
-        (WebCore::InspectorBackend::pushNodePathToFrontend):
-        (WebCore::InspectorBackend::addNodesToSearchResult):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::selectDOMStorage):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::focusNode):
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::clearConsoleMessages):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::scriptObjectReady):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::wrapObject):
-        (WebCore::InspectorController::unwrapObject):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::nodeForId):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        (WebCore::InspectorDOMAgent::innerParentElement):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::bind):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::clearConsoleMessages):
-        (WebCore::InspectorFrontend::updateFocusedNode):
-        (WebCore::InspectorFrontend::setDocument):
-        (WebCore::InspectorFrontend::selectDatabase):
-        (WebCore::InspectorFrontend::selectDOMStorage):
-        (WebCore::InspectorFrontend::addNodesToSearchResult):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.clearMessages):
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-        (WebInspector.ConsoleView.prototype._messagesClicked):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._format):
-        (WebInspector.ConsoleView.prototype._formatfunction):
-        (WebInspector.ConsoleView.prototype._formatdate):
-        (WebInspector.ConsoleView.prototype._formatregexp):
-        (WebInspector.ConsoleView.prototype._formatnode):
-        (WebInspector.ConsoleView.prototype._formatobject):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMNode):
-        (WebInspector.DOMNode.prototype._renumber):
-        (WebInspector.DOMDocument):
-        (WebInspector.DOMAgent):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
-        (WebInspector.DOMAgent.prototype.setAttributeAsync):
-        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
-        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
-        (WebInspector.DOMAgent.prototype.nodeForId):
-        (WebInspector.DOMAgent.prototype._setDocument):
-        (WebInspector.DOMAgent.prototype._setChildNodes):
-        (WebInspector.DOMAgent.prototype._bindNodes):
-        (WebInspector.DOMAgent.prototype._childNodeInserted):
-        (WebInspector.CSSStyleDeclaration):
-        (WebInspector.CSSStyleDeclaration.parseRule):
-        (WebInspector.setDocument):
-        (InspectorController.getStyles):
-        (InspectorController.getComputedStyle):
-        (InspectorController.getInlineStyle):
-        (InspectorController.applyStyleText):
-        (InspectorController.setStyleText):
-        (InspectorController.toggleStyleEnabled):
-        (InspectorController.applyStyleRuleText):
-        (InspectorController.addStyleSelector):
-        (InspectorController.setStyleProperty):
-        (InspectorController.getPrototypes):
-        (InspectorController.getProperties):
-        (InspectorController.setPropertyValue):
-        (InspectorController.evaluate):
-        (InspectorController.addInspectedNode):
-        (InspectorController.performSearch):
-        (InspectorController.searchCanceled):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel.prototype.searchCanceled):
-        (WebInspector.ElementsPanel.prototype.performSearch):
-        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
-        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
-        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
-        (WebInspector.ElementsTreeElement.prototype.updateChildren):
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleRuleText):
-        (InjectedScript.addStyleSelector):
-        (InjectedScript._doesSelectorAffectNode):
-        (InjectedScript._serializeRule):
-        (InjectedScript._serializeStyle):
-        (InjectedScript.getProperties):
-        (InjectedScript.evaluate):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript.performSearch.addNodesToResults):
-        (InjectedScript.performSearch.matchExactItems):
-        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
-        (InjectedScript.performSearch.matchExactId):
-        (InjectedScript.performSearch):
-        (InjectedScript.performSearch.matchExactTagNames):
-        (InjectedScript.performSearch.matchExactAttributeNames):
-        (InjectedScript.performSearch.matchPartialTagNames):
-        (InjectedScript.performSearch.matchStartOfTagNames):
-        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
-        (InjectedScript.performSearch.matchPartialAttributeValues):
-        (InjectedScript.performSearch.matchStyleSelector):
-        (InjectedScript.performSearch.matchPlainText):
-        (InjectedScript.performSearch.matchXPathQuery):
-        (InjectedScript.performSearch.finishedSearching):
-        (InjectedScript.performSearch.processChunk):
-        (InjectedScript.searchCanceled):
-        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-        (InjectedScript._resolveObject):
-        (InjectedScript._nodeForId):
-        (InjectedScript._objectForId):
-        (InjectedScript._createProxyObject):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectProxy):
-        (WebInspector.ObjectPropertyProxy):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update.callback):
-        (WebInspector.StylesSidebarPane.prototype.update):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.js:
-        (WebInspector._updateHoverHighlight):
-        (WebInspector.loaded):
-        (WebInspector.clearConsoleMessages):
-        (WebInspector.selectDatabase):
-        (WebInspector.selectDOMStorage):
-        (WebInspector.updateFocusedNode):
-        (WebInspector.addNodesToSearchResult):
-        * inspector/front-end/utilities.js:
-        (Object.proxyType):
-        * storage/Storage.h:
-        (WebCore::Storage::frame):
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
-        newly-allocated RGBColor is cleaned up by the caller.
-        * css/CSSPrimitiveValue.h:
-
-2009-08-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        wrong font size when css font-family includes monospace
-        https://bugs.webkit.org/show_bug.cgi?id=19161
-
-        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
-        WebKit has historically used fixed-width default size any time a
-        font-family includes monospace in the fallback list.
-
-        This patch corrects WebKit's behavior to match Firefox.
-        I also had to fix a bug in WebKit's font-family fallback behavior where
-        child elements would inherit parts of their parents fallback lists.
-
-        This patch is mostly just replacing all cases where we used to check for:
-        fontDescription.genericFontFamily() == MonospaceFamily
-        with:
-        fontDescription.useFixedDefaultSize()
-
-        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
-               fast/css/getComputedStyle/font-family-fallback-reset.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-           Deploy useFixedDefaultSize().  Also fix the bug where child
-           FontDescriptions would carry part of the parent font-family fallback list.
-        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
-           It's no longer alright to just check genericFontFamily(),
-           we have to check to make sure the changed style has a matching useFixedDefaultSize().
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::useFixedDefaultSize):
-           Only use the fixed default size if we have one font family and it is "monospace".
-           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
-
-2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        [v8] Fix atomic string externalization crash.
-        Atomic string externalization assumes that all non-empty strings
-        can be externalized which is untrue on 64-bit.  This change fixed
-        that.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28215
-
-        This bug causes loads of test crashes, no need to add new tests
-        specifically for this.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
-
-2009-08-13  George Staikos  <george.staikos@torchmobile.com>
-
-        Rubberstamped by Darin Adler.
-
-        Use ASSERT_UNUSED instead of UNUSED_PARAM
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::deregisterTask):
-
-2009-08-13  Steve Block  <steveblock@google.com>
-
-        Reviewed by Darin Adler.
-
-        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
-        https://bugs.webkit.org/show_bug.cgi?id=28262
-
-        No new tests possible.
-
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
-
-2009-08-13  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [CAIRO] getImageData fails on a given rect bigger than the image rect
-
-        The destination image and the source image was mixed up on creating the
-        imageData.
-
-        This is just a clean up and doesn't affect the current behavior. It's not
-        possible to test this failure in a LayoutTest. Only canvas uses getImageData
-        at the moment and returns before calling getImageData, if the image rect does
-        not contain the requested rect.
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::getImageData):
-
-2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectPropertyGetter):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
+        (JSC::Bindings::RuntimeObject::fieldGetter):
+        (JSC::Bindings::RuntimeObject::methodGetter):
+        * bridge/runtime_object.h:
 
-        Reviewed by Eric Seidel.
+2010-03-01  Oliver Hunt  <oliver@apple.com>
 
-        [Haiku] Adding RenderTheme to WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28258
-
-        * platform/haiku/RenderThemeHaiku.cpp: Added.
-        (WebCore::RenderThemeHaiku::create):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
-        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
-        (WebCore::supportsFocus):
-        (WebCore::RenderThemeHaiku::supportsFocusRing):
-        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeHaiku::systemFont):
-        (WebCore::RenderThemeHaiku::paintCheckbox):
-        (WebCore::RenderThemeHaiku::setCheckboxSize):
-        (WebCore::RenderThemeHaiku::paintRadio):
-        (WebCore::RenderThemeHaiku::setRadioSize):
-        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
-        (WebCore::RenderThemeHaiku::paintMenuList):
-        * platform/haiku/RenderThemeHaiku.h: Added.
-        (WebCore::RenderThemeHaiku::supportsHover):
-
-2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Eric Seidel.
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
 
-        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28256
+        Update bindings generation and the few manual indexing getters we have to use
+        the new PropertySlot API.
 
-        * platform/haiku/ContextMenuHaiku.cpp:
-        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
-        (WebCore::ContextMenu::ContextMenu):
-        (WebCore::ContextMenu::appendItem):
-        (WebCore::ContextMenu::insertItem):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::indexGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::indexGetter):
+        * bridge/runtime_array.h:
 
-2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-03-01  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Darin Adler.
 
-        Inspector: Show Hidden Cookie Data
-        https://bugs.webkit.org/show_bug.cgi?id=28185
-
-          Added new file Cookie.h to the WebCore XCode
+        AX: changes to WAI-ARIA grid aren't perceived correctly by VoiceOver
+        https://bugs.webkit.org/show_bug.cgi?id=35514
 
-        * WebCore.xcodeproj/project.pbxproj:
-
-          InspectorController.cookies() binding
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        * inspector/InspectorBackend.idl:
-
-          Struct for static Cookie information
-          (name, value, path, domain, expires, httpOnly, secure, session)
-
-        * platform/Cookie.h: Added.
-        (WebCore::Cookie::Cookie):
-        
-          Getter for the a list of raw Cookies
-          getRawCookies(., ., out Vector<Cookie>)
-        
-        * platform/CookieJar.h:
-
-          Implementation of getRawCookies for the mac platform.
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
+        When a table's DOM is changed and an AX Table is not asked first for its children,
+        it would return wrong information. A table needs to make sure children are up to date in
+        all methods that can be called from the outside.
 
-          Stub other CookieJar implementations to satisfy the interface.
+        Test: platform/mac/accessibility/stale-table-rows.html
 
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-
-2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Add a new gesture in Web Inspector to remove breakpoints
-        https://bugs.webkit.org/show_bug.cgi?id=19131
-        
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._documentMouseDown):
-
-2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Symbian target components (library and executable files)
-        require Unique Identifiers (i.e., UID3).
-        These identifiers are defined in the respective project
-        file, conditionally for "symbian" platform.
-
-        * WebCore.pro:
-
-2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        wrong calculation of overflow size for flexbox and table
-        https://bugs.webkit.org/show_bug.cgi?id=28064
-
-        RenderFlexibleBox and RenderTable were using the width of overflow
-        to update height of overflow, so height became wrong value and
-        width was not updated. As the corresponding code of RenderBlock
-        was sane, I factored it out and used from RenderFlexibleBox and
-        RenderTable.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
-        (WebCore::RenderBlock::layoutBlock):
-        * rendering/RenderBlock.h:
-        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
-
-        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
-        Windows build in a non-obvious manner.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.idl:
-        * platform/Cookie.h: Removed.
-        * platform/CookieJar.h:
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::setCookies):
-        (WebCore::cookies):
-        * platform/mac/CookieJar.mm:
-        * platform/network/chromium/CookieJarChromium.cpp:
-        * platform/network/curl/CookieJarCurl.cpp:
-        * platform/network/soup/CookieJarSoup.cpp:
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        * platform/network/win/CookieJarWin.cpp:
-        * platform/qt/CookieJarQt.cpp:
-
-2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Not reviewed: build fix (for r47192), adding new file from
-        https://bugs.webkit.org/show_bug.cgi?id=28174
-
-        * inspector/front-end/StatusBarButton.js: Added.
-
-2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::clearChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::clearChildren):
+        (WebCore::AccessibilityRenderObject::updateChildrenIfNecessary):
+        (WebCore::AccessibilityRenderObject::children):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::needsToUpdateChildren):
+        (WebCore::AccessibilityRenderObject::setNeedsToUpdateChildren):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::clearChildren):
+        (WebCore::AccessibilityTable::columns):
+        (WebCore::AccessibilityTable::rows):
+        (WebCore::AccessibilityTable::rowHeaders):
+        (WebCore::AccessibilityTable::columnHeaders):
+        (WebCore::AccessibilityTable::cells):
+        (WebCore::AccessibilityTable::columnCount):
+        (WebCore::AccessibilityTable::rowCount):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
 
-        Reviewed by Timothy Hatcher.
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Introduced StatusBarButton class that encapsulates glyphs support.
-        Views updated accordingly.
+        Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28174
+        Convert the zoom mode (page vs. text-only) into a proper enum.
+        https://bugs.webkit.org/show_bug.cgi?id=35347
 
+        * GNUmakefile.am:
+        * WebCore.base.exp: Substituted symbols __ZN7WebCore5Frame13setZoomFactorEfNS_8ZoomModeE
+        and __ZN7WebCore8Settings11setZoomModeENS_8ZoomModeE for __ZN7WebCore5Frame13setZoomFactorEfb
+        and __ZN7WebCore8Settings16setZoomsTextOnlyEb, respectively.
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
-        (WebInspector.CookieItemsView.prototype.hide):
-        (WebInspector.CookieItemsView.prototype.update):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView):
-        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
-        (WebInspector.DOMStorageItemsView.prototype.hide):
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.get statusBarItems):
-        (WebInspector.ElementsPanel.prototype.hide):
-        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
-        * inspector/front-end/Panel.js:
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype.get statusBarItems):
-        (WebInspector.ProfileView.prototype._updatePercentButton):
-        (WebInspector.ProfileView.prototype._focusClicked):
-        (WebInspector.ProfileView.prototype._excludeClicked):
-        (WebInspector.ProfileView.prototype._resetClicked):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
-        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
-        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
-        * inspector/front-end/StatusBarButton.js: Added.
-        (WebInspector.StatusBarButton):
-        (WebInspector.StatusBarButton.prototype._clicked):
-        (WebInspector.StatusBarButton.prototype.get disabled):
-        (WebInspector.StatusBarButton.prototype.set disabled):
-        (WebInspector.StatusBarButton.prototype.get title):
-        (WebInspector.StatusBarButton.prototype.set title):
-        (WebInspector.StatusBarButton.prototype.get toggled):
-        (WebInspector.StatusBarButton.prototype.set toggled):
-        (WebInspector.StatusBarButton.prototype.get visible):
-        (WebInspector.StatusBarButton.prototype.set visible):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
-        * inspector/front-end/inspector.html:
-
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Add shadow support in GraphicsContext::fillRect().
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
-        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed build fix for Chromium Linux.
-
-        Rollback r47157 as this broke debug tests of Chromium Linux.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed build fix for chromium.
-
-        The chromium build broke due to r47185 which added
-        a cookies array to inspector/InspectorBackend.idl.
-
-        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
-         for the cookies callback.
-
-2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Show Hidden Cookie Data
-        https://bugs.webkit.org/show_bug.cgi?id=28185
-
-          Added new file Cookie.h to the WebCore XCode
-
         * WebCore.xcodeproj/project.pbxproj:
+        * page/Frame.cpp:
+        (WebCore::Frame::zoomMode):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        * page/Frame.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setZoomMode):
+        * page/Settings.h:
+        (WebCore::Settings::zoomMode):
+        * page/ZoomMode.h: Added.
+        (WebCore::):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::setCurrentScale):
 
-          InspectorController.cookies() binding
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        * inspector/InspectorBackend.idl:
-
-          Struct for static Cookie information
-          (name, value, path, domain, expires, httpOnly, secure, session)
-
-        * platform/Cookie.h: Added.
-        (WebCore::Cookie::Cookie):
-        
-          Getter for the a list of raw Cookies
-          getRawCookies(., ., out Vector<Cookie>)
-        
-        * platform/CookieJar.h:
-
-          Implementation of getRawCookies for the mac platform.
+2010-03-01  Alex Milowski  <alex@milowski.com>
 
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
+        Reviewed by Kenneth Rohde Christiansen.
 
-          Stub other CookieJar implementations to satisfy the interface.
+        Added support for the msubsup element that also handles the msup and msub elements.
 
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
+        Test: mathml/presentation/subsup.xhtml
 
-2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLSubSup.cpp: Added.
+        (WebCore::RenderMathMLSubSup::RenderMathMLSubSup):
+        (WebCore::RenderMathMLSubSup::addChild):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::nonOperatorHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+        (WebCore::RenderMathMLSubSup::baselinePosition):
+        * mathml/RenderMathMLSubSup.h: Added.
+        (WebCore::RenderMathMLSubSup::hasBase):
+        (WebCore::RenderMathMLSubSup::):
+
+2010-03-01  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Cookies in Storage Panel
-        https://bugs.webkit.org/show_bug.cgi?id=27202
+        Web Inspector: use dejavu sans mono 11px on linux.
 
-          Data Structure for a Cookie. Just Key/Value for Now:
+        https://bugs.webkit.org/show_bug.cgi?id=35527
 
-        * inspector/front-end/Cookie.js: Added.
-        (WebInspector.Cookie):
-        (WebInspector.Cookie.prototype.get key):
-        (WebInspector.Cookie.prototype.set key):
-        (WebInspector.Cookie.prototype.get value):
-        (WebInspector.Cookie.prototype.set value):
-
-          A Storage View for Cookies.  Allows for Refresh/Delete:
-
-        * inspector/front-end/CookieItemsView.js: Added.
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
-        (WebInspector.CookieItemsView.prototype.show):
-        (WebInspector.CookieItemsView.prototype.hide):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
-        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
-        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
-
-          Include a SidebarSection Section in the Databases Panel:
-
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel):
-        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
-        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
-        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
-        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
-        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
-        (WebInspector.CookieSidebarTreeElement):
-        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
-        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
-        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
-        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
-
-          New "Cookies" Image for the Sidebar:
-
-        * inspector/front-end/Images/cookie.png: Added.
         * inspector/front-end/inspector.css:
 
-          Include the Added Files where appropriate:
-
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-08-12  George Wright  <george.wright@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28246
-
-        * WebCore.pro:
-
-2009-08-12  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Adam Treat.
+2010-03-01  Thatcher Ulrich  <tulrich@google.com>
 
-        Mark unused variables to avoid compile failures in -Werror.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::deregisterTask):
-
-2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Niko Zimmermann.
-
-        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
-        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
-        Minor fixes by Eric Seidel and George Staikos.
-        https://bugs.webkit.org/show_bug.cgi?id=23727
-
-        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
-
-        * WebCore.pro:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-        * css/WCSSPropertyNames.in: Added.
-        * css/WCSSValueKeywords.in: Added.
-        * rendering/RenderMarquee.cpp:
-        (WebCore::RenderMarquee::start):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::createObject):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-12  George Wright  <george.wright@torchmobile.com>
-
-        Reviewed by David Hyatt.
-
-        Update the canvas renderer's intrinsic size with the zoomed
-        lengths and ensure the intrinsic size is correct when setting
-        an initial style.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26908
-
-        Test: fast/canvas/canvas-zoom.html
-
-        * rendering/RenderHTMLCanvas.cpp:
-        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::styleDidChange):
-
-2009-08-12  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Simon Fraser.
-
-        Fix regression for dragging the media controller thumb.
-        https://bugs.webkit.org/show_bug.cgi?id=28211
-
-        Modified the conditions for rejecting events on the media controller
-        to only rejecting mouse events not from the left button.
-
-        Test: media/controls-drag-timebar.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-
-2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Eric Seidel.
+        Fix chromium iframe shims.  Add another test case to the
+        iframes-shims test.  After r53637, the plugin widget doesn't get
+        moved every paint.  This used to hide the bug that if an iframe
+        gets added, the plugin's cutout rectangles don't get updated until
+        a layout happens.
+        https://bugs.webkit.org/show_bug.cgi?id=35184
 
-        Fixing a deadlock caused by two transactions that run on two
-        different database handles for the same DB. Adding a per-DB thread
-        transaction coordinator that allows the DB thread to run only one
-        transaction per DB file at any given time.
+        * platform/Widget.h:
+        (WebCore::Widget::widgetPositionsUpdated): new virtual method
+            widgetPositionsUpdated() to notify widgets when other widgets on
+            the page have been repositioned.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateWidgetPositions): call widgetPositionsUpdated() on the widgets
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::widgetPositionsUpdated): call widgetPositionsUpdated() on the widget
+        * rendering/RenderWidget.h:
 
-        Adding a regression test for this bug.
+2010-03-01  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        Test: storage/multiple-transactions-on-different-handles.html
+        Reviewed by Holger Freyther.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27966
+        Dist some mathml related files
 
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionCoordinator):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionCoordinator):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::SQLTransaction):
-        (WebCore::SQLTransaction::debugStepName):
-        (WebCore::SQLTransaction::performNextStep):
-        (WebCore::SQLTransaction::aquireLock):
-        (WebCore::SQLTransaction::lockAquired):
-        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
-        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCoordinator.cpp: Added.
-        * storage/SQLTransactionCoordinator.h: Added.
-
-2009-08-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
-        https://bugs.webkit.org/show_bug.cgi?id=28194
-
-        * GNUmakefile.am: Added the two new source files.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-        * bindings/js/JSCSSRuleListCustom.cpp: Added.
-        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
-        on rules in the list.
-
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
-        markDOMObjectWrapper on the CSSValue objects that are owned by the
-        declaration as values of the properties.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM): Added code to handle some
-        cases where nodes are observable because they own objects that
-        in turn have custom properties.
-
-        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
-
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
-        for implementation and styleSheets.
-
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
-        for attributes and style.
-
-        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
-        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
-        on the rendering context.
-
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
-        items in the stylesheet.
-
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        (WebCore::JSStyleSheetList::markChildren): Added. Calls
-        markDOMObjectWrapper on stylesheets in the list.
-
-        * css/CSSRuleList.idl: Added CustomMarkFunction.
-        * css/CSSStyleDeclaration.idl: Ditto.
-        * css/StyleSheetList.idl: Ditto.
-        * dom/Element.idl: Ditto.
-        * html/HTMLCanvasElement.idl: Ditto.
-
-        * dom/Element.h: Made everything private that could be.
-        Added access to the attributeMap that does returns
-        the existing map without doing any of the lazy-updating work. This
-        is needed to get at the existing attributes during garbage collection
-        without having side effects.
-
-        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
-        members private. Added renderingContext2D function for use in
-        JSHTMLCanvasElement::markChildren.
-
-2009-08-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
-        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
-        https://bugs.webkit.org/show_bug.cgi?id=28023
-        https://bugs.webkit.org/show_bug.cgi?id=24794
-        
-        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
-        scroll, and use that for pan scrolling.
-
-        Test: platform/win/fast/events/panScroll-nested-divs.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseDraggedEvent):
-        (WebCore::EventHandler::updateAutoscrollRenderer):
-        (WebCore::EventHandler::handleMousePressEvent):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
-        * rendering/RenderBox.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollByRecursively):
-
-2009-08-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
-        list detaches drop down.
 
-        Added a function for Windows PopupMenu's to return their class name.
+2010-03-01  Kenneth Russell  <kbr@google.com>
 
-         * platform/PopupMenu.h:
-         * platform/win/PopupMenuWin.cpp:
-         (WebCore::PopupMenu::popupClassName):
-
-2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        WINCE PORT: Color and Gradient
-        https://bugs.webkit.org/show_bug.cgi?id=27511
-
-        * platform/graphics/wince/ColorWince.cpp: Added.
-        * platform/graphics/wince/GradientWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28172
-
-        No new tests because it's a just typo fix.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27458
-        Support for the :default CSS pseudoclass, as per HTML5 spec.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
-
-        Tests: fast/css/pseudo-default-001.html
-               fast/css/pseudo-default-002.html
-               fast/css/pseudo-default-003.html
-               fast/css/pseudo-default-004.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
-        aware that only one default button can be present in a form
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
-        the :default CSS pseudoclass
-        * dom/Element.h:
-        (WebCore::Element::isDefaultButtonForForm): new method to determine
-        whether a FormControl is a default button for a given form
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::defaultButton): extracts the default button
-        from the form
-        * html/HTMLFormElement.h:
-
-2009-08-12  David Levin  <levin@chromium.org>
+        Reviewed by Oliver Hunt.
 
-        No review, rolling out r47106.
-        https://bugs.webkit.org/show_bug.cgi?id=28215
+        Integer overflow in WebGL arrays
+        https://bugs.webkit.org/show_bug.cgi?id=35241
 
-        This patch relied on a new version of v8 which is not available
-        in chromium yet.
+        Test: fast/canvas/webgl/webgl-array-invalid-ranges.html
 
+        * bindings/js/JSWebGLArrayBufferConstructor.cpp:
+        (WebCore::constructCanvasArrayBuffer):
+        * bindings/js/JSWebGLArrayBufferConstructor.h:
+        (WebCore::construct):
+        * bindings/js/JSWebGLArrayHelper.h:
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayConstructor.cpp:
+        (WebCore::constructCanvasByteArray):
+        * bindings/js/JSWebGLFloatArrayConstructor.cpp:
+        (WebCore::constructCanvasFloatArray):
+        * bindings/js/JSWebGLIntArrayConstructor.cpp:
+        (WebCore::constructCanvasIntArray):
+        * bindings/js/JSWebGLShortArrayConstructor.cpp:
+        (WebCore::constructCanvasShortArray):
+        * bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedByteArray):
+        * bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedIntArray):
+        * bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedShortArray):
         * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
-
-2009-08-12  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
+        (WebCore::toUInt32):
+        * bindings/v8/V8Binding.h:
+        (WebCore::toUInt32):
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::V8WebGLArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::V8WebGLByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::V8WebGLFloatArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::V8WebGLIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::V8WebGLShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedShortArray::constructorCallback):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::verifySubRange):
+        (WebCore::WebGLArray::clampOffsetAndNumElements):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::tryAllocate):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::WebGLByteArray):
+        (WebCore::WebGLByteArray::slice):
+        * html/canvas/WebGLByteArray.h:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::slice):
+        * html/canvas/WebGLFloatArray.h:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::slice):
+        * html/canvas/WebGLIntArray.h:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::slice):
+        * html/canvas/WebGLShortArray.h:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        * html/canvas/WebGLUnsignedShortArray.h:
+
+2010-03-01  Brady Eidson  <beidson@apple.com>
 
-        Bug 26993 : Geolocation::requestPermission()
-        https://bugs.webkit.org/show_bug.cgi?id=26993
+        Reviewed by Sam Weinig.
 
-        Second patch to allow the Geolocation permission request to chrome to be asynchronous
-        or synchronous. Fixes a bug where callbacks were called twice when permissions
-        are granted synchronously.
+        REGRESSION: Telling a WebView to go to its current WebHistoryItem is broken.
+        <rdar://problem/7699371> and https://bugs.webkit.org/show_bug.cgi?id=35532
 
-        No new tests required.
+        Test: fast/loader/api-test-go-to-current-back-forward-item.html
 
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
-        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
-        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
-        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): If the current item is the same as the target item, don't
+          consider this to be a same document navigation.
 
-2009-08-12  Anders Carlsson  <andersca@apple.com>
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Hard code the "going to the same item as the current item" relationship
+          as a precondition for stopping all loaders, as that will be a new document load.
 
-        Reviewed by Sam Weinig.
+2010-03-01  Robert Hogan  <robert@webkit.org>
 
-        <rdar://problem/6952336>
-        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
+        Reviewed by nobody, build fix.
 
-        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
-        
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
+        Fix --minimal build. Add ENABLE(DATABASE) as compile time condition
+        for building file GeolocationPositionCache.cpp.
 
-2009-08-12  Xiaomei Ji  <xji@chromium.org>
+        * page/GeolocationPositionCache.cpp:
 
-        Reviewed by Eric Seidel.
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Fix [Chromium] drop down menu letter selection, skip selections
-        https://bugs.webkit.org/show_bug.cgi?id=28205
+        Reviewed by Dirk Schulze.
 
-        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
-        event to the popup, which is not possible (eventSender sends the key
-        events through webview, we want to go through the webwidget).
+        [OpenVG] Implement support for paths
+        https://bugs.webkit.org/show_bug.cgi?id=34366
 
-        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::isCharacterTypeEvent): style change.
-        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
-        a character type event to avoid calling twice for English.
-        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+        Adds an implementation of the Path class -
+        *almost* complete, but not quite because OpenVG
+        does not provide access to the points in a VGPath
+        unless one keeps track of all the points by
+        themselves, which we decided not to do.
 
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+        Also hooked up to PainterOpenVG and GraphicsContext.
 
-        Reviewed by Eric Seidel.
+        Further introduced is SharedResourceOpenVG, which is
+        intended as base class for paths and other OpenVG
+        resources (images, fonts) that WebKit creates as
+        long-lived objects. We are at a slight disadvantage
+        here as WebKit doesn't have the concept of resources
+        belonging to a specific (hardware graphics) context,
+        which is the reason why EGLDisplayOpenVG had to
+        provide a current display singleton; this class is
+        what actually requires that functionality.
 
-        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
-        https://bugs.webkit.org/show_bug.cgi?id=28130
+        Path::addArcTo() uses code by Yong Li <yoli@rim.com>.
 
-        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::savePlatformState):
-        (WebCore::GraphicsContext::restorePlatformState):
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
+        * platform/graphics/Path.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
         (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
         (WebCore::GraphicsContext::beginPath):
         (WebCore::GraphicsContext::addPath):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::translate):
-        (WebCore::GraphicsContext::origin):
-        (WebCore::GraphicsContext::rotate):
-        (WebCore::GraphicsContext::scale):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::setPlatformShouldAntialias):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setPlatformFont):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::getHaikuStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
-        (WebCore::GraphicsContext::setPlatformFillColor):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::setPlatformShadow):
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
-        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
-        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
-        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
-        * platform/graphics/GraphicsContext.cpp: 
-        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
-        class for Haiku. Adding getHaikuStrokeStyle() function.
-        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
-        this class isn't implemented for the moment.
-        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
-        for Haiku.
-        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
-        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
-        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
-        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
-        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
-        native pattern type.
-        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding modification to the WebCore/platform/ files to allow
-        the Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
-        class of Haiku.
-        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
-        * platform/DragData.h: Use a BMessage as DragDataRef.
-        * platform/DragImage.h: Use a BBitmap as DragImageRef.
-        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
-        * platform/PlatformMenuDescription.h: BMenu is the 
-        PlatformMenuDescription class of Haiku.
-        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
-        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
-        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
-        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
-        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
-        so many PLATFORM(HAIKU) were added to these functions.
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
-        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
-        invertSenseOfTabsToLinks() function.
-        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
-        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
-        behaves like Cairo or Wx, (not like Skia).
-        (WebCore::RGBA32Buffer::getAddr):
-        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
-        methods specific to Haiku.
-        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
-        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
-        (WebCore::currentSearchLocaleID): Missing function.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding the ScrollbarTheme files.
-        https://bugs.webkit.org/show_bug.cgi?id=28125
-
-        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
-        (buttonWidth):
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
-        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
-        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
-        (WebCore::ScrollbarThemeHaiku::hasButtons):
-        (WebCore::ScrollbarThemeHaiku::hasThumb):
-        (WebCore::ScrollbarThemeHaiku::backButtonRect):
-        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
-        (WebCore::ScrollbarThemeHaiku::trackRect):
-        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
-        (WebCore::ScrollbarThemeHaiku::paintButton):
-        (WebCore::ScrollbarThemeHaiku::paintThumb):
-        * platform/haiku/ScrollbarThemeHaiku.h: Added.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
-        https://bugs.webkit.org/show_bug.cgi?id=28122
-
-        * platform/graphics/haiku/ColorHaiku.cpp: Added.
-        (WebCore::Color::Color):
-        (WebCore::Color::operator rgb_color):
-        (WebCore::focusRingColor):
-        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
-        (WebCore::FloatPoint::FloatPoint):
-        (WebCore::FloatPoint::operator BPoint):
-        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
-        (WebCore::FloatRect::FloatRect):
-        (WebCore::FloatRect::operator BRect):
-        * platform/graphics/haiku/GradientHaiku.cpp: Added.
-        (WebCore::Gradient::platformDestroy):
-        (WebCore::Gradient::platformGradient):
-        (WebCore::Gradient::fill):
-        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
-        (WebCore::IntPoint::IntPoint):
-        (WebCore::IntPoint::operator BPoint):
-        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
-        (WebCore::IntRect::IntRect):
-        (WebCore::IntRect::operator BRect):
-        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
-        (WebCore::IntSize::IntSize):
-        (WebCore::IntSize::operator BSize):
-        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::PainterOpenVG):
+        (WebCore::PainterOpenVG::~PainterOpenVG):
+        (WebCore::PainterOpenVG::transformPath):
+        (WebCore::PainterOpenVG::beginPath):
+        (WebCore::PainterOpenVG::addPath):
+        (WebCore::PainterOpenVG::currentPath):
+        (WebCore::PainterOpenVG::drawPath):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/PathOpenVG.cpp: Added.
+        (WebCore::PlatformPathOpenVG::PlatformPathOpenVG):
+        (WebCore::PlatformPathOpenVG::operator=):
+        (WebCore::PlatformPathOpenVG::~PlatformPathOpenVG):
+        (WebCore::PlatformPathOpenVG::clear):
+        (WebCore::PlatformPathOpenVG::createPath):
         (WebCore::Path::Path):
         (WebCore::Path::~Path):
         (WebCore::Path::operator=):
-        (WebCore::Path::hasCurrentPoint):
         (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
         (WebCore::Path::translate):
         (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
         (WebCore::Path::moveTo):
         (WebCore::Path::addLineTo):
         (WebCore::Path::addQuadCurveTo):
@@ -34895,10373 +14531,6897 @@ form controls that have different validity states.
         (WebCore::Path::addEllipse):
         (WebCore::Path::clear):
         (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
         (WebCore::Path::debugString):
         (WebCore::Path::apply):
         (WebCore::Path::transform):
-        (WebCore::Path::strokeBoundingRect):
-
-2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCE PORT: Implement Keygen for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/KeygenWince.cpp: Added.
-
-2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
-
-        Rubber-stamped by Kevin Ollivier.
-
-        Handle crash in wx due to null value passed to strlen in
-        the CString constructor.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificatePath):  Check for null return from getenv
-        and use default CString constructor instead.
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/openvg/PlatformPathOpenVG.h: Added.
+        (WebCore::PlatformPathOpenVG::vgPath):
+        * platform/graphics/openvg/SharedResourceOpenVG.cpp: Added.
+        (WebCore::SharedResourceOpenVG::makeSharedContextCurrent):
+        (WebCore::SharedResourceOpenVG::makeCompatibleContextCurrent):
+        * platform/graphics/openvg/SharedResourceOpenVG.h: Added.
 
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        WINCE PORT: simple stubs to make it build for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/DragDataWince.cpp: Added.
-        * platform/wince/DragImageWince.cpp: Added.
-        * platform/wince/EditorWince.cpp: Added.
-        * platform/wince/KURLWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCEPORT: FileSystem and FileChooser
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/FileChooserWince.cpp: Added.
-        * platform/wince/FileSystemWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
+2010-03-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
-        WinMob devices. We pass the cursor info to application, which so that 
-        can determine what to do.
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        Not reviewed, bring English.lproj/locallizedStrings.js back to binary (UTF) mode.
 
-        * platform/wince/CursorWince.cpp: Added.
+        * English.lproj/localizedStrings.js:
 
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Reviewed by George Staikos.
+        Reviewed by Nikolas Zimmermann.
 
-        WINCE PORT: MIMETypeRegistry
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        [OpenVG] Convert from TransformationMatrix to AffineTransform.
+        https://bugs.webkit.org/show_bug.cgi?id=35445
 
-        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+        Dirk Schulze previously introduced AffineTransform as
+        replacement for most TransformationMatrix occurrences
+        in GraphicsContext & Co., but did not update the OpenVG
+        graphics backend as there's no publicly available way
+        to build it. This commit now takes care of that.
 
-2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::isNonRotatedAffineTransformation):
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::applyTransformation):
+        (WebCore::PainterOpenVG::transformation):
+        (WebCore::PainterOpenVG::concatTransformation):
+        (WebCore::PainterOpenVG::setTransformation):
+        (WebCore::PainterOpenVG::scale):
+        (WebCore::PainterOpenVG::rotate):
+        (WebCore::PainterOpenVG::translate):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/VGUtils.cpp:
+        (WebCore::VGMatrix::VGMatrix):
+        (WebCore::VGMatrix::operator AffineTransform):
+        (WebCore::VGMatrix::operator TransformationMatrix):
+        (WebCore::AffineTransform::operator VGMatrix):
+        * platform/graphics/openvg/VGUtils.h:
+        * platform/graphics/transforms/AffineTransform.h:
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by George Staikos.
+        Reviewed by Simon Hausmann.
 
-        WINCE PORT: Pasteboard and SearchPopupMenu
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        [Qt] Fix segfault when drawing NPAPI plugins on Mac
 
-        * platform/wince/PasteboardWince.cpp: Added.
-        * platform/wince/SearchPopupMenuWince.cpp: Added.
+        Don't try to get a contexctRef for a null-pixmap. If the pixmap
+        size is 0,0 the private pixmap data has not yet been initialized.
 
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
+        * plugins/mac/PluginViewMac.cpp:
 
-        Reviewed by George Staikos.
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        Reviewed by Simon Hausmann.
 
-        * platform/wince/SharedTimerWince.cpp: Added.
-        * platform/wince/SystemTimeWince.cpp: Added.
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
 
-2009-08-12  Mark Mentovai  <mark@chromium.org>
+        Use the proper event/drawing-model guards instead of global 64-bit
+        guard for the NPAPI plugin implementation (view and package).
 
-        Reviewed by Darin Adler.
+        * plugins/mac/PluginPackageMac.cpp: Change guards and fix warning
+        * plugins/mac/PluginViewMac.cpp: Remove 64-bit guard
 
-        https://bugs.webkit.org/show_bug.cgi?id=28204
-        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
+2010-02-27  Pavel Feldman  <pfeldman@chromium.org>
 
-        * WebCorePrefix.h:
-        Only undefine |try| and |catch| when building Objective-C[++],
-        leaving the C+library definitions intact for C++.
+        Reviewed by Timothy Hatcher.
 
-2009-08-12  Nate Chapin  <japhet@chromium.org>
+        Web Inspector: disable breakpoint upon Shift-click.
 
-        Reviewed by Adam Barth.
+        https://bugs.webkit.org/show_bug.cgi?id=35477
 
-        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27719
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        * inspector/front-end/textViewer.css:
 
-        Tests: fast/events/set-event-in-another-frame.html
-               fast/events/set-event-to-null.html
+2010-02-28  Alexey Proskuryakov  <ap@apple.com>
 
-        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
-            as it currently doesn't support a custom getter 
-            and a v8-specific custom setter simultaneously.
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * page/DOMWindow.idl:
+        Reviewed by Dan Bernstein.
 
-2009-08-12  Peter Kasting  <pkasting@google.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35496
+        <rdar://problem/7663444> Opening newsweek.com and youtube.com has become very slow in debug builds
 
-        Reviewed by Adam Treat.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        Removed consistency checks, as they affect performance too much in this case.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
-        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+2010-02-28  Robert Hogan  <robert@roberthogan.net>
 
-        * WebCore.gypi:
-        * WebCoreSources.bkl:
-        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
-        * webcore-wx.bkl:
+        Reviewed by Simon Hausmann.
 
-2009-08-12  Peter Kasting  <pkasting@google.com>
+        [Qt] Support private browsing mode in plugins
 
-        Reviewed by Dave Levin.
+        Add support for NPNVprivateModeBool property in plugins.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27933
-        Build fix after r47099.
+        See also: https://developer.mozilla.org/En/Supporting_private_browsing_in_plugins
 
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::putImageData):
+        The NPNVprivateModeBool property is supported as scriptable property privateBrowsingEnabled
+        in the test WebKit plugin. The Mac platform also supports a cachedPrivateBrowsingEnabled
+        property implemented in the test plugin. This allows the Layout test
+        plugins/private-browsing-mode.html to retrieve the previous value of NPNVprivateModeBool
+        in the test plugin. Due to the platform-specific overhead required to support this bespoke
+        property it is not implemented as part of this patch, instead a new test,
+        plugins/private-browsing-mode-2.html, is added to ensure that setting and resetting
+        privateBrowsingEnabled works as expected.
 
-2009-08-08  Yong Li  <yong.li@torchmobile.com>
+        http://bugs.webkit.org/show_bug.cgi?id=33180
 
-        Reviewed by Adam Treat.
+        Test: plugins/private-browsing-mode-2.html
 
-        WINCE PORT: Implement Path for WINCE. Most code can be
-        reused for other ports that don't have native path support
-        https://bugs.webkit.org/show_bug.cgi?id=28188
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
 
-        Written also by George Staikos (including quadCurve() and bezier())
 
-        * platform/graphics/wince/PathWince.cpp: Added.
-        * platform/graphics/wince/PlatformPathWince.cpp: Added.
-        * platform/graphics/wince/PlatformPathWince.h: Added.
-        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+2010-02-27  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+        Reviewed by Timothy Hatcher.
 
-        "Double-click to add" new style button does not always show up [quick fix]
-        https://bugs.webkit.org/show_bug.cgi?id=28187
+        Web Inspector shouldn't show a white color box for "-webkit-line-break: after-white-space"
+        https://bugs.webkit.org/show_bug.cgi?id=33478
 
         * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
 
-2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+2010-02-27  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by George Staikos.
-
-        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
-        https://bugs.webkit.org/show_bug.cgi?id=28178
-
-        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
-        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
-        * platform/graphics/wince/MediaPlayerProxy.h: Added.
-
-2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
-        https://bugs.webkit.org/show_bug.cgi?id=28175
+        Reviewed by Maciej Stachowiak.
 
-        Call QDir::toNativeSeparators() before the path is passed to the OS.
+        <rdar://problem/7696607> Links do not respect -webkit-user-drag: none
+        https://bugs.webkit.org/show_bug.cgi?id=35475
 
-        Based on work by David Leong.
-        
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::pathByAppendingComponent):
+        Test: fast/css/user-drag-none.html
 
-2009-08-12  Dirk Schulze  <krit@webkit.org>
+        * page/DragController.cpp:
+        (WebCore::DragController::mayStartDragAtEventLocation): Added a node
+        parameter. The image drag check is done against the node, rather than
+        than against the hit test result. This prevents a non-draggable image
+        with an auto-draggable ancestor from being dragged alone. The link drag
+        check now ignores links that are -webkit-user-drag: none.
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode): Pass the current node
+        to mayStartDragAtEventLocation().
 
-        Reviewed by Ariya Hidayat.
+2010-02-27  Pavel Feldman  <pfeldman@chromium.org>
 
-        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
-        of getImageData. This changed since r47099.
+        Reviewed by Timothy Hatcher.
 
-        * platform/graphics/filters/FEColorMatrix.cpp:
-        (WebCore::FEColorMatrix::apply):
+        Web Inspector: REGRESSION: hangs when scrolling in Resource pane.
 
-2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35216
 
-        Reviewed by Dimitri Glazkov.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
 
-        Explicitly set control tints for Chromium/Mac, since the controls'
-        NSCell(s) lack an NSView and hence their tint isn't updated
-        automatically when the application is activated/deactivated.
-        https://bugs.webkit.org/show_bug.cgi?id=28108
-        http://crbug.com/18199
+2010-02-27  Xan Lopez  <xlopez@igalia.com>
 
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::updateNSCellControlTint):
-        (WebCore::RenderThemeChromiumMac::paintCheckbox):
-        (WebCore::RenderThemeChromiumMac::paintRadio):
-        (WebCore::RenderThemeChromiumMac::paintButton):
-        (WebCore::RenderThemeChromiumMac::paintMenuList):
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintSearchField):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        Reviewed by Gustavo Noronha.
 
-2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+        Abort XEmbed plugin initialization if our parent is not anchored
+        in a widget hierarchy. This can happen when the browser window is
+        destroyed while the plugin is being loaded, and will lead to a
+        crash.
 
-        Reviewed by Dimitri Glazkov.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
 
-        [V8] Fix atomic string externalization crash.
-        Atomic string externalization assumes that all non-empty strings
-        can be externalized which is untrue on 64-bit.  This change fixed
-        that.
+2010-02-26  Pavel Feldman  <pfeldman@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28215
+        Reviewed by Timothy Hatcher.
 
-        This bug causes loads of test crashes, no need to add new tests
-        specifically for this.
+        Web Inspector: reload inspected page on Cmd+R / Ctrl+R / F5 key event in inspector.
+        Drive-by fix for couple of minor front-end problems.
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
+        https://bugs.webkit.org/show_bug.cgi?id=35434
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::reloadPage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.reloadPage):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.copyText):
+        (.WebInspector.InspectorFrontendHostStub.prototype.canAttachWindow):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.toggleAttach):
 
-        Reviewed by Holger Freyther.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
-        Also optimize by not having to save and restore painter state.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillRect):
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        * platform/efl/ScrollbarEfl.cpp: Added.
+        * platform/efl/EventLoopEfl.cpp: Added.
+        * platform/efl/PlatformKeyboardEventEfl.cpp: Added.
+        * platform/efl/DragImageEfl.cpp: Added.
+        * platform/efl/PlatformMouseEventEfl.cpp: Added.
 
-        Reviewed by Adam Treat.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        [Qt] Fix coding style in GraphicsContextQt.cpp
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
-        (WebCore::toQtLineCap):
-        (WebCore::toQtLineJoin):
-        (WebCore::GraphicsContextPlatformPrivate::p):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::pen):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::clipPath):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+        * platform/efl/CursorEfl.cpp: Added.
+        * platform/efl/LocalizedStringsEfl.cpp: Added.
+        * platform/efl/SearchPopupMenuEfl.cpp: Added.
 
-        Reviewed by Simon Hausmann and Ariya Hidayat.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        https://bugs.webkit.org/show_bug.cgi?id=23291
+        Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
-        the shadow still does not go well with border radius.
+        Add EFL port files to page/efl.
+        http://webkit.org/b/35087
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillRect):
+        * WebCore/page/efl/DragControllerEfl.cpp: Added.
+        * WebCore/page/efl/FrameEfl.cpp: Added.
+        * WebCore/page/efl/AccessibilityObjectEfl.cpp: Added.
+        * WebCore/page/efl/EventHandlerEfl.cpp: Added.
 
-2009-08-12  Xan Lopez  <xlopez@igalia.com>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Jan Alonzo.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Use AM_V_GEN in a few more places, for less noisy builds.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * GNUmakefile.am:
+        * WebCore/platform/efl/LoggingEfl.cpp: Added.
+        * WebCore/platform/efl/ScrollbarThemeEfl.cpp: Added.
+        * WebCore/platform/efl/TemporaryLinkStubs.cpp: Added.
+        * WebCore/platform/efl/ScrollViewEfl.cpp: Added.
+        * WebCore/platform/efl/SharedBufferEfl.cpp: Added.
+        * WebCore/platform/efl/DragDataEfl.cpp: Added.
 
-2009-08-12  Dirk Schulze  <krit@webkit.org>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        SVG Filter premultiplied color support for getImageDate/putImageData
-        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
-        and putImageData of ImageBuffer need support for premultiplied colors.
+        * WebCore/platform/efl/RenderThemeEfl.cpp: Added.
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::getImageData):
-        (WebCore::CanvasRenderingContext2D::putImageData):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * svg/graphics/SVGResourceMasker.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-
-2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Changed Number.bytesToString to support low-resolution output.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        https://bugs.webkit.org/show_bug.cgi?id=28146
+        * WebCore/platform/efl/PlatformWheelEventEfl.cpp: Added.
+        * WebCore/platform/efl/FileChooserEfl.cpp: Added.
+        * WebCore/platform/efl/ContextMenuEfl.cpp: Added.
+        * WebCore/platform/efl/PlatformScreenEfl.cpp: Added.
+        * WebCore/platform/efl/WidgetEfl.cpp: Added.
 
-        * inspector/front-end/utilities.js:
-        (Number.bytesToString):
+2010-02-26  Adam Barth  <abarth@webkit.org>
 
-2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Simon Hausmann.
+        Expose an API for ports to add schemes to the mixed content whitelist
+        https://bugs.webkit.org/show_bug.cgi?id=35438
 
-        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+        Add a notion of a "secure" scheme that doesn't trigger mixed content
+        warnings.  Let folks register new secure schemes in the same way they
+        can register "local" schemes.
 
-        Webkit uses the runtime patching trick explained by "Feng Yuan" for
-        hooking these paint functions. It currently supports only 32bit assembly
-        code. This patch adds support for 64Bit version. Since inline-assemblies
-        are not supported for 64Bit, we have use a seperate .asm file.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        * page/SecurityOrigin.cpp:
+        (WebCore::secureSchemes):
+        (WebCore::SecurityOrigin::registerURLSchemeAsSecure):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsSecure):
+        * page/SecurityOrigin.h:
 
-        * WebCore.pro:
-        * plugins/win/PaintHooks.asm: Added.
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-        (WebCore::hook):
+2010-02-26  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-08-11  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Gavin Barraclough.
+        [Qt] GraphicsLayerQt: artifacts and wrong transformOrigin
+        This was due to wrong way of applying cache-mode and transformation
+        on a graphics-item with HTML. Cache-mode should be updated
+        when the content type updates, even if it was the same cache-mode
+   
+        https://bugs.webkit.org/show_bug.cgi?id=35382
 
-        Make it harder to misuse try* allocation routines
-        https://bugs.webkit.org/show_bug.cgi?id=27469
+        Test URL attached to the bug now works correctly.
 
-        Add forwarding header for PossiblyNull type, and add missing null check
-        to ImageBuffer creation.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::computeTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
+2010-02-26  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Oliver Hunt.
+        Qt/Mac: Revert null timer removal (r51105)
+        https://bugs.webkit.org/show_bug.cgi?id=35396
 
-        Restrict use of FuncDeclNode & FuncExprNode to the parser.
-        https://bugs.webkit.org/show_bug.cgi?id=28209
+        r51105 removed the null timer event of the carbon event model. This however
+        breaks the flash of many sites.        
 
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-            Function signature change.
+        Applying patch suggested by Girish Ramakrishnan in bug comment #1.
 
-2009-08-11  Peter Kasting  <pkasting@google.com>
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::nullEventTimerFired):
+        (WebCore::PluginView::mousePosForPlugin):
 
-        Reviewed by Adam Treat.
+2010-02-26  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData): Use slightly shorter syntax.
-        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
-        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
-        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
-        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+        [Qt] Compile error with 3d-canvas
+        Replaced a direct gl call with a getProcAddress call
+        https://bugs.webkit.org/show_bug.cgi?id=35448
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        No new tests.
 
-        Reviewed by David Levin.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::blendColor):
 
-        SharedWorkers do not exit when the last parent document exits
-        https://bugs.webkit.org/show_bug.cgi?id=28170
+2010-02-26  Kwang Yul Seo  <skyul@company100.net>
 
-        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Added vector cache instead of nested hash tables for SharedWorker repository.
+        [BREWMP] Port EventHandler
+        https://bugs.webkit.org/show_bug.cgi?id=34796
 
-        Added SharedWorkerRepository::documentDetached API.
+        Add platform-specific code required to implement EventHandler.
 
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Notifies SharedWorkerRepository when the document is closing.
-        * loader/FrameLoader.cpp:
-        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::create):
-        (WebCore::SharedWorkerProxy::isClosing):
-        Renamed from closing().
-        (WebCore::SharedWorkerProxy::matches):
-        Added manual equality function to replace old hash lookup.
-        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
-        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
-        Added tracking of the worker's list of documents for lifecycle purposes.
-        (WebCore::SharedWorkerProxy::documentDetached):
-        Shuts down the proxy when the last associated document is detached.
-        (WebCore::SharedWorkerProxy::close):
-        Marks the proxy as closed so it is no longer shared with new instances.
-        (WebCore::SharedWorkerProxy::workerContextDestroyed):
-        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        closing()->isClosing()
-        (WebCore::SharedWorkerRepository::documentDetached):
-        (WebCore::SharedWorkerRepository::hasSharedWorkers):
-        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
-        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
-        (WebCore::DefaultSharedWorkerRepository::removeProxy):
-        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
-        (WebCore::DefaultSharedWorkerRepository::documentDetached):
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        * workers/DefaultSharedWorkerRepository.h:
-        * workers/SharedWorkerRepository.h:
-
-2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+        * page/brew/EventHandlerBrew.cpp: Added.
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::accessKeyModifiers):
 
-        Reviewed by Darin Adler.
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Bug 28200 - ListMarker should be included as part of the text value to parse
-        https://bugs.webkit.org/show_bug.cgi?id=28200
+        Reviewed by Kenneth Rohde Christiansen.
 
-        When returning text through the marker range attributes, the list marker text should
-        also be included. It isn't included by default because a TextIterator is used which
-        only looks at Nodes for text. A list marker does not have a corresponding node,
-        so its text is not returned through accessibility. That is, until now.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+        * WebCore/platform/efl/ClipboardEfl.cpp: Added.
+        * WebCore/platform/efl/PopupMenuEfl.cpp: Added.
+        * WebCore/platform/efl/SharedTimerEfl.cpp: Added.
+        * WebCore/platform/efl/RenderThemeEfl.h: Added.
+        * WebCore/platform/efl/Language.cpp: Added.
+        * WebCore/platform/efl/CookieJarEfl.cpp: Added.
+        * WebCore/platform/efl/MIMETypeRegistryEfl.cpp: Added.
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::listMarkerTextForRange):
-        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-        * rendering/RenderListItem.h:
+2010-02-26  Robert Kroeger  <rjkroege@chromium.org>
 
-        Make markerText() public so that accessibility code can access it.
+        Reviewed by Nate Chapin
 
-2009-08-11  Peter Kasting  <pkasting@google.com>
+        To fire each event handler registered on an SVG node once per
+        event, Chromium needs an implementation of wasCreatedFromMarkup
+        added to V8LazyEventListener.h that matches the one in
+        WebKit/WebCore/bindings/js/JSLazyEventListener.h.
+        
+        This patch adds such a matching implementation of wasCreatedFromMarkup
+        to V8LazyEventListener.h.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35325
 
-        Reviewed by Adam Treat.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::wasCreatedFromMarkup):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
-        merging most of the other ImageSource*.cpp files with it.
+2010-02-26  Arno Renevier  <arno@renevier.net>
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
-        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+        Reviewed by Gustavo Noronha Silva.
 
-2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+        [Gtk] use geoclue_position_get_position_async to get geolocation position.
+        https://bugs.webkit.org/show_bug.cgi?id=35355
 
-        Reviewed by Adam Roben.
+        No new tests, behaviour depends on system.
 
-        Cairo-based Windows port does not handle the https protocol.
-        https://bugs.webkit.org/show_bug.cgi?id=28171.
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::get_position):
+        * platform/gtk/GeolocationServiceGtk.h:
 
-        No new tests needed.  Existing https tests show this failure
-        for WinCairo builds.
+2010-02-26  Yaar Schnitman  <yaar@chromium.org>
 
-        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
-          definitions for SSL support in cURL.
-        * platform/network/curl/ResourceHandleManager.h: Add new
-          certificate path member variable.
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificateBundlePath): New method to retrieve the
-          proper certificate resource bundle path.
-        (WebCore::ResourceHandleManager::initializeHandle): Check for
-          the resource bundle and use if available to activate SSL
-          support.
+        Chromium Win build fix.
 
-2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+        * WebCore.gyp/WebCore.gyp: Added missing file to action input.
 
-        Reviewed by Eric Seidel.
+2010-02-12  Brett Wilson  <brettw@chromium.org>
 
-        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28127
+        Reviewed by Adam Barth.
 
-        * editing/haiku/EditorHaiku.cpp:
-        (WebCore::Editor::newGeneralClipboard):
-        * page/haiku/EventHandlerHaiku.cpp:
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::createDraggingClipboard):
-        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
-        (WebCore::ClipboardHaiku::ClipboardHaiku):
-        (WebCore::ClipboardHaiku::clearAllData):
-        (WebCore::ClipboardHaiku::getData):
-        (WebCore::ClipboardHaiku::setData):
-        (WebCore::ClipboardHaiku::types):
-        (WebCore::ClipboardHaiku::dragLocation):
-        (WebCore::ClipboardHaiku::dragImage):
-        (WebCore::ClipboardHaiku::setDragImage):
-        (WebCore::ClipboardHaiku::dragImageElement):
-        (WebCore::ClipboardHaiku::createDragImage):
-        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
-        (WebCore::ClipboardHaiku::writeURL):
-        (WebCore::ClipboardHaiku::writeRange):
-        (WebCore::ClipboardHaiku::hasData):
-        * platform/haiku/DragDataHaiku.cpp:
-        (WebCore::DragData::createClipboard):
-
-2009-08-11  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by NOBODY (build break).
-
-        Speculative GTK build fix
+        Update the Google-URL version of KURL and the V8 bindings to the new
+        behavior of KURL.IsStandard.
 
-        * GNUmakefile.am:
-        Added missing .idl file, and added notifications directory to IDL_PATH.
+        https://bugs.webkit.org/show_bug.cgi?id=34859
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        This is covered by fast/dom/Window/invalid-protocol.html
 
-        Reviewed by NOBODY (build break).
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-        Speculative Windows build fix
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        * WebCore.vcproj/WebCore.vcproj:
-        Added missing build steps for non-debug targets.
+        Reviewed by NOBODY (Build fix following r55312).
 
-2009-08-11  Drew Wilson <atwilson@google.com>
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::invokeMethod):
 
-        Reviewed by NOBODY (build break)
+2010-02-26  Yaar Schnitman  <yaar@chromium.org>
 
-        Speculative build fix for Qt build.
+        Reviewed by Dimitri Glazkov.
 
-        * WebCore.pro: Added /notifications to include path
+        [V8] Auto-generate and split DerivedSourcesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33048
 
-2009-08-11  John Gregg  <johnnyg@google.com>
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_derivedsourcesallinone.py: Added.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Removed.
 
-        Reviewed by Maciej Stachowiak.
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        Desktop Notifications API
-        https://bugs.webkit.org/show_bug.cgi?id=25463
+        Reviewed by NOBODY (Build fix following r55312).
 
-        Adds an implementation of desktop notifications, behind the compile-time
-        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
-        API through a NotificationProvider interface, which must provide the services
-        to actually notify the user and manage the desktop.  This provider is injected
-        into WebKit through the ChromeClient for normal page contexts and through the
-        WorkerThread for worker contexts.
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::invokeMethod):
 
-        A permissions API is defined on a per-origin basis, which allows a web page
-        to check if its origin is allowed to show desktop notifications, and to request
-        permission for its origin.
+2010-02-26  Alexey Proskuryakov  <ap@apple.com>
 
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
-        (WebCore::JSNotificationCenter::requestPermission):
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::JSNotification::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toNotification):
-        * dom/EventTarget.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::notificationPresenter):
-        * notifications: Added.
-        * notifications/Notification.cpp: Added.
-        (WebCore::Notification::Notification):
-        (WebCore::Notification::~Notification):
-        (WebCore::Notification::show):
-        (WebCore::Notification::cancel):
-        (WebCore::Notification::ondisplay):
-        (WebCore::Notification::setOndisplay):
-        (WebCore::Notification::onerror):
-        (WebCore::Notification::setOnerror):
-        (WebCore::Notification::onclose):
-        (WebCore::Notification::setOnclose):
-        (WebCore::Notification::getAttributeEventListener):
-        (WebCore::Notification::setAttributeEventListener):
-        (WebCore::Notification::clearAttributeEventListener):
-        (WebCore::Notification::dispatchDisplayEvent):
-        (WebCore::Notification::dispatchErrorEvent):
-        (WebCore::Notification::dispatchCloseEvent):
-        (WebCore::Notification::addEventListener):
-        (WebCore::Notification::removeEventListener):
-        (WebCore::Notification::handleEvent):
-        (WebCore::Notification::dispatchEvent):
-        * notifications/Notification.h: Added.
-        (WebCore::Notification::create):
-        (WebCore::Notification::isHTML):
-        (WebCore::Notification::url):
-        (WebCore::Notification::contents):
-        (WebCore::Notification::scriptExecutionContext):
-        (WebCore::Notification::toNotification):
-        (WebCore::Notification::refEventTarget):
-        (WebCore::Notification::derefEventTarget):
-        * notifications/Notification.idl: Added.
-        * notifications/NotificationCenter.cpp: Added.
-        (WebCore::NotificationCenter::NotificationCenter):
-        (WebCore::NotificationCenter::checkPermission):
-        (WebCore::NotificationCenter::requestPermission):
-        * notifications/NotificationCenter.h: Added.
-        (WebCore::NotificationCenter::create):
-        (WebCore::NotificationCenter::createHTMLNotification):
-        (WebCore::NotificationCenter::createNotification):
-        (WebCore::NotificationCenter::context):
-        (WebCore::NotificationCenter::presenter):
-        * notifications/NotificationCenter.idl: Added.
-        * notifications/NotificationContents.h: Added.
-        (WebCore::NotificationContents::NotificationContents):
-        (WebCore::NotificationContents::icon):
-        (WebCore::NotificationContents::title):
-        (WebCore::NotificationContents::body):
-        * notifications/NotificationPresenter.h: Added.
-        (WebCore::NotificationPresenter::):
-        (WebCore::NotificationPresenter::~NotificationPresenter):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::notificationPresenter):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::clear):
-        (WebCore::DOMWindow::webkitNotifications):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/Page.h:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        (WebCore::WorkerContext::webkitNotifications):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::getNotificationPresenter):
-        (WebCore::WorkerThread::setNotificationPresenter):
+        Reviewed by Anders Carlsson.
 
-2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35450
+        Crash when a Java array property accessor raises an exception
 
-        Reviewed by Timothy Hatcher.
+        Test: java/inaccessible-class.html
 
-        Inspector: Console Drawer is Toggling instead of Staying Open
-        https://bugs.webkit.org/show_bug.cgi?id=28115
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: (JavaField::valueFromInstance): Check if the result
+        is null before interpreting it as an object or array.
 
-        * inspector/front-end/Drawer.js:
-        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
-        * inspector/front-end/inspector.js:
-        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
-        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+2010-02-26  Dirk Schulze  <krit@webkit.org>
 
-2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by George Staikos.
+        Extend AffineTransform to mapQuad
+        https://bugs.webkit.org/show_bug.cgi?id=35444
 
-        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
-        https://bugs.webkit.org/show_bug.cgi?id=28180
-
-        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
-        Otherwhise this may lead to crashes related to intrinsic event exeuction.
-
-        Unfortunately select elements aren't testable by the layout tests, so adding
-        a new manual test reproducing the crash.
-
-        * manual-tests/wml/select-onpick-event-crash.wml: Added.
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLDocument.h:
-        (WebCore::WMLDocument::activeCard):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::WMLPageState):
-        * wml/WMLPageState.h:
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-
-2009-08-07  Peter Kasting  <pkasting@google.com>
+        This makes mapQuad available for AffineTransform. So that platforms
+        can make use of it after the switch from TransformationMatrix to
+        AffineTransform in GraphicsContext.
 
-        Reviewed by Eric Seidel.
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::mapRect): mapRect already did the calculation for mapQuad but gave back the
+                                             boundingBox of the resulting FloatQuad.
+        (WebCore::AffineTransform::mapQuad):
+        * platform/graphics/transforms/AffineTransform.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28073
-        Treat icons with no bit count and no color count as 256-color for
-        purposes of quality ranking.  Also fix a couple cases of a style
-        violation.
+2010-02-26  Brady Eidson  <beidson@apple.com>
 
-        Test: fast/images/icon-0colors.html
+        Reviewed by Pavel Feldman.
 
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        Arrow keys do not scroll source view in Resources pane or Scripts pane.
+        <rdar://problem/7594367> and https://bugs.webkit.org/show_bug.cgi?id=34356
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        Handle vertical scrolling in the Text Viewer:
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer): Listen for the keydown event.
+        (WebInspector.TextViewer.prototype._handleKeyDown): If the event has no modifiers and refers
+          to an arrow key, scroll. The horizontal values were ripped from the default "pixels per scroll line"
+          value in ScrollBar.h.
 
-        Reviewed by David Levin.
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        Need to refactor WorkerObjectProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=28136
+        Reviewed by Alexey Proskuryakov.
 
-        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+        Bug 35401 - Fix handling of errors in handling calls over bridge,
+        where base object bridge-type does not match method bridge-type.
 
-        Existing tests are sufficient, as this is only a refactoring.
+        The code assumes users will only attempt to invoke a Java method
+        on a Java base object, etc.
+        Add language specific subclasses of RuntimeMethod, and pass the
+        RuntimeMethod into invokeMethod, so we can typecheck before
+        casting.  Throw an exception on type mismatch.
 
-        * GNUmakefile.am:
-        Added WorkerReportingProxy.h to build.
-        * WebCore.gypi:
-        Added WorkerReportingProxy.h to build.
-        * WebCore.vcproj/WebCore.vcproj:
-        Added WorkerReportingProxy.h to build.
+        * WebCore.base.exp:
         * WebCore.xcodeproj/project.pbxproj:
-        Added WorkerReportingProxy.h to build.
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
-        * workers/DedicatedWorkerThread.cpp:
-        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
-        Changed constructor to pass WorkerReportingProxy to base class.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        (WebCore::SharedWorkerProxy::workerContextClosed):
-        (WebCore::SharedWorkerProxy::workerContextDestroyed):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
-        * workers/SharedWorkerContext.cpp:
-        * workers/SharedWorkerContext.h:
-        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
-        * workers/SharedWorkerThread.cpp:
-        (WebCore::SharedWorkerThread::create):
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        Passes WorkerReportingProxy to base class constructor.
-        * workers/SharedWorkerThread.h:
-        Constructor now takes a WorkerReportingProxy.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
-        (WebCore::WorkerContext::close):
-        Now notifies WorkerReportingProxy when the thread is closing.
-        (WebCore::WorkerContext::reportException):
-        Reports exceptions via WorkerReportingProxy.
-        (WebCore::WorkerContext::addMessage):
-        Reports console messages via WorkerReportingProxy.
-        * workers/WorkerContext.h:
-        * workers/WorkerObjectProxy.h:
-        (WebCore::WorkerObjectProxy::workerContextClosed):
-        Default empty implementation for dedicated workers.
-        * workers/WorkerReportingProxy.h: Added.
-        Base interface that contains APIs moved from WorkerObjectProxy.
-        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        Updated constructor to accept a WorkerReportingProxy.
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::workerReportingProxy):
-
-2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by NOBODY (build fix).
-
-        Fix the Qt build after r47022.
-
-        Use the new markChildren() pattern for marking aggregate/child objects.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
-        (JSC::Bindings::QtInstance::markAggregate):
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
-        * bridge/qt/qt_runtime.h:
-
-2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix the build on the Qt build bot by making the generated JS bindings
-        files depend on the code generator itself.
-
-        * WebCore.pro:
-
-2009-08-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::CRuntimeMethod):new class to distinguish this type of RuntimeMethod.
+        (JSC::Bindings::CInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (JSC::Bindings::CInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        * bridge/c/c_instance.h:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::JavaRuntimeMethod): new class to distinguish this type of RuntimeMethod.
+        (JavaInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (JavaInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcRuntimeMethod::ObjcRuntimeMethod): new class to distinguish this type of RuntimeMethod.
+        (ObjcInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (ObjcInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        (ObjcInstance::invokeObjcMethod): new method, takes an ObjcMethod* as an argument so that we don't need to dynamically determine the type.
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): use new invokeObjcMethod method.
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod): pass RuntimeMethod as argument to invokeMethod, rather than its MethodList.
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObject::methodGetter): use new getMethod method.
 
-        Stack overflow crash in JavaScript garbage collector mark pass
-        https://bugs.webkit.org/show_bug.cgi?id=12216
+2010-02-26  Oliver Hunt  <oliver@apple.com>
 
-        Make WebCore use the new iterative marking logic.
+        Reviewed by Geoff Garen.
 
-        Tests: fast/js/nested-object-gc.html
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::markChildren):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::markChildren):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markDOMNodesForDocument):
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::markDOMObjectWrapper):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::markChildren):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::markChildren):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::markChildren):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::markChildren):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        (WebCore::JSDedicatedWorkerContext::markChildren):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::markChildren):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::markJSFunction):
-        * bindings/js/JSEventListener.h:
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::markChildren):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::markChildren):
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::JSNavigator::markChildren):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::markAggregate):
-        * bindings/js/JSNodeFilterCondition.h:
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::markChildren):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::markChildren):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::markChildren):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::markChildren):
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::markChildren):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::markChildren):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::markChildren):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::markChildren):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::markChildren):
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::markChildren):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        * WebCore.xcodeproj/project.pbxproj:
         * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::markJSFunction):
-        (WebCore::markIfNotNull):
-        * dom/NodeFilter.h:
-        (WebCore::NodeFilter::markAggregate):
-        * dom/NodeFilterCondition.h:
-        (WebCore::NodeFilterCondition::markAggregate):
-        * dom/RegisteredEventListener.h:
-        (WebCore::markEventListeners):
-        * page/DOMWindow.h:
-        * workers/WorkerContext.h:
 
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-26  Alex Milowski  <alex@milowski.com>
 
-        Reviewed by Eric Seidel.
-
-        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
-        https://bugs.webkit.org/show_bug.cgi?id=28089
-
-        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
-        called by mistake.  This roughly matches the way JSC does it, which is an
-        additional advantage.
-
-        * bindings/v8/NPV8Object.cpp:
-        (npCreateV8ScriptObject):
-        (_NPN_Invoke):
-        (_NPN_InvokeDefault):
-        (_NPN_Evaluate):
-        (_NPN_EvaluateHelper):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_SetException):
-        (_NPN_Enumerate):
-        (_NPN_Construct):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::clearScriptObjects):
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
-        * bindings/v8/V8NPObject.cpp:
-        (npObjectInvokeImpl):
-        (npObjectGetProperty):
-        (npObjectIndexedPropertyGetter):
-        (npObjectGetIndexedProperty):
-        (npObjectSetProperty):
-        (npObjectIndexedPropertySetter):
-        (npObjectSetIndexedProperty):
-        (weakNPObjectCallback):
-        (createV8ObjectForNPObject):
-        (forgetV8ObjectForNPObject):
-        * bindings/v8/V8NPUtils.cpp:
-        (getStringIdentifier):
-        * bindings/v8/npruntime.cpp:
-        * bindings/v8/npruntime_impl.h:
-
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Brady Eidson.
-
-        Change ___Storage.key() to match current spec behavior.
-        https://bugs.webkit.org/show_bug.cgi?id=28112
-
-        The current WebStorage spec says that ___Storage.key() should return null when
-        the index is out of bounds, rather than an exception.  A bunch of logic can be
-        simplified after this change.
-
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::getPropertyNames):
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        * storage/Storage.cpp:
-        (WebCore::Storage::key):
-        * storage/Storage.h:
-        * storage/Storage.idl:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::key):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::key):
-        * storage/StorageMap.h:
-
-2009-08-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Fisher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28087
+        Added basic support for the munder, munderover, and mover elements.
 
-        Mods for a chrome specific impl of ApplicationCacheHost.
+        Tests: mathml/presentation/over.xhtml
+               mathml/presentation/under.xhtml
+               mathml/presentation/underover.xhtml
 
-        * The public section of the interface is the same, but we use
-        PLATFORM(CHROMIUM) to identify which parts of the private
-        section are shared. The chrome specific internals are encapsulated
-        in a seperate ApplicationCacheHostInternal class. WebCore common
-        code only contains a forward reference to this class.
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLUnderOver.cpp: Added.
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        (WebCore::RenderMathMLUnderOver::addChild):
+        (WebCore::getOffsetHeight):
+        (WebCore::RenderMathMLUnderOver::stretchToHeight):
+        (WebCore::RenderMathMLUnderOver::layout):
+        (WebCore::RenderMathMLUnderOver::baselinePosition):
+        (WebCore::RenderMathMLUnderOver::nonOperatorHeight):
+        * mathml/RenderMathMLUnderOver.h: Added.
+        (WebCore::RenderMathMLUnderOver::hasBase):
+        (WebCore::RenderMathMLUnderOver::):
+
+2010-02-24  Stephen White  <senorblanco@chromium.org>
 
-        * Cleanup a couple of stale comments.
+        Reviewed by Darin Adler.
 
-        * Have window.applicationCache return null to script when the
-        feature is disabled in the preferences.
+        This CL implements a simple ad-hoc parser for CSS rgb() values.
+        If it fails, it returns false and the normal lex/yacc parser will
+        be invoked.
         
-        No new tests.
-
-        * loader/appcache/ApplicationCacheHost.cpp:
-        * loader/appcache/ApplicationCacheHost.h:
-        (WebCore::ApplicationCacheHost::documentLoader):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::applicationCache):
-
-2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Implement GraphicsContext::fillRoundRect() for WINCE port
-        https://bugs.webkit.org/show_bug.cgi?id=27842
-
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::rectCenterPoint):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::drawRoundCorner):
+        https://bugs.webkit.org/show_bug.cgi?id=35362
 
-2009-08-10  Anthony Ricaud  <rik@webkit.org>
+        Covered by fast/canvas/canvas-bg.html, fast/canvas/canvas-bg-zoom.html,
+        and many more.
 
-        Reviewed by Timothy Hatcher.
+        * css/CSSParser.cpp:
+        (WebCore::parseInt):
+        (WebCore::CSSParser::parseColor):
 
-        Inspector Resources / Graphs should support filtering
-        https://bugs.webkit.org/show_bug.cgi?id=20629
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        Introduces a filter bar for resources.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Thanks to Matt Lilek for the CSS scope bar.
+        https://bugs.webkit.org/show_bug.cgi?id=35419
+        3D canvas did not update when WTF_USE_ACCELERATED_COMPOSITING
+        was enabled but not from run-time settings. Added run-time 
+        check that compositing is enabled.
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.createFilterElement):
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::markContextChanged):
 
-2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        Unreviewed build correction after http://trac.webkit.org/changeset/46978
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::initializeHandle):  Correct
-         deprecated removeRef to new removeFragmentIdentifier.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+        Compilation failed because functions glSampleCoverage, glBlendEquation
+        and glActiveTexture were not available.
+        https://bugs.webkit.org/show_bug.cgi?id=35423
 
-        Reviewed by Justin Garcia.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::sampleCoverage):
 
-        Background color formatting lost on enter
-        https://bugs.webkit.org/show_bug.cgi?id=20348
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
+ 
+         Reviewed by Kenneth Rohde Christiansen.
 
-        This patch makes background color be preserved during editing.
-        In particular, editingStyleAtPosition would include the background color when obtaining styles.
+         https://bugs.webkit.org/show_bug.cgi?id=35380
+         Fixed compilation error when WTF_USE_ACCELERATED_COMPOSITING=0
+ 
+         * css/MediaQueryEvaluator.cpp:
+         (WebCore::transform_3dMediaFeatureEval):
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
+2010-02-26  Nicholas Young  <nicholas.young@nokia.com>
 
-2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Tor Arne Vestbø.
 
-        Reviewed by Simon Hausmann.
+        [Qt] Incorrect painting after a size changed.
+        https://bugs.webkit.org/show_bug.cgi?id=35412
 
-        Stop sending QEvent::CursorChange to Qt for mouse move.
+        No new tests. Bug fix in backend.
 
-        Verify if the cursor didn't change in WidgetQt::setCursor,
-        just like the mac port does.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::paint): Provide the source rectangle, rather than inferring it.
 
-        Thanks to Adriano Rezendo for spotting and debugging the
-        issue.
+2010-02-26  Nicholas Young  <nicholas.young@nokia.com>
 
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-10  Alexey Proskuryakov  <ap@apple.com>
+        [Qt] Incorrect handling of MIME types in Media Player
+        https://bugs.webkit.org/show_bug.cgi?id=35413
 
-        Reviewed by Brady Eidson.
+        No new tests. Bug fix in backend.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28165
-        Application cache maximum size cannot be set before the database is opened
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType): Corrected logic.
 
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
-        open yet.
+2010-02-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+        Reviewed by Xan Lopez.
 
-        Reviewed by Dimitri Glazkov.
+        https://bugs.webkit.org/show_bug.cgi?id=35418
+        [Gtk] Every table, including layout tables, should be exposed as a table
 
-        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
-        https://bugs.webkit.org/show_bug.cgi?id=28156
+        This patch exposes layout tables as tables. (Addressing the problematic table
+        hierarchy remains to be done.)
 
-        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        * bindings/v8/V8ObjectEventListener.h:
-        (WebCore::V8ObjectEventListener::isObjectListener):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::removeHiddenDependency):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
-        (WebCore::toEventType):
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener): Made static.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
 
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-26  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Darin Adler.
 
-        Cleanup DOM Storage namespace shutdown code usage of security origin.
-        https://bugs.webkit.org/show_bug.cgi?id=28094
-
-        If a storage namespace is not explicitly closed, be sure to do so on
-        destruction of the object.  In addition, the close call should wait
-        on the background thread finishing its syncing.  (Not doing so is actually
-        a regression from the original LocalStorage code.)
-
-        There's no point to passing in the SecurityOrigin when copying a storage
-        area since what was passed in is exactly what is stored within each
-        storage area.  In addition, the non-copy constructor should take in a
-        PassRefPtr rather than a pointer since that pointer was only passed into
-        the constuctor for RefPtr's anyway.
-
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::copy):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::close):
-        * storage/StorageNamespaceImpl.h:
-
-2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        XSSAuditor is super super super slow
+        https://bugs.webkit.org/show_bug.cgi?id=35373
 
-        Not reviewed, build fix.
+        In this patch, we separate the decoding cache for the page's URL and
+        form data.  Previously, we used the same cache for both, which caused
+        us miss the cache every time when the page had form data (because the
+        cache only stored one entry).  When the form data is large, we were
+        wasting a lot of time canonicalizing.
 
-        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
 
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::canAccessDeck):
+2010-02-26  Dirk Schulze  <krit@webkit.org>
 
-2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Windows build fix.
+        SVGResourceClipper needs to be moved to RenderSVGResourceClipper
+        https://bugs.webkit.org/show_bug.cgi?id=35421
 
-        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
-        Fixes linker warnings.        
-        
-        Corrected spelling of JSInspectorBackend.cpp.
-        
-        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+        Move SVGResourceClipper to RenderSVGResourceClipper. This follows the changes
+        of Masker and helps to clean up the SVG code. Code snippets from SVGClipPathElement
+        and SVGResourceClipper got combined in RenderSVGResourceClipper. DRT results are
+        more readable for clipPath's now. It's possible to see the unit type of clipper, as
+        well as it's childs instead of just one path.
 
+        * Android.mk:
+        * GNUmakefile.am:
         * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Remove a dead #define.
-
-        * bindings/js/JSDOMBinding.cpp:
-
-2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Update KURLGoogle for ref* method renames in
-        http://trac.webkit.org/changeset/46978.
-        https://bugs.webkit.org/show_bug.cgi?id=28084
-
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
-            setFragmentIdentifier, respectively.
-        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
-
-2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
-        for r46989.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
-
-2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
-
-        Reviewed by Darin Adler.
-
-        Memory leak in error handling code for SOUP interface
-        https://bugs.webkit.org/show_bug.cgi?id=28144
-
-        Freed memory leaked in error handling code for soup requests.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderSVGResource.h:
         (WebCore::):
-
-2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Provide graceful handling of the situation when an embedder invokes
-        visited link update methods before a Page constructor has been called.
-        https://bugs.webkit.org/show_bug.cgi?id=28149
-
-        * page/Page.cpp:
-        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
-        (WebCore::Page::visitedStateChanged): Ditto.
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Fix GTKbuild.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
+        * rendering/RenderSVGResourceClipper.cpp: Added.
+        (WebCore::RenderSVGResourceClipper::RenderSVGResourceClipper):
+        (WebCore::RenderSVGResourceClipper::~RenderSVGResourceClipper):
+        (WebCore::RenderSVGResourceClipper::invalidateClients):
+        (WebCore::RenderSVGResourceClipper::invalidateClient):
+        (WebCore::RenderSVGResourceClipper::applyResource):
+        (WebCore::RenderSVGResourceClipper::resourceBoundingBox):
+        * rendering/RenderSVGResourceClipper.h: Added.
+        (WebCore::RenderSVGResourceClipper::renderName):
+        (WebCore::RenderSVGResourceClipper::resourceType):
+        (WebCore::RenderSVGResourceClipper::clipPathUnits):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::clipperBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeStyle):
+        (WebCore::writeSVGResource):
+        (WebCore::writeResources):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::svgAttributeChanged):
+        (WebCore::SVGClipPathElement::childrenChanged):
+        (WebCore::SVGClipPathElement::createRenderer):
+        * svg/SVGClipPathElement.h:
+        (WebCore::SVGClipPathElement::isValid):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResources):
+        * svg/graphics/SVGResource.h:
         (WebCore::):
+        (WebCore::SVGResource::isPaintServer):
+        (WebCore::SVGResource::isFilter):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceClipper.cpp: Removed.
+        * svg/graphics/SVGResourceClipper.h: Removed.
 
-2009-08-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
-
-        * platform/graphics/GlyphBuffer.h: Removed advanceData().
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
-            instead of advanceData() from.
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Remove workaround for older libsoup versions.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::fillResponseFromMessage):
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Let startHttp validate the URI instead of doing it, with potential
-        crashes, in ::start.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-
-2009-08-10  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        When empty <input> is focused, getSelection() exposes shadow tree nodes
-        https://bugs.webkit.org/show_bug.cgi?id=15903
-
-        Test: fast/forms/shadow-tree-exposure.html
+2010-02-26  Ben Murdoch  <benm@google.com>
 
-        * page/DOMSelection.cpp:
-        (WebCore::selectionShadowAncestor): Added.
-        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
-        ancestor if the selection is in a shadow tree. Matches Firefox.
-        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
-        ancestor if the selection is in a shadow tree. Matches Firefox.
-        (WebCore::DOMSelection::focusNode): Ditto.
-        (WebCore::DOMSelection::focusOffset): Ditto.
-        (WebCore::DOMSelection::baseNode): More of the same, but since this
-        is a WebKit-invented property, it does not match Firefox.
-        (WebCore::DOMSelection::baseOffset): Ditto.
-        (WebCore::DOMSelection::extentNode): Ditto.
-        (WebCore::DOMSelection::extentOffset): Ditto.
-        (WebCore::DOMSelection::isCollapsed): Return true even when the
-        selection is a range, if the selection is in the shadow tree.
-        Matches Firefox. Also changed behavior when called and the frame
-        is gone to return true instead of false which makes more sense.
-        (WebCore::DOMSelection::empty): Use clear() just like the other
-        selection-clearing function in this file does.
-        (WebCore::DOMSelection::getRangeAt): Return a range that starts
-        and ends before the shadow ancestor. Matches Firefox.
-
-2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Make all status bar button images glyph-based.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28124
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
-        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
-        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
-        * inspector/front-end/Images/consoleButtons.png: Removed.
-        * inspector/front-end/Images/dockButtonGlyph.png: Added.
-        * inspector/front-end/Images/dockButtons.png: Removed.
-        * inspector/front-end/Images/enableButtons.png: Removed.
-        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
-        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
-        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
-        * inspector/front-end/Images/excludeButtons.png: Removed.
-        * inspector/front-end/Images/focusButtonGlyph.png: Added.
-        * inspector/front-end/Images/focusButtons.png: Removed.
-        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
-        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
-        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
-        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
-        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
-        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
-        * inspector/front-end/Images/percentButtonGlyph.png: Added.
-        * inspector/front-end/Images/percentButtons.png: Removed.
-        * inspector/front-end/Images/recordButtonGlyph.png: Added.
-        * inspector/front-end/Images/recordButtons.png: Removed.
-        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
-        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
-        * inspector/front-end/Images/reloadButtons.png: Removed.
-        * inspector/front-end/Images/undockButtonGlyph.png: Added.
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel.prototype.createStatusBarButton):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-
-2009-08-07  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        KURL ref() methods should be fragmentIdentifier() methods 
-        https://bugs.webkit.org/show_bug.cgi?id=28084
-
-        In addition to the renames, also took the chance to replace all use of:
-        setRef(String());
-        with:
-        removeFragmentIdentifier();
-
-        * platform/KURL.cpp:
-        (WebCore::KURL::fragmentIdentifier):
-        (WebCore::KURL::hasFragmentIdentifier):
-        (WebCore::KURL::setFragmentIdentifier):
-        (WebCore::KURL::removeFragmentIdentifier):
-        (WebCore::KURL::prettyURL):
-        (WebCore::equalIgnoringFragmentIdentifier):
-        * platform/KURL.h:
-
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::isSVGCursorIdentifier):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::isCurrentDocument):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::hash):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::isURLAllowed):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::gotoAnchor):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::scrollToAnchor):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::urlsMatchItem):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        (WebCore::ApplicationCache::resourceForRequest):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        (WebCore::ApplicationCacheGroup::didFail):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::create):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * page/Location.cpp:
-        (WebCore::Location::hash):
-        * page/Page.cpp:
-        (WebCore::Page::goToItem):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::isURLAllowed):
-        * workers/WorkerLocation.cpp:
-        (WebCore::WorkerLocation::hash):
-
-2009-08-10  Andy Shaw <andy.shaw@nokia.com>
-
-        Reviewed by Simon Hausmann.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
+        The element that a touchevent is dispatched to isn't always right
+        https://bugs.webkit.org/show_bug.cgi?id=35431
 
-        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
-        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
-        as from Qt through its knowledge of globally registered eventloops.
+        The element that touch events are dispatched on is not always the
+        correct one, as the cached m_touchEventTarget member is only updated
+        when the first element of the PlatformTouchEvent touch list is in the
+        TouchPressed state.
 
-        There is no unit test for this bug as it would require exporting additional symbols and
-        introduce the synchronous loader as global variable just for the test.
+        This patch changes this behavior to dispatch the event to the target
+        of the touch that caused the event to be generated and eliminates the
+        m_touchEventTarget in favour of using the touch target hashmap. It also
+        simplifies the way in which the touchTargets list is generated as we
+        no longer have m_touchEventTarget (which was used previously to build
+        the list). The new behavior matches the observed behavior of the
+        iPhone and Android.
 
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
-        (WebCore::WebCoreSynchronousLoader::didFail):
-        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+        * page/EventHandler.cpp:
+        (WebCore::assembleTargetTouches): Added. new function to build the
+            targetTouches list. Filters a list of touches (passed) about
+            another given touch.
+        (WebCore::EventHandler::handleTouchEvent): Remove the
+            m_touchEventTarget member, and simplify the generation of the
+            TouchLists that are bundled with the TouchEVent object. Dispatch
+            the event to the target of the touch that caused the event to be
+            fired.
+        * page/EventHandler.h: Remove m_touchEventTarget.
+
+2010-02-26  Dirk Pranke  <dpranke@chromium.org>
 
-2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Timothy Hatcher.
+        Fix the handling of updates to #hash fragments to check for differences
+        post-canonicalization rather than comparing pre- to post-. Chromium
+        had a bug where we would set the #hash on an about:blank URL and generate
+        an onload event because we thought the URL (not just the fragment) was
+        changing.
 
-        WebInspector: Make properties inspection serialized.
+        http://bugs.webkit.org/show_bug.cgi?id=35180
 
-        https://bugs.webkit.org/show_bug.cgi?id=28078
+        Test: fast/loader/about-blank-hash-change.html
 
-        * inspector/front-end/DOMAgent.js:
-        (InspectorController.getPrototypes):
-        (InspectorController.getProperties):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getPrototypes):
-        (InjectedScript.getProperties):
-        (InjectedScript.setPropertyValue):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectRef):
-        (WebInspector.ObjectPropertyRef):
-        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
-        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertiesSection.prototype._update):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] wml.css lacks <pre> support
-        https://bugs.webkit.org/show_bug.cgi?id=28135
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::hashAccessorSetter):
 
-        Add <pre> support for WML.
-        Extended fast/wml/text-emphasis.wml to cover <pre> support.
+2010-02-26  Zhenyao Mo  <zmo@google.com>
 
-        * css/wml.css: <pre> section copied from html.css
+        Reviewed by David Levin.
 
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        texImage2D and texSubImage2D taking ImageData ignore flipY and premultiplyAlpha
+        https://bugs.webkit.org/show_bug.cgi?id=34459
 
-        Reviewed by Oliver Hunt.
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-data.html
 
-        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D): Apply flipY and premultiplyAlpha to the texture data.
+        (WebCore::WebGLRenderingContext::texSubImage2D): Ditto.
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::extractImageData): Extract data from ImageData, applying flipY and premultiplyAlpha.
+        * platform/graphics/GraphicsContext3D.h: Add function extractImageData declaration.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::loadItem):
+2010-02-26  Zhenyao Mo  <zmo@google.com>
 
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Reviewed by David Levin.
 
-        Reviewed by George Staikos.
+        Set viewport to canvas size upon context creation
+        https://bugs.webkit.org/show_bug.cgi?id=35057
 
-        [WML] Deck access control is completly broken
-        https://bugs.webkit.org/show_bug.cgi?id=27721
+        Covered by existing tests, in particular fast/canvas/webgl/gl-get-calls.html
 
-        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
-        Added several new layout tests covering local & remote access support.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext): Set the viewport size to match the canvas size.
 
-        In order to detect WML task execution failures from within the WML layout tests a new
-        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
-        error message. Change WML log messages to dump to InspectorClient, just like it's done
-        for HTML - we used to behave like JSMessageSource, which is wrong.
+2010-02-26  Pavel Feldman  <pfeldman@chromium.org>
 
-        Tests: http/tests/wml/access-target-domain-deny.html
-               http/tests/wml/access-target-path-deny.html
-               http/tests/wml/access-target.html
-               wml/access-target-deny.html
-               wml/access-target.html
+        Not reviewed: touch InspectorController to force front-end deployment.
 
-        * inspector/ConsoleMessage.h:
-        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
-        (WebCore::ConsoleMessage::message): Added public method to access the error message.
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
-        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoaderTypes.h:
-        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
-        * page/Console.cpp:
-        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
-        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
-        * page/Console.h:
-        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
-        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
-        (WebCore::WMLAccessElement::parseMappedAttribute):
-        (WebCore::WMLAccessElement::insertedIntoDocument):
-        * wml/WMLAccessElement.h:
-        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::WMLDocument::initialize):
-        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
-        (WebCore::reportWMLError):
-        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::normalizedHostName):
-        (WebCore::hostFromURL):
-        (WebCore::urlForHistoryItem):
-        (WebCore::tryAccessHistoryURLs):
-        (WebCore::WMLPageState::processAccessControlData):
-        (WebCore::WMLPageState::resetAccessControlData):
-        (WebCore::WMLPageState::canAccessDeck):
-        (WebCore::WMLPageState::hostIsAllowedToAccess):
-        (WebCore::WMLPageState::pathIsAllowedToAccess):
-        * wml/WMLPageState.h:
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * inspector/InspectorController.cpp:
 
-        Reviewed by Maciej Stachowiak.
+2010-02-26  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        FrameLoadType / WebFrameLoadType enums are out of sync
-        https://bugs.webkit.org/show_bug.cgi?id=28132
+        Reviewed by Pavel Feldman.
 
-        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
-        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
-        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
+        WebInspector: While the current timeline view in DevTools provides a great overview of
+        things happening, we should make it easier to locate the cause of an event,
+        e.g., link to JS where relevant.
+        Caller info support for all kind of Timeline events and new Function Call event will be added.
+        JSC can be patched the same way as it will be done for V8.
 
-        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
+        https://bugs.webkit.org/show_bug.cgi?id=33995
 
-        * loader/FrameLoaderTypes.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::callLocation):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::callLocation):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willCallFunction):
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
         (WebCore::):
+        (WebCore::InspectorTimelineAgent::instanceCount):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createFunctionCallData):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.hideWhenClicked):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._closeRecordDetails):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype._createCell):
+        (WebInspector.TimelineRecordListRow.prototype._createRow):
+        (WebInspector.TimelineRecordListRow.prototype._createLinkRow):
+        (WebInspector.TimelineRecordListRow.prototype._generateBubbleContent):
+        (WebInspector.TimelineRecordListRow.prototype._onClick):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyResourceAsNode):
 
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] manual-tests/wml/onevent-prev.wml crashes
-        https://bugs.webkit.org/show_bug.cgi?id=27722
-
-        Fix intrinsic event execution, leading to crashes.
-        First finish parsing the document, then execute the events. Not the other way round.
-        -> exposes bugs all over the WML layout tests, which relied on that quirk.
-
-        Fixes manual-tests/wml/onevent-prev.wml.
-
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::WMLDocument):
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::WMLDocument::initialize):
-        * wml/WMLDocument.h:
-
-2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
-        introduced by http://trac.webkit.org/changeset/46956.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * WebCore.gypi: Added ImageBuffer.cpp.
-
-2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by Jan Michael Alonzo.
-
-        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
-        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
-
-        * dom/Document.idl:
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Eric Seidel.
+2010-02-26  Csaba Osztrogonác  <ossy@webkit.org>
 
-        SVG Filter need feColorMatrix implementation
-        [https://bugs.webkit.org/show_bug.cgi?id=27711]
+        Unreviewed. Roll-out r55263 because it broke fast/forms/textarea-type-spaces-pretty-diff.html.
+        https://bugs.webkit.org/show_bug.cgi?id=30946
 
-        Adds the filter effect feColorMatrix to SVG filters. 
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::isWhitespace):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/InsertTextCommand.h:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
 
-        There is already a test in the w3c directory.
-        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
+2010-02-25  Mark Rowe  <mrowe@apple.com>
 
-        * platform/graphics/filters/FEColorMatrix.cpp:
-        (WebCore::matrix):
-        (WebCore::saturate):
-        (WebCore::huerotate):
-        (WebCore::luminance):
-        (WebCore::FEColorMatrix::apply):
+        Reviewed by Brady Eidson.
 
-2009-08-08  Dirk Schulze  <krit@webkit.org>
+        <rdar://problem/7688455> REGRESSION(r55205): Crash inside dispatchEventsOnWindowAndFocusedNode when clicking link from bookmarks view
 
-        Reviewed by Oliver Hunt.
+        Null-check the document's page to avoid dereferencing a null page.
 
-        Build fix for Tiger.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
+        No regression test is added as this appears to be dependent on an interaction with Safari's bookmarks view that is
+        not testable from within DumpRenderTree.
 
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
 
-2009-08-08  Dirk Schulze  <krit@webkit.org>
+2010-02-25  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Simon Fraser.
 
-        This is an initial implementation for linearRGB and sRGB support for all
-        platforms. Some platforms like Cg support different color spaces
-        natively, others like Qt, Cairo and Skia do not. This patch uses the
-        native implementation of platforms if possible and offers a common version
-        if not.
+        Multiple repaints on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=35409
 
-        Different color spaces are used in SVG Filters. Nearly every Filter test 
-        case is a test for this patch and will be enabled, once Filters are enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
+        apple.com was triggering the fast scaling path for background images due to
+        repeated repaints as more content came in.  This occured due to a two problems
+        in the logic to detect scaling.  The first is that the main context is flipped
+        on mac so fails the identity or translation check.  We work around this by adding
+        an function that allows the scaling for a flipped CTM.  The other problem was that
+        we were looking at the destination rect size instead of the destination tile size
+        when deciding if the size we were drawn at would cause scaling.
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * platform/graphics/GeneratedImage.cpp:
-        (WebCore::GeneratedImage::drawPattern):
-        * platform/graphics/ImageBuffer.cpp: Added.
-        (WebCore::ImageBuffer::transformColorSpace):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::):
-        (WebCore::ImageBuffer::create):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::getEffectContext):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::strokeContains):
-        (WebCore::Path::strokeBoundingRect):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::scratchContext):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::paint):
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::isIdentityOrTranslationOrFlipped):
         * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
         (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::buildPattern):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::nativeImageForCurrentFrame):
-        * svg/graphics/SVGPaintServerGradient.cpp:
-        (WebCore::createMaskAndSwapContextForTextGradient):
-        * svg/graphics/SVGPaintServerPattern.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-        * svg/graphics/SVGResourceFilter.cpp:
-        (WebCore::SVGResourceFilter::prepareFilter):
-        (WebCore::SVGResourceFilter::applyFilter):
-        * svg/graphics/SVGResourceMasker.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-        * svg/graphics/filters/SVGFETile.cpp:
-        (WebCore::FETile::apply):
-
-2009-08-08  Xan Lopez  <xlopez@igalia.com>
-
-        Roll out r46928, since it wasn't done in accordance with the
-        agreed naming.
-
-        * bindings/gdom/GdomDOMObject.cpp: Removed.
-
-2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        [Gtk] Enable accessibility in Gtk DRT
-        https://bugs.webkit.org/show_bug.cgi?id=25989
-
-        Add SPI to get the focused accessible element to be used by DRT.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_focused_element):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
-
-2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix - add html/canvas to the binding generator's include path
-
-        * GNUmakefile.am:
-
-2009-08-07  Oliver Hunt  <oliver@apple.com>
-
-        Another attempt to fix windows.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-
-2009-08-07  Oliver Hunt  <oliver@apple.com>
-
-        Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix - add html/canvas to the include path.
-
-        * GNUmakefile.am:
-
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
-
-        Prospective build fix for Qt following r46937.
-
-        * WebCore.pro:
-
-2009-08-07  Yong Li  <yong.li@torchmobile.com>
-
-        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
-        https://bugs.webkit.org/show_bug.cgi?id=27734
-
-        * platform/graphics/GlyphBuffer.h:
-        (WebCore::GlyphBuffer::advanceAt):
-        (WebCore::GlyphBuffer::advanceData):
-        (WebCore::GlyphBuffer::add):
-
-2009-08-07  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
 
-        WINCE PORT: pass unrecognized glyphs to GDI to handle
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+2010-02-25  Enrica Casucci  <enrica@apple.com>
 
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::glyphDataForCharacter):
-
-2009-08-07  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Move Canvas related file to a subdirectories
-        https://bugs.webkit.org/show_bug.cgi?id=28026
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/CanvasGradient.cpp: Removed.
-        * html/CanvasGradient.h: Removed.
-        * html/CanvasGradient.idl: Removed.
-        * html/CanvasPattern.cpp: Removed.
-        * html/CanvasPattern.h: Removed.
-        * html/CanvasPattern.idl: Removed.
-        * html/CanvasPixelArray.cpp: Removed.
-        * html/CanvasPixelArray.h: Removed.
-        * html/CanvasPixelArray.idl: Removed.
-        * html/CanvasRenderingContext2D.cpp: Removed.
-        * html/CanvasRenderingContext2D.h: Removed.
-        * html/CanvasRenderingContext2D.idl: Removed.
-        * html/CanvasStyle.cpp: Removed.
-        * html/CanvasStyle.h: Removed.
-        * html/canvas: Added.
-        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
-        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
-        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
-        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
-        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
-        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
-        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
-        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
-        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
-        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
-        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
-        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
-        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
-        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
-
-2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
-
-        Reviewed by David Hyatt.
-
-        QtWebkit ignores letter-spacing and word-spacing styles.
-        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
-        class, but the values for these options are not not passed on from
-        the platform independent part of the Font class.
-        Fixed QtWebkit behavior by applying the options to QFont when it is
-        returned via Font::font()
+        Reviewed by Adele Peterson.
 
-        http://bugs.webkit.org/show_bug.cgi?id=27988
+        Extra layout on keypress after a space (problem with rebalanceWhitespaceAt in InsertTextCommand).
+        https://bugs.webkit.org/show_bug.cgi?id=30946
+        <rdar://problem/7639184>
 
-        LayoutTests:
-        fast/css/word-space-extra.html
-        css2.1/t1604-c542-letter-sp-00-b-a.html
-        css2.1/t1604-c541-word-sp-01-b-a.html
-        css1/text_properties/word_spacing.html
+        Do text insertion and whitespace rebalancing around the insertion in one step so that there's only one layout.
+        This patch was originally made by Justin Garcia.
         
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::font):
-
-2009-08-07  Nicolas Weber  <thakis@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Use correct highlight color for listboxes and completion popups.
+        Test: editing/inserting/rebalance-whitespace-1.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28090
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): No behavior changes here,
+        just pushed the code that determined the extent of whitespace surrounding a position
+        to its own helper function.
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTextIntoNodeAndRebalanceWhitespace): Added.  Find 
+        whitespace surrounding the insertion position, add the text to insert, rebalance that entire
+        string, then insert it into the document.
+        (WebCore::InsertTextCommand::input):
+        * editing/InsertTextCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::isWhitespace): Moved from CompositeEditCommand.cpp.
+        (WebCore::extentOfWhitespaceForRebalancingAt): Moved code from rebalanceWhitespaceAt into this helper
+        function.  Obtains the offset of the start and end of whitespace around a particular position.
+        * editing/htmlediting.h:
 
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        Rename activeListBoxSelectionBackgroundColor to
-        platformActiveListBoxSelectionBackgroundColor, so that it actually
-        overrides a virtual method.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+        Reviewed by Anders Carlsson.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
 
-        Added a fourth bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26988
+        Test: java/array-sort.html
 
-        * platform/haiku/PasteboardHaiku.cpp: Added.
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::generalPasteboard):
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        (WebCore::Pasteboard::writeURL):
-        (WebCore::Pasteboard::writeImage):
-        (WebCore::Pasteboard::clear):
-        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
-        (WebCore::keyIdentifierForHaikuKeyCode):
-        (WebCore::windowsKeyCodeForKeyEvent):
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
-        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
-        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-2009-08-07  Nicolas Weber  <thakis@chromium.org>
-
-        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
-        Heavily inspired by Firefox's take on this issue.
+        Made RuntimeArray inherit from JSArray, keeping the promise given in ClassInfo.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27909
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        (JSC::RuntimeArray::~RuntimeArray):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::classInfo):
+        (JSC::RuntimeArray::getConcreteArray):
 
-        Reviewed by Eric Seidel.
+2010-02-25  Dan Bernstein  <mitz@apple.com>
 
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageReader::decode):
-        Tell jpeglib to convert ycck to cmyk and keep cmyk.
-        (WebCore::convertCMYKToRGBA):
-        Added function to convert cmyk to rgb.
-        (WebCore::convertRGBToRGBA):
-        Extracted existing conversion logic into its own function.
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
-        images.
+        Reviewed by Alexey Proskuryakov.
 
-2009-08-07  Drew Wilson  <atwilson@google.com>
+        Fixed a regression introduced in r44243, which made the assertion in checkListItems()
+        ineffective.
 
-        Reviewed by David Levin.
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElementData::checkListItems): Copy the items vector before recomputing it,
+        then assert that the newly-computed vector is equal to the copy.
 
-        SharedWorkers should be shared
-        https://bugs.webkit.org/show_bug.cgi?id=28058
+2010-02-25  Dirk Schulze  <krit@webkit.org>
 
-        Added tracking of shared workers to the SharedWorkerRepository.
+        Reviewed by Nikolas Zimmermann.
 
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::create):
-        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
-        (WebCore::SharedWorkerProxy::thread):
-        (WebCore::SharedWorkerProxy::closing):
-        Added flag used to determine whether the worker has closed itself while loading.
-        (WebCore::SharedWorkerProxy::url):
-        (WebCore::SharedWorkerProxy::name):
-        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::SharedWorkerProxy::addToDocumentSet):
-        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
-        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
-        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
-        (WebCore::SharedWorkerScriptLoader::load):
-        (WebCore::SharedWorkerScriptLoader::notifyFinished):
-        (WebCore::DefaultSharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Now handles "worker already loaded" case.
-        (WebCore::SharedWorkerRepository::connect):
-        Delegates to DefaultSharedWorkerRepository::connectToWorker
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        Atomic get-or-create operation on the internal tracking HashMap.
-        * workers/DefaultSharedWorkerRepository.h:
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::SharedWorker):
-        * workers/SharedWorkerRepository.h:
-        Removed instance() API and made constructor private to prevent instantiation.
-        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
+        SVG's tspan is no member of SVGRenderBase, this can cause crashes on filters
+        https://bugs.webkit.org/show_bug.cgi?id=35354
 
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+        This makes the base class RenderSVGInline of RenderSVGTSpan and RenderSVGInlineText
+        dependent on SVGBaseRenderer.
+        The SVG spec want as to use the object bounding box of the text root as the bounding box
+        for text-childs. So we search for the text root and use it's bounding box, stroke rect and
+        repaint rect for further calculations.
 
-        Reviewed by Eric Seidel.
+        Test: svg/filters/filter-on-tspan.svg
 
-        Added four Haiku-specific files for WebCore:
-        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
-        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28080
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::objectBoundingBox): Find the text root and give back it's bounding box.
+        (WebCore::RenderSVGInline::strokeBoundingBox): same for stroke rect
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates): same for repaint rect
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::toSVGRenderBase): RenderSVGInline is part of SVGRenderBase now.
+        * rendering/RenderSVGTSpan.h:
+        (WebCore::RenderSVGTSpan::renderName): Removed bounding box code. Was just a hack for filters and maskers.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::findTextRootObject): Search for the text root.
+        * rendering/SVGRenderSupport.h:
+        * svg/graphics/SVGPaintServerGradient.cpp: moved findTextRootObject to SVGRenderSupport
 
-        * platform/haiku/PopupMenuHaiku.cpp: Added.
-        (WebCore::PopupMenu::PopupMenu):
-        (WebCore::PopupMenu::~PopupMenu):
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::hide):
-        (WebCore::PopupMenu::updateFromElement):
-        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
-        * platform/haiku/ScreenHaiku.cpp: Added.
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
-        (WebCore::SearchPopupMenu::SearchPopupMenu):
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        (WebCore::SearchPopupMenu::enabled):
-        * platform/haiku/SoundHaiku.cpp: Added.
-        (WebCore::systemBeep):
+2010-02-25  Dirk Schulze  <krit@webkit.org>
 
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Eric Seidel.
+        Use-element doesn't transform clipPath
+        https://bugs.webkit.org/show_bug.cgi?id=35375
 
-        Added two Haiku-specific files to WebCore:
-        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28080
+        If the use element is a child of clipPath, any settings on x, y or transform does not
+        transform the clipPath it references.
+        The use-element just misses this transformation in toClipPath.
 
-        * platform/haiku/TemporaryLinkStubs.cpp: Added.
-        (loadResourceIntoArray):
-        (WebCore::historyContains):
-        (WebCore::supportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::userIdleTime):
-        (WebCore::callOnMainThread):
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        (WebCore::KURL::fileSystemPath):
-        (WebCore::getSupportedKeySizes):
-        * platform/haiku/WidgetHaiku.cpp: Added.
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        (WebCore::Widget::paint):
-        (WebCore::Widget::setIsSelected):
+        Test: svg/custom/use-on-clip-path-with-transformation.svg
 
-2009-08-07  Jian Li  <jianli@chromium.org>
+        * platform/graphics/cairo/PathCairo.cpp: Gtk port translated the path to the wrong direction.
+        (WebCore::Path::translate):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-25  Jian Li  <jianli@chromium.org>
 
-        [V8] Fix the problem that isAttribute is set to false for onerror and
-        onmessage in worker custom code.
-        https://bugs.webkit.org/show_bug.cgi?id=28083
+        Reviewed by Dmitry Titov.
 
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
+        File.type support.
+        https://bugs.webkit.org/show_bug.cgi?id=35361
 
-2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+        Test: LayoutTests/editing/pasteboard/file-input-files-access.html
 
-        Reviewed by Dimitri Glazkov.
+        * html/File.cpp:
+        (WebCore::File::File):
+        * html/File.h:
+        (WebCore::File::type):
+        * html/File.idl:
 
-        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
+2010-02-25  Alexander Pavlov  <apavlov@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28071
+        Reviewed by Pavel Feldman.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        Javascript console should not attempt to scroll to end of console if console is not visible
 
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=22992
 
-        Reviewed by Justin Garcia.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView.scrollIntoView):
+        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView):
+        (WebInspector.ConsoleView.prototype.addMessage):
 
-        selectionHasStyle doesn't handle text-specific properties properly
-        https://bugs.webkit.org/show_bug.cgi?id=27858
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
-        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
-        regardless of whether the style is also present in their ancestor nodes or not.
-        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
+        Qt and Gtk build fixes.
 
-        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
-        at least one text node, rather than at the beginning of selection except on Mac.
-        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
+        * GNUmakefile.am:
+        * WebCore.pro:
+        Added CRuntimeObject.{c,cpp}.
 
-        Test: editing/execCommand/toggle-compound-styles.html
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
-        * editing/Editor.cpp:
-        (WebCore::):
-        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
-        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
-        * editing/EditorCommand.cpp:
-        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
+        Windows build fix.
 
-2009-08-07  Jian Li  <jianli@chromium.org>
+        * WebCore.vcproj/WebCore.vcproj: Added CRuntimeObject.{c,cpp}.
 
-        Reviewed by Dimitri Glazkov.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=28082
+        Reviewed by Geoffrey Garen.
 
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        https://bugs.webkit.org/show_bug.cgi?id=35394
+        <rdar://problem/7685262> Make passing objects between Java and plug-ins work
 
-2009-08-07  Kwang Yul Seo  <skyul@company100.net>
+        * WebCore.PluginHostProcess.exp: WebKit now subclasses RuntimeObject, so it needed more exports.
 
-        Reviewed by Eric Seidel.
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::callRuntimeObject):
+        (JSC::Bindings::callRuntimeConstructor):
+        Assert that a runtime object is passed as function.
 
-        Cairo-based Windows port does not handle cookies properly
-        https://bugs.webkit.org/show_bug.cgi?id=27414
+        * bridge/runtime_object.h: Moved RuntimeObject into Bindings namespace, matching other
+        related classes.
 
-        curl handles cookies by itself, so using WinINet functions
-        to get and set cookies is wrong.
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::toString): Pass rootObject to convertValueToJValue(). It's not needed when
+        constructing a string, but this function now takes it for the sake of Object.
+        (JavaJSObject::convertValueToJObject): Check that object class is JavaRuntimeObject, not
+        just RuntimeObject.
 
-        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
-        cookies can be implemented later once curl provides an API to
-        get and set cookies.
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::setValueToInstance): Pass rootObject to convertValueToJValue().
+        (JavaArray::setValueAt): Ditto.
 
-        * WebCore.vcproj/WebCore.vcproj:
+        * bridge/jni/jsc/JNIUtilityPrivate.h: convertValueToJValue() now takes a RootObject argument,
+        because one is needed to gcProtect an object ghtat is wrapped into JSObject.
 
-2009-08-07  Michael Nordman  <michaeln@google.com>
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue): Convert
+        JavaScript objects to Java JSObject ones. This was already happening in other code paths,
+        which we should change to use common code.
 
-        Reviewed by Dimitri Glazkov.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::newRuntimeObject): Create an appropriate RuntimeObject subclass,
+        which is JavaRuntimeObject for Java.
+        (JavaInstance::invokeMethod): Unwrap returned JavaObjects that contain JS objects.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28074
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/c/CRuntimeObject.cpp: Added.
+        (JSC::Bindings::CRuntimeObject::CRuntimeObject):
+        (JSC::Bindings::CRuntimeObject::~CRuntimeObject):
+        (JSC::Bindings::CRuntimeObject::getInternalCInstance):
+        * bridge/c/CRuntimeObject.h: Added.
+        (JSC::Bindings::CRuntimeObject::classInfo):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::newRuntimeObject):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jni/jsc/JavaRuntimeObject.cpp: Added.
+        (JSC::Bindings::):
+        (JSC::Bindings::JavaRuntimeObject::JavaRuntimeObject):
+        (JSC::Bindings::JavaRuntimeObject::~JavaRuntimeObject):
+        (JSC::Bindings::JavaRuntimeObject::getInternalJavaInstance):
+        * bridge/jni/jsc/JavaRuntimeObject.h: Added.
+        (JSC::Bindings::JavaRuntimeObject::classInfo):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/ObjCRuntimeObject.h: Added.
+        (JSC::Bindings::ObjCRuntimeObject::classInfo):
+        * bridge/objc/ObjCRuntimeObject.mm: Added.
+        (JSC::Bindings::):
+        (JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
+        (JSC::Bindings::ObjCRuntimeObject::~ObjCRuntimeObject):
+        (JSC::Bindings::ObjCRuntimeObject::getInternalObjCInstance):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::newRuntimeObject):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_root.h:
+        Added RuntimeObject subclasses for each instance type, and use them for type casting.
 
-        V8 bindings for the window.applicationCache attribute.
+2010-02-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
+        Rubber-stamped by Xan Lopez.
 
-2009-08-07  Alpha Lam  <hclam@chromium.org>
+        Adopt the same string as the one that is expected by
+        fast/parser/fragment-parser.html for the description used by the
+        <isindex> element.
 
-        Reviewed by Eric Seidel.
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::searchableIndexIntroduction):
 
-        Right click on timeline of media controls panel cause seek
-        https://bugs.webkit.org/show_bug.cgi?id=27920
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
-        Add a test simulate the behavior of seeking by right clicking
-        on the time bar of media controls while playing.
+        Reviewed by Timothy Hatcher.
 
-        * media/controls-right-click-on-timebar-expected.txt: Added.
-        * media/controls-right-click-on-timebar.html: Added.
+        Web Inspector: evaluate-on-hover does not work on HTML files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35378
+
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.set line):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._attrValueTokenType):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/SourceTokenizer.js:
+        (WebInspector.SourceTokenizer.prototype.set condition):
+        (WebInspector.SourceTokenizer.prototype.get condition):
+        (WebInspector.SourceTokenizer.prototype.get subTokenizer):
+        (WebInspector.SourceTokenizer.prototype.getLexCondition):
+        (WebInspector.SourceTokenizer.prototype.setLexCondition):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLine):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+
+2010-02-25  Xan Lopez  <xlopez@igalia.com>
 
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+        Reviewed by Gustavo Noronha.
 
-        Reviewed by Justin Garcia.
+        Simple style cleanups.
 
-        deprecatedCopyInheritableProperties must be replaced by two different functions
-        https://bugs.webkit.org/show_bug.cgi?id=28057
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::plugRemovedCallback):
+        (WebCore::plugAddedCallback):
+        (WebCore::PluginView::platformStart):
 
-        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
-        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
-        which consists of all CSS properties need to be preserved under editing operations.
+2010-02-25  Andreas Kling  <andreas.kling@nokia.com>
 
-        No test is added since this patch does not change any behavior.
+        Reviewed by Darin Adler.
 
-        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
-        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::):
-        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
-        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
-        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
-        * editing/ApplyStyleCommand.h:
-        (WebCore::):
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
-        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
-        * editing/EditCommand.cpp:
-        * editing/EditCommand.h:
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
-        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
-        * editing/RemoveFormatCommand.cpp:
-        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
-        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
-        * editing/markup.cpp:
-        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
-        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
-        (WebCore::createMarkup): Uses editingStyleAtPosition
+        Optimize decoding of Latin-1 text by exploiting the fact that most of it will
+        be ASCII-only data.
 
-2009-08-07  Steve Block  <steveblock@google.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35233
 
-        Reviewed by Darin Adler.
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::TextCodecLatin1::decode):
 
-        Bug 27250: Geolocation callback function IDL files are superfluous
-        https://bugs.webkit.org/show_bug.cgi?id=27250
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
-        The objects for the Geolocation success and error callbacks are created 'manually' in
-        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
-        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
-        appear on the window object. Hence IDL files for these callbacks are not required.
+        Reviewed by Dimitri Glazkov.
 
-        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
-        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
+        Web Inspector: make script lines count calculation lazy.
 
-        No new tests required.
+        https://bugs.webkit.org/show_bug.cgi?id=35392
 
-        * DerivedSources.make: Modified. Removed reference to IDL files.
-        * WebCore.gypi: Modified. Removed reference to IDL files.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
-        * page/PositionCallback.idl: Removed.
-        * page/PositionErrorCallback.idl: Removed.
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        (WebInspector.Script.prototype.get linesCount):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
 
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+2010-02-25  James Choi  <jchoi42@pha.jhu.edu>
 
         Reviewed by David Levin.
 
-        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
-        put the idl files back into play regardless of compile time defines.
-
-        * html/TimeRanges.idl:
+        Change hardcoded gcc paths to be Solaris friendly
+        https://bugs.webkit.org/show_bug.cgi?id=35213
 
-2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by George Staikos.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/IDLParser.pm:
+        * css/make-css-file-arrays.pl:
+        * dom/make_names.pl:
 
-        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
+2010-02-25  Xan Lopez  <xlopez@igalia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28050
+        Reviewed by Gustavo Noronha.
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::baselinePosition):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::supportsFocus):
-        (WebCore::RenderThemeQt::applyTheme):
+        Workaround Java plugins not drawing themselves properly on first
+        expose by doing a late size-allocate after 'plug-added' has been
+        emitted on the embedding GtkSocket. It's unclear to me if this is
+        a bug in our side or theirs, but this should be pretty safe and
+        fixes the annoyance while we investigate it further.
 
-2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::plugAddedCallback):
+        (WebCore::PluginView::platformStart):
 
-        Reviewed by Eric Seidel.
+2010-02-23  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
-        from discarding style colour.
+        Reviewed by Tor Arne Vestbø.
 
-        Add tests and remove tests from platform/qt/Skipped that now pass.
+        Add missing include guards
 
-        https://bugs.webkit.org/show_bug.cgi?id=28050
+        * loader/CrossOriginPreflightResultCache.h:
+        * loader/MainResourceLoader.h:
 
-        Tests: fast/forms/menulist-style-color.html
-               fast/forms/text-style-color.html
+2010-02-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustTextFieldStyle):
-        (WebCore::RenderThemeQt::adjustMenuListStyle):
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
+        [Qt] Restrict the optimization flags for Symbian to release builds.
 
-        Unreviewed, build fix.
+        * WebCore.pro:
 
-        https://bugs.webkit.org/show_bug.cgi?id=22495
-        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
-        http://trac.webkit.org/changeset/46874 re-landed
+2010-02-25  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+        Qt WebGL support
 
-        Reviewed by Darin Adler and George Staikos.
+        Adds GraphicsContext3D QtWebKit implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=35153
 
-        Add rectToRect convenience function which returns the TransformationMatrix
-        which maps the 'from' rectangle to the 'to' rectangle.
+        * WebCore.pri:
+        * WebCore.pro:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp: Added.
+        (WebCore::GraphicsContext3DInternal::isValid):
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::getProcAddress):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::blendColor):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::blendEquationSeparate):
+        (WebCore::GraphicsContext3D::blendFunc):
+        (WebCore::GraphicsContext3D::blendFuncSeparate):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::clearColor):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::clearDepth):
+        (WebCore::GraphicsContext3D::clearStencil):
+        (WebCore::GraphicsContext3D::colorMask):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::copyTexImage2D):
+        (WebCore::GraphicsContext3D::copyTexSubImage2D):
+        (WebCore::GraphicsContext3D::cullFace):
+        (WebCore::GraphicsContext3D::depthFunc):
+        (WebCore::GraphicsContext3D::depthMask):
+        (WebCore::GraphicsContext3D::depthRange):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::disable):
+        (WebCore::GraphicsContext3D::disableVertexAttribArray):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::enable):
+        (WebCore::GraphicsContext3D::enableVertexAttribArray):
+        (WebCore::GraphicsContext3D::finish):
+        (WebCore::GraphicsContext3D::flush):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::frontFace):
+        (WebCore::GraphicsContext3D::generateMipmap):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::getString):
+        (WebCore::GraphicsContext3D::hint):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isEnabled):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::sampleCoverage):
+        (WebCore::GraphicsContext3D::scissor):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::stencilFunc):
+        (WebCore::GraphicsContext3D::stencilFuncSeparate):
+        (WebCore::GraphicsContext3D::stencilMask):
+        (WebCore::GraphicsContext3D::stencilMaskSeparate):
+        (WebCore::GraphicsContext3D::stencilOp):
+        (WebCore::GraphicsContext3D::stencilOpSeparate):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::viewport):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::createBuffer):
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createProgram):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::createShader):
+        (WebCore::GraphicsContext3D::createTexture):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteProgram):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteShader):
+        (WebCore::GraphicsContext3D::deleteTexture):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+        (WebCore::GraphicsContext3D::getImageData):
 
-        https://bugs.webkit.org/show_bug.cgi?id=28067
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
-        No tests as this would require binding the method to js and since it is static
-        that doesn't seem possible.  Please check the math.
+        Reviewed by Timothy Hatcher.
 
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        (WebCore::TransformationMatrix::rectToRect):
-        * platform/graphics/transforms/TransformationMatrix.h:
+        Web Inspector: Swap images for activate and deactivate breakpoints.
 
-2009-08-07  Brady Eidson  <beidson@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35383
 
-        Reviewed by Darin Adler.
+        * WebCore.gypi:
+        * inspector/front-end/Images/breakpointsActivateButtonGlyph.png: Renamed from WebCore/inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png.
+        * inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png: Renamed from WebCore/inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-        Implement the HTML5 hashchange event.
-        https://bugs.webkit.org/show_bug.cgi?id=21605
+2010-02-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Test: fast/loader/hashchange-event.html
+        Reviewed by Xan Lopez.
 
-        * dom/EventNames.h: Add "hashchange"
-        * html/HTMLAttributeNames.in: Add "onhashchange"
+        Go back on symlink resolution if we are loading the flash plugin,
+        and the path contains /netscape/, following what Chromium does.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::HashChangeEventTask::create):
-        (WebCore::HashChangeEventTask::performTask):
-        (WebCore::HashChangeEventTask::HashChangeEventTask):
-        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
-          new fragment identifier is different from the old one, queue a hash change event
-          on the Document.
-
-        Add a window event listener for the hashchange event if onhashchange is encountered:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute): 
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        Thanks to Evan Martin for the help on this!
 
-        Add a new string utility method that gives "null and empty are equivalent" behavior:
-        * platform/text/PlatformString.h:
-        (WebCore::equalIgnoringNullity):
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringNullity):
-        * platform/text/StringImpl.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
 
-2009-08-07  Jessie Berlin  <jberlin@apple.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Add the initial implementation of the ability to resize the columns in
-        a DataGrid in the Web Inspector. Enables that functionality in both the
-        Profile View and in the Local Storage View.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26182
-        
-        In this version, resizing a column can change the width of at most two
-        columns (the columns to the left and right of the resizer being dragged).
-        
-        Possible changes in future patches:
-        
-        1) Be able to specify the minimum size of a column and the maximum size
-           of a column. If the minimum size is equal to the maximum size, the
-           column can't be resized.
-        2) Make the behavior more in line with the following description:
-        
-        Everything before the column that is resized stays fixed size. The
-        resized column changes sizes. The other columns except the last stay
-        the same size. And the last column adjusts to fit with a minimum size.
-        If the last column is already the minimum, the next to last column
-        shrinks, etc.
-        
-        3) Make it possible to scale the column sizes appropriately when the
-           Web Inspector window gets resized.
-        
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        Once the DataGrid is added to the DOM, update the widths of the
-        DataGrid in order to put the resizers in place.
-        (WebInspector.DOMStorageItemsView.prototype.resize):
-        Update the widths of the DataGrid in order to correctly adjust the
-        positions of the resizers.
-        
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid):
-        Store column groups whose widths can later be changed when the columns
-        are resized by the user.
-        Also, keep track of whether the widths of the columns have been
-        initialized.
-        (WebInspector.DataGrid.prototype.updateWidths):
-        Create the resizers for the columns.
-        (WebInspector.DataGrid.prototype._clickInDataTable):
-        Didn't actually change anything in this method, just added a comma to
-        the end of the function.
-        (WebInspector.DataGrid.prototype._startResizerDragging):
-        Store the resizer that is currently dragging.
-        (WebInspector.DataGrid.prototype._resizerDragging):
-        Constrain the area that the resizer can be dragged to the column to
-        it's left and right, with some padding added to make sure that the
-        neighboring columns don't disappear.
-        (WebInspector.DataGrid.prototype._endResizerDragging):
-        
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.resize):
-        Resize the view.
-        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
-        ditto.
-        
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.prototype.show):
-        Now that the DataGrid is actually attached to the DOM, update the
-        widths of the DataGrid in order to put the resizers in place.
-        (WebInspector.ProfileView.prototype.resize):
-        Update the widths of the DataGrid in order to correctly adjust the
-        positions of the resizers.
-        
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.resize):
-        Resize the view.
-        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
-        ditto.
-        
-        * inspector/front-end/inspector.css:
-        Add in a style rule for a resizer in the Data Grid.
-
-2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Back out r46847 and fix the Qt build system to always generate
-        all the JS binding files from IDL files. The generated files
-        have #if feature guards, so the #ifs are not needed in the
-        files using them.
-
-        * WebCore.pro:
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSWorkerContextBase.cpp:
-        * bindings/js/WorkerScriptController.cpp:
+        Web Inspector: Scripts panel shows blank source when stopping on a breakpoint on refresh.
 
-2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35232
 
-        Reviewed by Adele Peterson.
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.canShowSourceLine):
+        (WebInspector.Panel.prototype.showSourceLine):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype.showSourceLine):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.get searchableViews):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype._resourceLoadingFinished):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLine):
+        (WebInspector.ScriptsPanel.prototype.showSourceLine):
+        (WebInspector.ScriptsPanel.prototype._scriptOrResourceForURLAndLine):
+        (WebInspector.ScriptsPanel.prototype.showView):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu.optionCompare):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._choosePanelToShowSourceLine):
+        (WebInspector.canShowSourceLine):
+        (WebInspector.showSourceLine):
 
-        Cannot scroll for box-reflect:right
-        https://bugs.webkit.org/show_bug.cgi?id=27979
+2010-02-25  Ben Murdoch  <benm@google.com>
 
-        Update m_overflowLeft an m_overflowWidth for reflection just like
-        m_overflowTop and m_overflowHeight.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Test: fast/reflections/reflection-overflow-scroll.html
+        The target element of a Touch should be the target where that touch originated, not where it is now.
+        https://bugs.webkit.org/show_bug.cgi?id=34585
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
+        Currently the target of a touch is set to the resulting node of the hit test where the touch currently
+        is. This does not match the behavior of iPhone or Android. This patch uses a hashmap on the EventHandler
+        to keep track of the target element when a touch is first started. This target is then used as the target
+        for subsequent touches with the same id. This matches observed behavior on iPhone and Android.
 
-2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+        Tests:
+        fast/events/touch/touch-target.html: Added.
+        fast/events/touch/basic-single-touch-events.html: Updated.
 
-        Reviewed by Adam Barth.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Store the originating target element of a touch in a hashmap
+            so that we can reuse that target for future events caused by that touch. This matches observed behavior
+            on iPhone and Android.
+        * page/EventHandler.h: Add hashmap as a member.
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::id): Store the touch point id as unsigned.
+        * platform/qt/PlatformTouchPointQt.cpp: 
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint): Cast platform touch id from signed to unsigned. Qt API
+            docs state that it will always be >= 0.
+
+2010-02-24  Antonio Gomes  <tonikitoo@webkit.org>
 
-        box-shadow's spread is ignored with <table>
-        https://bugs.webkit.org/show_bug.cgi?id=28017
+        Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+        Add a convenient center() method to IntRect
+        https://bugs.webkit.org/show_bug.cgi?id=35346
 
-        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+        As it is a convenience method, and implemention is
+        based on FloatRect's one, patch does not provide a
+        layout test.
 
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
+        * platform/graphics/IntRect.h:
+        (WebCore::IntRect::center):
 
-2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-25  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        Inspector: NodeLists Don't Display Well in the Console
-        https://bugs.webkit.org/show_bug.cgi?id=28061
+        Fake workers implementation that simulates workers using iframe and timer,
+        needed to support workers debugging. Also, a facility to inject scripts into
+        inspected page upon load.
+        https://bugs.webkit.org/show_bug.cgi?id=35148
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorBackend::removeAllScriptsToEvaluateOnLoad):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorController::removeAllScriptsToEvaluateOnLoad):
+        * inspector/InspectorController.h:
+        * inspector/front-end/InjectedFakeWorker.js: Added.
+        (InjectedFakeWorker.Worker):
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.postMessage):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._onmessageWrapper):
+        (InjectedFakeWorker.FakeWorker.prototype._dispatchMessage):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._buildWorker):
+        (InjectedFakeWorker.FakeWorker.prototype._setupWorkerContext.handler):
+        (InjectedFakeWorker.FakeWorker.prototype._setupWorkerContext):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.URL):
+        (InjectedFakeWorker.URL.prototype.urlRegEx.split):
+        (InjectedFakeWorker.URL.prototype.mockLocation):
+        (InjectedFakeWorker.URL.prototype.completeWith):
+        (InjectedFakeWorker.URL.prototype.sameOrigin):
+        (InjectedFakeWorker.DOMCoreException.formatError):
+        (InjectedFakeWorker.DOMCoreException):
+        (InjectedFakeWorker.noop):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.setInjectedScriptSource):
+        (.WebInspector.InspectorBackendStub.prototype.addScriptToEvaluateOnLoad):
+        (.WebInspector.InspectorBackendStub.prototype.removeAllScriptsToEvaluateOnLoad):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
 
-2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+2010-02-24  Nicholas Young  <nicholas.young@nokia.com>
 
-        Reviewed by David Levin.
+        Reviewed by Eric Carlson.
 
-        Chromium Linux: add support for @font-face
-        https://bugs.webkit.org/show_bug.cgi?id=28015
-        
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
+        Add mediaPlayerOwningDocument() to MediaPlayerClient.
+        https://bugs.webkit.org/show_bug.cgi?id=35374
 
-        Modified #ifdefs so that chromium linux can load remote fonts.
-        
-        * platform/graphics/chromium/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
+        No new tests. These are interface changes only.
 
-        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
-        
-        (WebCore::RemoteFontStream::RemoteFontStream):
-        (WebCore::RemoteFontStream::~RemoteFontStream):
-        (WebCore::RemoteFontStream::rewind):
-        (WebCore::RemoteFontStream::read):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerOwningDocument): Implementation for media element.
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerOwningDocument): New virtual method.
 
-        New class that implements SkStream interface and wraps wtf's SharedBuffer.
-        
-        * platform/graphics/chromium/FontCustomPlatformData.h:
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+2010-02-24  Andreas Kling  <andreas.kling@nokia.com>
 
-        Added member variables for Linux.
-        
-2009-08-06  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix JPEGImageDecoder.cpp compile error on WinCE
-        https://bugs.webkit.org/show_bug.cgi?id=28051
+        Optimized Font::normalizeSpaces() by caching the String::characters()
+        instead of repeatedly calling operator[]
 
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=35336
 
-2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces):
 
-        Reviewed by Eric Seidel.
+2010-02-24  Jungshik Shin  <jshin@chromium.org>
 
-        Adding WebCore support for the waf build system for wx.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27619
+        Reviewed by David Levin.
 
-        * wscript: Added.
+        [Chromium] Traditional Chinese Chrome on Windows should use PMingLiu instead of Simsun for Han characters
+        https://bugs.webkit.org/show_bug.cgi?id=35319
 
-2009-08-06  Adam Barth  <abarth@webkit.org>
+        No visible change in the layout test.
 
-        Unreviewed revert.
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
 
-        http://bugs.webkit.org/show_bug.cgi?id=27879
+2010-02-24  Anthony Ricaud  <rik@webkit.org>
 
-        Revert 46877 because it broke GTK.
+        Reviewed by Pavel Feldman.
 
-        * platform/graphics/wince/GraphicsContextWince.cpp:
+        Web Inspector: Reduce the timer to show the eval popover
+        https://bugs.webkit.org/show_bug.cgi?id=35344
 
-2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseMove):
 
-        Reviewed by Eric Seidel.
+2010-02-24  Jay Campan  <jcampan@google.com>
 
-        Bug 27956 - AX: roleValue should be cached for performance
-        https://bugs.webkit.org/show_bug.cgi?id=27956
+        Reviewed by David Levin.
 
-        Caches the role value of an accessibility object instead of calculating it everytime.
-        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
+        Don't show the autofill popup when the input text is disabled or read only.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        Test: manual-tests/chromium/no-autofill-on-readonly.html
 
-        Use generic role setter instead of specific ARIA role setter.
+        https://bugs.webkit.org/show_bug.cgi?id=35129
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::AccessibilityObject):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::headingLevel):
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::autofill):
+        *  manual-tests/chromium/no-autofill-on-readonly.html: Added.
 
-        Make headingLevel into instance method so that it can *safely* be called in the constructor.
+2010-02-24  Dominic Mazzoni  <dmazzoni@chromium.org>
 
-        (WebCore::AccessibilityObject::setRoleValue):
-        (WebCore::AccessibilityObject::roleValue):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
-        (WebCore::AccessibilityRenderObject::headingLevel):
-        (WebCore::AccessibilityRenderObject::intValue):
-        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
-        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (AXAttributeStringSetHeadingLevel):
+        Reviewed by Jeremy Orlow.
 
-2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+        Wraps includes of SVG headers so that it's possible to
+        compile the V8 bindings with SVG disabled, e.g. 'enable_svg=0'.
+        https://bugs.webkit.org/show_bug.cgi?id=35345
 
-        Reviewed by Adam Barth.
+        No new tests.
 
-        Change Noncopyable inheriting to public
-        http://bugs.webkit.org/show_bug.cgi?id=27879
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/custom/V8CSSValueCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8SVGElementCustom.cpp:
 
-        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
-        inheriting has been changed to public.
+2010-02-24  Maciej Stachowiak  <mjs@apple.com>
 
-        * platform/graphics/wince/GraphicsContextWince.cpp:
+        Unreviewed build fix.
 
-2009-08-06  Mark Rowe  <mrowe@apple.com>
+        Fix gtk build.
 
-        Rubber-stamped by Sam Weinig.
+        Include JSC headers as runtime/ instead of JavaScriptCore/
 
-        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+        * bindings/js/JSDOMWrapper.h:
+        * bindings/js/ScriptWrappable.h:
 
-        * WebCore.xcodeproj/project.pbxproj:
+2010-02-24  Maciej Stachowiak  <mjs@apple.com>
 
-2009-08-05  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Darin Adler.
+        Cache JavaScript wrappers inline in DOM nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35226
 
-        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
-        https://bugs.webkit.org/show_bug.cgi?id=22495
+        <rdar://problem/7664202>
         
-        Add a new Media interface, obtainable via the AbstractView, that can
-        evaluate queries via its matchesMedium() method.
+        7.4% speedup on Dromaeo DOM Core tests.
+        2.3% speedup on Hixie DOM Core tests.
 
-        Test: fast/media/matchmedium-query-api.html
+        This fixes the following things from the last attempt:
+        - Now builds in both debug and release and passes all tests
+        - Properly use a WeakGCPtr, not just a raw pointer, in ScriptWrappable
+        - Properly look in the appropriate per-document or per-world map
+        - Added an assert that would have caught any of the problems I found
+        - Handle clearing the inline cache properly in all cases
+        
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper): Adjust for name changes.
+        (WebCore::forgetDOMNode): Clear wrapper pointer.
+        (WebCore::cacheDOMNodeWrapper): Cache inline too if caching for normal world.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::Document::getWrapperCache): Inlined.
+        (WebCore::domObjectWrapperMapFor): Renamed to start with lowercase. Moved to header to inline.
+        * bindings/js/JSDOMWrapper.h: Added.
+        (WebCore::DOMObject::DOMObject): Factored this out of JSDOMBinding.h to avoid include
+        cycle. I think the class should be renamed, I picked a forward-looking header name because
+        we already have a DOMObject.h
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Renamed version of original createWrapper.
+        (WebCore::createWrapper): Call createWrapperInline. Out-of-line version.
+        (WebCore::toJSNewlyCreated): Call createWrapperInline instead of createWrapper.
+        * bindings/js/JSNodeCustom.h: Added.
+        (WebCore::getCachedDOMNodeWrapper): Moved from JSDOMBinding.cpp and moved here,
+        so it could inline everywhere without creating an include cycle. Consider inline
+        cache.
+        (WebCore::toJS): Moved to header to inline.
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable): Implement this in the obvious
+        way for JavaScriptCore. (Using a WeakGCPtr).
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm: Include CustomHeader heaaders
+        in the header, not just the impl file, so they can add inlining.
+        * dom/Node.idl: Add CustomHeader directive.
+        
+        Add new files to build.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Add Media.* files to the build.
-
-        * css/Media.cpp: Added.
-        (WebCore::Media::Media):
-        (WebCore::Media::type):
-        (WebCore::Media::matchMedium):
-        * css/Media.h: Added.
-        (WebCore::Media::create):
-        (WebCore::Media::document):
-        * css/Media.idl: Added.
-        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
 
-        * page/AbstractView.idl:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::media):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Add a readonly attribute for Media.
 
-2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-24  Jochen Eisinger  <jochen@chromium.org>
 
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27455
-        Support for a custom validation message in ValidityState and related
-        form controls.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
-
-        Tests: fast/forms/ValidityState-customError-001.html
-               fast/forms/ValidityState-customError-002.html
-               fast/forms/ValidityState-customError-003.html
-               fast/forms/ValidityState-customError-004.html
+        Reviewed by Jeremy Orlow.
 
-        * html/HTMLButtonElement.idl: setCustomValidity DOM method
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMissing): moved down
-        * html/HTMLInputElement.idl: ditto
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
-        validation message
-        (WebCore::ValidityState::customError): validation flag
+        Expose Database object of currently active task on the database thread
+        https://bugs.webkit.org/show_bug.cgi?id=35341
 
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Bring a little order to our otherwise out of control lives.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Stop copying .idl files in to the framework resources directory.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Fix the build some more.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getDatabaseOfCurrentTask):
 
-        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
-        files and groups in to the appropriate locations.
+2010-02-24  Nicholas Young  <nicholas.young@nokia.com>
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Reviewed by Eric Carlson.
 
-2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
+        supportsMuting() should be an internal interface between MediaPlayer and MediaPlayerPrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=35327
 
-        Reviewed by Alexey Proskuryakov.
+        No new tests. Refactoring Only.
 
-        Add WebSocket.idl
-        https://bugs.webkit.org/show_bug.cgi?id=27209
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setMuted): Do not check supportsMuting()
+        (WebCore::HTMLMediaElement::updateVolume): Set volume and muted
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setVolume): Check supportsMuting()
+        (WebCore::MediaPlayer::setMuted): Check supportsMuting()
+        * platform/graphics/MediaPlayer.h: Remove supportsMuting()
 
-        Add WebSocket.idl in WebCore/websockets/.
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
-        Other build systems will be updated once the code is functional.
+2010-02-24  Adam Barth  <abarth@webkit.org>
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSWebSocketConstructor.cpp: Added.
-        * bindings/js/JSWebSocketConstructor.h: Added.
-        * bindings/js/JSWebSocketCustom.cpp: Added.
-        * websockets/WebSocket.cpp: Added.
-        * websockets/WebSocket.h: Added.
-        * websockets/WebSocket.idl: Added.
+        Reviewed by Darin Fisher.
 
-2009-08-06  Jian Li  <jianli@chromium.org>
+        [Chromium API] Disambiguate allowJavaScript from didNotAllowScript
+        https://bugs.webkit.org/show_bug.cgi?id=35205
 
-        Reviewed by Dimitri Glazkov.
+        For clients that want to show a user interface element when JavaScript
+        was blocked on a page, we need to disambiguate between querying the
+        client for whether JavaScript is enabled from actually failing to
+        execute some script.
 
-        [V8] Style cleaning for WorkerContextExecutionProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27997
+        This patch adds a new FrameLoaderClient callback for when WebCore would
+        like to execute JavaScript but fails to because JavaScript is disabled.
 
-        Cleanup WorkerContextExecutioonProxy related files to follow
-        WebKit coding styles after all V8 binding codes are upstreamed.
-        1) Lower-case the first letter of remaining functins in class
-           WorkerContextExecutionProxy. Update the V8 code generator
-           and all other references accordingly.
-        2) Integrate getConstructor from WorkerContextExecutionProxy
-           to V8DOMWrapper.
-        3) Other misc changes, like removing trailing whitespaces and
-           sorting the include files.
+        This patch also touches every client of canExecuteScripts so they can
+        indicate whether we should make this callback.  I was hoping there was
+        a better choke point, but my first two attempts were wrong in subtle
+        ways.  pkasting points out that this will be easy to screw up in the
+        future, so it's better to make all the clients be explicit.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/ScheduledAction.cpp:
+        * WebCore.PluginHostProcess.exp:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/ScheduledAction.cpp:
         (WebCore::ScheduledAction::execute):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructorForContext):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        (WebCore::V8WorkerContextEventListener::reportError):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
-        (WebCore::WorkerContextExecutionProxy::removeEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        (WebCore::WorkerContextExecutionProxy::context):
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-08-06  Darin Adler  <darin@apple.com>
-
-        Fix Mac Leopard debug build.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.h:
+        (WebCore::):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptController.h:
+        (WebCore::):
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::processToken):
+        * inspector/InspectorController.cpp:
+        (WebCore::canPassNodeToJavaScript):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didNotAllowScript):
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
-        is always >= 0 and checking causes a warning in the newer versions of gcc.
+2010-02-24  Adam Barth  <abarth@webkit.org>
 
-2009-08-06  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Fisher.
 
-        Unreview rollout.
+        Add call to FrameLoaderClient::allowPlugins everywhere arePluginsEnabled is called
+        https://bugs.webkit.org/show_bug.cgi?id=34997
 
-        Revert 46840 because it broke the reliability tests.
+        If we want to let the FrameLoaderClient override arePluginsEnabled,
+        then we need to call out to the FrameLoaderClient every time we read
+        the setting.
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        We don't have testing infrustructure for these changes, which is lame.
+        I'm supposed to fix that in Bug 33991.
 
-2009-08-06  Adam Barth  <abarth@webkit.org>
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::substituteMIMETypeFromPluginDatabase):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * plugins/MimeType.cpp:
+        (WebCore::MimeType::enabledPlugin):
 
-        Unreviewed rollout.
+2010-02-24  James Robinson  <jamesr@chromium.org>
 
-        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
+        Reviewed by Dmitry Titov.
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::mainWorldContext):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::context):
+        Do not fire focus events while a modal dialog is up.
+        https://bugs.webkit.org/show_bug.cgi?id=33962
 
-2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+        Modifies the FocusController to check the frame's page's defersLoading() flag before firing blur/focus events.
+        This flag is set while a modal dialog (like a window.alert or window.confirm) is up.  Firing the events causes
+        assertion failures, since when the dialog is dismissed the PageGroupLoadDeferrer assumes that no script has run.
 
-        Reviewed by Timothy Hatcher.
+        Manual tests only as DumpRenderTree does not support modal dialogs
 
-        WebInspector: move style-related utilities into InjectedScript.
+        * manual-tests/modal-dialog-blur-selfclose.html: Added.
+        * manual-tests/modal-dialog-blur.html: Added.
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
 
-        http://bugs.webkit.org/show_bug.cgi?id=27939
+2010-02-24  Dan Bernstein  <mitz@apple.com>
 
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.CSSStyleDeclaration):
-        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
-        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
-        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
-        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleText):
-        (InjectedScript.toggleStyleEnabled):
-        (InjectedScript._serializeStyle):
-        (InjectedScript._getUniqueStyleProperties):
-        (InjectedScript._getLonghandProperties):
-        (InjectedScript._getShorthandPriority):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype._update):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
-        (WebInspector.StylePropertiesSection.prototype.onpopulate):
-        (WebInspector.StylePropertyTreeElement.prototype.get priority):
-        (WebInspector.StylePropertyTreeElement.prototype.get value):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/utilities.js:
+        Reviewed by Anders Carlsson.
 
-2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
+        <rdar://problem/7018611> innerHTML applies meta/link/title tags from a detached html element
 
-        Unreviewed build fix, add #ifdef guards around
-        inclusions of shared worker specific files.
+        Test: fast/parser/fragment-parser.html
 
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSWorkerContextBase.cpp:
-        * bindings/js/WorkerScriptController.cpp:
+        Ensure that fragment parsing has no side effects on the fragment’s owner
+        document.
 
-2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode): Don’t call
+        dispatchDocumentElementAvailable() for fragments.
+        (WebCore::HTMLParser::handleError): Don’t copy attributes to the owner
+        document’s <html> and <body> elements when a redundant <html> or <body>
+        is encountered while parsing a fragment.
+        (WebCore::HTMLParser::framesetCreateErrorCheck): Don’t change the owner
+        document’s <body> element’s style when parsing a fragment.
+        (WebCore::HTMLParser::createHead): Don’t attach the new <head> to the
+        ownder document of a fragment.
+
+2010-02-24  David Levin  <levin@chromium.org>
 
         Reviewed by Darin Adler.
 
-        cssgrammar.cpp fails to compile with RVCT compiler
-        https://bugs.webkit.org/show_bug.cgi?id=27952
+        Need to create a CanvasSurface base class for HTMLCanvasElement.
+        https://bugs.webkit.org/show_bug.cgi?id=35322
 
-        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
-        memory allocation 
+        This is an initial step in making the OffscreenCanvas object.
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringCase):
-        * platform/text/StringImpl.h: 
-        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
-          function that works with a character pointer and length
+        No new functionality so no new tests.
 
-2009-08-06  Drew Wilson  <atwilson@google.com>
+        * GNUmakefile.am: Added CanvasSurface to the build.
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * dom/CanvasSurface.cpp: Added.
+        * dom/CanvasSurface.h: Added.
+        * html/HTMLCanvasElement.h: Made HTMLCanvasElement inherit from CanvasSurface.
 
-        Reviewed by David Levin.
+2010-02-24  Peter Kasting  <pkasting@google.com>
 
-        Created first working implementation of SharedWorkers (execution only, no sharing).
-        https://bugs.webkit.org/show_bug.cgi?id=27927
+        Reviewed by Adam Barth.
 
-        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
-        No v8 bindings yet.
+        Fix regression in calculating an animated image's start time.
+        https://bugs.webkit.org/show_bug.cgi?id=35115
 
-        * DerivedSources.cpp:
-        Added shared worker files.
-        * DerivedSources.make:
-        Added shared worker files.
-        * GNUmakefile.am:
-        Added shared worker files.
-        * WebCore.gypi:
-        Added shared worker files.
-        * WebCore.pro:
-        Added shared worker files.
-        * WebCore.vcproj/WebCore.vcproj:
-        Added shared worker files.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added shared worker files.
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        Added code to convert from EventTarget to correct JS class.
-        (WebCore::toEventTarget):
-        Added code to cast from JS object to appropriate EventTarget impl class.
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        (WebCore::constructSharedWorker):
-        Tweaked the constructor code to pass in the lexical global object like normal workers.
-        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
-        (WebCore::JSSharedWorkerContext::mark):
-        Custom marking of the onconnect handler.
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJSSharedWorkerContext):
-        (WebCore::toJSWorkerContext):
-        Added proper conversion to the correct WorkerContext derived class.
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Added support for SharedWorkerContext.
-        * bindings/v8/DOMObjectsInclude.h:
-        Added shared worker bindings files.
-        * dom/EventNames.h:
-        Added connect event.
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toSharedWorkerContext):
-        Added API for casting to new derived class (SharedWorkerContext).
-        * dom/EventTarget.h:
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::resolveURL):
-        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
-        * workers/AbstractWorker.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::logException):
-        Refactored exception handling code - moved onerror handling to base class.
-        * workers/DedicatedWorkerContext.h:
-        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::SharedWorker):
-        Changed constructor to fire up worker thread.
-        * workers/SharedWorker.h:
-        * workers/SharedWorkerContext.cpp: Added.
-        (WebCore::SharedWorkerContext::SharedWorkerContext):
-        (WebCore::SharedWorkerContext::~SharedWorkerContext):
-        (WebCore::SharedWorkerContext::logException):
-        (WebCore::SharedWorkerContext::addMessage):
-        Placeholder methods until we add support for sending exceptions/messages to console.
-        (WebCore::SharedWorkerContext::dispatchConnect):
-        (WebCore::SharedWorkerContext::thread):
-        * workers/SharedWorkerContext.h: Added.
-        (WebCore::SharedWorkerContext::create):
-        (WebCore::SharedWorkerContext::isSharedWorkerContext):
-        (WebCore::SharedWorkerContext::toSharedWorkerContext):
-        (WebCore::SharedWorkerContext::setOnconnect):
-        (WebCore::SharedWorkerContext::onconnect):
-        (WebCore::SharedWorkerContext::name):
-        * workers/SharedWorkerContext.idl: Added.
-        * workers/SharedWorkerRepository.h: Added.
-        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
-        * workers/DefaultSharedWorkerRepository.cpp: Added.
-        Implementation of core singleton class that will be used to implement sharing.
-        (WebCore::SharedWorkerProxy::setThread):
-        Proxy object used to handle resource loading for a given shared worker.
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
-        Placeholder routines until we implement loading.
-        (WebCore::SharedWorkerConnectTask::create):
-        Creates a task to fire off a connect event on the worker thread.
-        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
-        (WebCore::SharedWorkerConnectTask::performTask):
-        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
-        Added helper object to load the initial script for the worker.
-        (WebCore::SharedWorkerLoader::load):
-        (WebCore::SharedWorkerLoader::notifyFinished):
-        (WebCore::SharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Fires off the worker thread once the script is loaded.
-        (WebCore::SharedWorkerRepository::connect):
-        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
-        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
-        * workers/DefaultSharedWorkerRepository.h: Added.
-        * workers/SharedWorkerThread.cpp: Added.
-        (WebCore::SharedWorkerThread::create):
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        (WebCore::SharedWorkerThread::~SharedWorkerThread):
-        (WebCore::SharedWorkerThread::createWorkerContext):
-        * workers/SharedWorkerThread.h: Added.
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isSharedWorkerContext):
-        (WebCore::WorkerContext::isDedicatedWorkerContext):
-        Added APIs to determine the type of a given context.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-2009-08-06  Chris Marrin  <cmarrin@apple.com>
+2010-02-24  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by David Hyatt.
+        Reviewed by Simon Fraser.
 
-        Added ENABLE_3D_CANVAS flag to build, default to off
+        <rdar://problem/7682827> Text with :first-letter lingers after being removed
 
-        * Configurations/FeatureDefines.xcconfig:
+        Test: fast/css/first-letter-set-text.html
 
-2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::setTextInternal): Set this back as the
+        text node’s renderer, as removing the first letter has resets the node’s
+        renderer.
 
-        Reviewed by Simon Hausmann.
+2010-02-24  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        [Qt] windowsKeyCodeForKeyEvent fix
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
+        [Qt] Faster cut-off for rectangle fill without shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=35337
 
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-2009-08-06  George Staikos  <george.staikos@torchmobile.com>
+2010-02-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Rubber-stamped by Ariya Hidayat.
+        Reviewed by nobody, build fix.
 
-        Remove the dead wince/ directory that should never have gone in.
+        [Qt] Corrects build break of QtLauncher on Windows.
+        The VERSION variable was not set anymore while building in trunk.
 
-        * svg/graphics/wince: Removed.
-        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
+        * WebCore.pro:
 
-2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-24  Alexander Pavlov  <apavlov@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        WebInspector: Extract style editing into a separate file that is
-        going to be loaded in page context.
+        Web Inspector: Activate/Deactivate breaks does not look consistent with rest of the toolbar.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27939
+        Fix style and add the new images to the related file sets.
+        https://bugs.webkit.org/show_bug.cgi?id=35307
 
-        * inspector/front-end/InjectedScript.js: Added.
-        (InjectedScript.applyStyleText):
-        (InjectedScript.setStyleText):
-        (InjectedScript.toggleStyleEnabled):
-        (InjectedScript.setStyleRule):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        * WebCore.gypi:
+        * inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png:
+        * inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png:
         * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Remove bug-bait V8Proxy::context()
-        https://bugs.webkit.org/show_bug.cgi?id=27826
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::mainWorldContext):
-        * bindings/v8/V8Proxy.h:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed attempt to fix the Chromium Linux build.  This function is
-        not used.
-
-        * bindings/v8/OwnHandle.h:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
+        * inspector/front-end/inspector.css:
 
-        Reviewed by Eric Seidel.
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        Reviewed by Gustavo Noronha.
 
-        We now save a weak handle to the original context.  We use that handle
-        to call the timeout in the right context / world.
+        Get rid of an extra call to
+        setNPWindowIfNeeded. updatePluginWidget already calls this for us
+        if needed.
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
 
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Gustavo Noronha.
 
-        Unreviewed, build fix.
+        Try to sanitize a bit the geometry management of plugins.
 
-        [V8] Revert http://trac.webkit.org/changeset/46821, which was
-        landed to supplement http://trac.webkit.org/changeset/46816, but
-        now that the latter is reverted, the former needs the same.
+        Stop doing contradictory things in updatePluginWidget (we were at
+        the same time pretending the geometry setting was delayed until
+        ::paint and setting the geometry not once but twice) and just set
+        it any time the windowRect or clipRect for the plugin has changed.
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+        This is closer to what the Mac port does, and fixes instances of
+        the plugins not being drawn until the window is resized or
+        scrolled. Other than that all manual and layout tests seems to
+        still work.
 
-        Reviewed by Timothy Hatcher.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::setNPWindowIfNeeded):
 
-        Color is only reported in rgb() format; should toggle between rgb() and hex
-        https://bugs.webkit.org/show_bug.cgi?id=13516
-
-          New Class to Parse and Change Between Color Representations:
-
-        * inspector/front-end/Color.js: Added.
-        (WebInspector.Color):
-
-          Representations of Colors in Raw Form. (May be Lazy Loaded):
-
-        (WebInspector.Color.prototype.get shorthex):
-        (WebInspector.Color.prototype.get hex):
-        (WebInspector.Color.prototype.set hex):
-        (WebInspector.Color.prototype.get rgb):
-        (WebInspector.Color.prototype.set rgb):
-        (WebInspector.Color.prototype.get hsl):
-        (WebInspector.Color.prototype.set hsl):
-        (WebInspector.Color.prototype.get nickname):
-        (WebInspector.Color.prototype.set nickname):
-        (WebInspector.Color.prototype.get rgba):
-        (WebInspector.Color.prototype.set rgba):
-        (WebInspector.Color.prototype.get hsla):
-        (WebInspector.Color.prototype.set hsla):
-
-          Helpers and Standard String Representations:
-
-        (WebInspector.Color.prototype.hasShortHex):
-        (WebInspector.Color.prototype.toRgb):
-        (WebInspector.Color.prototype.toHsl):
-        (WebInspector.Color.prototype.toShortHex):
-        (WebInspector.Color.prototype.toHex):
-        (WebInspector.Color.prototype.toRgba):
-        (WebInspector.Color.prototype.toHsla):
-        (WebInspector.Color.prototype.toNickname):
-
-          Conversion Functions to Determine Other Representations:
-          My Sources for all algorithms and sample data:
-          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
-          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
-
-        (WebInspector.Color.prototype.rgbToHex):
-        (WebInspector.Color.prototype.hexToRgb):
-        (WebInspector.Color.prototype.rgbToHsl):
-        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
-        (WebInspector.Color.prototype.hslToRgb):
-        (WebInspector.Color.prototype.rgbaToHsla):
-        (WebInspector.Color.prototype.hslaToRgba):
-
-          Called from the constructor, attempts to parse and will throw an error
-          if it cannot parse.  If simple then the "hex" value is guarenteed.
-          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
-          a nickname in any way (e.g. "transparent", "black") then this is
-          guarenteed to be set as well.
-
-        (WebInspector.Color.prototype.parse):
-
-          Clicking on the swatch will rotate through Color Representations.
-            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
-            Advanced: rgba -> hsla -> nickname? -> (loop around)
+2010-02-23  Geoff Garen  <ggaren@apple.com>
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+        Reviewed by Oliver Hunt.
 
-          Load Color.js:
+        Simplify animation lifetime handling.  Previously we manually
+        determined whether our base element was safe when we unregistered
+        our listener, now we simply ensure that the base element itself
+        registers and unregisters the animation listener.
 
-        * inspector/front-end/inspector.html:
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::create):
+        (WebCore::ConditionEventListener::disconnectAnimation):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        (WebCore::SVGSMILElement::eventBaseFor):
+        (WebCore::SVGSMILElement::connectConditions):
+        (WebCore::SVGSMILElement::disconnectConditions):
+        * svg/animation/SVGSMILElement.h:
 
-2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+2010-02-23  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by David Levin.
 
-        Support setting event listeners for message ports in the worker process.
+        Chromium: Use V8::TerminateExecution to actually terminate workers.
+        https://bugs.webkit.org/show_bug.cgi?id=35137
 
-        https://bugs.webkit.org/show_bug.cgi?id=28004
+        Test: existing fast/workers/stress-js-execution.html which is currently failing
+        on Mac and Linux bots for Chromium.
 
         * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-08-05  Stephen White  <senorblanco@chromium.org>
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::forbidExecution):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-23  Enrica Casucci  <enrica@apple.com>
 
-        http://bugs.webkit.org/show_bug.cgi?id=28022
+        Reviewed by Simon Fraser.
 
-        Minor fix for media code on chromium/skia.
+        REGRESSION: WebKit crashes when deleting images on blogger.com (34957)
+        <rdar://problem/7651935>
+        https://bugs.webkit.org/show_bug.cgi?id=34957
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+        Fixing a regression introduced with revision 53085. Anchor elements should not be considered
+        in editable content when calculating the position in the parent before the node.
+        
+        Test: editing/execCommand/delete-image-in-anchor.html
 
-2009-08-05  Darin Adler  <darin@apple.com>
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
 
-        Reviewed by Dan Bernstein.
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        Client side image maps did not handle zoom correctly.
-        Client side image maps did not handle border and padding correctly.
+        Reviewed by Eric Seidel.
 
-        Test: fast/images/image-map-zoom.html
+        https://bugs.webkit.org/show_bug.cgi?id=34634
+        Pasting a list into the middle of another list item should split the target
+        list item into two separate list items.  This matches the behavior in other
+        browsers.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
-        element using the content box and the effective zoom.
+        Test: editing/pasteboard/paste-list-004.html
 
-2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        Reviewed by Oliver Hunt.
+2010-02-23  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28027
-        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
-        precomposed Unicode
+        Reviewed by Tim Hatcher and Pavel Feldman.
 
-        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
-        FileSystem.h instead of custom code for getting file size. This adds path normalization
-        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
-        important anyway.
+        Regression (r55107) - WebInspector docking is busted.
+        https://bugs.webkit.org/show_bug.cgi?id=35274
 
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::canAttachWindow): Use the minimum height for this calculation,
+          not the preferred height.
+        (WebCore::InspectorController::attachWindow): attachWindow() shouldn't decide the policy, as it is
+          often called partway through the show or dock procedure after some of the initial conditions have
+          changed. Let the front-end itself and the InspectorClient's make the policy decision at the start
+          of the show/dock operation.
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::canAttachWindow):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
 
-        Unreviewed, build fix.
+        * inspector/front-end/inspector.js:
+        (WebInspector.toggleAttach): Before attaching, ask the front-end-host if attaching is allowed.
 
-        [V8] Include Media into V8 bindings.
+2010-02-23  Mark Rowe  <mrowe@apple.com>
 
-        * bindings/v8/DOMObjectsInclude.h: Added Media include.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
-        * bindings/v8/V8Index.cpp: Added decl for V8Media.
-        * bindings/v8/V8Index.h: Added V8Media include.
+        Reviewed by Geoff Garen.
 
-2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+        <http://webkit.org/b/35287> ImageSourceCG::frameIsCompleteAtIndex returns false for all frames until image has completed loading
 
-        Fix Windows layout test crashes.
+        CGImageSourceGetStatusAtIndex claims that all frames of a multi-frame image are incomplete when we've not yet received the
+        complete data for an image that is using an incremental data source (<rdar://problem/7679174>). We work around this by
+        special-casing all frames except the last in an image and treating them as complete if they are present and reported as
+        being incomplete. We do this on the assumption that loading new data can only modify the existing last frame or append new
+        frames. The last frame is only treated as being complete if the image source reports it as such. This ensures that it is
+        truly the last frame of the image rather than just the last that we currently have data for.
 
-        PluginView::removeFromUnstartedListIfNecessary() would try to remove
-        any unstarted PluginView from the Page's set of unstarted plug-ins,
-        regardless of why the PluginView wasn't started. If we tried to start a
-        plug-in, but it failed to start, we would hit an assertion in
-        Page::removeUnstartedPlugin() that asserts that we would only modify the
-        unstarted plug-ins set if we were not currently starting plug-ins.
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
 
-        Fix this by having PluginView track whether it's waiting to be started,
-        and to check this before trying to remove itself from the Page's
-        unstarted plug-ins set.
+2010-02-23  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Darin Adler.
 
-        * page/Page.cpp:
-        (WebCore::Page::removeUnstartedPlugin):
-        Assert that the passed PluginView is in the unstarted set.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        Set that we are not waiting to be started.
-        (WebCore::PluginView::startOrAddtoUnstartedList):
-        Set that we are waiting to be started.
-        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
-        Check not whether we are started, but whether we are waiting to be
-        started.
-        (WebCore::PluginView::PluginView):
-
-        * plugins/PluginView.h:
-
-2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
-
-       Fix DOM Storage memory leak
-       https://bugs.webkit.org/show_bug.cgi?id=28029
+        Crash in createContextualFragment when inserting a list in a non HTML document.
+        <rdar://problem/7666670>
+        https://bugs.webkit.org/show_bug.cgi?id=35305
+        
+        createFragmentFromMarkup did not handle correctly the case where documentElement is
+        not an HTMLElement. The static cast to HTMLElement was causing createContextualFragment to
+        crash.
+        
+        Test: editing/execCommand/insert-list-xml.xhtml
 
-       Forgot to use adoptRef in one place.  This caused the = operator to
-       increment the ref count when it shouldn't have, so StorageAreaImpl's were
-       never freed.
+        * dom/Element.cpp:
+        (WebCore::Element::createContextualFragment): Added.
+        * dom/Element.h: Added createContextualFragment virtual function.
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup): Removed static cast to HTMLElement.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Modified to perform only checks
+        that are specific for an HTMLElement object. The rest of the logic has been moved to the
+        corresponding method in the Element class.
 
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::storageArea):
+2010-02-23  Steve Falkenburg  <sfalken@apple.com>
 
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Adam Roben.
 
-        Unreviewed, build fix.
+        WebCore should stop throwing away the CGImageSourceRef on Windows to improve GIF performance
+        https://bugs.webkit.org/show_bug.cgi?id=35309
 
-        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-08-05  Darin Adler  <darin@apple.com>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by David Levin.
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        * WebCore/platform/KURL.cpp
+        * WebCore/platform/TextEncoding.cpp:
+        * WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp: 
+        * WebCore/platform/text/gtk/TextCodecGtk.cpp:
 
-        Last patch. Makes all the casts of RenderObject use checked
-        casts instead of using static_cast directly.
+2010-02-23  Brady Eidson  <beidson@apple.com>
 
-        * accessibility/AccessibilityListBox.cpp:
-        (WebCore::AccessibilityListBox::visibleChildren):
-        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
-        * accessibility/AccessibilityListBoxOption.cpp:
-        (WebCore::AccessibilityListBoxOption::elementRect):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::textUnderElement):
-        (WebCore::AccessibilityRenderObject::stringValue):
-        (WebCore::AccessibilityRenderObject::titleUIElement):
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySliderThumb::elementRect):
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::updatePlaceholderVisibility):
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::scrollToSelection):
-        (WebCore::SelectElement::recalcStyle):
-        (WebCore::SelectElement::setRecalcListItems):
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-        (WebCore::SelectElement::listBoxDefaultEventHandler):
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::reset):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::updateWidget):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::attach):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::defaultEventHandler):
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::attach):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::addSearchResult):
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLLIElement.cpp:
-        (WebCore::HTMLLIElement::parseMappedAttribute):
-        (WebCore::HTMLLIElement::attach):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
-        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
-        (WebCore::HTMLMediaElement::defaultEventHandler):
-        (WebCore::HTMLMediaElement::finishParsingChildren):
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::parseMappedAttribute):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::updateWidget):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        * page/DragController.cpp:
-        (WebCore::DragController::concludeEditDrag):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::capsLockStateMayHaveChanged):
-        * page/Frame.cpp:
-        (WebCore::Frame::ownerRenderer):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        * page/wince/FrameWince.cpp:
-        (WebCore::computePageRectsForFrame):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::findNextLineBreak):
-        * rendering/RenderCounter.cpp:
-        (WebCore::planCounter):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::RenderFrameSet::computeEdgeInfo):
-        (WebCore::RenderFrameSet::setIsResizing):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::contentsBox):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
-        * rendering/RenderListItem.cpp:
-        (WebCore::previousListItem):
-        (WebCore::RenderListItem::explicitValueChanged):
-        * rendering/RenderObject.cpp:
-        (WebCore::updateListMarkerNumbers):
-        * rendering/RenderObjectChildList.cpp:
-        (WebCore::updateListMarkerNumbers):
-        (WebCore::invalidateCountersInContainer):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::minimumThumbLength):
-        (WebCore::RenderScrollbarTheme::backButtonRect):
-        (WebCore::RenderScrollbarTheme::forwardButtonRect):
-        (WebCore::RenderScrollbarTheme::trackRect):
-        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
-        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackPiece):
-        (WebCore::RenderScrollbarTheme::paintButton):
-        (WebCore::RenderScrollbarTheme::paintThumb):
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::defaultEventHandler):
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintSliderThumb):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintSliderThumb):
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::determineSliderThumbState):
-        * rendering/SVGCharacterLayoutInfo.cpp:
-        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
-        * rendering/SVGRootInlineBox.cpp:
-        (WebCore::findSVGRootObject):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
-        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::attach):
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::canvasResource):
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::rootInlineBoxForTextContentElement):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::defaultEventHandler):
-        Use checked casts.
+        Reviewed by Alexey Proskuryakov.
 
-        * rendering/RenderApplet.h:
-        * rendering/RenderCounter.h:
-        * rendering/RenderFieldset.h:
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderFrame.h:
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderHTMLCanvas.h:
-        * rendering/RenderListBox.h:
-        * rendering/RenderListItem.h:
-        * rendering/RenderListMarker.h:
-        * rendering/RenderMedia.h:
-        * rendering/RenderMenuList.h:
-        * rendering/RenderPart.h:
-        * rendering/RenderPartObject.h:
-        * rendering/RenderPath.h:
-        * rendering/RenderSVGContainer.h:
-        * rendering/RenderSVGRoot.h:
-        * rendering/RenderSVGTextPath.h:
-        * rendering/RenderSVGViewportContainer.h:
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderSlider.h:
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.h:
-        * rendering/RenderVideo.h:
-        Added a checked cast. Also made most members protected or private.
+        HTTP 307 after a 303 after a POST re-sends POST data from the original request.
+        <rdar://problem/7390251> and https://bugs.webkit.org/show_bug.cgi?id=31410
 
-        * rendering/RenderBlock.h:
-        * rendering/RenderInline.h:
-        * rendering/RenderReplaced.h:
-        * rendering/RenderSVGBlock.h:
-        * rendering/RenderSVGImage.h:
-        * rendering/RenderSVGInlineText.h:
-        * rendering/RenderSVGText.h:
-        * rendering/RenderTextControl.h:
-        Made most members protected or private.
+        Test: http/tests/loading/307-after-303-after-post.html
 
-        * rendering/RenderInline.cpp:
-        * rendering/RenderSVGContainer.cpp:
-        * rendering/RenderSVGHiddenContainer.cpp:
-        * rendering/RenderSVGImage.cpp:
-        * rendering/RenderSVGRoot.cpp:
-        Removed unneeded destructor.
+        Remember the last HTTP method send out during a redirect chain for a resource handle:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::lastHTTPMethod):
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
 
-        * rendering/RenderSVGHiddenContainer.h:
-        Removed unneeded virtual function overrides that did the same as
-        the default and base class.
+        Refer to the last HTTP method used instead of the original method:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::willSendRequest):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willSendRequest):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
 
-        * rendering/RenderSVGViewportContainer.cpp:
-        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
-        directly instead of using a function call.
-        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
-        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
-        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
-        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+2010-02-23  Crystal Zhang  <haizhang@rim.com>
 
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
-        all values instead of using a default case.
+        Unreviewed build fix.
 
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::operator<<): Removed dependency on casting to types that don't
-        have any public members we need to get at. Instead, use function names to
-        identify the type rather than doing so much overloading. Changed to use
-        checked casts.
-        (WebCore::write): Ditto.
+        Fix build error when enable plugin proxy: 'toRenderEmbeddedObject' identifier not found.
+        As RenderEmbeddedObject inherits RenderPartObject and 'toRenderEmbeddedObject' belongs
+        to former one.
 
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
-        added a comment about the fact that the code does not do sufficient type
-        checking before doing the cast.
+        * html/HTMLMediaElement.cpp:
 
-        * rendering/SVGRenderTreeAsText.cpp:
-        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
-        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
-        (WebCore::writeSVGText): Renamed this from write.
-        (WebCore::writeSVGInlineText): Ditto.
-        (WebCore::writeSVGImage): Ditto.
-        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
-        unneeded default arguments.
+2010-02-23  Evan Martin  <evan@chromium.org>
 
-2009-08-05  Peter Kasting  <pkasting@google.com>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Sam Weinig.
+        [chromium] fix previous SVG-disabling patch
+        https://bugs.webkit.org/show_bug.cgi?id=35298
 
-        https://bugs.webkit.org/show_bug.cgi?id=27851
-        Fix a pair of compiler warnings on the GTK Linux buildbot.
+        * WebCore.gypi: rename variable
+        * WebCore.gyp/WebCore.gyp: actually use the variable
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+2010-02-23  Michael Lotz <mmlr@mlotz.ch>
 
-2009-08-05  Peter Kasting  <pkasting@google.com>
+        Reviewed by David Levin.
 
-        Reviewed by Eric Seidel.
+        [Haiku] Fix conversion from BString to String
+        https://bugs.webkit.org/show_bug.cgi?id=35082
 
-        https://bugs.webkit.org/show_bug.cgi?id=26460
-        Return multiple icon entries from the ICO decoder as separate frames,
-        sorted by decreasing quality (much like the CG ICO decoder does).
+        The previous patch to this file was broken (sorry). First of all,
+        the conversion from UTF8 was accidentally removed. Second, for
+        empty strings, we need to point the implementation at StringImpl::empty().
 
-        As a result of this change, we can eliminate the Skia-specific setData()
-        hack that the Chromium port used to select the desired icon size -- now
-        callers can just enumerate the frames and ask for the data from the one
-        they like.
-        
-        Under the hood, the ICO decoder now keeps vectors for a number of things
-        (including directory entries and image decoders) where it used to have
-        single members.  However, callers (that I have seen) will only request
-        one frame from the icon, so practically there aren't going to be lots of
-        instantiated image decoders.
-
-        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
-        * platform/graphics/skia/ImageSourceSkia.h: Removed.
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
-        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
-        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
-        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
-        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
-        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
-        (WebCore::ICOImageDecoder::frameCount): Implement.
-        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
-        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
-        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
-        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
-        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
-        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
-        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
-        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
-        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
-        * platform/image-decoders/ico/ICOImageDecoder.h:
+        Covered by existing tests.
 
-2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+        * platform/text/haiku/StringHaiku.cpp:
+        (WebCore::String::String):
 
-        Reviewed by Darin Adler.
+2010-02-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27942
+        Reviewed by Eric Carlson.
 
-        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
+        [Qt] Prevent the media backend from handling non-audio or -video mime types
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::reset):
-           Added HTML 4.01 compliant handling of broken webpages that
-           specify more than one selected option for single selection SELECT
-           element, in a manner that emulates Firefox and is similar to IE 7
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
 
+2010-02-23  Evan Martin  <evan@chromium.org>
 
-2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Simon Hausmann.
+        [chromium] Allow building without SVG
+        https://bugs.webkit.org/show_bug.cgi?id=31522
 
-        WebCore.pro bugfix
+        * WebCore.gyp/WebCore.gyp, WebCore.gypi: test enable_svg flag.
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp,
+          bindings/v8/custom/V8SVGPathSegCustom.cpp: test ENABLE(SVG).
 
-        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
 
-        * WebCore.pro:
+        Reviewed by Gustavo Noronha Silva.
 
-2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+        Fixes references to GOwnPtr and GRefPtr so the GTK+ port builds
+        again.
+        http://webkit.org/b/35084
 
-        Fix Tiger build breakage.
+        * WebCore/platform/gtk/DataObjectGtk.h:
+        * WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
+2010-02-23  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
-        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+        [Qt] Faster cut-off for rectangle drawing without shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=35267
 
-        * WebCore.pro:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
 
-2009-08-04  Brian Weinstein  <bweinstein@apple.com>
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        Reviewed by Adele Peterson.
+        Reviewed by Jeremy Orlow.
 
-        Keypress should exit from pan scrolling mode.
-        https://bugs.webkit.org/show_bug.cgi?id=28005
+        Removes redundant Settings::setGeolocationEnabled and Settings::geolocationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=35242
 
-        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
-        making it easier for users to back out of an accidental pan scroll.
+        No new tests, removing dead code only.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::keyEvent):
-        
-2009-08-04  Eric Seidel  <eric@webkit.org>
+        * page/Settings.cpp:
+        * page/Settings.h:
 
-        Reviewed by Simon Fraser.
+2010-02-23  Ben Murdoch  <benm@google.com>
 
-        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
-        https://bugs.webkit.org/show_bug.cgi?id=26787
+        Reviewed by Eric Seidel.
 
-        Add back missing dragController()->clear() call.
+        pageX/Y co-ordinates of TouchEvent should be 0,0
+        https://bugs.webkit.org/show_bug.cgi?id=35239
 
-        * manual-tests/drag-caret.html: Added.
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
+        The co-ordinates attached to a touch event are not used for tracking touch motion, rather the co-ordinates attached to Touches within the touch event should be used. Set the co-ordinates on the event itself to 0 to avoid confusion and match observed iPhone behavior.
 
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Set the pageX/Y and screenX/Y co-ordinates attached to the touch event to 0,0 to match observed behavior on the iPhone.
+        * page/EventHandler.h: Remove now unused members m_firstTouchScreenPos and m_firstTouchPagePos.
 
-        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=27994
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
-        Forgot to commit attribute names.
+        Reviewed by Eric Seidel.
 
-        * html/HTMLAttributeNames.in:
+        [Haiku] Various improvements to EventHandlerHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+        Covered by existing tests.
 
-        Reviewed by Darin Adler.
+        Fix the build by not including PlatformScrollBar.h.
 
-        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=27994
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::isKeyboardOptionTab):
+            Use the correct keycode for tab keys.
+        (WebCore::EventHandler::focusDocumentView):
+            Use proper locking. In any case, Haiku doesn't append platform
+            widgets to WebCore widgets. But if it did, this implementation
+            would be correct.
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+            Implemented.
+        (WebCore::EventHandler::eventActivatedView):
+            Removed notImplemented() and added note.
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::accessKeyModifiers):
+            Added note.
 
-        Test: platform/mac/accessibility/aria-valuetext.html
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::valueDescription):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::valueDescription):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * html/HTMLAttributeNames.in:
+        Not reviewed.
+        Revert r55135 because the layout test is failing on all the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=34634
 
-2009-08-04  Michael Nordman  <michaeln@google.com>
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        Reviewed by Alexey Proskuryakov.
+2010-02-17  Steve Block  <steveblock@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27821
+        Reviewed by Ariya Hidayat.
 
-        No new features, no new tests. Existing layout tests pass.
+        Adds cache to store Geolocation positions between browser sessions.
+        https://bugs.webkit.org/show_bug.cgi?id=34084
 
-        * WebCore.base.exp:
+        This is required to fully implement the Geolocation maximumAge property.
+        See Bug 30676.
 
-        Export AppliationCacheGroup::storeCopyOfCache
+        No new tests, will add tests for maximumAge once complete.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * Android.mk: Modified. Added GeolocationPositionCache.cpp
+        * GNUmakefile.am: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.gypi: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.pro: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationPositionCache.[cpp|h]
+        * page/GeolocationPositionCache.cpp: Added.
+        (WebCore::GeolocationPositionCache::GeolocationPositionCache):
+        (WebCore::GeolocationPositionCache::~GeolocationPositionCache):
+        (WebCore::GeolocationPositionCache::setCachedPosition):
+        (WebCore::GeolocationPositionCache::cachedPosition):
+        (WebCore::GeolocationPositionCache::setDatabasePath):
+        (WebCore::GeolocationPositionCache::readFromDB):
+        (WebCore::GeolocationPositionCache::writeToDB):
+        * page/GeolocationPositionCache.h: Added.
 
-        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
-        instead of 'private' headers since they're no longer in the DocumentLoader.h
-        include graph.
+2010-02-23  Yuta Kitamura  <yutak@chromium.org>
 
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+        Reviewed by Dan Bernstein.
 
-        Reinstate the test for manifest.isNull instead of .isEmtpty().
-        Added a FIXME to revisit once the spec gets clarified.
+        Fix alignment of vertical-align: text-bottom inside an inline-block.
         
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        (WebCore::DocumentLoader::mainReceivedError):
-        (WebCore::DocumentLoader::detachFromFrame):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCacheHost):
+        This patch is based on a fix provided by Takahito Hirano.
 
-        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
-        for compile time friendliness, it results in a smaller include graph for files
-        dependent on DocumentLoader.h.
+        display: inline-block + vertical-align: text-bottom causes misalignment.
+        https://bugs.webkit.org/show_bug.cgi?id=30846
 
-        * loader/FrameLoader.cpp:
-        * loader/MainResourceLoader.cpp:
-        * loader/ResourceLoader.cpp:
+        Test: fast/inline-block/inline-block-vertical-align-2.html
 
-        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
-        This was done for readability at the include site. The included files contain appropriate guards,
-        so they're not needed at the include site.
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::update):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::manifestNotFound):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::CallCacheListenerTask::create):
-        (WebCore::CallCacheListenerTask::performTask):
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        * loader/appcache/ApplicationCacheGroup.h:
-
-        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
-
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
-        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
-        (WebCore::ApplicationCacheHost::notifyEventListener):
-        (WebCore::ApplicationCacheHost::status):
-        * loader/appcache/ApplicationCacheHost.h:
-        (WebCore::ApplicationCacheHost::):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-
-        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
-
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::status):
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::callListener):
-        (WebCore::DOMApplicationCache::toEventType):
-        (WebCore::DOMApplicationCache::toEventID):
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::setAttributeEventListener):
-        (WebCore::DOMApplicationCache::getAttributeEventListener):
-        (WebCore::DOMApplicationCache::clearAttributeEventListener):
-        (WebCore::DOMApplicationCache::callEventListener):
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::setOnobsolete):
-        (WebCore::DOMApplicationCache::onobsolete):
-
-        Use ApplicationCachHost defined constants for Status and EventIDs.
-
-2009-08-04  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
-        (WebCore::ACCESSOR_GETTER):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27993 - AXSliders are missing required attributes and actions
-        https://bugs.webkit.org/show_bug.cgi?id=27993
-
-        Expose appropriate actions and attributes for sliders.
-
-        Test: platform/mac/accessibility/slider-supports-actions.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::orientation):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySlider::orientation):
-        * accessibility/AccessibilitySlider.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityActionNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition): Fixed vpos calculation.
+        We cannot cut corners for inline blocks, since they may have their own
+        text metrics.
 
-2009-08-04  Jian Li  <jianli@chromium.org>
+2010-02-23  Steve Block  <steveblock@google.com>
 
         Reviewed by David Levin.
 
-        [V8] Fix an assert in WebCoreStringResource that causes worker script
-        evaluation failed.
-        https://bugs.webkit.org/show_bug.cgi?id=27996
+        Sets default values of V8 runtime enabler flags to match behavior with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=35095
 
-        The fix is to check for the same thread, instead of the main thread.
-        This is because Chromium's workers use v8 in a single thread that is
-        not the main thread.
+        No new tests, modifies a Chromium feature only.
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::atomicString):
-
-2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Modified. Sets appcache and geolocation flag defaults to 'on'
+        * storage/Database.cpp: Modified. Sets database flag default to 'on'.
 
-        Reviewed by Dave Hyatt.
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
-        Add support for transitions/animations of text-indent.
+        Reviewed by Eric Seidel.
 
-        Test: transitions/text-indent-transition.html
+        [Haiku] Fix various issues in keyboard event generation.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
+        Covered by existing tests.
 
-2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+        Fixed backspace keycode.
+        Fixed using the appropriate fields from the Haiku event for mapping
+        to the VK_* codes and added mapping a great deal more codes.
+        Added extraction of modifier key flags.
+        Completed implementation of disambiguateKeyDownEvent()
+        Implemented currentCapsLockState().
 
-        Reviewed by Dave Hyatt.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp:
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
 
-        Add support for transitions of min- and max-width, and min- and max-height.
-        https://bugs.webkit.org/show_bug.cgi?id=27990
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        Test: transitions/min-max-width-height-transitions.html
+        Reviewed by Darin Adler.
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
+        Adds Client::cancelGeolocationPermissionRequestForFrame and ChromeClient::cancelGeolocationPermissionRequestForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=34962
 
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+        These methods are required so that a Geolocation object can cancel an
+        asynchronous permission request. This allows the chrome client to cancel
+        any UI it is showing for the permission request.
 
-        Reviewed by Darin Adler.
+        No new tests, as this is for the purposes of browser UI only.
 
-        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
-        https://bugs.webkit.org/show_bug.cgi?id=27964
+        * loader/EmptyClients.h: Modified
+        (WebCore::EmptyChromeClient::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Chrome.cpp: Modified.
+        (WebCore::Chrome::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Chrome.h: Modified.
+        * page/ChromeClient.h: Modified.
+        (WebCore::ChromeClient::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::disconnectFrame): Modified. Call cancelGeolocationPermissionRequestForFrame
 
-        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
-        Also fixed an issue where an extra space was being appended to some ARIA labels.
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        Test: platform/mac/accessibility/aria-radiobutton-text.html
+        Reviewed by Eric Seidel.
 
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::ariaAccessibilityName):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
-        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
-        (WebCore::AccessibilityRenderObject::title):
-        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
-        * accessibility/AccessibilityRenderObject.h:
+        https://bugs.webkit.org/show_bug.cgi?id=34634
+        Pasting a list into the middle of another list item should split the target
+        list item into two separate list items.  This matches the behavior in other
+        browsers.
 
-2009-08-04  Nate Chapin  <japhet@chromium.org>
+        Test: editing/pasteboard/paste-list-004.html
 
-        Reviewed by Dimitri Glazkov.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        Missed a place that expects window.event to be hidden when it shouldn't be.
+2010-02-23  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27719
+        Reviewed by Laszlo Gombos.
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
+        [Qt] Correct build problems while building QtWebKit inside Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=34975
 
-2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+        * WebCore.pro: Change the condition !standalone_package to !QTDIR_build
 
-        Reviewed by Jon Honeycutt.
+2010-02-23  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=27958
+        Reviewed by Ariya Hidayat.
 
-        Test: platform/mac/accessibility/aria-required.html
+        [Qt] Connect video with accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=35276
+
+        MediaControlPrivate and GraphicsLayer are patched together via
+        a shared PlatformLayer (QGraphicsItem). This patch makes sure that the
+        QGraphicsVideoItem from MediaControl becomes part of the scene 
+        associsated with GraphicsLayer
+
+        Test: http://double.co.nz/video_test/test1.html with AC turned on
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::): mediaLayer member
+        (WebCore::GraphicsLayerQtImpl::opaqueArea): video is opaque
+        (WebCore::GraphicsLayerQtImpl::paint): don't paint video
+        (WebCore::GraphicsLayerQtImpl::flushChanges): flush mediaLayer
+        (WebCore::GraphicsLayerQt::setContentsToMedia): notify
+        * platform/graphics/qt/GraphicsLayerQt.h: reimp setContentsToMedia
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): m_compositing
+        (WebCore::MediaPlayerPrivate::paint): don't paint if compositing
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        reimp from MediaPlayerPrivateInterface to support AC
+        (WebCore::MediaPlayerPrivate::platformLayer): ditto
+        * platform/graphics/qt/MediaPlayerPrivateQt.h: 
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering): ditto
 
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isRequired):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isRequired):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * html/HTMLAttributeNames.in:
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
-2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Simon Hausmann.
+        Fix various issues in PlatformWheelEventHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        Add QWebPluginDatabase API to the Qt API.
+        Covered by existing tests.
         
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+        Fixed coding style violations.
+        Synced extracting the correct coordinates with Haiku WebKit implementation.
+        Added extracting modifier key flags.
 
-        * WebCore.pro:
+        * platform/haiku/PlatformWheelEventHaiku.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
 
-2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+2010-02-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Adam Treat.
+        Reviewed by Eric Seidel.
 
-        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
-        (as it is the closest match) instead of CompositionMode_SourceOver.
+        Build fix for PluginView
+        https://bugs.webkit.org/show_bug.cgi?id=35230
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
+        No new tests, build fix only.
 
-2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
 
-        Reviewed by Adam Barth.
+2010-02-23  Kwang Yul Seo  <skyul@company100.net>
 
-        [v8] Fix crash when converting empty v8 string to atomic webkit string.
-        https://bugs.webkit.org/show_bug.cgi?id=27975
+        Reviewed by Eric Seidel.
 
-        collection-null-like-arguments.html tests for this.
+        [BREWMP] Port ScriptController::createScriptInstanceForWidget
+        https://bugs.webkit.org/show_bug.cgi?id=34413
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
+        * bindings/js/ScriptControllerBrew.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
 
-2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-23  José Millán Soto  <jmillan@igalia.com>
 
         Reviewed by Eric Seidel.
 
-        selectionHasStyle needs clean up to fix Bug 27858
-        https://bugs.webkit.org/show_bug.cgi?id=27865
+        [Gtk] Webkit crashes when using orca
+        https://bugs.webkit.org/show_bug.cgi?id=35169
 
-        This patch cleans up selectionStartHasStyle and selectionHasStyle.
-        No test is added because the patch does not change any behavior.
+        Made webkit_accessible_text_get_caret_offset check if end selection
+        node is null.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
-        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
-        * editing/Editor.cpp:
-        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
-        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
-        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
-
-2009-08-03  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by David Levin.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
 
-        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27906
+        Reviewed by Eric Seidel.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        [Haiku] Implemented PopupMenu support.
+        https://bugs.webkit.org/show_bug.cgi?id=35078
 
-2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+        Covered by existing tests.
 
-        Reviewed by David Levin.
+        The implementation is currently very simple: Added a PopupMenuHaiku
+        class that derives from a native BPopUpMenu. It attaches a BHandler
+        derivative to the BApplication (WebCore main thread) which receives
+        the item invokation and menu hidden events and informs the PopupMenuClient
+        accordingly.
 
-        [V8] Cache atomic strings in externalized v8 strings
-        https://bugs.webkit.org/show_bug.cgi?id=27762
+        * platform/PopupMenu.h:
+            Changed type of m_menu for Haiku.
+        * platform/haiku/PopupMenuHaiku.cpp:
+        (WebCore::PopupMenuHandler::PopupMenuHandler):
+        (WebCore::PopupMenuHandler::MessageReceived):
+        (WebCore::PopupMenuHaiku::PopupMenuHaiku):
+        (WebCore::PopupMenuHaiku::~PopupMenuHaiku):
+        (WebCore::PopupMenuHaiku::show):
+        (WebCore::PopupMenuHaiku::hide):
+        (WebCore::PopupMenuHaiku::Hide):
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+            Removed bogus code.
+        (WebCore::PopupMenu::show):
+            Implemented using new PopupMenuHaiku class.
+        (WebCore::PopupMenu::hide):
+            Implemented using new PopupMenuHaiku class.
+        (WebCore::PopupMenu::updateFromElement):
+            Implemented.
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+            Implemented according to Gtk port.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::data):
-        (WebCore::WebCoreStringResource::length):
-        (WebCore::WebCoreStringResource::webcoreString):
-        (WebCore::WebCoreStringResource::atomicString):
-        (WebCore::WebCoreStringResource::toStringResource):
-        (WebCore::v8StringToWebCoreString):
-        (WebCore::v8StringToAtomicWebCoreString):
-        (WebCore::v8ValueToWebCoreString):
-        (WebCore::v8ValueToAtomicWebCoreString):
-        * bindings/v8/V8Binding.h:
-        (WebCore::):
-        * dom/Document.idl:
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
-2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Timothy Hatcher.
+        Fix various issues in PlatformMouseEventHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
-        https://bugs.webkit.org/show_bug.cgi?id=27957
+        Covered by existing tests.
+        
+        Mapping Haiku button constants (bit field) to WebCore buttons was broken.
+        Extracting event time was broken (supposed to be in seconds).
+        Wrong coordinate was being extracted, needs to be content local.
+        Added extracting modifier key flags.
 
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
+        * platform/haiku/PlatformMouseEventHaiku.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
 
-2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        [Qt] Consolidate common gcc flags to WebKit.pri
-        https://bugs.webkit.org/show_bug.cgi?id=27934
-
-        * WebCore.pro:
+        [Haiku] Implement creating and filling platform gradients.
+        https://bugs.webkit.org/show_bug.cgi?id=34683
 
-2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
+        Covered by existing tests.
 
-        Reviewed by Darin Fisher.
+        * platform/graphics/Gradient.h:
+            Typedef PlatformGradient to BGradient
+        * platform/graphics/haiku/GradientHaiku.cpp:
+        (WebCore::Gradient::platformDestroy):
+            Delete the cached BGradient object.
+        (WebCore::Gradient::platformGradient):
+            Create a BGradient object according to the type of Gradient.
+            Return the cached object.
+        (WebCore::Gradient::fill):
+            use BView API to fill with the platform gradient.
 
-        Chromium code sometimes isn't sandboxed and needs to access the FS.
-        https://bugs.webkit.org/show_bug.cgi?id=27954
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
-        These changes are the WebKit side of http://codereview.chromium.org/159778 which
-        aims to make LocalStorage persistent.
+        Reviewed by Eric Seidel.
 
-        This change runs all FileSystem routines through the ChromiumBridge so that
-        WebKitClients can handle them if they choose to.  For now, the only such client
-        will be the one running in the browser process.
+        Build fix for debug builds of GlyphPageTreeNode.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34528
 
-        It also adds a method called sandboxEnabled to the Chromium bridge so that the
-        SQLite file system code can shift its behavior depending on whether we're
-        inside a sandbox or not.
+        Covered by existing tests.
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileModificationTime):
-        (WebCore::directoryName):
-        (WebCore::pathByAppendingComponent):
-        (WebCore::makeAllDirectories):
-        (WebCore::fileExists):
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
-        (WebCore::SQLiteFileSystem::openDatabase):
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-
-2009-08-03  Alpha Lam  <hclam@chromium.org>
+        * platform/graphics/GlyphPageTreeNode.cpp:
+            include <stdio.h> since printf() is used if NDEBUG is not defined.
 
-        Reviewed by David Levin.
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-        [chromium] Implement media slider for chromium
-        https://bugs.webkit.org/show_bug.cgi?id=27859
+        Unreviewed, Chromium build fix.
 
-        Implemented the media slider for chromium port. The implementation
-        is using Skia for drawing the thumb and buffered region instead of
-        using any native system controls so different platforms would have
-        the same look and feel.
+        Add special case in CodeGeneratorV8.pm for named getters for html plugin-related elements.
 
-        No new tests because this is covered by existing tests.
+        CodeGeneratorV8.pm was relying on HasOverridingNameGetter to hint
+        that a custom named getter was needed. That hint was removed in
+        http://trac.webkit.org/changeset/55104.
 
-        * css/mediaControlsChromium.css:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-2009-07-27  Peter Kasting  <pkasting@google.com>
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Eric Seidel.
+        Rubber-stamped by Geoff Garen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26460
-        Plumbing and cleanup in advance of returning multiple frames from the
-        ICOImageDecoder:
-        * Make ImageDecoder::frameCount() return a size_t like
-          ImageSource::frameCount() and BitmapImage::frameCount() already do.
-        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
-          size of a particular frame.  Hook all the
-          ImageSource::frameSizeAtIndex() implementations to this.  No
-          ImageDecoder implements this yet; that will come in my next change.
-
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameCount): returns size_t.
-        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
-        * platform/graphics/win/ImageCairoWin.cpp:
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::size): Clarify comment.
-        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
-        (WebCore::ImageDecoder::frameCount): returns size_t.
-        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::frameCount): returns size_t.
-        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
-        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
+        Rename RuntimeObjectImp to RuntimeObject.
 
-2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
+        * WebCore.PluginHostProcess.exp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::getRuntimeObject):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomGetOwnPropertySlot):
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        (WebCore::runtimeObjectCustomPut):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertValueToJObject):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObject::markChildren):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtRuntimeObject::QtRuntimeObject):
+        (JSC::Bindings::QtInstance::getInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObject::QtPixmapRuntimeObject):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtPixmapInstance::variantFromObject):
+        (JSC::Bindings::QtPixmapInstance::createRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObject::RuntimeObject):
+        (JSC::RuntimeObject::~RuntimeObject):
+        (JSC::RuntimeObject::invalidate):
+        (JSC::RuntimeObject::fallbackObjectGetter):
+        (JSC::RuntimeObject::fieldGetter):
+        (JSC::RuntimeObject::methodGetter):
+        (JSC::RuntimeObject::getOwnPropertySlot):
+        (JSC::RuntimeObject::getOwnPropertyDescriptor):
+        (JSC::RuntimeObject::put):
+        (JSC::RuntimeObject::deleteProperty):
+        (JSC::RuntimeObject::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::RuntimeObject::getCallData):
+        (JSC::callRuntimeConstructor):
+        (JSC::RuntimeObject::getConstructData):
+        (JSC::RuntimeObject::getOwnPropertyNames):
+        (JSC::RuntimeObject::throwInvalidAccessError):
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
 
-        Reviewed by Darin Adler.
+2010-02-19  Peter Kasting  <pkasting@google.com>
 
-        Fix a bug that could cause an ASSERT to fail incorrectly, leading
-        to a renderer crash in Chromium.
+        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27947
+        Avoid recursion when trying to get the size of a PNG; it's unnecessary
+        and in the worst case can lead to heap corruption.
+        https://bugs.webkit.org/show_bug.cgi?id=35167
 
-        All tests in storage/ pass.
+        Test: fast/images/bad-png.html
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::~SQLiteTransaction):
-        (WebCore::SQLiteTransaction::begin):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
 
-2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-02-22  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Tim Hatcher.
 
-        Based on work by Yael Aharon.
+        Disable WebView docking to views that are too small.
+        <rdar://problem/7248409> and https://bugs.webkit.org/show_bug.cgi?id=35254
 
-        Implement keyboard event forwarding for windowless plugins
-        for the Qt port.
+        * WebCore.base.exp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::canAttachWindow): Provide a utility for WebKits to make a showWindow()
+          decision based on if attachment would be allowed or not.
+        (WebCore::InspectorController::attachWindow): Don't attach if the view is too small to attach to.
+        * inspector/InspectorController.h:
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::setSharedXEventFields):
-        (WebCore::setXKeyEventSpecificFields):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+        Build fix.
 
-        Reviewed by Timothy Hatcher.
+        * WebCore.base.exp: Export Instance::newRuntimeObject, it's virtual!
 
-        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
-        https://bugs.webkit.org/show_bug.cgi?id=27928
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        * English.lproj/localizedStrings.js:
+        Undo a small part of the previous commit.
 
-          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
+        * bridge/runtime_method.cpp: (JSC::callRuntimeMethod): Let's keep the instance local
+        variable as RefPtr for safety.
 
-        * inspector/front-end/ChangesView.js: Added.
-        (WebInspector.ChangesView):
-        (WebInspector.ChangesView.prototype._clearButtonClicked):
-        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
-        (WebInspector.ChangesView.prototype.attach):
-        (WebInspector.ChangesView.prototype.show):
-        (WebInspector.ChangesView.prototype.hide):
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
+        Reviewed by Darin Adler.
 
-        * inspector/front-end/Console.js: Removed.
+        https://bugs.webkit.org/show_bug.cgi?id=35260
+        Eliminate __apple_runtime_object
 
-          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
+        No change in functionality, so no tests.
 
-        * inspector/front-end/ConsoleView.js: Added.
+        * WebCore.base.exp: Don't export Instance::newRuntimeObject, WebKit doesn't need it.
 
-          Little has changed from its move from Console.js other then support for working with the Drawer.
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLObjectElement.idl:
+        These objects no longer need overriding name getters, as they no longer intercept the
+        __apple_runtime_object property.
 
-        * inspector/front-end/Drawer.js: Added.
-        (WebInspector.Drawer):
-        (WebInspector.Drawer.prototype.get visibleView):
-        (WebInspector.Drawer.prototype.set visibleView):
-        (WebInspector.Drawer.prototype.show.animationFinished):
-        (WebInspector.Drawer.prototype.show):
-        (WebInspector.Drawer.prototype.hide.animationFinished):
-        (WebInspector.Drawer.prototype.hide):
-        (WebInspector.Drawer.prototype._safelyRemoveChildren):
-        (WebInspector.Drawer.prototype._startStatusBarDragging):
-        (WebInspector.Drawer.prototype._statusBarDragging):
-        (WebInspector.Drawer.prototype._endStatusBarDragging):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginInstance): This is no longer static. It was used for callPlugin() in
+        this file, and now it's also used elsewhere when calling plug-in methods.
+        (WebCore::runtimeObjectGetter): Removed. This function was only used by the intercepting
+        name getters.
 
-          Allow for multiple views inside the Sliding Drawer.
+        * bindings/js/JSPluginElementFunctions.h: Export pluginInstance().
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.renameSelector):
-        (WebInspector.ElementsPanel.prototype.addStyleChange):
-        (WebInspector.ElementsPanel.prototype.removeStyleChange):
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Take plug-in element's instance directly, without relying on fake attribute lookup.
+        One change resulting from this is that RuntimeObjectImp may not be created in some cases -
+        this code only needs an instance, but the old code had to pass the instance wrapped into
+        RuntimeObjectImp.
 
-          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+2010-02-22  John Sullivan  <sullivan@apple.com>
+        
+        Reviewed by Tim Hatcher.
 
-        * inspector/front-end/Images/styleIcon.png: Added.
+        https://bugs.webkit.org/show_bug.cgi?id=35256
+        HTMLSelectElement::setSelectedIndexByUser() can trigger unnecessary JS when there is no change to the selected index
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        No new tests because this code path is not used for JS-initiated changes.
 
-          Interface with ElementsPanel for generating a Stylesheet of Changes.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        Bail out if the to-be-selected index matches the already-selected index.
 
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
-        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
+2010-02-22  Enrica Casucci  <enrica@apple.com>
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.get styleChanges):
-        (WebInspector.set styleChanges):
-        (WebInspector._updateChangesCount):
-        (WebInspector.loaded):
-        (WebInspector.documentKeyDown):
-        (WebInspector.showConsole):
-        (WebInspector.showChanges):
+        Reviewed by Dan Bernstein.
 
-          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
+        Reproducible crash in WebCore::nextLinePosition on Tweeteorites.com
+        <rdar://problem/7615758>
+        https://bugs.webkit.org/show_bug.cgi?id=35060
 
-2009-08-03  Dean McNamee  <deanm@chromium.org>
+        Test: editing/selection/extend-byline-withfloat.html
 
-        Reviewed by Adam Barth.
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition): Skip elements with zero height.
+        (WebCore::nextLinePosition): Skip elements with zero height.
 
-        Correct an assert on a PassRefPtr in the v8 svg bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27951
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+        Unreviewed, Chromium build fix.
 
-2009-08-03  Dirk Pranke  <dpranke@chromium.org>
+        * bindings/scripts/CodeGeneratorV8.pm: Compile break due to bad patch merge.
 
-        Reviewed by Sam Weinig.
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
-        crash w/ stack overflow when same CSS file loaded repeatedly
+        Reviewed by Dimitri Glazkov.
 
-        Fix crash caused by a stack overflow when repeatedly loading very large
-        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
-        recursively rather than iteratively.
+        [V8] Streamline V8 event listener code. Merge all the variants of
+        V8DOMWrapper::getEventListner() into a single version and generate
+        addEventListener() and removeEventListener() bindings for all objects 
+        except DOMWindow.
 
-        Test: fast/css/large-list-of-rules-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=35245
 
-        * css/CSSStyleSelector.h:
-        (WebCore::CSSRuleData::~CSSRuleData):
-        (WebCore::CSSRuleDataList::~CSSRuleDataList):
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+        * bindings/v8/custom/V8EventSourceCustom.cpp: Removed.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp: Removed.
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * dom/MessagePort.idl:
+        * dom/Node.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * notifications/Notification.idl:
+        * page/EventSource.idl:
+        * svg/SVGElementInstance.idl:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.idl:
 
-2009-08-03  Simon Fraser  <simon.fraser@apple.com>
+2010-02-22  Chris Fleizach  <cfleizach@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Beth Dakin.
 
-        Make the DRT APIs to pause transitions and animations work for accelerated animations
-        <https://bugs.webkit.org/show_bug.cgi?id=27627>
-        <rdar://problem/6442932>
+        AX: AXFocused is not writable like it should be on nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35186
 
-        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
-        available to LayoutTests to work with accelerated animations and transitions. Done by sending
-        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
-        
-        I also added an assertion to check that the animation has actually started when we
-        try to pause it, to check that the pause time we compute is valid. This revealed a number
-        of tests that tried to pause before animations started, required some amount of test fixing.
+        Test: platform/mac/accessibility/element-focus.html
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::freezeAtTime):
-        * page/animation/AnimationBase.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::pauseAnimationAtTime):
-        (WebCore::CompositeAnimation::pauseTransitionAtTime):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::suspendAnimations):
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::suspendAnimations):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::suspendAnimations):
-        * rendering/RenderLayerBacking.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
 
-2009-08-03  Tony Chang  <tony@chromium.org>
+2010-02-22  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Dan Bernstein, Darin Adler.
 
-        Fix Chromium build by removing PluginView.h from Page.cpp.
-        Chromium doesn't use PluginView and the pointer is never
-        dereferenced so the header doesn't need to be included.
-        https://bugs.webkit.org/show_bug.cgi?id=27946
+        Remove addScrolledContentOffset/subtractScrolledContentOffset
+        https://bugs.webkit.org/show_bug.cgi?id=35225
 
-        No new tests because this is a build fix.
+        Remove RenderLayer's addScrolledContentOffset() and subtractScrolledContentOffset()
+        methods, and instead use the existing scrolledContentOffset(), and use
+        IntSize and IntPoint instead of lots of x, y variables.
+        
+        Added new IntPoint toPoint(const IntSize&) method as a convenience to convert a size to a point,
+        which is needed in a few places.
+        
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag): Use the new toPoint() convenience.
+        * platform/graphics/IntPoint.h:
+        (WebCore::toPoint): New convenience method to convert an IntSize to an IntPoint.
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::size):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
 
-        * page/Page.cpp:
+2009-02-22  Adam Langley  <agl@google.com>
 
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+        Reviewed by Darin Fisher.
 
-        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+        fontconfig on Linux can change the render preferences on a per strike
+        basis (a strike a combination of face and size). Because of this, we
+        need to query fontconfig each time a new FontPlatformData is created
+        for a new size.
 
-        Unreviewed.
+        This patch adds support for querying this via ChromiumBridge.
 
-        * WebCoreSources.bkl:
+        https://bugs.webkit.org/show_bug.cgi?id=33065
 
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+        * platform/chromium/ChromiumBridge.h: add getRenderStyleForStrike
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::setupPaint):
+        (WebCore::FontPlatformData::queryStyle):
+          add code to query fontconfig via ChromiumBridge
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
 
-        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Unreviewed.
+        Build fix for make distcheck.
 
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
 
-2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Darin Adler.
-
-        Bug 27943: Need to implement ARIA role="radiogroup"
-        https://bugs.webkit.org/show_bug.cgi?id=27943
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Test: platform/mac/accessibility/aria-radiogroup.html
+        Fix compiler warning "suggest parentheses around"
+        https://bugs.webkit.org/show_bug.cgi?id=35197
 
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isRadioGroup):
-        (WebCore::AccessibilityObject::selectedRadioButton):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::selectedRadioButton):
-        (WebCore::RoleEntry::):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        No new tests as there is no new functionality.
 
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+        * wml/WMLVariables.cpp:
+        (WebCore::substituteVariableReferences):
 
-        Reviewed by Eric Seidel.
+2010-02-22  Gustavo Noronha Silva  <gns@gnome.org>
 
-        HTMLInputElement is not controllable by assistive technologies
-        https://bugs.webkit.org/show_bug.cgi?id=27941
+        Reviewed by Xan Lopez.
 
-        Test: accessibility/input-slider.html
+        [Soup] loses information related to message flags when converting from/to Resource{Request,Response}
+        https://bugs.webkit.org/show_bug.cgi?id=35093
 
-        * WebCore.xcodeproj/project.pbxproj:
-            Add AccessibilitySlider.cpp/.h
+        Store message flags in WebCore objects, and set them on the
+        SoupMessage, when creating one from them.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::getOrCreate):
-            Create AccessibilitySlider and AccessibilitySliderThumb.
+        No behaviour change.
 
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::increment):
-        (WebCore::AccessibilityObject::decrement):
-            Add default, do nothing, base class methods.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::soupMessageFlags):
+        (WebCore::ResourceRequest::setSoupMessageFlags):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::soupMessageFlags):
+        (WebCore::ResourceResponse::setSoupMessageFlags):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::toSoupMessage):
+        (WebCore::ResourceResponse::updateFromSoupMessage):
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
-            Correct typo.
-
-        * accessibility/AccessibilitySlider.cpp: Added.
-        (WebCore::AccessibilitySlider::AccessibilitySlider):
-        (WebCore::AccessibilitySlider::create):
-        (WebCore::AccessibilitySlider::children):
-        (WebCore::AccessibilitySlider::addChildren):
-        (WebCore::AccessibilitySlider::getAttribute):
-        (WebCore::AccessibilitySlider::valueForRange):
-        (WebCore::AccessibilitySlider::maxValueForRange):
-        (WebCore::AccessibilitySlider::minValueForRange):
-        (WebCore::AccessibilitySlider::changeValue):
-        (WebCore::AccessibilitySlider::setValue):
-        (WebCore::AccessibilitySlider::increment):
-        (WebCore::AccessibilitySlider::decrement):
-        (WebCore::AccessibilitySlider::element):
-        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
-        (WebCore::AccessibilitySliderThumb::create):
-        (WebCore::AccessibilitySliderThumb::elementRect):
-        (WebCore::AccessibilitySliderThumb::size):
-        * accessibility/AccessibilitySlider.h: Added.
-        (WebCore::AccessibilitySlider::~AccessibilitySlider):
-        (WebCore::AccessibilitySlider::roleValue):
-        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
-        (WebCore::AccessibilitySlider::isSlider):
-        (WebCore::AccessibilitySlider::canSetValueAttribute):
-        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
-        (WebCore::AccessibilitySliderThumb::roleValue):
-        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
-        (WebCore::AccessibilitySliderThumb::setParentObject):
-        (WebCore::AccessibilitySliderThumb::parentObject):
-
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (RoleEntry::):
-            SliderThumbRole -> NSAccessibilityValueIndicatorRole
-        (-[AccessibilityObjectWrapper roleDescription]):
-            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-            Minor coding style correction.
-        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
-            If attachement view handles press action, don't also call object wrapper.
-        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
-            New, call object's increment() method.
-        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
-            New, call object's decrement() method.
-        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
-            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
+2010-02-22  Steve Block  <steveblock@google.com>
 
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::thumbRect):
-            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
-        (WebCore::RenderSlider::layout):
-            Move code to thumbRect().
-        * rendering/RenderSlider.h:
+        Reviewed by Nate Chapin.
 
-2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Shared worker types used in globalObjectPrototypeIsDOMWindow are not properly guarded
+        https://bugs.webkit.org/show_bug.cgi?id=35238
 
-        Reviewed by Eric Seidel.
+        No new tests, build fix only.
 
-        Build fix if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=27940
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::globalObjectPrototypeIsDOMWindow):
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
-        disabled
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::platformStart): Empty stub.
+2010-02-22  Steve Block  <steveblock@google.com>
 
-2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by George Staikos.
+        Simplifies calculation of the transform in RenderLayer::paintLayer
+        https://bugs.webkit.org/show_bug.cgi?id=35101
 
-        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27917
+        No new tests, optimization only.
 
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
 
-2009-08-02  Adam Barth  <abarth@webkit.org>
-        Reviewed by Darin Adler.
+2010-02-22  Nicholas Young  <nicholas.young@nokia.com>
 
-        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
+        Reviewed by Tor Arne Vestbø.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27932
+        [Qt] Switching from Phonon to QtMultimedia Backend for Qt 4.7
 
-        There's no reason to pay for a virtual function call in this case.  We
-        can just call document() directly because we know that element is a
-        Node*.
+        https://bugs.webkit.org/show_bug.cgi?id=34631
 
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::scriptExecutionContext):
+        No new tests. This patch only affects multimedia backend.
 
-2009-08-02  Adam Barth  <abarth@webkit.org>
+        * WebCore.pro: Build depends on Qt version.
+        * css/mediaControlsQt.css: Updated media controls.
+        * platform/graphics/MediaPlayer.cpp: Different backend included depending on Qt version.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp: Added new QtMultimedia Backend.
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytes):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::mediaStatusChanged):
+        (WebCore::MediaPlayerPrivate::handleError):
+        (WebCore::MediaPlayerPrivate::stateChanged):
+        (WebCore::MediaPlayerPrivate::nativeSizeChanged):
+        (WebCore::MediaPlayerPrivate::queuedSeekTimeout):
+        (WebCore::MediaPlayerPrivate::seekTimeout):
+        (WebCore::MediaPlayerPrivate::positionChanged):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::mutedChanged):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::repaint):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h: Added new QtMultimedia Backend.
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::mediaControlsBaselineOpacity): New method.
+        (WebCore::RenderThemeQt::paintMediaBackground): Background depends on baseline opacity.
+        (WebCore::RenderThemeQt::paintMediaMuteButton): Changed styling.
+        (WebCore::RenderThemeQt::paintMediaCurrentTime): Added current time display.
+        (WebCore::RenderThemeQt::formatMediaControlsCurrentTime): Added time formatting.
+        (WebCore::RenderThemeQt::formatMediaControlsRemainingTime): Added time formatting.
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack): Volume slider added.
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderThumb): Volume slider added.
+        (WebCore::RenderThemeQt::paintMediaSliderTrack): Updated for QtMultimedia.
+        (WebCore::RenderThemeQt::paintMediaSliderThumb): Dropped an unnecessary check.
+        (WebCore::RenderThemeQt::adjustSliderThumbSize): Handle a missing case.
+        * platform/qt/RenderThemeQt.h: Reimplemented a few more methods.
 
-        Reviewed by Darin Adler.
+2010-02-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        JSNodeCustom should call document() instead of scriptExecutionContext()
-        https://bugs.webkit.org/show_bug.cgi?id=27931
+        Not reviewed: mac build fix
 
-        We want to call document() because it's in inline function, instead of
-        scriptExecutionContext() because it's a virtual function.  If we have a
-        Node*, then we know that the virtual function will always return the
-        document anyway.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
 
-        There are more instance of this bug, but I'd like to start with a small
-        patch and work up.
+2010-02-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
+        Reviewed by Pavel Feldman.
 
-2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Web Inspector: there should be a way to "deactivate" or "skip" all breakpoints while debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=33217
 
-        Reviewed by Anders Carlsson.
+        * English.lproj/localizedStrings.js:
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::setBreakpointsActivated):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::setBreakpointsActivated):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::activateBreakpoints):
+        (WebCore::InspectorBackend::deactivateBreakpoints):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png: Added.
+        * inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png: Added.
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.activateBreakpoints):
+        (.WebInspector.InspectorBackendStub.prototype.deactivateBreakpoints):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get breakpointsActivated):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpointsClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/textViewer.css:
 
-        Share implementation of PluginView::userAgent() and userAgentStatic()
+2010-02-22  Mark Rowe  <mrowe@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Rubber-stamped by Sam Weinig and Maciej Stachowiak.
 
-        Differences to the original implementation are as follows:
-        
-            - The Win port used to return 0 for userAgentStatic, but now
-              returns the quirk mode MozillaUserAgent as the other ports.
+        REGRESSION (r55039): Animation starts from near end when loaded over slow network
+        <http://webkit.org/b/35222> / <rdar://problem/7673523>
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::userAgent):
-        (WebCore::PluginView::userAgentStatic):
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        Roll out r55039 (related to <http://webkit.org/b/35115>) as it causes animated GIFs
+        to skip intermediate frames when loading over a slower network.
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        Reviewed by Anders Carlsson.
+2010-02-22  Maciej Stachowiak  <mjs@apple.com>
 
-        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        Not reviewed, build fix.
         
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Revert the previous change.
         
-        Since the plugin has not been started yet (m_isStarted is not set),
-        calling stop() will not have any affect, so we manually unregister
-        in start() before returning.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Anders Carlsson.
+2010-02-21  Maciej Stachowiak  <mjs@apple.com>
 
-        Join the various versions of PluginView::stop() into one shared implementation
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Cache JavaScript wrappers inline in DOM nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35226
+        <rdar://problem/7664202>
 
-        The platform-dependent bits are now ifdef'ed in the shared implementation,
-        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
+        8.8% speedup on Dromaeo DOM Core tests.
+        3.3% speedup on Hixie DOM Core tests.
         
-        Differences to the original implementation are as follows:
-
-            - The Qt port unregistered the plugin before calling NP_SetWindow
-              with a 0 window handle. Now it's done after (similar to Win)
-
-            - The GTK and Qt ports unregistered the plugin before clearing
-              the m_npWindow.ws_info struct. Now it's done after.
-              
-            - The Win port constructed the DropAllLocks after unsubclassing
-              the window. Now it's done before.
-              
-            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
-              to NP_Destroy (like the Win port). Now all ports do.
-
-            - The Win port did not call PluginView::setCurrentPluginView()
-              before calling to NP-functions. Now it does.     
-
-        * plugins/PluginView.cpp:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-
-2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: let me *edit* css styles in the web inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=27124
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
-        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
-        (WebInspector.StylePropertiesSection):
-        (WebInspector.StylePropertiesSection.prototype.expand):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
-        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
-        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
-        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
-        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
-        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
-        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
-        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
-        (WebInspector.StylePropertyTreeElement.prototype):
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        * inspector/front-end/inspector.css:
-
-2009-07-31  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::forgetDOMNode): Clear wrapper pointer.
+        (WebCore::cacheDOMNodeWrapper): Cache inline too if caching for normal world.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWrapperMapFor): 
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): Remove unneeded argument from getCachedDOMNodeWrapper.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Renamed version of original createWrapper.
+        (WebCore::createWrapper): Call createWrapperInline. Out-of-line version.
+        (WebCore::toJSNewlyCreated): Call createWrapperInline instead of createWrapper.
+        * bindings/js/JSNodeCustom.h: Added.
+        (WebCore::getCachedDOMNodeWrapper): Moved here so it can be inlined.
+        (WebCore::toJS): Moved here so it can be inlined.
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable): Implement this in the obvious
+        way for JavaScriptCore.
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm: Include CustomHeader heaaders
+        in the header, not just the impl file, so they can add inlining.
+        * dom/Node.idl: Add CustomHeader directive.
+        
+        Add new files to build.
 
-        [v8] check if proxy is present before invoking a handler
-        https://bugs.webkit.org/show_bug.cgi?id=27883 
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
 
-        Do not invoke handler function if proxy is null pointer (that would lead to access violation
-        anyway)
+2010-02-22  Pavel Feldman  <pfeldman@chromium.org>
 
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::callListenerFunction):
+        Not reviewed: windows build fix.
 
-2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-21  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Reimplement Elements Panel so that its
-        interaction with DOM is serialized.
-
-        This is a first cut wuth read support for DOM elements
-        tree as well as some limited editing. No properties, no
-        styles, no search capabilities are implemented yet.
-        Set Preferences.useDOMAgent to true in order to try it
-        out, otherwise disabled by default.
+        Web Inspector: stop on inline breakpoints on reload.
+        - ScriptBreakpoint struct has been introduced and reused in InspectorController
+          and debug server.
+        - JavaScriptDebugServer was moved to bindings/js and renamed to ScriptDebugServer
+          There were no changes to semantics, only some mechanical changes:
+            - addBreakpoint and updateBreakpoint were merged into setBreakpoint
+            - ScriptDebugServer now operates ScriptBreakpoint instances instead of
+              BreakpointInfo.
+            - It no longer allocates maps and breakpoint info in heap - all done on stack.
+            - JavaScriptDebugListener is now ScriptDebugServer::Listener
+            - Listener methods no longer have ExecState (was unused).
+            - addListener/removeListener pair wuth no page argument removed (was unused).
+        - InspectorController now binds sourceID to url and maintains a map of 'sticky'
+          breakpoints. Whenever script is loaded and there is a sticky breakpoint url matching,
+          breakpoint is being 'restored' synchronously in debug server and pushed to frontend.
+          Front-end no longer stores map of sticky breakpoints.
+            - setBreakpoint/removeBreakpoint/didParseSource trio handle this logic.
+        - A bunch of if(USE_JSC/V8/other) forks removed.
+        - InspectorFrontend now operates primitive types only, got rid of USE_JSC as well.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27771
+        https://bugs.webkit.org/show_bug.cgi?id=28799
 
         * GNUmakefile.am:
+        * WebCore.base.exp:
         * WebCore.gypi:
+        * WebCore.order:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::isActivation):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::~ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::hasListenersInterestedInPage):
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        (WebCore::ScriptDebugServer::setPauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::pauseProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::currentCallFrame):
+        (WebCore::ScriptDebugServer::currentCallFrameState):
+        (WebCore::ScriptDebugServer::dispatchDidParseSource):
+        (WebCore::ScriptDebugServer::dispatchFailedToParseSource):
+        (WebCore::toPage):
+        (WebCore::ScriptDebugServer::detach):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        (WebCore::ScriptDebugServer::callEvent):
+        (WebCore::ScriptDebugServer::atStatement):
+        (WebCore::ScriptDebugServer::returnEvent):
+        (WebCore::ScriptDebugServer::exception):
+        (WebCore::ScriptDebugServer::willExecuteProgram):
+        (WebCore::ScriptDebugServer::didExecuteProgram):
+        (WebCore::ScriptDebugServer::didReachBreakpoint):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::didAddListener):
+        (WebCore::ScriptDebugServer::didRemoveListener):
+        (WebCore::ScriptDebugServer::didRemoveLastListener):
+        * bindings/js/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::Listener::~Listener):
+        (WebCore::ScriptDebugServer::):
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::hasListeners):
+        (WebCore::ScriptDebugServer::hasGlobalListeners):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::Listener::~Listener):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        (WebCore::ScriptDebugServer::):
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::setPauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::pauseProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::currentCallFrameState):
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::~ScriptDebugServer):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        (WebCore::V8InjectedScriptHost::isActivationCallback):
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setAttribute):
-        (WebCore::InspectorBackend::removeAttribute):
-        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::setBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptionsState):
+        (WebCore::InspectorBackend::setPauseOnExceptionsState):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
+        * inspector/ScriptBreakpoint.h: Added.
+        (WebCore::InspectorBreakpoint::InspectorBreakpoint):
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
         (WebCore::InspectorController::close):
-        (WebCore::InspectorController::populateScriptObjects):
         (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::resumeDebugger):
+        (WebCore::InspectorController::setBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        (WebCore::InspectorController::didPause):
         * inspector/InspectorController.h:
-        (WebCore::InspectorController::domAgent):
-        * inspector/InspectorDOMAgent.cpp: Added.
-        * inspector/InspectorDOMAgent.h: Added.
         * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::restoredBreakpoint):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::resumedScript):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/Callback.js: Added.
-        * inspector/front-end/DOMAgent.js: Added.
-        * inspector/front-end/ElementsPanel.js:
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
+        * inspector/JavaScriptDebugListener.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed.
+        * inspector/JavaScriptDebugServer.h: Removed.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.sourceFrameForResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
         * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        isContentEditable function in htmlediting.* must be removed
-        https://bugs.webkit.org/show_bug.cgi?id=27870
-
-        This patch removes isContentEditable function in htmlediting.cpp and
-        replaces all usage by calling Node::isContentEditable or its derivatives.
-
-        * editing/AppendNodeCommand.cpp: ditto
-        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
-        * editing/IndentOutdentCommand.cpp: ditto
-        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
-        * editing/InsertNodeBeforeCommand.cpp: ditto
-        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
-        * editing/htmlediting.cpp: ditto
-        (WebCore::enclosingNodeWithTag): ditto
-        (WebCore::enclosingNodeOfType): ditto
-        (WebCore::canMergeLists): ditto
-        * editing/htmlediting.h: Updated prototype
-
-2009-08-01  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix a message port handle always getting marked as reachable once it gets entangled.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27824
-
-        No tests since this only arises with the Chromium multi-process message port implementation
-        which isn't in this repostiory.
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
-
-2009-07-31  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Barth.
-
-        Fix Geolocation permission problem
-        https://bugs.webkit.org/show_bug.cgi?id=26993
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::requestPermission):
-
-2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        Added project properties as needed by symbian platform
-
-        * WebCore.pro:
-
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix compiler warning.
-
-        Initialize member variables in the correct order.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-
-2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Windows build fix!
-
-        Unreviewed.
-
-        * page/win/PageWin.cpp:
-
-2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Mac build fix.
-
-        Unreviewed.
-
-        * page/Page.cpp:
-        Move setCanStartPlugins() from here...
-        * page/win/PageWin.cpp:
-        (WebCore::Page::setCanStartPlugins):
-        ... to here.
-
-2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
-        background tabs (make Win consistent with Mac)
-
-        https://bugs.webkit.org/show_bug.cgi?id=27855
-
-        Reviewed by Anders Carlsson.
-
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
-        Declare a new function to dispatch failures to start plug-ins.
-
+        (WebInspector.restoredBreakpoint):
         * page/Page.cpp:
         (WebCore::Page::Page):
-        Initialize new member variable.
-        (WebCore::Page::addUnstartedPlugin):
-        Add the PluginView to the set of unstarted plug-ins.
-        (WebCore::Page::removeUnstartedPlugin):
-        Remove the PluginView from the set of unstarted plug-ins.
-        (WebCore::Page::setCanStartPlugins):
-        If we can now start plug-ins, iterate the set of unstarted plug-ins,
-        starting them. If a plug-in fails to start, dispatch a failed-to-start-
-        plug-in error. Clear the list of unstarted plug-ins.
-
-        * page/Page.h:
-        Added m_canStartPlugins to track whether we can currently start
-        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
-        page that are waiting to be started.
-        (WebCore::Page::canStartPlugins):
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
-        fails, set m_status to reflect this; this used to be set by init(), but
-        start() will not be called by init() if we are delaying start().
-        If NPP_New() succeeds, set m_status to reflect this, and call
-        platformStart().
-        (WebCore::PluginView::startOrAddToUnstartedList):
-        If we cannot start plug-ins, add this view to the Page's list of
-        unstarted plug-ins and return true. Otherwise, call start() and return
-        the result.
-        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
-        If we've been started or we don't have a Page, return early. Remove
-        ourselves from the Page's list of unstarted plug-ins.
-        (WebCore::PluginView::bindingInstance):
-        If we haven't been started yet, return 0. This matches the Mac
-        behavior.
-        (WebCore::PluginView::setParameters):
-        If we find the "plug-ins page" parameter, record it; it may be used if
-        we fail to start the plug-in.
-        (WebCore::PluginView::PluginView):
-        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
-        with mimeType directly; m_mimeType is now a WebCore::String.
-
-        * plugins/PluginView.h:
-        Made start() public, so Page can call it when we start unstarted
-        plug-ins. Changed m_mimeType from CString to String and added
-        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
-        (WebCore::PluginView::pluginsPage):
-        Added for dispatchDidFailToStartPlugin().
-        (WebCore::PluginView::mimeType):
-        Ditto.
-        (WebCore::PluginView::url):
-        Ditto.
-
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+        * platform/android/TemporaryLinkStubs.cpp:
 
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+        Reviewed by Oliver Hunt.
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
-        and SetWindowRgn() to position the plug-in and set its clip rect if an
-        earlier call to updatePluginWidget() was made before
-        setPlatformPluginWidget() was called to set the plug-in's HWND.
-        (WebCore::PluginView::~PluginView):
-        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
-        the unstarted list if the plug-in is destroyed before it is started.
-        (WebCore::PluginView::init):
-        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
-        cannot be started, to add it to the list of plug-ins waiting to be
-        started. Set m_status to indicate success; this is also set by start(),
-        but that may be delayed, and we don't want the loader to dispatch a
-        failed-to-start-plug-in error when we return from init().
-        (WebCore::PluginView::platformStart):
-        Added; code moved from init(). This is now called by start() to perform
-        any platform-specific tasks that need to take place after the plug-in
-        has started. Added a call to updatePluginWidget() to ensure we position
-        the plug-in and set its clip rect after the plug-in has started.
-        Removed the setting of m_status; start() does this before calling this
-        function (and we assert this at the head of the function).
+        Make the UChar owned/ref-counted by StringImpl::CrossThreadRefCounted be const.
 
-2009-07-30  Darin Adler  <darin@apple.com>
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
 
-        Reviewed by David Levin.
+2010-02-07  Yuzo Fujishima  <yuzo@google.com>
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        Reviewed by Eric Seidel.
 
-        Next step: Add casts for all the RenderTable classes and use them everywhere.
+        When page-break-{after,before} is set to always, force page breaks even for overflow-specified elements.
+        RenderBlock::inRootBlockContext() was introduced by Changeset 5611. Although it is a reasonable criteria for choosing an optional page break location, it is not for a mandatory page break as specified by http://dev.w3.org/csswg/css3-page/#forced-pg-brk. The method is removed because it is not used anywhere else.
+        Note: this patch makes page break work for overflow-specified elements. For tables and floated elements, more work is needed.
+        https://bugs.webkit.org/show_bug.cgi?id=9526
 
-        Also added a few uses in places that were still using static_cast.
-        Also made some virtual member functions private.
-        Also changed RenderTable::m_tableLayout to use OwnPtr.
+        Test: printing/page-break-always-for-overflow.html
 
-        * accessibility/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-        (WebCore::AccessibilityTable::addChildren):
-        (WebCore::AccessibilityTable::cellForColumnAndRow):
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::parentTable):
-        (WebCore::AccessibilityTableCell::rowIndexRange):
-        (WebCore::AccessibilityTableCell::columnIndexRange):
-        (WebCore::AccessibilityTableCell::titleUIElement):
-        * accessibility/AccessibilityTableColumn.cpp:
-        (WebCore::AccessibilityTableColumn::headerObject):
-        * accessibility/AccessibilityTableRow.cpp:
-        (WebCore::AccessibilityTableRow::parentTable):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode):
-        * editing/TextIterator.cpp:
-        (WebCore::shouldEmitTabBeforeNode):
-        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
-        * html/HTMLTableCellElement.cpp:
-        (WebCore::HTMLTableCellElement::parseMappedAttribute):
-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseMappedAttribute):
-        * page/Frame.cpp:
-        (WebCore::Frame::searchForLabelsAboveCell):
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::searchForNSLabelsAboveCell):
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::fullRecalc):
-        (WebCore::shouldScaleColumns):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray):
         * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::calcPrefWidths):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcPercentageHeight):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::addChild):
-        (WebCore::RenderObject::containingBlock):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::collapsedBottomBorder):
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::table):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::addChild):
-        (WebCore::RenderTableRow::layout):
-        (WebCore::RenderTableRow::paint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::addChild):
-        (WebCore::RenderTableSection::layoutRows):
-        (WebCore::RenderTableSection::lowestPosition):
-        (WebCore::RenderTableSection::rightmostPosition):
-        (WebCore::RenderTableSection::leftmostPosition):
-        (WebCore::RenderTableSection::paintObject):
-        (WebCore::RenderTableSection::recalcCells):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::operator<<):
-        (WebCore::writeTextRun):
-        Use checked casts.
-
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
-        (WebCore::RenderTable::addChild): Use checked cast.
-        (WebCore::RenderTable::layout): Ditto.
-        (WebCore::RenderTable::setCellWidths): Ditto.
-        (WebCore::RenderTable::paintObject): Ditto.
-        (WebCore::RenderTable::splitColumn): Ditto.
-        (WebCore::RenderTable::appendColumn): Ditto.
-        (WebCore::RenderTable::colElement): Ditto.
-        (WebCore::RenderTable::recalcSections): Ditto.
-        (WebCore::RenderTable::outerBorderBottom): Ditto.
-        (WebCore::RenderTable::outerBorderLeft): Ditto.
-        (WebCore::RenderTable::outerBorderRight): Ditto.
-        (WebCore::RenderTable::sectionAbove): Ditto.
-        (WebCore::RenderTable::sectionBelow): Ditto.
-
-        * rendering/RenderTable.h: Added checked cast. Made virtual
-        functions private. Changed m_tableLayout to be a OwnPtr.
-
-        * rendering/RenderTableCell.h: Added checked cast.
-        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
-        * rendering/RenderTableRow.h: Ditto.
-        * rendering/RenderTableSection.h: Ditto.
-
-2009-07-31  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by John Sullivan.
-
-        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
-        Favicons are still loaded when automatic image loading is disabled.
-
-        People who want to avoid loading images generally want to avoid loading all images.
-
-        Test: http/tests/misc/favicon-loads-with-images-disabled.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
-          perform the load if images shouldn't be loading.
-
-2009-07-31  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Anders Carlsson.
-        
-        Accelerated animations stutter on pages with lots of animations and 3d transforms
-        https://bugs.webkit.org/show_bug.cgi?id=27884
-        
-        This patch changes the strategy for synchronizing painting view the view,
-        and compositing layer updates. Previously the strategy was to disable screen
-        updates between the time we updated the layer tree, and painted the view. That
-        left screen updates disabled for too long (hundreds of milliseconds) in some
-        cases, causing animation stutter.
-        
-        The new strategy is to batch up changes to the CA layer tree, and commit them
-        all at once just before painting happens (referred to as a "sync" in the code).
-        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
-        the values stored in GraphicsLayer into the CA layer tree at commit time.
-        
-        Compositing layers are then synced in FrameView::paintContents(). However, not
-        all style/layout changes will result in painting; to deal with style changes that
-        touch only compositing properties, we set up a runloop observer that takes care
-        of comitting layer changes when no painting happens.
-
-        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
-
-        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
-        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
-
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
-        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
-        sync and returns false, since we only want to sync when layout is done.
-        
-        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
-
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::endAnimation):
-        Call animationPaused() to notify the graphics layers about animation pausing.
-        
-        * platform/graphics/FloatPoint3D.h:
-        (WebCore::operator==):
-        (WebCore::operator!=): 
-        Add missing comparison operators.
-        
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::setOpacity):
-        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
-        
-        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
-        
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::AnimationValue:):
-        (WebCore::TransformAnimationValue:):
-        (WebCore::KeyframeValueList:):
-        (WebCore::KeyframeValueList::insert):
-        Cleaned up versions of FloatValue and TransformValue, used to store information
-        about keyframes values.
-
-        (WebCore::GraphicsLayer::contentsRect):
-        (WebCore::GraphicsLayer::setContentsRect):
-        ContentsRect is now a simple setter.
-        
-        (WebCore::GraphicsLayer::addAnimation):
-        (WebCore::GraphicsLayer::removeAnimationsForProperty):
-        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
-        (WebCore::GraphicsLayer::pauseAnimation):
-        Simplified animation api.
-        
-        (WebCore::GraphicsLayer::setGeometryOrientation):
-        (WebCore::GraphicsLayer::geometryOrientation):
-        setGeometryOrientation is now just a normal member variable.
-        
-        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
-        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
-        
-        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
-
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        Lots of cleanup and refactoring. Main points:
-        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
-        - Bitmask is used to store which properties have changed. More efficient than before.
-        - Simpler animation interface; simple setters are no longer confounded with animations.
-        - Refactored code that creates CA animations, and stores which animations are running.
-
-        * platform/graphics/transforms/TransformOperations.h:
-        (WebCore::TransformOperations::size):
-        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
-        
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerBacking.cpp:
-        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
-        contentsLayer.
-        Adapt to GraphicsLayer's simpler animation API.
-        Pass animation pausing through to the graphics layers.
-        contentsBox() is no longer a callback via GraphicsLayerClient.
-        
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
-        (WebCore::RenderLayerCompositor::scheduleSync):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
-        notifications, which travel up to WebKit and set up a runloop observer.
-        
-2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by David Levin.
-
-        Guard needs //'s between #endif and ENABLE(DATAGRID)
-        https://bugs.webkit.org/show_bug.cgi?id=27862
-
-        Compiling this file causes a build break without this change.
-
-        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        (WebCore::RenderBlock::paintChildren):
+        * rendering/RenderBlock.h:
 
-2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+2010-02-21  Julien Chaffraix  <jchaffraix@webkit.org>
 
         Reviewed by Eric Seidel.
 
-        Geolocation clean up when no longer updating
-        https://bugs.webkit.org/show_bug.cgi?id=27888
+        Remove auto_ptr usage in WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35157
 
-        When Geolocation::disconnectFrame() is called, need to call 
-        Document::setUsingGeolocation(false) to mirror the true call 
-        when it is set up.
+        The changes consists of:
 
-        When handling an error, and there are no more listeners, call
-        GeolocationService::stopUpdating().
+        - Changing auto_ptr arguments or return types to PassOwnPtr.
 
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::disconnectFrame):
-        (WebCore::Geolocation::handleError):
-
-2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+        - Replacing local auto_ptr by OwnPtr.
 
-        Reviewed by George Staikos.
+        - Removing now unneeded <memory> inclusion.
 
-        Consolidate GeoLocation code to send positions and errors
-        https://bugs.webkit.org/show_bug.cgi?id=27863
-        
-        Create helper methods that will send positions and errors to either
-        one shots or watchers.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::workerContextDidReceiveResponse):
+        (WebCore::workerContextDidReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::workerContextDidReceiveAuthenticationCancellation):
+        * loader/WorkerThreadableLoader.h:
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::create):
+        * loader/icon/IconLoader.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::separatorItem):
+        * platform/CrossThreadCopier.h:
+        (WebCore::):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/network/ResourceResponseBase.h:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::removePendingResource):
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::insertedIntoDocument):
+        * workers/GenericWorkerTask.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
 
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::sendError):
-        (WebCore::Geolocation::sendErrorToOneShots):
-        (WebCore::Geolocation::sendErrorToWatchers):
-        (WebCore::Geolocation::sendPosition):
-        (WebCore::Geolocation::sendPositionToOneShots):
-        (WebCore::Geolocation::sendPositionToWatchers):
-        * page/Geolocation.h:
+2010-02-21  Simon Fraser  <simon.fraser@apple.com>
 
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Dan Bernstein.
 
-        Roll out previous change as it might be causing some weirdness in
-        the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=22215
+        Avoid calling absoluteClippedOverflowRect() so many times
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader):
+        RenderLayer::updateLayerPositions() computes the clipped overflow rect
+        and the outline bounds for repaint, and then calls repaintAfterLayoutIfNeeded()
+        which can compute the same rects all over again. Avoid this by passing
+        these two rects into repaintAfterLayoutIfNeeded() if known. This measurably
+        reduces the time spent in updateLayerPositions() for some content.
 
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
 
-        Reviewed by Mark Rowe.
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        Fix compiler warning.
-        https://bugs.webkit.org/show_bug.cgi?id=27851
+        Reviewed by Maciej Stachowiak.
 
-        GCC does not like multi-character character constants, so use the
-        explicit numerical value of 'BM' in the enum.
+        https://bugs.webkit.org/show_bug.cgi?id=35202
+        <rdar://problem/4856597> Calling Java method which accepts Object always passes a null argument
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue): Add cases for
+        other JS types.
 
-2009-07-30  Brady Eidson  <beidson@apple.com>
+2010-02-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+        Reviewed by Darin Adler.
 
-        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
-        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
-        
-        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+        Fix compiler warning "suggest parentheses around"
+        https://bugs.webkit.org/show_bug.cgi?id=35197
 
-        * platform/network/HTTPParsers.cpp:
-        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+        No new tests as there is no new functionality.
 
-2009-07-30  Mark Rowe  <mrowe@apple.com>
+        * html/DateComponents.cpp:
+        (WebCore::beforeGregorianStartDate):
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::findPlugin):
 
-        Reviewed by Adele Peterson and Jon Honeycutt.
+2010-02-20  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
-        Bug 27828: Title attribute is not respected on option elements
+        Reviewed by Laszlo Gombos.
 
-        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+        [Qt] ENABLE_3D_RENDERING should be optional
+        https://bugs.webkit.org/show_bug.cgi?id=35100
 
-        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
-        * rendering/RenderMenuList.h:
-        * rendering/RenderTextControlSingleLine.h:
-        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
-        the popup menu in RenderTextControlSingleLine.
+        No new tests: this is a build fix.
 
-2009-07-30  Xiaomei Ji  <xji@chromium.org>
+        * WebCore.pri: ENABLE_3D_RENDERING is now a proper feature test
 
-        Reviewed by Dan Bernstein.
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        Remove ChromeClientChromium::setToolTip().
-        https://bugs.webkit.org/show_bug.cgi?id=27861
+        Reviewed by Maciej Stachowiak.
 
-        This patch is just to remove a temporarily introduced overloaded empty
-        virtual function. No test is needed.
+        https://bugs.webkit.org/show_bug.cgi?id=23742
+        Applet methods can not return arrays to JS
 
-        * page/chromium/ChromeClientChromium.h:
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: (JavaArray::JavaArray): Don't accidentally zero out
+        m_rootObject (that's how PassRefPtr works). Without m_rootObject, we crash quickly.
 
-2009-07-30  Michael Nordman  <michaeln@google.com>
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: (JavaInstance::invokeMethod): Do handle returned arrays.
+        Also, added an ifdef around  code that's only needed on Tiger, and removed a comment saying
+        it can be removed when "new" plugin ships. I doubt that anyone can remember what "new"
+        could refer to back then.
 
-        Reviewed by Darin Fisher.
+2010-02-20  Pavel Feldman  <pfeldman@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27821
+        Reviewed by Timothy Hatcher.
 
-        ApplicationCacheHost refactoring.
-        
-        1) Better encapsulate the interfaces between webcore common code
-        and the appcache system within a new class ApplicationCacheHost.
+        Web Inspector: re-creating view in ResourcesPanel confuses ScriptsPanel's visibleView logic.
 
-        2) Use that interface throughout the loader system, replacing inline appcache logic.
+        https://bugs.webkit.org/show_bug.cgi?id=35192
 
-        3) Implement the interface in terms of webcore's appcache system.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.viewRecreated):
 
-        4) Add the new files to various makefiles.
+2010-02-20  Pavel Feldman  <pfeldman@chromium.org>
 
-        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+        Reviewed by Timothy Hatcher.
 
-        No new features, no new tests. The existing layout tests all pass.
+        Web Inspector: need to highlight the evaluated expression used for popovers.
 
-        * GNUmakefile.am:
-        * WebCore.base.exp:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::insertedIntoDocument):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        (WebCore::DocumentLoader::~DocumentLoader):
-        (WebCore::DocumentLoader::mainReceivedError):
-        (WebCore::DocumentLoader::detachFromFrame):
-        (WebCore::DocumentLoader::setPrimaryLoadComplete):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCacheHost):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        (WebCore::MainResourceLoader::didReceiveData):
-        (WebCore::MainResourceLoader::didFinishLoading):
-        (WebCore::MainResourceLoader::didFail):
-        (WebCore::MainResourceLoader::load):
-        * loader/MainResourceLoader.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::load):
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didFail):
-        * loader/ResourceLoader.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
-        (WebCore::ApplicationCacheGroup::update):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::manifestNotFound):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
-        (WebCore::CallCacheListenerTask::create):
-        (WebCore::CallCacheListenerTask::performTask):
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        * loader/appcache/ApplicationCacheGroup.h:
-        * loader/appcache/ApplicationCacheHost.cpp: Added.
-        * loader/appcache/ApplicationCacheHost.h: Added.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::transferApplicationCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::DOMApplicationCache):
-        (WebCore::DOMApplicationCache::disconnectFrame):
-        (WebCore::DOMApplicationCache::applicationCacheHost):
-        (WebCore::DOMApplicationCache::status):
-        (WebCore::DOMApplicationCache::update):
-        (WebCore::DOMApplicationCache::swapCache):
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::dispatchEvent):
-        (WebCore::DOMApplicationCache::callListener):
-        (WebCore::DOMApplicationCache::toEventName):
-        (WebCore::DOMApplicationCache::toEventType):
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::):
-        (WebCore::DOMApplicationCache::setAttributeEventListener):
-        (WebCore::DOMApplicationCache::getAttributeEventListener):
-        (WebCore::DOMApplicationCache::clearAttributeEventListener):
-        (WebCore::DOMApplicationCache::callEventListener):
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::setOnobsolete):
-        (WebCore::DOMApplicationCache::onobsolete):
-        (WebCore::DOMApplicationCache::~DOMApplicationCache):
-        * platform/KURLGoogle.cpp:
-        (WebCore::protocolHostAndPortAreEqual):
+        https://bugs.webkit.org/show_bug.cgi?id=35126
 
-2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        (WebInspector.SourceFrame.prototype._hidePopup):
+        (WebInspector.SourceFrame.prototype._mouseHover):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup):
+        * inspector/front-end/inspector.css:
 
-        Reviewed by Darin Adler.
+2010-02-20  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
-        https://bugs.webkit.org/show_bug.cgi?id=27854
+        Roll out 55047 because it causes layout, and API tests to fail
 
-        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
-        they can disappear and then lead to crashes.
-       
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::notificationPostTimerFired):
-        (WebCore::AXObjectCache::postNotification):
-        * accessibility/AXObjectCache.h:
+2010-02-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Xan Lopez.
 
-        Minor change to earlier commit suggested by Darin Adler.
-        Use the variable rather than dereferencing 'it' again.
+        [Soup] loses information related to message flags when converting from/to Resource{Request,Response}
+        https://bugs.webkit.org/show_bug.cgi?id=35093
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        Refactor updating of ResourceResponse objects from soup message
+        objects, to avoid code duplication.
 
-2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+        No behaviour change.
 
-        Reviewed by Dan Bernstein.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
 
-        Animation with a timing function property in a keyframe eats CPU
-        https://bugs.webkit.org/show_bug.cgi?id=27856
-        <rdar://problem/7104476> Animation demo uses lots of CPU
-        
-        Don't include animation-timing-function in the list of properties to
-        animate in a keyframe animation, because this property is not animated;
-        instead, it describes the timing function to apply to this keyframe.
-        
-        This prevents the animation code from thinking that there's a property
-        that it has to software-animate, and thus firing the animation timer frequently.
-        
-        Not testable because there is no visible impact.
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
-        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+        Reviewed by Maciej Stachowiak.
 
-        * page/animation/KeyframeAnimation.cpp
-        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+        https://bugs.webkit.org/show_bug.cgi?id=35190
+        Don't use system malloc in Java bindings
 
-2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: (JavaInstance::invokeMethod): Switched to WTF::Vector.
 
-         Reviewed by Adam Treat.
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-         Apply colour style to buttons that use Theme settings in Qt.
+        Reviewed by Maciej Stachowiak.
 
-         https://bugs.webkit.org/show_bug.cgi?id=27814
+        https://bugs.webkit.org/show_bug.cgi?id=9761
+        LiveConnect string conversion fails for java.lang.Object
 
-         * platform/qt/RenderThemeQt.cpp:
-         (WebCore::RenderThemeQt::adjustButtonStyle):
+        Can't test Java in DRT (I wonder why).
 
-=== End merge of nitro-extreme branch 2009-07-30 ===
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue):
+        Added the necessary conversion. Also, removed CONVERT_NULL_TO_EMPTY_STRING dead code.
 
-2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
 
-        Reviewed by Sam Weinig.
-
-        Make WebCore compile with the new JS number representation.
+        Reviewed by David Levin.
 
-        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
-        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
-        * bindings/js/ScriptEventListener.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/c/c_instance.cpp:
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
 
-=== Start merge of nitro-extreme branch 2009-07-30 ===
+        I made ENABLE(SANDBOX) only control the sandbox attribute itself;
+        I did not ifdef the infrastructure to make sandboxing
+        switchable. This is because the likely concerns about sandboxing
+        are not stability of the infrastructure code, but rather the fact
+        that the security model exposed to authors is still evolving.
 
-2009-07-30  Dean McNamee  <deanm@chromium.org>
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-19  Alexey Proskuryakov  <ap@apple.com>
 
-        Don't try to hash member function pointers, instead use a precomputed value based on the field.
-        https://bugs.webkit.org/show_bug.cgi?id=27843
+        Reviewed by Maciej Stachowiak.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
-        (WebCore::PODTypeWrapperCacheInfo::operator==):
-        (WebCore::PODTypeWrapperCacheInfoHash::hash):
-        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        https://bugs.webkit.org/show_bug.cgi?id=35132
+        <rdar://problem/7664353> Mouse cursor sometimes flickers over Flash content (35132)
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        * page/EventHandler.cpp: (WebCore::EventHandler::handleMouseMoveEvent): Don't set mouse
+        pointer when above a plug-in or applet to prevent flicker.
 
-        Reviewed by Simon Fraser.
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        Fix compiler warning.
+        Reviewed by Adam Barth.
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Fix regression in calculating an animated image's start time.
+        https://bugs.webkit.org/show_bug.cgi?id=35115
 
-2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        Reviewed by Adam Barth.
+2010-02-19  Alexey Proskuryakov  <ap@apple.com>
 
-        Add a way to register V8 extensions for Isolated Worlds only.
-        https://bugs.webkit.org/show_bug.cgi?id=27785
+        Reviewed by Geoffrey Garen.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInNewWorld):
-        (WebCore::ScriptController::evaluateInNewContext):
-        * bindings/v8/ScriptController.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-        * bindings/v8/V8IsolatedWorld.h:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewWorld):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::registerExtensionWithV8):
-        (WebCore::V8Proxy::registerExtension):
-        * bindings/v8/V8Proxy.h:
+        https://bugs.webkit.org/show_bug.cgi?id=35178
+        LiveConnect code uses hand-rolled fprintf logging
 
-2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+        Changed to use LOG, LOG_ERROR and ASSERT.
 
-         Reviewed by Adam Treat.
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        * platform/mac/LoggingMac.mm:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        * platform/win/LoggingWin.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        TextConversion channel was (almost) unused, renamed to LiveConnect.
+
+        * platform/text/gtk/TextCodecGtk.cpp: (WebCore::TextCodecGtk::registerEncodingNames):
+        The only use of this channel was in platform specific code, commandeered it for cross-platform
+        needs.
+
+        * bridge/jni/JNIBridge.cpp:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::getJavaVM):
+        (JSC::Bindings::getJNIEnv):
+        (JSC::Bindings::getJNIField):
+        * bridge/jni/JNIUtility.h:
+        (JSC::Bindings::callJNIMethodV):
+        (JSC::Bindings::callJNIStaticMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (completedJavaScriptAccess):
+        (dispatchToJavaScriptThread):
+        (performJavaScriptAccess):
+        (JavaJSObject::invoke):
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::createNative):
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
 
-         Add previously defined out support to PopupMenuQt for marking entries as
-         disabled and for selecting the desired item.
+2010-02-19  Dirk Schulze  <krit@webkit.org>
 
-         https://bugs.webkit.org/show_bug.cgi?id=27772
+        Reviewed by Nikolas Zimmermann.
 
-         * platform/qt/PopupMenuQt.cpp:
-         (WebCore::PopupMenu::populate):
+        RenderSVGResourceMasker causes an Assert on Wind builds during DRT
+        https://bugs.webkit.org/show_bug.cgi?id=35182
 
-2009-07-30  Darin Adler  <darin@apple.com>
+        We remove the Assert for now and return earlier, if the HashMap of the Masker
+        does not contain the RenderObject. The RenderObject is an identifiert to get
+        a already calculated mask.
+        A race condition during parsing can cause the invalidation call, before the mask
+        got calculated (only during DRT on Win build bots).
+        The real bug will be fixed with: https://bugs.webkit.org/show_bug.cgi?id=35181
 
-        Reviewed by David Levin.
+        * rendering/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::invalidateClient):
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        Next step: Add new toRenderWidget cast and use it everywhere.
+        Reviewed by Darin Fisher.
 
-        Use checked casts in all the places that were using static_cast
-        but there is a checked cast available.
+        Make Pasteboard::writeImage() safe against NULL cachedImages, and clean
+        up some code.
+        https://bugs.webkit.org/show_bug.cgi?id=35136
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::stringValue):
-        (WebCore::AccessibilityRenderObject::widget):
-        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
-        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getPangoLayoutForAtk):
-        * dom/Document.cpp:
-        (WebCore::widgetForNode):
-        (WebCore::Document::setFocusedNode):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::findWidgetRenderer):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::defaultEventHandler):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::HTMLPlugInElement::defaultEventHandler):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::writeRawData):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::subframeForTargetNode):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/Frame.cpp:
-        (WebCore::isFrameElement):
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::computePageRects):
-        * page/android/EventHandlerAndroid.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/chromium/EventHandlerChromium.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/chromium/FrameChromium.cpp:
-        (WebCore::computePageRectsForFrame):
-        * page/gtk/EventHandlerGtk.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/haiku/EventHandlerHaiku.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        * page/win/FrameWin.cpp:
-        (WebCore::computePageRectsForFrame):
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::getCachedImage):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateRenderer): Shorten some code.
+        * page/DragController.cpp:
+        (WebCore::getImage): Shorten some code.
         * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
         * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
         * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeImage):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::getCachedImage):
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
         * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::getCachedImage):
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
         * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::boxModelObject):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::splitInlines):
-        (WebCore::RenderInline::addChildToContinuation):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateImageContents):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::positionForPoint):
-        Use checked cast instead of static_cast.
-        
-        * rendering/RenderWidget.h: Added toRenderWidget.
-
-2009-07-30  Yong Li  <yong.li@torchmobile.com>
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
 
-        Reviewed by George Staikos.
+2010-02-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        WINCE PORT: some files modified to build for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27816
+        Rubberstamped by Noam Rosenthal, who wrote the original code.
 
-        * accessibility/AccessibilityObject.h:
-        * page/win/EventHandlerWin.cpp:
-        (WebCore::EventHandler::createDraggingClipboard):
-        * platform/win/PlatformMouseEventWin.cpp:
-        (WebCore::messageToEventType):
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::deviceInfoForWidget):
-        (WebCore::screenIsMonochrome):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::paint):
-        (WebCore::registerPopup):
-        (WebCore::PopupWndProc):
+        Make mouse wheel scrolling work when using the GraphicsLayer.
 
-2009-07-30  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCE PORT: modified graphics files
-        https://bugs.webkit.org/show_bug.cgi?id=27779
-
-        * platform/graphics/BitmapImage.h:
-        (WebCore::BitmapImage::mayFillWithSolidColor):
-        * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.cpp:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/MediaPlayer.cpp:
-        * platform/graphics/Path.h:
-        * platform/graphics/Pattern.h:
-        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::blend):
-        * platform/graphics/transforms/MatrixTransformOperation.cpp:
-        (WebCore::MatrixTransformOperation::blend):
-        * platform/graphics/transforms/TransformationMatrix.h:
-        (WebCore::TransformationMatrix::operator*):
-        * platform/graphics/win/IconWin.cpp:
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-
-2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Ariya Hidayat.
-
-        Improve efficiency by rewriting code doing three hash table
-        lookups, which can be replaced by just one as pointed out
-        by Darin Adler.
-
-        Though being slightly less clear, this should be considerable
-        faster.
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::remove):
-
-2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
-
-        Reviewed by Gustavo Noronha.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
 
-        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+2010-02-19  Nate Chapin  <japhet@chromium.org>
 
-        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-
-2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
-        No functionality change at all.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        * platform/graphics/gtk/VideoSinkGStreamer.h:
-
-2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Allow to explicitly choose a preferred plugin for a mimetype.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        When the preferred plugin is set for a specific MIME type, it will be
-        always picked up, regardless of its version, quirks etc.
-
-        Client applications may want to use that API to resolve mimetype
-        ambiguity in a custom way, rather than in the default way that is
-        currently used in WebKit.
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::pluginForMIMEType):
-        (WebCore::PluginDatabase::MIMETypeForExtension):
-        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
-        (WebCore::PluginDatabase::remove):
-        (WebCore::PluginDatabase::clear):
-        * plugins/PluginDatabase.h:
-
-2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
-
-        [Qt] Fix build with Qt 4.4 after r46535.
+        Reviewed by Dimitri Glazkov.
 
-        * platform/network/qt/ResourceHandleQt.cpp:
+        [V8] Fix Worker crash regression in r54972
 
-2009-07-30  Eric Carlson  <eric.carlson@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35166
 
-        Reviewed by Simon Fraser.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object): Properly unwrap global objects when inside a WorkerContext.
 
-        Video elements fires another "load" event when attached to DOM
-        https://bugs.webkit.org/show_bug.cgi?id=27623
+2010-02-19  Steve Block  <steveblock@google.com>
 
-        Test: media/media-load-event.html
+        Not reviewed. Reverts r55020 which causes crashes in Chromium LayoutTests
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::insertedIntoDocument):
-            Only schedule load when element's network state is NETWORK_EMPTY.
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * storage/Database.cpp:
 
-2009-07-30  Anton Muhin  <antonm@chromium.org>
+2010-02-19  Steve Block  <steveblock@google.com>
 
         Reviewed by David Levin.
 
-        Cache v8 strings when converting from WebCore::String to v8 string.
-        https://bugs.webkit.org/show_bug.cgi?id=27655
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8String): now just immediately calls v8ExternalString
-        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
-        v8::String
-        (WebCore::makeExternalString): utilty function to create external v8::String out of
-        WebCore::String
-        (WebCore::getStringCache): static function to access string cache
-        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
-        cache
-        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
-        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
-        string.
-        * bindings/v8/V8Binding.h:
-
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25535
-        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
-
-        Implement state-changed:checked for radio buttons and checkboxes.
-
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
-
-        Forgot the 'break'.
-
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
-
-        Try to fix Mac build.
-
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-
-2009-07-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Adam Barth.
-
-        Add missing enumeration value to switch.
-
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-
-2009-07-29  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Workers need to throw an exception when presented with invalid URLs.
-        https://bugs.webkit.org/show_bug.cgi?id=27770
-
-        Tests covered by worker-constructor.html and worker-redirect.html.
+        Sets default values of V8 runtime enabler flags to match behavior with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=35095
 
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/Worker.h:
-        (WebCore::Worker::create):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        * workers/WorkerScriptLoader.h:
-
-2009-07-29  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
-        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+        No new tests, modifies a Chromium feature only.
 
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
-          only limiting connections while parsing and still trying to figure out stylesheet urls.
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Modified. Sets appcache and geolocation flag defaults to 'on'
+        * storage/Database.cpp: Modified. Sets database flag default to 'on'.
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+2010-02-19  Alexander Pavlov  <apavlov@chromium.org>
 
-        Reviewed by George Staikos.
-
-        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27729
-
-        * page/wince/FrameWince.cpp: Added.
-
-2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=27809
-
-        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
-        To determine that a particular text decoration is present, currentlyHasStyle should refer to
-        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
-        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
-
-        * editing/ApplyStyleCommand.cpp: ditto
-        (WebCore::StyleChange::currentlyHasStyle): ditto
-
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by George Staikos.
+        WebInspector: Elements panel: Correctly show empty elements' ending tags
+        for XML and HTML documents.
+        https://bugs.webkit.org/show_bug.cgi?id=26315
 
-        WINCE PORT: changes to platform/text files
-        https://bugs.webkit.org/show_bug.cgi?id=27715
+        Test: inspector/elements-panel-xhtml-structure.xhtml
 
-        * platform/text/String.cpp:
-        (WebCore::String::format):
-        * platform/text/TextEncoding.cpp:
-        (WebCore::TextEncoding::encode):
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
-
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.get isXMLMimeType):
+        (WebInspector.ElementsTreeOutline.prototype._contextMenuEventFired):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        (WebInspector.ElementsTreeElement.prototype.oncollapse):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
 
-        Reviewed by Adam Roben.
+2010-02-19  Pavel Feldman  <pfeldman@chromium.org>
 
-        FIX: HDC leaks in PopupMenuWin.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27817
+        Not reviewed. Chromium build fix: reverting r54997 and r54998.
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::~PopupMenu):
-        (WebCore::PopupMenu::paint):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-2009-07-29  Darin Adler  <darin@apple.com>
+2010-02-17  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Eric Seidel.
 
-        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
-        https://bugs.webkit.org/show_bug.cgi?id=27810
+        [GTK] RTP/RTSP streams playback support
+        https://bugs.webkit.org/show_bug.cgi?id=33662
 
-        Test: fast/lists/ol-start-parsing.html
+        Added live pipelines support in updateStates().
 
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
-        and use the value 1 if it failed to parse. Before we were getting toInt's default
-        behavior, which is to return 0.
+        * manual-tests/video-rtsp.html: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-2009-07-29  Kevin McCullough  <kmccullough@apple.com>
+2010-02-18  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Added foundation work to allow a testing infrastructure for the Web
-        Inspector.
-
-        * inspector/InspectorClient.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::scriptObjectReady): Tell the testing
-        harness that the window object is ready.
-        * loader/EmptyClients.h: Empty class support for SVG.
-        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
-
-2009-07-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Build fix for windows after landing
-        Bug 27807 - AX: move re-usable code into more common areas for other platforms
-   
-        Apparently bzero doesn't exist on windows.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
-
-2009-07-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Justin Garcia.
+        Normalize custom ctors for Image, Option, Audio
+        https://bugs.webkit.org/show_bug.cgi?id=34782
 
-        Bug 27807 - AX: move re-usable code into more common areas for other platforms
-        https://bugs.webkit.org/show_bug.cgi?id=27807
+        Test: fast/js/custom-constructors.html
 
-        Moves some accessibility code that was in the Mac file to a more common place so 
-        it can be used by other platforms. 
-        This includes:
-           Making TextMarkerData from a VisiblePosition.
-           Making a VisiblePosition from TextMarkerData.
-           Finding the anchor accessibility object for an arbitrary Node.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
-        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
-        * accessibility/AXObjectCache.h:
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::anchorElementForNode):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::visiblePositionForIndex):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (textMarkerForVisiblePosition):
-        (visiblePositionForTextMarker):
-        (AXAttributedStringAppendText):
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::HTMLAudioElement):
+        (WebCore::HTMLAudioElement::createForJSConstructor):
+        * html/HTMLAudioElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::createForJSConstructor):
+        (WebCore::HTMLImageElement::mapToEntry):
+        (WebCore::HTMLImageElement::createRenderer):
+        (WebCore::HTMLImageElement::attach):
+        (WebCore::HTMLImageElement::width):
+        (WebCore::HTMLImageElement::height):
+        (WebCore::HTMLImageElement::naturalHeight):
+        * html/HTMLImageElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::createForJSConstructor):
+        (WebCore::HTMLOptionElement::ownerSelectElement):
+        (WebCore::HTMLOptionElement::nonRendererRenderStyle):
+        (WebCore::HTMLOptionElement::disabled):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLOptionElement.h:
 
-2009-07-29  Dan Bernstein  <mitz@apple.com>
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Simon Fraser.
+        No Review.
 
-        Inset box shadows are incorrectly accounted for in visual overflow
-        computations
-        https://bugs.webkit.org/show_bug.cgi?id=27811
+        Remove a couple of extraneous spaces that got added to the project file
+        by hand-ending.
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
-            getBoxShadowHorizontalExtent().
-        (WebCore::InlineFlowBox::placeBoxesVertically): Use
-            getBoxShadowVerticalExtent(). Removed duplicate code to get the
-            text-shadow overflow.
-        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::overflowHeight): Use
-            getBoxShadowVerticalExtent().
-        (WebCore::RenderBlock::overflowWidth): Use
-            getBoxShadowHorizontalExtent().
-        (WebCore::RenderBlock::overflowLeft): Ditto.
-        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
-        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
-        (WebCore::RenderBlock::layoutBlock): Ditto.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
-            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
-        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
-            shadows.
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
-            not inset.
-        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
-            shadows.
-        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
-        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
-        * rendering/style/RenderStyle.h:
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-07-29  Simon Fraser  <simon.fraser@apple.com>
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
-        https://bugs.webkit.org/show_bug.cgi?id=27796
+        <rdar://problem/7535894> Page contents missing from snapshot on Newsweek.com article
         
-        Avoid repainting when a layer becomes composited if the renderer is not parented
-        yet, because it makes no sense to do so.
+        Add logic to determine when painting via the software rendering path will give an equivalent
+        result to the accelerated compositing presentation. This tests for the presence of 3D transforms
+        via the existing RenderLayerCompositor::has3DContent() method.
         
-        If the table row is a repaint container, default to the RenderBox implementation
-        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
-        computation to something that is above the repaint container.
-
-        Test: fast/table/table-row-compositing-repaint-crash.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+        * WebCore.base.exp: Export FrameView's isSoftwareRenderable(), paintBehavior() and setPaintBehavior().
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isSoftwareRenderable): New method.
+        (WebCore::FrameView::paintBehavior): Make this non-inline so that we can reliably export it.
 
-2009-07-29  Brady Eidson  <beidson@apple.com>
+2010-02-18  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by John Sullivan.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27791
-        307 redirects of POSTs should use POST, not GET
+        <rdar://problem/7658811> Multiple style recalcs due to getComputedStyle() on “display: none;” element
+        when there are pending style sheets
 
-        Test: http/tests/loading/redirect-methods.html
+        Test: fast/css/getComputedStyle/pending-stylesheet.html
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+        When querying a property of a computed style declaration for a non-rendered element,
+        CSSStyleSelector::styleForElement() was called, and if there were pending style sheet, it
+        would behave as if the lack of renderer is due to FOUC suppression, and set a flag on
+        the document causing it to recalculate style. On the next computed style property access,
+        style would be recalculated for the document, but then the flag would get set again if the
+        element did not have a renderer.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        * dom/Document.cpp:
+        (WebCore::Document::styleForElementIgnoringPendingStylesheets): Added. Temporarily sets
+        m_ignorePendingStylesheets around the call to CSSStyleSelector::styleForElement().
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::computedStyle): Use Document::styleForElementIgnoringPendingStylesheets().
 
-2009-07-29  Chris Marrin  <cmarrin@apple.com>
+2010-02-18  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Nikolas Zimmermann.
 
-        Adding -webkit-animation-play-state back in
-        https://bugs.webkit.org/show_bug.cgi?id=26867
+        Move SVGResources to Renderers, starting with Masker
+        https://bugs.webkit.org/show_bug.cgi?id=35020
 
-        We've decided to keep -webkit-animation-play-state. So this
-        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
+        We have rendering specific code in WebCore/svg/graphics. The goal is to move
+        this code into suitable Renderers. This helps us to clean up the code and makes
+        maintenance easier. It also makes it possible to remove rendering specific code
+        from SVG*Elements into this renderers. So the Renderer contains everything that
+        is needed to use the resource.
+        RenderSVGResource will be the base class for all new resource render classes like
+        RenderSVGResourceMasker, RenderSVGResourceClipper and the other resources.
 
-        Test: animations/play-state.html
+        This patch starts moving SVGResourceMasker to RenderSVGResourceMasker.
+        Another benefit is the much more useful result in DRT on using masker.
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseAnimationPlayState):
-        (WebCore::CSSParser::parseAnimationProperty):
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapAnimationPlayState):
-        * css/CSSStyleSelector.h:
-        * platform/animation/Animation.h:
-        * rendering/style/RenderStyleConstants.h:
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toRenderSVGResource): Conversion to RenderSVGResource base class.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResource): Check if renderer is a resource.
+        * rendering/RenderPath.cpp:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGImage.h: Some code clean up according to the webkit style.
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::renderName):
+        (WebCore::RenderSVGImage::isSVGImage):
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        (WebCore::RenderSVGImage::requiresLayer):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::objectBoundingBox): Needed for SVGRenderTreeAsText
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResource.h: Added.
+        (WebCore::): Base class for all Resource renderers like masker, clipper and others.
+        (WebCore::RenderSVGResource::RenderSVGResource):
+        (WebCore::RenderSVGResource::cast):
+        (WebCore::RenderSVGResource::toRenderSVGResource):
+        (WebCore::RenderSVGResource::isSVGResource): 
+        (WebCore::RenderSVGResource::drawsContents):
+        (WebCore::getRenderSVGResourceById):
+        * rendering/RenderSVGResourceMasker.cpp: Added.
+        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::invalidateClients): Status of masker changed, remove all clients.
+        (WebCore::RenderSVGResourceMasker::invalidateClient): Status of an object changed, remove pending client.
+        (WebCore::RenderSVGResourceMasker::applyResource): Apply masker to object.
+        (WebCore::RenderSVGResourceMasker::resourceBoundingBox): boundingBox of the resource, depending on the object.
+        (WebCore::RenderSVGResourceMasker::createMaskImage): Creates the mask image, the context gets clipped with.
+        * rendering/RenderSVGResourceMasker.h: Added.
+        (WebCore::MaskerData::MaskerData):
+        (WebCore::RenderSVGResourceMasker::renderName):
+        (WebCore::RenderSVGResourceMasker::maskUnits): Unit of mask for DRT.
+        (WebCore::RenderSVGResourceMasker::maskContentUnits): Unit of childs from mask for DRT.
+        (WebCore::RenderSVGResourceMasker::resourceType):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::destroy): dito.
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources): Unregister object from all it's resources after status changed.
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRenderTreeAsText.cpp: Update TreeAsText to dump maskers correctly.
+        (WebCore::operator<<):
+        (WebCore::writeSVGResource):
+        (WebCore::writeSVGContainer):
+        (WebCore::writeSVGText):
+        (WebCore::writeSVGInlineText):
+        (WebCore::writeSVGImage):
+        (WebCore::write):
+        (WebCore::writeResourcesToObject):
+        * rendering/SVGRenderTreeAsText.h:
+        * svg/SVGMaskElement.cpp: Update Masker to use the new renderer.
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::createRenderer):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp: We need to tell the renderer to unregister object, after the status changed.
+        (WebCore::SVGStyledElement::invalidateResources):
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGUnitTypes.h: Conversion of integer to SVGUnitType.
+        (WebCore::toUnitType):
+        * svg/graphics/SVGResource.h:
         (WebCore::):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceMasker.cpp: Removed.
+        * svg/graphics/SVGResourceMasker.h: Removed.
 
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
+2010-02-18  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Expose the default plugin directories and the current directory set of
-        the plugin database as public API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::pluginDirectories):
-
-2009-07-29  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] Font size for current time display in media controls panel
-        is affected by body font size.
-        https://bugs.webkit.org/show_bug.cgi?id=27799
-
-        Fixing the problem of rendering by explicitly setting the font size
-        for the time displays.
+        Reviewed by Dimitri Glazkov.
 
-        No new tests since this is covered by existing media tests.
+        Allow creating/dropping virtual tables when the module is FTS2.
 
-        * css/mediaControlsChromium.css:
+        https://bugs.webkit.org/show_bug.cgi?id=34867
 
-2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createVTable):
+        (WebCore::DatabaseAuthorizer::dropVTable):
 
-        Reviewed by David Levin.
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
-        Style Guidelines as identified by cpp_style.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27613
+        Not reviewed, Chromium build fix.
 
-        * page/ContextMenuController.cpp:
-        (WebCore::openNewWindow):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
+        r54963 had a typo in the WebCore.gypi change.
+        https://bugs.webkit.org/show_bug.cgi?id=35003
 
-2009-07-29  Dean McNamee  <deanm@chromium.org>
+        * WebCore.gypi:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-18  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27805
+        Reviewed by Simon Fraser.
 
-        * bindings/v8/V8DOMWrapper.h:
+        Changing forward declaration of TimingFunction in GraphicsLayer.h from
+        class to struct to match its actual definition in TimingFunction.h
 
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35069
 
-        Reviewed by Simon Hausmann.
 
-        Expose the PluginDatabase::pluginForMIMEType() function as public API.
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+        * platform/graphics/GraphicsLayer.h:
+           Change forward declaration from: class TimingFunction to:
+           struct TimingFunction
 
-        It can be used to determine the appropriate plugin for a mime type,
-        without guessing the mimetype from the extension.
+2010-02-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * plugins/PluginDatabase.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+        [Qt] Minor improvement to hybrid QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34507
+        Instead of having toHTMLImageElement which creates a new element,
+        assignToHTMLImageElement would set an existing HTML <img/> element to
+        contain the native QPixmap/QImge.
+        Also made some style fixes.
+
+        Additions to existing tests: see WebKit/qt/tests
+
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapWidthField::valueFromInstance): style
+        (JSC::Bindings::QtPixmapHeightField::valueFromInstance): style
+        (JSC::Bindings::QtPixmapAssignToElementMethod::name): assignTo
+        (JSC::Bindings::QtPixmapAssignToElementMethod::invoke): new function
+        (JSC::Bindings::QtPixmapAssignToElementMethod::numParameters): 1
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke): style
+        (JSC::Bindings::QtPixmapToStringMethod::invoke): style
+        (JSC::Bindings::QtPixmapInstance::invokeMethod): style
+        (JSC::Bindings::QtPixmapClass::methodsNamed): new func, removed old
+        (JSC::Bindings::QtPixmapInstance::getPropertyNames): ditto
+        (JSC::Bindings::QtPixmapInstance::defaultValue): style
+        (JSC::Bindings::QtPixmapInstance::valueOf): style
+        (JSC::Bindings::QtPixmapInstance::toPixmap): style
+        (JSC::Bindings::QtPixmapInstance::variantFromObject): style
+
+2010-02-18  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, bustage fix.
+
+        An extraneous line in r54839 broke GIF animation.
 
-        Reviewed by Adam Treat.
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::read):
 
-        Allow to enable/disable particular plugin packages.
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+2010-02-18  Dan Bernstein  <mitz@apple.com>
 
-        Disabled plugins will not be picked up when looking for a plugin
-        supporting the requested mimetypes.
+        Reviewed by Simon Fraser.
 
-        Client applications may want to use that API to disable specific
-        plugins.
+        <rdar://problem/7650652> REGRESSION: Selection painting issue in bug review textbox
+        https://bugs.webkit.org/show_bug.cgi?id=34946
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::pluginForMIMEType):
-        (WebCore::PluginDatabase::MIMETypeForExtension):
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::PluginPackage):
-        (WebCore::PluginPackage::setEnabled):
-        * plugins/PluginPackage.h:
-        (WebCore::PluginPackage::isEnabled):
+        Test: fast/repaint/selection-gap-overflow-scroll-2.html
 
-2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection): localToContainerQuad() adjusts for
+        overflow scroll, but RenderLayer::addBlockSelectionGapsBounds() takes
+        non-scrolled coordinates, so account for that.
 
-        Reviewed by Adam Treat.
+2010-02-17  Dumitru Daniliuc  <dumi@chromium.org>
 
-        [WML] Running WML tests in random order multiple times exposes subtle bugs
-        https://bugs.webkit.org/show_bug.cgi?id=27801
-
-        Remove superflous assertions regarding the parent node. Under certain circumstances
-        these can even fire (related to garbage collection while destructing). Fixes random order
-        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
-
-        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
-        WMLPageState::reset() - the history stack should still contain the current card afterwards.
-        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
-
-        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
-        (WebCore::BackForwardList::clearWMLPageHistory):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::insertedIntoDocument):
-        (WebCore::WMLDoElement::removedFromDocument):
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::eventHandlingParent):
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::insertedIntoDocument):
-        (WebCore::WMLPostfieldElement::removedFromDocument):
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::insertedIntoDocument):
-        (WebCore::WMLSetvarElement::removedFromDocument):
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::insertedIntoDocument):
-        (WebCore::WMLTaskElement::removedFromDocument):
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::insertedIntoDocument):
-        (WebCore::WMLTimerElement::removedFromDocument):
-
-2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Simon Hausmann.
+        Change the V8 and JSC SQLStatementErrorCallback to interpret
+        'undefined' return values as 'true', as required by the spec.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26848
-        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=35048
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadItem):
-        * platform/network/ResourceHandle.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallbackHelper):
+        (WebCore::invokeCallback):
+        (WebCore::invokeCallbackTreatUndefinedAsTrue):
+        * bindings/v8/custom/V8CustomVoidCallback.h:
 
-2009-07-29  Alpha Lam  <hclam@chromium.org>
+2010-02-17  Ojan Vafai  <ojan@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Adam Barth.
 
-        Media control panel for <video> in MediaDocument is mis-placed
-        https://bugs.webkit.org/show_bug.cgi?id=27798
+        keyboard selection sometimes moves the wrong end of the selection for Win/Linux
+        https://bugs.webkit.org/show_bug.cgi?id=35066
 
-        Fixing a rendering problem: When <video> is displayed in MediaDocument,
-        the media control panel overlaps with the video by 16 pixels.
+        On Windows/Linux keyboard based selections should always move the same
+        end of the seleciton. On Mac, lineboundary and documentboundary changes
+        move different ends of the selection depending on which direction your
+        extending.
 
-        No new tests as this is covered by existing media tests.
+        Test: editing/selection/extend-after-mouse-selection.html
 
-        * css/mediaControlsChromium.css:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::positionForPlatform):
+        (WebCore::SelectionController::startForPlatform):
+        (WebCore::SelectionController::endForPlatform):
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/SelectionController.h:
 
-2009-07-29  Adam Barth  <abarth@webkit.org>
+2010-02-18  Timothy Hatcher  <timothy@apple.com>
 
-        Unreviewed build fix for Chromium.  Those last two patches weren't
-        independent despite the clean merge.
+        Add "with" to the list of keywords to syntax highlight.
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        http://webkit.org/b/35123
 
-2009-07-29  Avi Drissman  <avi@chromium.org>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Darin Adler.
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer): Add "width" to _keywords.
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        (WebInspector.SourceJavaScriptTokenizer): Ditto.
 
-        ImageSourceCG makes bad data refs (race condition causes blank images)
-        https://bugs.webkit.org/show_bug.cgi?id=27777
+2010-02-17  Peter Kasting  <pkasting@google.com>
 
-        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
-        backs the CFDataRef will be long enough.
+        Reviewed by Adam Barth.
 
-        No new tests, as this fixes a bug with a race condition that is
-        difficult to trigger.
+        Rework PNG-in-ICO decoding to copy the decoded framebuffer into the ICO
+        decoder, making the logic less crazy and more like the other decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
 
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::operator=):
 
-2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Console should show completions for the command line APIs
-        https://bugs.webkit.org/show_bug.cgi?id=27696
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
-        completions when available.
-        * inspector/front-end/utilities.js:
-        (Object.properties): Added.
-        (Object.sortedProperties):
-
-2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
+        Web Inspector: multiple popovers on screen at the same time.
 
-        Reviewed by Eric Seidel.
-
-        Refactor the first step of layout in RenderFlexibleBox.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27704
-
-        No new tests as this change is just a refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=35105
 
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::gatherFlexChildrenInfo):
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-
-2009-07-29  Kent Tamura  <tkent@chromium.org>
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.hide):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup):
 
-        Reviewed by Nikolas Zimmermann.
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix a bug that HTMLOptionElement::value() returns an incorrect
-        value in a case that the element has a label attribute and no
-        value attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=27760
+        Reviewed by Timothy Hatcher.
 
-        Test: fast/forms/option-value-and-label.html
+        Web Inspector: Expand Object.__proto__ properly.
 
-        * dom/OptionElement.cpp:
-        (WebCore::OptionElement::collectOptionLabelOrText):
-        (WebCore::OptionElement::collectOptionInnerText):
-        (WebCore::OptionElement::normalizeText):
-        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
-        (WebCore::OptionElement::collectOptionValue):
-        * dom/OptionElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::text):
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::text):
+        https://bugs.webkit.org/show_bug.cgi?id=35113
 
-2009-07-29  Adam Barth  <abarth@webkit.org>
+        * inspector/front-end/EventListenersSidebarPane.js:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-18  Nate Chapin  <japhet@chromium.org>
 
-        [V8] Fix isolated world wrappers for event handlers
-        https://bugs.webkit.org/show_bug.cgi?id=27533
+        Reviewed by Adam Barth.
 
-        Instead of getting the context from the frame, we cache the context
-        when the listener is created so that we get the context for the right
-        world.
+        [V8] Merge the DOMWindow and WorkerContext object wrapping code paths,
+        and use a faster method of disambiguating between the types of contexts.
 
-        Test: http/tests/security/isolatedWorld/click-event.html
+        https://bugs.webkit.org/show_bug.cgi?id=35009
 
-        * WebCore.gypi:
-        * bindings/v8/OwnHandle.h: Added.
-        (WebCore::OwnHandle::OwnHandle):
-        (WebCore::OwnHandle::~OwnHandle):
-        (WebCore::OwnHandle::get):
-        (WebCore::OwnHandle::set):
-        (WebCore::OwnHandle::release):
-        (WebCore::OwnHandle::adopt):
-        (WebCore::OwnHandle::swap):
-        (WebCore::OwnHandle::clear):
-        (WebCore::OwnHandle::makeWeak):
-        (WebCore::OwnHandle::weakCallback):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/scripts/CodeGeneratorV8.pm: Remove logic determining whether we need to
+            handle the WorkerContext case.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::globalObjectPrototypeIsDOMWindow):
+        (WebCore::V8DOMWrapper::instantiateV8Object): Merge instantiateV8Object paths.
         * bindings/v8/V8DOMWrapper.h:
 
-2009-07-29  Adam Barth  <abarth@webkit.org>
+2010-02-12  Brett Wilson  <brettw@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        [V8] Teach V8Proxy::context about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27701
+        Update the Google-URL version of KURL and the V8 bindings to the new
+        behavior of KURL.IsStandard.
 
-        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
-        all callers of this method to make sure they want isolated worlds.  In
-        cases where we really want the main world, I've changed the call to
-        V8Proxy::mainWorldContext(Frame*).
-        
-        The main visible change is to the document.open method when called with
-        more than two arguments.  This design seems more likely to lead to
-        future correct code.
+        https://bugs.webkit.org/show_bug.cgi?id=34859
 
-        Test: http/tests/security/isolatedWorld/document-open.html
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::collectGarbage):
-        (WebCore::createScriptObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::toV8Context):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::mainWorldContext):
-        (WebCore::V8Proxy::bindJsObjectToWindow):
-        * bindings/v8/V8Proxy.h:
+        This is covered by fast/dom/Window/invalid-protocol.html
 
-2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-        Reviewed by Simon Hausmann.
+2010-02-18  Xan Lopez  <xlopez@igalia.com>
 
-        Fix the Qt build, add missing file.
+        Reviewed by Gustavo Noronha.
 
-        * WebCore.pro:
+        Remove some duplication between PluginView and Widget methods, and
+        move the setSelfVisible calls to the parent class.
 
-2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
 
-        Speculative fix for <rdar://problem/7005077> WER: Crash in
-        WebCore::PluginStream::destroyStream+279 (1310510882)
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Adler.
 
-        * plugins/PluginStream.cpp:
-        (WebCore::PluginStream::destroyStream):
-        Move the "protector" RefPtr out of the block that dispatches
-        notifications and into the function level; if NPN_DestroyStream were
-        called from NPP_NewStream as the comment warns, we would be deleted at
-        the end of the block.
+        <rdar://problem/7655195> Switch Leopard back to using CGShading to avoid CGGradient leaks
 
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+        Define USE_CG_SHADING on for Tiger and Leopard, and use it to toggle the methods
+        used for Core Graphics gradient drawing.
 
-        Inspector: Tab Through the DOM Storage DataGrid when Editing
+        * platform/graphics/Gradient.h:
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::paint):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27746
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
-
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+        Web Inspector: on-hover evaluation renders nodes and arrays as strings.
 
-        Inspector: Create New DOM Storage Items via DataGrid
-
-        https://bugs.webkit.org/show_bug.cgi?id=27322
-
-        Reviewed by Timothy Hatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=35103
 
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
-        (WebInspector.CreationDataGridNode): new type of node
-        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
 
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-18  Brady Eidson  <beidson@apple.com>
 
-        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
+        Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27400
+        Particularly constructed WebFrames can try to access a null HistoryItem
+        <rdar://problem/7638892> and https://bugs.webkit.org/show_bug.cgi?id=35063
 
-        Reviewed by Timothy Hatcher.
+        Test: fast/loader/api-test-new-window-data-load-base-url.html
 
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
-        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
-        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
-        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
-        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll): We have a known case where a fragment scroll
+          might take place with a null m_currentItem. updateBackForwardListClippedAtTarget() will either move m_currentItem 
+          to m_previousItem then create a new m_currentItem...  or it will do nothing. So we either have both an m_currentItem 
+          and m_previousItem, or we have neither.  In the case where we have no m_previousItem, return early.
 
-2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+2010-02-18  Nate Chapin  <japhet@chromium.org>
 
-        Inspector should support inspect() in the command line.
+        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=19874
-        rdar://problem/6070225
+        [V8] Correctly handle the case where the event field on the
+        global object is a v8::Object, but not a DOM wrapper.
 
-        Reviewed by Timothy Hatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=34899
 
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
-        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
-        (WebInspector.DatabasesPanel.prototype.showDatabase): 
+        Test: fast/dom/Window/window-event-override-no-crash.html
 
-2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
-
-        The rest of: Web Inspector: Add inspected node using public console API.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::isValidDOMObject):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        * bindings/v8/V8DOMWrapper.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=27758
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Not reviewed, Qt build fix.
 
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
-        (WebInspector.Console.prototype.addInspectedNode): Added.
+        * inspector/front-end/WebKit.qrc:
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Accept autocomplete on 'End' key pressed.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27447.
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype.handleKeyEvent):
-
-2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Web Inspector: Implement evaluate-on-hover for scripts panel.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=35003
+ 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Images/gearButtonGlyph.png: Added.
+        * inspector/front-end/Images/popoverArrows.png: Added.
+        * inspector/front-end/Images/popoverBackground.png: Added.
+        * inspector/front-end/Images/thumbActiveHoriz.png: Added.
+        * inspector/front-end/Images/thumbActiveVert.png: Added.
+        * inspector/front-end/Images/thumbHoriz.png: Added.
+        * inspector/front-end/Images/thumbHoverHoriz.png: Added.
+        * inspector/front-end/Images/thumbHoverVert.png: Added.
+        * inspector/front-end/Images/thumbVert.png: Added.
+        * inspector/front-end/Images/trackHoriz.png: Added.
+        * inspector/front-end/Images/trackVert.png: Added.
+        * inspector/front-end/Popup.js:
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype._positionElement):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createViewerIfNeeded):
+        (WebInspector.SourceFrame.prototype._scroll):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._mouseUp):
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        (WebInspector.SourceFrame.prototype._mouseOut):
+        (WebInspector.SourceFrame.prototype._resetHoverTimer):
+        (WebInspector.SourceFrame.prototype._hidePopup):
+        (WebInspector.SourceFrame.prototype._mouseHover):
+        (WebInspector.SourceFrame.prototype._showPopup.showTextPopup):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup.evaluateCallback):
+        (WebInspector.SourceFrame.prototype._showPopup):
+        (WebInspector.HoverPropertiesSection):
+        (WebInspector.HoverPropertiesSection.prototype.update):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+        * inspector/front-end/popover.css: Added.
 
-        [Qt] Build fix after r46502
-        https://bugs.webkit.org/show_bug.cgi?id=27789
+2010-02-18  Ben Murdoch  <benm@google.com>
 
-        * WebCore.pro: Remove StorageArea.cpp
+        Reviewed by Jeremy Orlow.
 
-2009-07-28  Mark Rowe  <mrowe@apple.com>
+        [v8] Complete upstreaming of V8 Touch Event bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35094
 
-        Reviewed by Darin Adler.
+        No new tests required.
 
-        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
-        in -dealloc overrides in DOMObject subclasses.
+        * bindings/v8/V8Index.cpp: Add generated touch event headers.
 
-        * bindings/scripts/CodeGeneratorObjC.pm:
+2010-02-18  Steve Block  <steveblock@google.com>
 
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Adam Treat.
+        Updates Android V8 build to use DerivedSourcesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=35083
 
-        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=27786
-
-        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
-        The only case where this is relevant in WML is error handling. The parsed WML
-        tree fragment is inserted in an XHTML compound error document. This requires
-        removedFromDocument() to be correctly implemented otherwhise we run into
-        trouble (visible when using run-webkit-tests fast/wml --random).
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::registerTask):
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLAnchorElement.h:
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::removedFromDocument):
-        (WebCore::WMLDoElement::registerTask):
-        (WebCore::WMLDoElement::deregisterTask):
-        * wml/WMLDoElement.h:
-        * wml/WMLEventHandlingElement.cpp:
-        (WebCore::WMLEventHandlingElement::registerDoElement):
-        (WebCore::WMLEventHandlingElement::deregisterDoElement):
-        * wml/WMLEventHandlingElement.h:
-        * wml/WMLFieldSetElement.cpp:
-        (WebCore::WMLFieldSetElement::removedFromDocument):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::registerPostfieldElement):
-        (WebCore::WMLGoElement::deregisterPostfieldElement):
-        * wml/WMLGoElement.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
-        * wml/WMLIntrinsicEventHandler.h:
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::eventHandlingParent):
-        (WebCore::WMLOnEventElement::registerTask):
-        (WebCore::WMLOnEventElement::deregisterTask):
-        * wml/WMLOnEventElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::removedFromDocument):
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::removedFromDocument):
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::removedFromDocument):
-        (WebCore::WMLTaskElement::registerVariableSetter):
-        (WebCore::WMLTaskElement::deregisterVariableSetter):
-        (WebCore::WMLTaskElement::storeVariableState):
-        * wml/WMLTaskElement.h:
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::removedFromDocument):
-        * wml/WMLTimerElement.h:
-
-2009-07-28  David Levin  <levin@chromium.org>
-
-        Suggested by Drew Wilson.
-
-        Speculative gtk build fix, follow up to:
-        https://bugs.webkit.org/show_bug.cgi?id=27697
+        No new tests, build fix only.
 
-        * GNUmakefile.am:
+        * Android.derived.v8bindings.mk:
+        * Android.v8bindings.mk:
 
-2009-07-28  Dan Bernstein  <mitz@apple.com>
+2010-02-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Xan Lopez.
 
-        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
-        properties
-        https://bugs.webkit.org/show_bug.cgi?id=27578
+        fast/frames/iframe-reparenting.html crashing on GTK Debug bots
+        https://bugs.webkit.org/show_bug.cgi?id=35081
 
-        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
-        border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=27584
+        Check that the client is alive after every call to it, since any
+        of them could cause the load to be cancelled, and the client to go
+        away.
 
-        Test: fast/borders/border-radius-parsing.html
+        This is much better than protecting a specific subclass of
+        ResourceHandleClient (ResourceLoader), which makes us fail when
+        any other client is used.
 
-        Dropped the -webkit- prefix from the individual corner border-radius
-        properties. Added border-radius with the / and 4-value syntax, and
-        maintained -webkit-border-radius with legacy 2-value syntax.
+        Test: fast/frames/iframe-reparenting.html
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (computedProperties): Removed Webkit prefix.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
-            single-corner properties. Call out to parseBorderRadius() to parse
-            border-radius and -webkit-border-radius. 
-        (WebCore::completeBorderRadii): Added this helper function that
-            completes the values for all four corners when fewer than four are
-            specified.
-        (WebCore::CSSParser::parseBorderRadius): Added.
-        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
-            unprefixed property.
-        * css/CSSParser.h:
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
-            for border-radius. Kept the entry for -webkit-border-radius.
-        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
-            single-corenr properties. Added border-radius. Kept
-            -webkit-border-radius because of its conflicting syntax.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap): Ditto.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-2009-07-28  Drew Wilson  <atwilson@google.com>
+2010-02-18  Ben Murdoch  <benm@google.com>
 
-        Reviewed by David Levin.
+        Reviewed by Nate Chapin.
 
-        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+        [v8] [Android] V8 bindings for touch events are missing.
+        https://bugs.webkit.org/show_bug.cgi?id=33795
 
-        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
-        https://bugs.webkit.org/show_bug.cgi?id=27697
+        No new tests as this just enables touch events in V8. Existing touch tests suffice.
 
-        This is just a refactoring, so existing tests suffice.
+        * WebCore.gypi: Add Touch idl files.
+        * bindings/scripts/CodeGeneratorV8.pm: Add TouchList to typeCanFailConversion map.
+        * bindings/v8/DOMObjectsInclude.h: Add touch headers.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Add touch generated bindings.
+        * bindings/v8/V8Index.h: Add touch DOM object types.
+        * bindings/v8/custom/V8EventCustom.cpp: Add conversion of event to touch event.
+        * Android.derived.jscbindings.mk: Add the touch derived sources to the makefile.
+        * Android.derived.v8bindings.mk: Add the touch derived sources to the makefile.
 
-        * GNUmakefile.am:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.gypi:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.pro:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.vcproj/WebCore.vcproj:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.xcodeproj/project.pbxproj:
-        Added DedicatedWorkerThread.h/.cpp
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::addMessage):
-        Forwards console messages to parent document.
-        (WebCore::DedicatedWorkerContext::importScripts):
-        Now sends the updated pending activity status after importing scripts.
-        (WebCore::DedicatedWorkerContext::thread):
-        Helper routine that casts WorkerThread to DedicatedWorkerThread.
-        * workers/DedicatedWorkerContext.h:
-        (WebCore::DedicatedWorkerContext::create):
-        * workers/DedicatedWorkerThread.cpp: Added.
-        (WebCore::DedicatedWorkerThread::create):
-        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
-        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
-        (WebCore::DedicatedWorkerThread::createWorkerContext):
-        Implementation of the base class factory method to create the appropriate worker context.
-        (WebCore::DedicatedWorkerThread::runEventLoop):
-        Reports pending activity before running the event loop.
-        * workers/DedicatedWorkerThread.h: Added.
-        (WebCore::DedicatedWorkerThread::workerObjectProxy):
-        Moved from base class.
-        * workers/WorkerContext.cpp:
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerMessagingProxy::startWorkerContext):
-        Now creates DedicatedWorkerThread.
-        (WebCore::WorkerMessagingProxy::workerThreadCreated):
-        Now is passed a DedicatedWorkerThread.
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        Moved workerObjectProxy param into derived class constructor.
-        (WebCore::WorkerThread::workerThread):
-        (WebCore::WorkerThread::runEventLoop):
-        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::workerContext):
+2010-02-18  William Chan  <willchan@chromium.org>
 
-2009-07-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Darin Fisher.
+        Reviewed by Adam Barth.
 
-        Fix V8NPUtils' handling of UTF8 identifiers.
+        https://bugs.webkit.org/show_bug.cgi?id=35071
+        Disable loader limiting of requests per host for the chromium port.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27782
+        No tests because we're only changing a constant.
 
-        * bindings/v8/V8NPUtils.cpp:
-        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
-            since NPN_GetStringIdentifier() is expecting UTF8.
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
 
-2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-18  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Eric Seidel.
 
-        Misc cleanup in DOM Storage.
-        https://bugs.webkit.org/show_bug.cgi?id=27517
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
 
-        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
-        runs in a different process from where the Frame object lives, Chromium passes in NULL
-        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
-        incognito mode does not use the private browsing setting, so that's not a concern.  As for
-        events, I've decided to simply disable them for now.
+        The NP Version supported by WebKit is at the moment hardcoded in
+        PluginPackage.cpp (to 24), but not all backends actually implement
+        the methods needed to claim this. Introduce a new method to be
+        implemented by each backend where the maximum supported version
+        can be specified, and set the GTK+ port NPVersion to 19. This
+        fixes an instantaneous crasher in the Sun Java NPAPI plugin.
 
-        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
-        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
-
-        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
-
-        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::privateBrowsingEnabled): Factored out the check.
-        (WebCore::StorageAreaImpl::setItem): Make frame optional.
-        (WebCore::StorageAreaImpl::removeItem): ditto
-        (WebCore::StorageAreaImpl::clear): ditto
-        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
-        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
-
-2009-07-28  Alpha Lam  <hclam@google.com>
-
-        Reviewed by David Levin.
-
-        [chromium] Default UI controls for <video> has rendering problems
-        https://bugs.webkit.org/show_bug.cgi?id=27669
-
-        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
-        it is playing an audio file by changing the style to be 32px
-        tall.
-
-        Also fixes a problem of default styled audio tag that hides the
-        all the time digits by expanding the width to 300px.
-
-        Changed the size and position of the current time and remaining
-        display to give enough space for the hour digit to be shown.
-
-        There are no new tests provided because this is already covered
-        by existing tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix style in PluginPackage and PluginDatabase.
-        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::refresh):
-        (WebCore::PluginDatabase::findPlugin):
-        * plugins/PluginDatabase.h:
         * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::~PluginPackage):
-        (WebCore::PluginPackage::freeLibrarySoon):
-        (WebCore::PluginPackage::freeLibraryTimerFired):
-        (WebCore::PluginPackage::unloadWithoutShutdown):
         (WebCore::PluginPackage::initializeBrowserFuncs):
         * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/symbian/PluginPackageSymbian.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::NPVersion):
 
-2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27769
-        The V8 bindings function V8Proxy::createNewContext can be 
-        called during frame shutdown where the activeDocumentLoader
-        function in FrameLoader can return NULL. Added a check for the
-        same.
-
-        No new tests added as this is an edge case where the V8 
-        bindings code is reentered via NPAPI during shutdown. It is 
-        difficult to write a consistently reproducible test for this.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-
-2009-07-28  Ivan Posva  <iposva@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Associate the CanvasPixelData backing store with the
-        indexed properties of the wrapper object.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27773
-
-        No new tests: Relying on existing Canvas tests.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-
-2009-07-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
+2010-02-17  Dmitry Titov  <dimich@chromium.org>
 
-        Nuke all references to JSWorkerContextBase.lut.h, it was removed
-        back in April.
+        Reviewed by David Levin, Darin Fisher, Simon Hausmann.
 
-        * GNUmakefile.am:
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+        Test: fast/frames/iframe-reparenting-new-page.html
 
-        Reviewed by Simon Hausmann.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setName):
+        Move the code setting the frame name into a separate function.
 
-        Fixed references to script generate-webkitversion.pl, and
-        removed duplicated generate-webkitversion.pl
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::updateOnReparenting):
+        Called on the frame that was just re-parented and inserted into another Document.
+        Simply invoke Frame::transferChildFrameToNewDocument(...);
 
-        https://bugs.webkit.org/show_bug.cgi?id=27158
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::setName):
+        Make this a virtual function, to be able to reach it via Frame::m_ownerElement.
 
-        * WebCore.pro:
-        * platform/generate-webkitversion.pl: Removed.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::adoptFrame):
+        * loader/FrameLoaderClient.h:
+        Add a new method, didTransferChildFrameToNewDocument().
+        It compliments createFrame() in that a frame which was re-parented
+        in DOM and potentially changes Page, should notify the WebKit
+        implementation about potential ownership change.
+        Many embedders assume that Page owns all the Frames, or at least
+        all Frames are destroyed before 'their' Page is destroyed. Obviously, if Frame
+        can be transferred to another Page, the embedders should be notified.
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+        * page/Frame.cpp:
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        Added, makes actual adjustments for Frame - resets the Page,
+        updates the frame tree and frame name, calls to FrameLoaderClient
+        to update external objects and recurses into children.
+        Can only be used on child frames.
 
-        Reviewed by Dmitry Glazkov.
+        * page/Frame.h:
 
-        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
-        InspectorJSONObject.
+2010-02-17  Tony Chang  <tony@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27766
+        Reviewed by Eric Seidel.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/ScriptArray.cpp:
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptArray.h:
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::ScriptObject):
-        (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::get):
-        * bindings/js/ScriptObject.h:
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptArray.cpp:
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/v8/ScriptArray.h:
-        * bindings/v8/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptObject::ScriptObject):
-        (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::get):
-        * bindings/v8/ScriptObject.h:
-        (WebCore::ScriptObject::ScriptObject):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::addToConsole):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::bind):
-        * inspector/InspectorDatabaseResource.cpp:
-        (WebCore::InspectorDatabaseResource::bind):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::newScriptArray):
-        (WebCore::InspectorFrontend::newScriptObject):
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        (WebCore::InspectorFrontend::addResource):
-        (WebCore::InspectorFrontend::updateResource):
-        (WebCore::InspectorFrontend::addDatabase):
-        (WebCore::InspectorFrontend::addDOMStorage):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorJSONObject.cpp: Removed.
-        * inspector/InspectorJSONObject.h: Removed.
-        * inspector/InspectorResource.cpp:
-        (WebCore::populateHeadersObject):
-        (WebCore::InspectorResource::createScriptObject):
-        (WebCore::InspectorResource::updateScriptObject):
+        Copying and pasting into a contenteditable area can create <div>s surrounded by <span>s
+        https://bugs.webkit.org/show_bug.cgi?id=26937
 
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        This happens because of a span added when we copy that is used to
+        preserve styles.  To avoid this, when we paste, make sure to apply
+        the styles to the span's children and then remove the style span.
 
-        Reviewed by George Staikos.
+        This change is covered by existing layout tests.
 
-        [WML] Variable substitution recursion seems to have bugs
-        https://bugs.webkit.org/show_bug.cgi?id=27726
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::copyStyleToChildren):
+        * editing/ReplaceSelectionCommand.h:
 
-        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
-        Required by the specification - assure it only works in linear order. A setvar element may
-        not depend on the variable state of a following setvar element, only the previous ones.
+2010-02-17  Tony Chang  <tony@chromium.org>
 
-        Extend wml/variable-reference-valid.html layout test to cover these cases.
+        Reviewed by Eric Seidel.
 
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::storeVariableState):
+        https://bugs.webkit.org/show_bug.cgi?id=34914
+        When pasting absolute font sizes into a content editable area with
+        page zoom, adjust the font sizes to be the same after page zoom is
+        applied.
 
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Test: editing/pasteboard/page-zoom.html
 
-        Reviewed by George Staikos.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance):
 
-        [WML] Page title doesn't update after variable substitution, if it contained variables
-        https://bugs.webkit.org/show_bug.cgi?id=27725
+2010-02-17  Tony Chang  <tony@chromium.org>
 
-        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
-        too much, leading to a bug with 1-char variable names, which were not detected properly.
+        Reviewed by Eric Seidel.
 
-        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
-        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
+        https://bugs.webkit.org/show_bug.cgi?id=34737
+        Copying styled list items then pasting into a list
+        should work the same as copying unstyle list items:
+        it shouldn't indent an extra level, but styles should
+        be copied.
 
-        * wml/WMLVariables.cpp:
-        (WebCore::containsVariableReference):
+        Small cleanups to insertAsListItems to make variable names
+        more descriptive.
 
-2009-07-28  Robert Hogan  <robert@roberthogan.net>
+        Test: editing/pasteboard/paste-list-003.html
 
-        Reviewed by Simon Hausmann.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        Add WebKit version API to Qt.
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
-        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
-        at compile time and make it available to webkit ports through WebKitVersion.h.
+        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27158
+        [BREWMP] Port PlatformKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=34794
 
-        * WebCore.pro: Call generate-webkitversion.pl
+        Retrieve the type, key code, text and modifiers from BREW's keyboard event.
 
-2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * platform/PlatformKeyboardEvent.h:
+        * platform/brew/PlatformKeyboardEventBrew.cpp: Added.
+        (WebCore::keyIdentifierForBrewKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::singleCharacterString):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
 
-        Unreviewed make dist build fix.
+2010-02-17  Hayato Ito  <hayato@chromium.org>
 
-        * GNUmakefile.am:
+        Reviewed by Eric Seidel.
 
-2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
+        Support CSS page-break-inside with a value of 'avoid'.
 
-        Reviewed by Adam Treat.
+        https://bugs.webkit.org/show_bug.cgi?id=34080
 
-        Replace hardcoded separator text with proper separator.
-        Also adjusts include order as per style guidelines.
+        Test: printing/page-break-inside.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=27763
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
 
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
+2010-02-17  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Steve Falkenburg.
+        WebSocket bufferedAmount should not be 0 when send after close.
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        Add output directory for VS pre-build steps to enable out-of-tree builds
+        Fixed bug in webkit r54694.  check m_client after it calls user
+        callback, because user callback may call close(), which would
+        call onclose event handler.
+        
+        Test: websocket/tests/bufferedAmount-after-close.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=27700
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-        The tmp.obj file is now placed in the intermediate build directory.
+2010-02-17  Yuzo Fujishima  <yuzo@google.com>
 
-        * WebCore.vcproj/WebCoreCommon.vsprops:
+        Reviewed by Eric Seidel.
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+        In diffing render styles, consider all pseudo style changes.
+        Without this patch, only :before and :after are considered. This is the cause of the following bug.
+        https://bugs.webkit.org/show_bug.cgi?id=32187
 
-        Reviewed by Timothy Hatcher.
+        Test: fast/css/first-letter-first-line-hover.html
 
-        Web Inspector: Add inspected node using public console API.
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::hasAnyPublicPseudoStyles):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27758
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addInspectedNode):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel):
+        Reviewed by Eric Seidel.
 
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        [BREWMP] Add WebCore::prefetchDNS
+        https://bugs.webkit.org/show_bug.cgi?id=34873
 
-        Reviewed by George Staikos.
+        DNS prefetching is not implemented because the maximum number
+        of UDP sockets is quite small in most BREW devices.
 
-        [WML] <do> elements with a <noop> task shouldn't be exposed to the user
-        https://bugs.webkit.org/show_bug.cgi?id=27724
+        * platform/network/brew/DNSBrew.cpp: Added.
+        (WebCore::prefetchDNS):
 
-        Fix WMLNoopElement to disable it's parent WMLDoElement, as required by the spec.
-        Moved manual-tests/wml/task-noop-in-do.wml to LayoutTests/fast/wml/task-noop-in-do.wml.
+2010-02-17  Kent Tamura  <tkent@chromium.org>
 
-        * manual-tests/wml/task-noop-in-do.wml: Removed.
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
+        Reviewed by Eric Seidel.
 
-2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Introduces new Icon loading interface in order to support
+        asynchronous loading.
+        https://bugs.webkit.org/show_bug.cgi?id=32054
 
-        Reviewed by Simon Hausmann.
+        It's hard for Chromium port to load an icon inside
+        Icon::createIconForFiles() because of sanbox and multi-process
+        architecture. So this change adds a method to request an icon to
+        Chrome class, and makes FileChooser receives an Icon instance
+        asynchronously.  Synchronous loading also works with the new interface.
 
-        [Qt] Disable some compiler warnings for the win build
-        https://bugs.webkit.org/show_bug.cgi?id=27709
+        Because all ports don't have implementations of Chrome::iconForFiles()
+        yet, FileChooser tries to load an Icon synchronously with
+        Icon::createIconForFiles(), then tries to load an Icon asynchronously
+        with Chrome::iconForFiles() if Icon::createIconForFiles() returns 0.
 
-        * WebCore.pro: Move the msvc options to WebKit.pri
+        The existing Icon::createIconForFiles() implementations should be
+        moved to Chrome::iconForFiles(). We're going to remove
+        Icon::createIconForFiles().
 
-2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::iconForFiles): Add an empty implementation.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::iconForFiles): Delegate to ChromeClient::iconForFiles().
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::iconForFiles): Add a declaration as a pure virtual method.
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser): Use loadIcon().
+        (WebCore::FileChooser::chooseFiles): ditto.
+        (WebCore::FileChooser::loadIcon): Added.
+        (WebCore::FileChooser::iconLoaded): Added.
+        * platform/FileChooser.h: Add two methods to FileChooserClient; repaint() and iconForFiles().
+        * platform/graphics/Icon.h: Add a FIXME comment.
+        * platform/graphics/gtk/IconGtk.cpp: ditto.
+        * platform/graphics/mac/IconMac.mm: ditto.
+        * platform/graphics/qt/IconQt.cpp: ditto.
+        * platform/graphics/win/IconWin.cpp: ditto.
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::iconForFiles): Delegate to Chrome::iconForFiles().
+        (WebCore::RenderFileUploadControl::click): Use chrome().
+        (WebCore::RenderFileUploadControl::chrome):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::repaint):
 
-        Reviewed by Tor Arne Vestbø
+2010-02-17  Mark Rowe  <mrowe@apple.com>
 
-        Make equality checks for logging channel names ignore casing.
+        Reviewed by Darin Adler.
 
-        * platform/Logging.cpp:
-        (WebCore::getChannelFromName):
+        Bug 35065: Delay between page loading and animated GIF playing
+        <http://webkit.org/b/35065> / <rdar://problem/7109548>
 
-2009-07-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        BitmapImage::startAnimation was adding the current frame duration to the desired start time
+        of the frame for every time it was called.  If the function then bailed out due to not having
+        sufficient data to render the frame, this would lead to the desired start time of the frame
+        being pushed out multiple times.  On an animated GIF that took mulitple seconds to load this
+        could happen many times for a single frame, resulting in the start time of the second frame
+        of the animation being pushed out by as much as five seconds.
 
-        Reviewed by Xan Lopez.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation): Change the order of the code slightly so that the
+        desired start time is only updated after determining that we have sufficient data to handle
+        the next frame.
 
-        [Gtk] Refactor ResourceHandleSoup - make start* functions static
-        https://bugs.webkit.org/show_bug.cgi?id=27687
+2010-02-17  Stephan Aßmus  <superstippi@gmx.de>
 
-        * platform/network/ResourceHandle.h:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startData):
-        (WebCore::startHttp):
-        (WebCore::):
+        Reviewed by Eric Seidel.
 
-2009-07-28  Xan Lopez  <xlopez@igalia.com>
+        Implemented homeDirectoryPath() and listDirectory() on the Haiku platform.
+        https://bugs.webkit.org/show_bug.cgi?id=34687
 
-        Reviewed by Gustavo Noronha.
+        Covered by existing tests.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
+        * platform/haiku/FileSystemHaiku.cpp:
+        (WebCore::homeDirectoryPath): Implemented
+        (WebCore::listDirectory): Implemented
 
-        Do not cache the pango layout in the object, since the layout of
-        the page can change between calls.
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        Reviewed by Eric Seidel.
 
-2009-07-23  Anton Muhin  <antonm@chromium.org>
+        [BREWMP] Port userIdleTime
+        https://bugs.webkit.org/show_bug.cgi?id=34259
 
-        Reviewed by Adam Barth.
+        Return an arbitrarily high userIdleTime so that releasing pages from the page
+        cache isn't postponed.
 
-        Simplify management of Nodes in weak handles callbacks.
-        https://bugs.webkit.org/show_bug.cgi?id=27628
+        * platform/brew/SystemTimeBrew.cpp: Added.
+        (WebCore::userIdleTime):
 
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::weakNodeCallback):
+2010-02-17  Dirk Schulze  <krit@webkit.org>
 
-2009-07-28  Brian Weinstein  <bweinstein@apple.com>
+        Rolling out r54909. Breaks SL and Win.
 
-        Rubber-stamped by David Levin.
+2010-02-17  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Fix error handling of GetIconInfo (returns a bool).
+        Reviewed by Dimitri Glazkov.
 
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageIconForCachedImage):
+        Fix Chromium's bindings for Database.transaction(): a 'null'
+        callback should be treated as no callback.
 
-2009-07-27  Brian Weinstein  <bweinstein@apple.com>
+        Test: storage/null-callbacks.html
 
-        Reviewed by Jon Honeycutt.
+        https://bugs.webkit.org/show_bug.cgi?id=35047
 
-        Fix of <rdar://5015949> Drag Icon is not produced for over sized images.
-        
-        Implemented the createDragImageIconForCachedImage function by using the Windows 
-        SHFILEINFO structure.
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction):
 
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageIconForCachedImage):
+2010-02-17  Dirk Schulze  <krit@webkit.org>
 
-2009-07-25  Adam Barth  <abarth@webkit.org>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by David Levin.
+        Move SVGResources to Renderers, starting with Masker
+        https://bugs.webkit.org/show_bug.cgi?id=35020
 
-        [V8] Split up V8DOMMap.cpp by class
-        https://bugs.webkit.org/show_bug.cgi?id=27685
+        We have rendering specific code in WebCore/svg/graphics. The goal is to move
+        this code into suitable Renderers. This helps us to clean up the code and makes
+        maintenance easier. It also makes it possible to remove rendering specific code
+        from SVG*Elements into this renderers. So the Renderer contains everything that
+        is needed to use the resource.
+        RenderSVGResource will be the base class for all new resource render classes like
+        RenderSVGResourceMasker, RenderSVGResourceClipper and the other resources.
 
-        No behavior change.  Just copy-and-paste.
+        This patch starts moving SVGResourceMasker to RenderSVGResourceMasker.
+        Another benefit is the much more useful result in DRT on using masker.
 
+        * Android.mk:
+        * GNUmakefile.am:
         * WebCore.gypi:
-        * bindings/v8/ChildThreadDOMData.cpp: Added.
-        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
-        (WebCore::ChildThreadDOMData::getStore):
-        * bindings/v8/ChildThreadDOMData.h: Added.
-        * bindings/v8/DOMData.cpp: Added.
-        (WebCore::DOMData::DOMData):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::getCurrentMainThread):
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::ensureDeref):
-        (WebCore::DOMData::derefObject):
-        (WebCore::DOMData::derefDelayedObjects):
-        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/DOMData.h: Added.
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toRenderSVGResource): Conversion to RenderSVGResource base class.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResource): Check if renderer is a resource.
+        * rendering/RenderPath.cpp:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGImage.h: Some code clean up according to the webkit style.
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::renderName):
+        (WebCore::RenderSVGImage::isSVGImage):
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        (WebCore::RenderSVGImage::requiresLayer):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::objectBoundingBox): Needed for SVGRenderTreeAsText
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResource.h: Added.
+        (WebCore::): Base class for all Resource renderers like masker, clipper and others.
+        (WebCore::RenderSVGResource::RenderSVGResource):
+        (WebCore::RenderSVGResource::cast):
+        (WebCore::RenderSVGResource::toRenderSVGResource):
+        (WebCore::RenderSVGResource::isSVGResource): 
+        (WebCore::RenderSVGResource::drawsContents):
+        (WebCore::getRenderSVGResourceById):
+        * rendering/RenderSVGResourceMasker.cpp: Added.
+        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::invalidateClients): Status of masker changed, remove all clients.
+        (WebCore::RenderSVGResourceMasker::invalidateClient): Status of an object changed, remove pending client.
+        (WebCore::RenderSVGResourceMasker::applyResource): Apply masker to object.
+        (WebCore::RenderSVGResourceMasker::resourceBoundingBox): boundingBox of the resource, depending on the object.
+        (WebCore::RenderSVGResourceMasker::createMaskImage): Creates the mask image, the context gets clipped with.
+        * rendering/RenderSVGResourceMasker.h: Added.
+        (WebCore::MaskerData::MaskerData):
+        (WebCore::RenderSVGResourceMasker::renderName):
+        (WebCore::RenderSVGResourceMasker::maskUnits): Unit of mask for DRT.
+        (WebCore::RenderSVGResourceMasker::maskContentUnits): Unit of childs from mask for DRT.
+        (WebCore::RenderSVGResourceMasker::resourceType):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::destroy): dito.
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources): Unregister object from all it's resources after status changed.
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRenderTreeAsText.cpp: Update TreeAsText to dump maskers correctly.
+        (WebCore::operator<<):
+        (WebCore::writeSVGResource):
+        (WebCore::writeSVGContainer):
+        (WebCore::writeSVGText):
+        (WebCore::writeSVGInlineText):
+        (WebCore::writeSVGImage):
+        (WebCore::write):
+        (WebCore::writeResourcesToObject):
+        * rendering/SVGRenderTreeAsText.h:
+        * svg/SVGMaskElement.cpp: Update Masker to use the new renderer.
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::createRenderer):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp: We need to tell the renderer to unregister object, after the status changed.
+        (WebCore::SVGStyledElement::invalidateResources):
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGUnitTypes.h: Conversion of integer to SVGUnitType.
+        (WebCore::toUnitType):
+        * svg/graphics/SVGResource.h:
         (WebCore::):
-        * bindings/v8/DOMDataStore.cpp: Added.
-        (WebCore::DOMDataStore::DOMDataStore):
-        (WebCore::DOMDataStore::~DOMDataStore):
-        (WebCore::DOMDataStore::allStores):
-        (WebCore::DOMDataStore::allStoresMutex):
-        (WebCore::DOMDataStore::getDOMWrapperMap):
-        (WebCore::forget):
-        (WebCore::DOMDataStore::weakDOMObjectCallback):
-        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
-        (WebCore::DOMDataStore::weakNodeCallback):
-        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
-        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
-        * bindings/v8/DOMDataStore.h: Added.
-        (WebCore::DOMDataStore::):
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::forgetOnly):
-        (WebCore::DOMDataStore::domData):
-        (WebCore::DOMDataStore::domNodeMap):
-        (WebCore::DOMDataStore::domObjectMap):
-        (WebCore::DOMDataStore::activeDomObjectMap):
-        (WebCore::DOMDataStore::domSvgElementInstanceMap):
-        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
-        * bindings/v8/MainThreadDOMData.cpp: Added.
-        (WebCore::MainThreadDOMData::MainThreadDOMData):
-        (WebCore::MainThreadDOMData::getStore):
-        * bindings/v8/MainThreadDOMData.h: Added.
-        * bindings/v8/ScopedDOMDataStore.cpp: Added.
-        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
-        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
-        * bindings/v8/ScopedDOMDataStore.h: Added.
-        * bindings/v8/StaticDOMDataStore.cpp: Added.
-        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
-        * bindings/v8/StaticDOMDataStore.h: Added.
-        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceMasker.cpp: Removed.
+        * svg/graphics/SVGResourceMasker.h: Removed.
 
-2009-07-27  Mark Rowe  <mrowe@apple.com>
+2010-02-17  Kenneth Russell  <kbr@google.com>
 
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7091036> REGRESSION: Microsoft Messenger crashes during file send/receive due to use of WebKit on non-main thread
-
-        Add a method for detecting if we're being used within Microsoft Messenger.
-
-        * WebCore.base.exp: Export applicationIsMicrosoftMessenger and sort existing entries.
-        * platform/mac/RuntimeApplicationChecks.h:
-        * platform/mac/RuntimeApplicationChecks.mm:
-        (WebCore::applicationIsMicrosoftMessenger):
-
-2009-07-27  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Implement EventListener::reportError for V8 event listeners in worker context. 
-        https://bugs.webkit.org/show_bug.cgi?id=27731
-
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        * bindings/v8/V8WorkerContextEventListener.h:
+        Reviewed by Oliver Hunt.
 
-2009-07-27  Stephen White  <senorblanco@chromium.org>
+        Refactor texImage2D and texSubImage2D taking Image to use common code
+        https://bugs.webkit.org/show_bug.cgi?id=34458
 
-        Reviewed by Eric Seidel and David Levin.
+        Merged the Safari and Chromium code which extracts the data from
+        Image objects into common entry points on GraphicsContext3D. This
+        immediately fixes the following three problems:
+          - Chromium not implementing texSubImage2D taking Image.
+          - Safari not obeying the flipY parameter to texImage2D or
+            texSubImage2D taking Image.
+          - Safari not obeying the premultipyAlpha parameter to texImage2D
+            or texSubImage2D taking Image.
+        Added new test verifying the behavior of texImage2D and
+        texSubImage2D and the flipY parameter. The premultiplyAlpha
+        parameter can not be tested yet as the implementation is not yet
+        spec compliant. This will be fixed in a follow-on bug.
 
-        Re-apply chromium/skia border fix (originally landed in r46157,
-        reverted in r46363), since it was not the cause of the reliability
-        failures in Chromium.
+        Ran all WebGL demos in demo repository on Safari and Chromium;
+        textures are now the right way up in both browsers, and
+        transparent textures in Particles demo now look correct in Safari.
 
-        http://bugs.webkit.org/show_bug.cgi?id=27388
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-image.html
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext3D.cpp: Added.
+        (WebCore::GraphicsContext3D::extractImageData):
+        (WebCore::GraphicsContext3D::processImageData):
+        (WebCore::GraphicsContext3D::premultiplyAlpha):
+        (WebCore::GraphicsContext3D::unmultiplyAlpha):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/cg/GraphicsContext3DCG.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData):
 
-2009-07-27  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-17  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Justin Garcia.
+        Reviewed by Ariya Hidayat.
 
-        createMarkup does not handle CSS properly
-        https://bugs.webkit.org/show_bug.cgi?id=27660
+        [Qt] GraphicsLayer: support perspective and 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=34960
 
-        This patch isolates code that creates markup for styles in addStyleMarkup
-        It also makes all presentational elements (u, s, strike, i, em, b, strong) special ancestor in createMarkup
-        so that we can assume no text decoration style is passed to addStyleMarkup.
+        New tests: http://webkit.org/blog-files/3d-transforms/perspective-by-example.html
 
-        * editing/markup.cpp:
-        (WebCore::propertyMissingOrEqualToNone): Changed the first argument from CSSMutableStyleDecleration to CSSStyleDeclaration
-        (WebCore::isElementPresentational): Used to be elementHasTextDecorationProperty, now supports presentational tags
-        (WebCore::addStyleMarkup): Adds markup for style span and div
-        (WebCore::createMarkup): Uses isElementPresentational and addStyleMarkup
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::updateTransform):
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform):
+        (WebCore::GraphicsLayerQtImpl::computeTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
 
-2009-07-27  Eric Seidel  <eric@webkit.org>
+2010-02-17  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Adam Barth.
+        Unreviewed, build fix.
 
-        fix more obvious global object lookups
-        https://bugs.webkit.org/show_bug.cgi?id=27745
+        Fix crashes due to an omitted line in r54839.
 
-        No new tests for these changes.  I believe in many cases
-        testing to be impossible.  Lack of testing justification next to
-        each change below.  The remaining pieces of bug 27634 will all
-        need tests.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
 
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::updateDocument): not testable.
-        * bindings/js/JSDataGridColumnListCustom.cpp:
-        (WebCore::JSDataGridColumnList::nameGetter): no testing for this incomplete feature.
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent): would require outer frame to trigger an event in the inner frame
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS): covered by other tests, always correct to pass the globalObject through.
-        * bindings/js/JSHTMLElementCustom.cpp:
-        (WebCore::JSHTMLElement::pushEventHandlerScope): unclear when this could be triggered.
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::remove): toJS seems superfluous here to begin with.
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode): would require outer frame to trigger inner frame event.
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::jsObjectForPluginElement): only used for NPAPI binding, unclear how to test.
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener): unclear how to test.
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set): unclear how to test/inspector only.
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject): unclear how to test.
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]): unclear how to test.
+2010-02-17  Alok Priyadarshi  <alokp@chromium.org>
 
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by George Staikos.
+        Bug 34900: Implement accelerated compositing for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34900
 
-        [WML] 'title' attribute handling not correct for <a> / <anchor> elements
-        https://bugs.webkit.org/show_bug.cgi?id=27720
+        Do not exclude files needed for accelerated compositing. In fact there is no need to exclude these files.
+        These files are already guarded with WTF_USE_ACCELERATED_COMPOSITING flag.
 
-        Unify title() implementation in WMLElement instead of several copies of the same logic.
-        We forgot WMLAnchorElement/WMLAElement, that lead to bugs. Fixes hovering links in the
-        WML manual-test suite.
+        * WebCore.gyp/WebCore.gyp: Removed GraphicsLayer.cpp, RenderLayerBacking.cpp,
+        and RenderLayerCompositor.cpp from excluded list.
 
-        * wml/WMLCardElement.cpp:
-        * wml/WMLCardElement.h:
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::title):
-        * wml/WMLElement.h:
-        * wml/WMLOptGroupElement.cpp:
-        * wml/WMLOptGroupElement.h:
-        * wml/WMLSelectElement.cpp:
-        * wml/WMLSelectElement.h:
+2010-02-17  Jian Li  <jianli@chromium.org>
 
-2009-07-27  Adam Treat  <adam.treat@torchmobile.com>
+        Reviewed by Darin Fisher.
 
-        Speculative build fix for Windows and WinCE.
+        [chromium] Remove the obsolete chromium interface for handling DownloadURL.
+        https://bugs.webkit.org/show_bug.cgi?id=34982
 
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
 
-2009-07-27  Ojan Vafai  <ojan@chromium.org>
+2010-02-17  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27474
-        Fixes crashes due to renderer getting destroyed in updateLayout.
-        We need to call updateLayout before we call into the renderer.
-        Removed the updateLayout call from RenderTextControl and moved it
-        into the calling sites.
-        
-        Also changes updateLayout to updateLayoutIgnorePendingStylesheets so
-        this works with pending stylesheets. Unfortunately, this seems to be
-        untestable. Loading an external stylesheet and then having an inline
-        script hit this code did not result in an pending stylesheets.
-        
-        The are other cases of this bug in the rendering code. I'll file a 
-        followup bug to audit the calls to updateLayout.
+        <rdar://problem/7645569> REGRESSION (r51324): Incorrect marker rects for blocks that span multiple columns
 
-        Test: fast/dom/text-control-crash-on-select.html
-
-        * dom/Document.h:
-        (WebCore::Document::inStyleRecalc): Added so the ASSERTs in updateFocusAppearance
-            and setSelectionRange could deal with cases of reentrancy into updateLayout
-            calls. This happens in a couple layout tests.
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::updateSelectionRange):
-        * html/HTMLInputElement.cpp:
-        (WebCore::isTextFieldWithRendererAfterUpdateLayout):
-        (WebCore::HTMLInputElement::setSelectionStart):
-        (WebCore::HTMLInputElement::setSelectionEnd):
-        (WebCore::HTMLInputElement::select):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::rendererAfterUpdateLayout):
-        (WebCore::HTMLTextAreaElement::setSelectionStart):
-        (WebCore::HTMLTextAreaElement::setSelectionEnd):
-        (WebCore::HTMLTextAreaElement::select):
-        (WebCore::HTMLTextAreaElement::setSelectionRange):
-        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setSelectionRange):
-
-2009-07-27  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Dave Levin.
-
-        [V8] Remove parameterless frame/window retrieval methods from V8Proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27737
+        * manual-tests/match-marker-rects.html: Added.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker): Use the text renderer rather
+        than its ancestor block for the local-to-absolute transformation.
+        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
 
-        Refactoring, no new behavior, covered by existing tests.
+2010-02-17 Gustavo Noronha Silva <gustavo.noronha@collabora.co.uk>
 
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        * bindings/v8/V8NPUtils.cpp:
-        (convertV8ObjectToNPVariant): Ditto.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::retrieve): Ditto.
-        (WebCore::V8Proxy::canAccessPrivate): Ditto.
-        * bindings/v8/V8Proxy.h: Removed parameterless retrieveWindow/retrieveProxy decls.
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Changed to use V8Proxy::retrieveFrameForCurrentContext().
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        Reviewed by Xan Lopez.
 
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Does not send an Accept header for subresources, causing some sites to break
+        https://bugs.webkit.org/show_bug.cgi?id=33242
 
-        Reviewed by George Staikos.
+        Set */* as the Accept header when downloading resources
+        that did not set an Accept header. This behaviour is similar to
+        the one adopted by Chromium.
 
-        [WML] 'onpick' intrinsic event handling missing
-        https://bugs.webkit.org/show_bug.cgi?id=27723
+        Test: http/tests/misc/image-checks-for-accept.html
 
-        Trigger 'onpick' intrinsic events from WMLOptionElement::setSelectedState().
-        All was in place, just forgot to enable the relevant code.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
 
-        Fixes manual-tests/wml/select-onpick-event.wml
-        Test: wml/option-element-onpick.html
+2010-02-17  Marcus Bulach  <bulach@chromium.org>
 
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::setSelectedState):
+        Reviewed by Jeremy Orlow.
 
-2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+        Fixes initialization order of members for GeolocationServiceChromium.
+        https://bugs.webkit.org/show_bug.cgi?id=35034
 
-        Reviewed by Darin Adler.
+        * platform/chromium/GeolocationServiceChromium.cpp:
 
-        https://bugs.webkit.org/show_bug.cgi?id=27735
-        Give a helpful name to JSLock constructor argument
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
 
-        * bindings/js/GCController.cpp:
-        (WebCore::collect):
-        (WebCore::GCController::gcTimerFired):
-        (WebCore::GCController::garbageCollectNow):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent):
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        (WebCore::JSInspectorBackend::profiles):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        * bindings/js/ScriptArray.cpp:
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        (WebCore::ScriptCachedFrameData::clear):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
-        (WebCore::ScriptController::clearScriptObjects):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::appendArgument):
-        (WebCore::ScriptFunctionCall::call):
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::set):
-        (WebCore::ScriptGlobalObject::get):
-        (WebCore::ScriptGlobalObject::remove):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::quarantineValue):
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::getString):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        (-[WebScriptObject setValue:forKey:]):
-        (-[WebScriptObject valueForKey:]):
-        (-[WebScriptObject removeWebScriptKey:]):
-        (-[WebScriptObject stringRepresentation]):
-        (-[WebScriptObject webScriptValueAtIndex:]):
-        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
-        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_Enumerate):
-        (_NPN_Construct):
-        * bridge/c/c_class.cpp:
-        (JSC::Bindings::CClass::~CClass):
-        (JSC::Bindings::CClass::methodsNamed):
-        (JSC::Bindings::CClass::fieldNamed):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
-        (JSC::Bindings::CInstance::invokeMethod):
-        (JSC::Bindings::CInstance::invokeDefaultMethod):
-        (JSC::Bindings::CInstance::invokeConstruct):
-        (JSC::Bindings::CInstance::getPropertyNames):
-        * bridge/c/c_runtime.cpp:
-        (JSC::Bindings::CField::valueFromInstance):
-        (JSC::Bindings::CField::setValueToInstance):
-        * bridge/c/c_utility.cpp:
-        (JSC::Bindings::convertValueToNPVariant):
-        (JSC::Bindings::convertNPVariantToValue):
-        * bridge/jni/jni_class.cpp:
-        (JavaClass::JavaClass):
-        (JavaClass::~JavaClass):
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::stringValue):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        (JavaJSObject::getMember):
-        (JavaJSObject::setMember):
-        (JavaJSObject::removeMember):
-        (JavaJSObject::getSlot):
-        (JavaJSObject::setSlot):
-        (JavaJSObject::toString):
-        (JavaJSObject::convertValueToJObject):
-        (JavaJSObject::convertJObjectToValue):
-        * bridge/jni/jni_objc.mm:
-        (JSC::Bindings::dispatchJNICall):
-        * bridge/jni/jni_runtime.cpp:
-        (JavaMethod::signature):
-        * bridge/jni/jni_runtime.h:
-        (JSC::Bindings::JavaString::JavaString):
-        (JSC::Bindings::JavaString::_commonInit):
-        (JSC::Bindings::JavaString::~JavaString):
-        (JSC::Bindings::JavaString::UTF8String):
-        * bridge/jni/jni_utility.cpp:
-        (JSC::Bindings::convertValueToJValue):
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::moveGlobalExceptionToExecState):
-        (ObjcInstance::invokeMethod):
-        (ObjcInstance::invokeDefaultMethod):
-        (ObjcInstance::setValueOfUndefinedField):
-        (ObjcInstance::getValueOfUndefinedField):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcField::valueFromInstance):
-        (JSC::Bindings::ObjcField::setValueToInstance):
-        * bridge/objc/objc_utility.mm:
-        (JSC::Bindings::convertValueToObjcValue):
-        (JSC::Bindings::convertNSStringToString):
-        (JSC::Bindings::convertObjcValueToValue):
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::removeFromCache):
-        (JSC::Bindings::QtInstance::~QtInstance):
-        (JSC::Bindings::QtInstance::getQtInstance):
-        (JSC::Bindings::QtInstance::createRuntimeObject):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-        (JSC::Bindings::convertQVariantToValue):
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
-        (JSC::Bindings::QtConnectionObject::execute):
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::createRuntimeObject):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addScriptProfile):
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::getTotalTime):
-        (WebCore::getSelfTime):
-        (WebCore::getTotalPercent):
-        (WebCore::getSelfPercent):
-        (WebCore::getNumberOfCalls):
-        (WebCore::getChildren):
-        (WebCore::getParent):
-        (WebCore::getHead):
-        (WebCore::getVisible):
-        (WebCore::getCallUID):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        (WebCore::getString):
-        (WebCore::PluginView::performRequest):
-        (WebCore::PluginView::bindingInstance):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::dispatchNPEvent):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
+        Reviewed by Gustavo Noronha.
 
-2009-07-27  Yong Li  <yong.li@torchmobile.com>
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
 
-        Reviewed by George Staikos.
+        Resolve symlinks before trying to load plugins as modules, since
+        GModule won't do it.
 
-        WINCE PORT: Make plugin work for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27713
+        Based on original work by Gustavo Noronha.
 
-        * plugins/win/PluginDatabaseWin.cpp:
-        (SHGetValue):
-        (PathRemoveFileSpec):
-        (WebCore::addWindowsMediaPlayerPluginDirectory):
-        (WebCore::addMacromediaPluginDirectories):
-        * plugins/win/PluginPackageWin.cpp:
+        * plugins/gtk/PluginPackageGtk.cpp:
         (WebCore::PluginPackage::load):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::registerPluginView):
-        (WebCore::PluginView::wndProc):
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paintWindowedPluginIntoContext):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-
-2009-07-27  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Tab Through Element Attributes and CSS Properties When Editing
 
-        https://bugs.webkit.org/show_bug.cgi?id=27673
+2010-02-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._startEditing): refactored parameter
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): refactored to remove excess
-        (WebInspector.ElementsTreeElement.prototype._triggerEditAttribute): provide an attribute name and this will start editing it
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted.moveToNextAttributeIfNeeded): move between attributes
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.onpopulate):
-        (WebInspector.StylePropertiesSection.prototype.findTreeElementWithName): search through treeElements for a style property name
-        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty): initialize a blank property for adding new properties
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): add references to the name and value elements
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.js:
-        (WebInspector.startEditing.editingCommitted): include the move direction as a parameter to the commit callback
-        (WebInspector.startEditing.element.handleKeyEvent): handle the tab key to specify the move direction
-        (WebInspector.startEditing):
-
-2009-07-27  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Add mapping FontWeight to QFont::Weight values as requested via FIXME.
-        https://bugs.webkit.org/show_bug.cgi?id=27663
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::toQFontWeight):
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-
-2009-07-27  Jakub Wieczorek  <faw217@gmail.com>
-
-         Reviewed by Adam Treat.
-
-         When clearing the plugin database, clear also the timestamp map.
-
-         https://bugs.webkit.org/show_bug.cgi?id=27651
-
-         Currently, if we clear the database, it will still think that it is up
-         to date with the plugin directories so refreshing the database again
-         after changing the search paths may not work.
-
-         * plugins/PluginDatabase.cpp:
-         (WebCore::PluginDatabase::clear):
-
-2009-07-27  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add in trivial implementation of FontPlatformData::description() for
-        linux to fix build bustage in chromium.
-
-        Fix chromium linux build by adding missing function implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=27732
-
-        Tested with a build of chromium on linux.
-
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::description):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        Reviewed by Xan Lopez.
 
-2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+        Protect the resource loader object from disappearing during
+        parseDataUrl.
 
-        Build correct, no review.
+        Tested by testdownload API test.
 
-        Final correction for WinCairo builds.
-        CoreServices only exists in Apple builds, but
-        some of its internal includes (e.g., <windows.h>) are needed
-        for other Windows targets.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        * WebCorePrefix.h: When building for WinCairo, make sure
-          to include <windows.h>, <stdio.h>, and <ConditionalMacros.h>
+2010-02-17  Marcus Bulach  <bulach@chromium.org>
 
-2009-07-27  Michelangelo De Simone  <micdesim@gmail.com>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Darin Adler.
+        Implements GeolocationServices for Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=32068
 
-        https://bugs.webkit.org/show_bug.cgi?id=25552
-        Added new "pattern" attribute to HTMLInputElement and validation code
-        (validity.patternMismatch) as per HTML5 specs.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-pattern
-
-        Tests: fast/forms/ValidityState-002.html
-               fast/forms/ValidityState-patternMismatch-001.html
-               fast/forms/ValidityState-patternMismatch-002.html
-               fast/forms/ValidityState-patternMismatch-003.html
-               fast/forms/ValidityState-patternMismatch-004.html
-               fast/forms/ValidityState-patternMismatch-005.html
-               fast/forms/ValidityState-patternMismatch-006.html
-               fast/forms/ValidityState-patternMismatch-007.html
-               fast/forms/pattern-attribute-001.html
-               fast/forms/pattern-attribute-002.html
-               fast/forms/pattern-attribute-003.html
-
-        * html/HTMLAttributeNames.in: pattern attribute
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::patternMismatch): method definition
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::patternMismatch): validation method
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::patternMismatch): validation flag
+        This is part of implementing Geolocation framework for Chromium. Existing layout tests should pass.
 
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * WebCore.gypi:
+        * page/Geolocation.h:
+        * platform/GeolocationService.h:
 
-        Reviewed by George Staikos.
+2010-02-17  Steve Block  <steveblock@google.com>
 
-        [WML] Manual WML tests aren't properly working
-        https://bugs.webkit.org/show_bug.cgi?id=27718
-
-        Fix file paths in the manual WML layout tests, remove unneeded tests (already covered by DRT tests).
-        Add missing resources directory and test image. Reformat all testcases to a common style.
-        Add new StartTests.wml file, which should be used as starting point to crawl through the manual tests.
-
-        Filing bugs soon for all tests exposing bugs (7 in total).
-
-        * manual-tests/wml/StartTests.wml: Added.
-        * manual-tests/wml/a-br-element.wml:
-        * manual-tests/wml/a-element.wml:
-        * manual-tests/wml/a-img-element.wml:
-        * manual-tests/wml/access-target.wml:
-        * manual-tests/wml/anchor-br-element.wml:
-        * manual-tests/wml/anchor-element.wml:
-        * manual-tests/wml/anchor-img-element.wml:
-        * manual-tests/wml/card-newcontext-attr.wml:
-        * manual-tests/wml/card-onenterbackward.wml:
-        * manual-tests/wml/card-onenterforward.wml:
-        * manual-tests/wml/card-ontimer.wml:
-        * manual-tests/wml/card-title-attr.wml: Removed.
-        * manual-tests/wml/deck-access-control.wml:
-        * manual-tests/wml/go-element.wml: Removed.
-        * manual-tests/wml/input-emptyok.wml: Removed.
-        * manual-tests/wml/input-format.wml:
-        * manual-tests/wml/onevent-go.wml:
-        * manual-tests/wml/onevent-noop.wml:
-        * manual-tests/wml/onevent-prev.wml:
-        * manual-tests/wml/onevent-refresh.wml:
-        * manual-tests/wml/onevent-shadow.wml:
-        * manual-tests/wml/postfield-get.wml: Removed.
-        * manual-tests/wml/postfield-post.wml: Removed.
-        * manual-tests/wml/resources: Added.
-        * manual-tests/wml/resources/smiley.png: Added.
-        * manual-tests/wml/select-element.wml:
-        * manual-tests/wml/select-onpick-event.wml:
-        * manual-tests/wml/setvar-element.wml:
-        * manual-tests/wml/targetdeck.wml:
-        * manual-tests/wml/task-go-in-anchor.wml:
-        * manual-tests/wml/task-noop-in-do.wml:
-        * manual-tests/wml/task-noop-in-onevent.wml: Removed.
-        * manual-tests/wml/task-prev-in-anchor.wml:
-        * manual-tests/wml/task-refresh-in-anchor.wml:
-        * manual-tests/wml/template-go.wml:
-        * manual-tests/wml/template-onevent.wml: Removed.
-        * manual-tests/wml/template-ontimer.wml:
-        * manual-tests/wml/timer.wml:
-        * manual-tests/wml/variable-substitution.wml:
-
-2009-07-27  Nate Chapin  <japhet@chromium.org>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Dimitri Glazkov.
+        Adds missing platform and feature guards to V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=34987
 
-        Fix a regression introduced in r42671, which caused the js event 
-        object to be hidden (some websites depend on being able to access it).
+        No new tests, build fix only.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27719
+        * bindings/v8/V8Proxy.cpp: Modified. Adds CHROMIUM guards and uses PlatformBridge in place of ChromiumBridge
+        * bindings/v8/V8Proxy.h: Modified. Adds CHROMIUM guards and uses PlatformBridge in place of ChromiumBridge
+        * bindings/v8/custom/V8DocumentCustom.cpp: Modified. Adds XPATH guards
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler): Make the event object visible to javascript, instead of hidden.
+2010-02-17  Steve Block  <steveblock@google.com>
 
-2009-07-27  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Dimitri Glazkov.
+        Include WebCore's npruntime.h for Android in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35002
 
-        Removing a no-op block of code in DatabaseTracker.cpp that
-        should've been removed in the patch for bug 26054.
+        Currently, the V8 bindings include bindings/npruntime.h, which is a
+        Chromium-specific file outside of the WebKit tree.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27666
+        No new tests, build fix only.
 
-        All tests in WebCore/storage pass.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8NPObject.h:
+        * bindings/v8/V8NPUtils.h:
+        * bindings/v8/npruntime_impl.h:
+        * bindings/v8/npruntime_priv.h:
 
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::fullPathForDatabase): Removed a no-op
-        block of code that was moved to SQLiteFileSystem.cpp and should
-        have been removed from DatabaseTracker.cpp
+2010-01-07  Philippe Normand  <pnormand@igalia.com>
 
-2009-07-27  Jian Li  <jianli@chromium.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by David Levin.
+        [GStreamer] Should handle BUFFERING messages
+        https://bugs.webkit.org/show_bug.cgi?id=30004
 
-        Fix error handling in dedicated worker and worker context.
-        https://bugs.webkit.org/show_bug.cgi?id=27525
+        Initial support for on-disk buffering of videos. This works only
+        for Quicktime and flv though.
 
-        The following problems have been fixed:
-        1) The uncaught runtime script error is not reported using the
-        WorkerGlobalScope object's onerror attribute.
-        2) If the error is still not handled afterwards (onerror attribute
-        is not defined as a function or it returns true), the error should
-        be reported back to the associated Worker object by firing an
-        ErrorEvent.
-        3) If the error is still not handled by the associated Worker
-        object, the error should be reported to the user.
+        * css/mediaControlsGtk.css:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack): Draw the
+        buffering status in the media controls.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Defer buffering
+        messages handling to processBufferingStats().
+        (WebCore::bufferingTimeoutCallback): Closure called periodically
+        during the on-disk buffering process.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): New instance
+        variables and create playbin2 here instead of doing it in load().
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate): New instance
+        variables.
+        (WebCore::MediaPlayerPrivate::load): Simply set uri on playbin2
+        instead of creating the pipeline and setting uri all together.
+        (WebCore::MediaPlayerPrivate::processBufferingStats): Start a new
+        timeout source if the player is starting on-disk buffering.
+        (WebCore::MediaPlayerPrivate::queryBufferingStats): Method called
+        200ms during on-disk buffering to update the maxTimeLoaded and few
+        other private variables.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::bytesLoaded): Fixed implementations
+        regarding buffering.
+        (WebCore::MediaPlayerPrivate::totalBytes): Improved logging.
+        (WebCore::MediaPlayerPrivate::updateStates): Start playback if it
+        was internally paused at beginning of on-disk buffering and set
+        ready/network states depending on the state of the on-disk
+        buffering process.
+        (WebCore::MediaPlayerPrivate::didEnd): Emit durationChanged.
+        (WebCore::MediaPlayerPrivate::setAutobuffer): Edit playbin2 flags
+        property depending on autoBuffer value.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Don't set uri
+        there, it is now done in load().
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h: New methods
+        and instance variables.
+
+2010-02-16  Chris Evans  <cevans@chromium.org>
 
-        Test: fast/workers/worker-script-error.html
+        Reviewed by Adam Barth.
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError): adds a function to call
-        EventListener as a function with 3 arguments to report an error.
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-        * workers/AbstractWorker.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::reportException):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::performTask):
-        * workers/WorkerMessagingProxy.h:
+        Add a new setting which gives the option of assigning every file:///
+        to its own unique domain.
 
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34778
 
-        Reviewed by George Staikos.
+        Test: Pending in forthcoming separate change due to non-trivial
+        dependencies.
 
-        [WML] History handling / page cache / loading is buggy and depends on several hacks
-        https://bugs.webkit.org/show_bug.cgi?id=27707
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext): Place file:/// URI documents
+        into their own unique domains if the new setting requires it.
+        * page/Settings.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setAllowFileAccessFromFileURLs): Simple setter.
+        * page/SecurityOrigin.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::makeUnique): Add simple ability to force an
+        origin to be considered unique.
 
-        Redesign WML history/loading handling. In detail:
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
-        - Remove FrameLoader::setForceReloadWmlDeck(). WML used to force a special loading behaviour
-          by calling this method from WMLGoElement & friends - instead teach FrameLoader to detect
-          WML content itself.
+        Reviewed by Timothy Hatcher.
 
-          WML content is usually a standalone WML document (isWMLDocument()=true) or as special case
-          an XHTML document which embeds a WML document (that's the way the WML layout tests work).
-          Force WML loading behaviour even for XHTML document which embed WML documents. This only
-          applies to our layout tests, not for any real world site. Though it gives us a perfect
-          way to test the WML loading code even when we're not operating on a standalone WML document.
+        Web Inspector: drosera/demo.js not syntax highlighted correctly.
 
-          Whenever a WMLCardElement is inserted into the document it will check wheter it's inserted
-          in a standalone WML document or wheter the main frame document is different. If it differs
-          the main frame documents' "containsWMLContent" property is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=35008
 
-          -> Make FrameLoader::shouldReload() use the new frameContainsWMLContent() method, which
-             checks if the associated frame document is a WML document or wheter it contains WML content.
+        * inspector/front-end/SourceTokenizer.js:
+        (WebInspector.SourceTokenizer.Registry):
+        (WebInspector.SourceTokenizer.Registry.prototype.getTokenizer):
 
-        - Change FrameLoader::loadItem() to use the new frameContainsWMLContent() method for 'shouldScroll'
-          detection. WML documents (or those containing WML content) always want new loads even for in-page
-          navigation. No "scroll to anchor" mechanism should apply.
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
-        - Modify FrameLoader::canCachePageContainingThisFrame() to check for !frameContainsWMLContent().
-          WML pages should never be cached, potential security problem due the use of variables (per spec).
+        Reviewed by Timothy Hatcher.
 
-        Add two new WML tests which were broken before, testing onenterforward/onenterbackward event handling
-        and history navigation (<prev/> task).
+        Web Inspector: prefer smooth scrolling to instant highlight.
 
-        Tests: wml/enter-card-with-events.html
-               wml/enter-first-card-with-events.html
+        https://bugs.webkit.org/show_bug.cgi?id=34978
 
-        * dom/Document.cpp: Initialize new 'm_containsWMLContent' property.
-        (WebCore::Document::Document):
-        * dom/Document.h: Add new helper methods and 'm_containsWMLContent" variable (explained above).
-        (WebCore::Document::setContainsWMLContent):
-        (WebCore::Document::containsWMLContent):
-        * history/BackForwardList.cpp:
-        (WebCore::BackForwardList::clearWMLPageHistory): Renamed from clearWmlPageHistory() & slight cleanup.
-        * history/BackForwardList.h:
-        * loader/FrameLoader.cpp: Rework WML loading behaviour (explained above).
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::frameContainsWMLContent):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoader.h:
-        * wml/WMLCardElement.cpp: 
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): No need anymore to manually track history length.
-        (WebCore::WMLCardElement::insertedIntoDocument): Handle setting containsWMLContent on the main frame document.
-        * wml/WMLGoElement.cpp: 
-        (WebCore::WMLGoElement::executeTask): Remove call to FrameLoader::setForceReloadWmlDeck()
-        * wml/WMLPageState.cpp: Remove 'm_historyLength' - no need anymore to track history length on our own.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::WMLPageState::dump):
-        (WebCore::WMLPageState::reset):
-        * wml/WMLPageState.h:
-
-2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype._scroll):
+        (WebInspector.TextChunk):
+        (WebInspector.TextChunk.prototype._createRow):
+        * inspector/front-end/textViewer.css:
 
-        Reviewed by Adam Roben.
+2010-02-16  Yael Aharon  <yael.aharon@nokia.com>
 
-        Fix Chromium build breakage introduced in 46388.
+        Reviewed by Nikolas Zimmermann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27705
+        SVG not rendered as background-image from data URI
+        https://bugs.webkit.org/show_bug.cgi?id=33630
 
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
-        (WebCore::FontPlatformData::description):
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        When the background image is an SVG image, and it is smaller than the area
+        it is supposed to fill, we were using renderSubTreeToImage to draw it.
+        That call was not going through all the drawing phases, and so the SVG itself
+        would not be drawn.
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Test: svg/css/background-image-svg.html
 
-        Reviewed by Simon Hausmann.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
 
-        Add some more debug logging to PluginViewMac.
+2010-02-16  Bryan Yeung  <bryeung@chromium.org>
 
-        * plugins/mac/PluginViewMac.cpp:
+        Reviewed by Nikolas Zimmermann.
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Remove the bounds on stroke width and miter for the skia platform.
+        https://bugs.webkit.org/show_bug.cgi?id=34954
 
-        Reviewed by Jan Michael Alonzo.
+        Test: svg/custom/stroke-width-large.svg
 
-        Remove dead code from the GTK NPAPI implementation.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
 
-        * plugins/gtk/PluginViewGtk.cpp:
+2010-02-16  MORITA Hajime  <morrita@gmail.com>
 
-2009-07-27  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Simon Hausmann.
+        REGRESSION: SVG text disappaears after double click
+        https://bugs.webkit.org/show_bug.cgi?id=34880
 
-        [Qt] Buildfix on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=27702
+        Tests: svg/text/selection-doubleclick.svg
+               svg/text/selection-tripleclick.svg
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedEndPaint):
-            Constraint of (*endPaint) operand modified from "g" to "m" (memory) in inline 
-            assembly, because with "g" constraint, wrong assembly code generated.
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::mayHaveSelection):
+        Use InlineTextBox::selectionStartEnd() instead of
+        RenderObject::selectionStartEnd() because latter may span multiple
+        comparing startPos and endPos is irrelevant in some cases.
+        former selectionStartEnd() is for single line and comparing
+        startPos and endPos will make sense.
 
-2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Jessie Berlin  <jberlin@webkit.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebCore bindings: Implement ScriptArray bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27691
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptArray.cpp: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::handleException):
-        (WebCore::ScriptArray::set):
-        (WebCore::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptArray.h: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::jsArray):
-        * bindings/v8/ScriptArray.cpp: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/v8/ScriptArray.h: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::~ScriptArray):
-
-2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build correct, no review.
-
-        Change in r46407 broke Apple Windows build.
-        Switch to WinCairo-only test, to avoid any
-        other platform break.
+        Inspector should display Array lengths in the property lists.
+        https://bugs.webkit.org/show_bug.cgi?id=20695
 
-        * WebCorePrefix.h: 
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        For objects of type 'array' (which includes Arrays, NodeLists, and HTMLCollections), make the length of the object available via propertyLength on the proxy object.
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        For properties that have propertyLength defined, append it to the displayed description.
 
-2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-16  Yusuke Sato  <yusukes@chromium.org>
 
-        Build correct, no review.
+        Reviewed by Dimitri Glazkov.
 
-        Change in r46407 broke Apple Windows build.
+        [Chromium] OpenType font with CFF glyphs is not handled correctly on Windows XP
+        https://bugs.webkit.org/show_bug.cgi?id=34735
 
-        * WebCorePrefix.h: Use WTF_PLATFORM_CG to decide if
-          CoreServices.h should be included.
+        Use 0xFFFF as invalidGlyph when fontData is a OpenType font with CFF glyphs.
+        
+        Test: fast/css/font-face-opentype.html
 
-2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
 
-        Build correction, no review.
+2010-02-16  Darin Adler  <darin@apple.com>
 
-        Change in r46195 broke WinCairo build.
+        * page/MediaCanStartListener.h: Fixed license.
 
-        * WebCorePrefix.h: CoreServices should be ignored
-          for non-Apple build.
+2010-02-16  Darin Adler  <darin@apple.com>
 
-2009-07-26  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Timothy Hatcher.
+        Generalize delayed plug-in start for background tabs for use for other media
+        https://bugs.webkit.org/show_bug.cgi?id=34981
 
-        Web Inspector: Implement the breakpoints sidebar pane.
-        This change adds simple UI support into the existing
-        BreakpointSidebarPane.
+        Also did some simple cleanup of HTMLMediaElement to get ready to make it
+        a client of the same mechanism.
 
-        https://bugs.webkit.org/show_bug.cgi?id=11175
+        * WebCore.base.exp: Added Page::setCanStartMedia and resorted.
+        * WebCore.xcodeproj/project.pbxproj: Added MediaCanStartListener.h.
 
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint.prototype.set enabled):
-        (WebInspector.Breakpoint.prototype.get label):
-        (WebInspector.Breakpoint.prototype.get id):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane):
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
-        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.labelClicked):
-        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.scriptOrResourceForID):
-        * inspector/front-end/inspector.css:
+        * html/HTMLAudioElement.h: Added an implementation of isVideo since that
+        is now a pure virtual function in HTMLMediaElement. Also made tagPriority
+        private.
 
-2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+        * html/HTMLMediaElement.h: Made it clearer that HTMLMediaElement is an
+        abstract base class by making its constructor protected and making the
+        isVideo function a pure virtual function.
 
-        Reviewed by Oliver Hunt.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Updated for name change from m_canStartPlugins
+        to m_canStartMedia.
+        (WebCore::Page::addMediaCanStartListener): Renamed and added an assertion.
+        (WebCore::Page::removeUnstartedMedia): Ditto.
+        (WebCore::Page::setCanStartMedia): Renamed plugin to media and moved
+        the code here from PageWin.cpp. The main change from the one in PageWin.cpp
+        is that this function calls mediaCanStart rather than explicitly calling a
+        combination of start and dispatchDidFailToStartPlugin on a PluginView.
 
-        Canvas: rotation of 'no-repeat' pattern still has small error
-        https://bugs.webkit.org/show_bug.cgi?id=26749
+        * page/Page.h: Re-sorted forward class declarations. Renamed the plugin
+        starting functions to media starting names and changed types from
+        PluginView to MediaCanStartListener.
 
-        Use 1<<22 as steps of no-repeat pattern to make the error less
-        than 0.5.  The previous value may cause 1 pixel errors.
+        * page/MediaCanStartListener.h: Added.
 
-        Add another test to show this bug clearly.
-        Also add png expected image which was missing in the previous patch.
+        * page/win/PageWin.cpp: Moved setCanStartPlugins to the platform-independent
+        Page.cpp file so it can be used for more than just Windows plug-ins.
 
-        Test: fast/canvas/image-pattern-rotate.html
+        * plugins/PluginView.cpp: Sorted includes.
+        (WebCore::PluginView::startOrAddToUnstartedList): Use addMediaCanStartListener.
+        (WebCore::PluginView::mediaCanStart): Added. Called when the page decides that
+        media can start. Contains the code that used to be in Page::setCanStartPlugins.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary): Use
+        removeMediaCanStartListener.
 
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
+        * plugins/PluginView.h: Adopted MediaCanStartListener.
 
-2009-07-25  Kwang Yul Seo  <skyul@company100.net>
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Dan Bernstein.
 
-        Windows build break due to warning C4819
-        https://bugs.webkit.org/show_bug.cgi?id=27416
+        https://bugs.webkit.org/show_bug.cgi?id=34999
+        Compositing layers inside overflow:scroll divs are not always updated on scrolling
+        
+        When RenderLayer::scrollToOffset() updates compositing layer positions, it needs
+        to start updating at its stacking context rather than just its compositing ancestor.
+        The stacking context is guaranteed to contain all descendants of the overflow
+        layer, including those that are not direct descendants of the overflow layer in stacking
+        (and therefore compositing) order.
 
-        Disable C4819 warning to fix build.
+        Test: compositing/overflow/scroll-ancestor-update.html
 
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCore.vcproj:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
 
-2009-07-25  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-16  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Kevin McCullough.
+        Reviewed by Simon Fraser.
 
-        Inspector: Keyboard Shortcuts to Switch Panels
-        https://bugs.webkit.org/show_bug.cgi?id=27286
+        Allow FloatRect::center() to return fractional coordinates. It was
+        mistakenly converting to integers.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded): save a list of the order of the panels
-        (WebInspector.documentKeyDown): handle the keyboard shortcuts to traverse the panels
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center):
 
-2009-07-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by George Staikos.
+        Reviewed by Oliver Hunt.
 
-        [Qt] Fix build break after r46369
-        https://bugs.webkit.org/show_bug.cgi?id=27680
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
 
-        * WebCore.pro:
+        Renamed cUStringImpl::size() to UStringImpl::size()UStringImpl::length()
+        (matches WebCore::StringImpl).
 
-2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaStringImpl::length):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
 
-        Reviewed by George Staikos.
+2010-02-15  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        [WML] Variable substitution is buggy
-        https://bugs.webkit.org/show_bug.cgi?id=27677
+        <rdar://problem/7288853> Message about missing plugin does not specify
+        the type or download link for download
 
-        Substitute variables upon attach() time instead of insertedIntoDocument(). Otherwhise variable substitution
-        won't work during inter-deck jumps (same URL, different fragment). Covered by new test fast/wml/newcontext-same-deck.html.
+        Reviewed by Mark Rowe.
 
-        * dom/Text.cpp:
-        (WebCore::Text::attach):
-        * dom/Text.h:
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::findPlugin):
+        Only update the mimeType out param if we find a plug-in for the file
+        extension.
 
-2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by George Staikos.
+        Build fix for Tiger.
 
-        [WML] WMLDoElement doesn't update its RenderButton object upon attach()
-        https://bugs.webkit.org/show_bug.cgi?id=27676
+        Add #if USE(ACCELERATED_COMPOSITING) around the call to mediaPlayerRenderingModeChanged().
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
 
-        WMLDoElement needs to implement attach() and call updateFromElement() on its associated RenderButton.
-        Mimics HTMLButtonElement/HTMLFormControlElement behaviour and fixes several painting/styling issues covered by existing tests in fast/wml.
+2010-02-16  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::attach):
-        * wml/WMLDoElement.h:
+        Reviewed by Eric Carlson.
 
-2009-07-25  Pavel Feldman  <pfeldman@chromium.org>
+        Buildfix for r54826.
 
-        Fix Windows build breakage introduced in 46390.
+        HTMLMediaElement class defined by HTMLMediaElement.h in #if ENABLE(VIDEO) block,
+        it should be in #if ENABLE(VIDEO) block in rendering/RenderLayerBacking.cpp too.
 
-        * WebCore.vcproj/WebCore.vcproj:
+        * rendering/RenderLayerBacking.cpp: Missing #if ENABLE(VIDEO) guard added.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
 
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-16  Julie Parent  <jparent@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Unreviewed: Chromium build fix.
 
-        Inspector: Properties Should be Sorted more Naturally
-        https://bugs.webkit.org/show_bug.cgi?id=27329
+        http://trac.webkit.org/changeset/54823 introduced an unused variable.  Remove it.
 
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update): use the displaySort when showing properties
-        (WebInspector.ObjectPropertiesSection.prototype._displaySort): alphaNumerical sort
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): use the displaySort when showing properties
-        * inspector/front-end/utilities.js:
-        (Object.sortedProperties): allow for an optional sorting function in Object.sortedProperties
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
 
-2009-07-24  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Alexey Proskuryakov.
 
-        Web Inspector: Split InspectorController into InspectorController
-        and InspectorBackend. Everything frontend needs from InspectorController
-        will slowly migrate into the InspectorBackend.
+        Bug 34974: Leak of ScheduledAction during layout tests
+        <https://bugs.webkit.org/show_bug.cgi?id=34974>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27541
+        ScheduledAction::create was returning a raw pointer which was threaded down through to an OwnPtr in DOMTimer.
+        If any of the code paths in between hit an error case and returned early the raw pointer would be leaked.  We
+        can avoid this by passing it as a PassOwnPtr.  This will ensure that the ScheduledAction is cleaned up should
+        an error case be hit.
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSInspectorBackendCustom.cpp: Added.
-        (WebCore::JSInspectorBackend::highlightDOMNode):
-        (WebCore::JSInspectorBackend::search):
-        (WebCore::JSInspectorBackend::databaseTableNames):
-        (WebCore::JSInspectorBackend::inspectedWindow):
-        (WebCore::JSInspectorBackend::setting):
-        (WebCore::JSInspectorBackend::setSetting):
-        (WebCore::JSInspectorBackend::wrapCallback):
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        (WebCore::JSInspectorBackend::profiles):
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/js/JSInspectorControllerCustom.cpp: Removed.
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/js/ScriptObject.h:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObject.h:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::inspectorBackend):
-        * inspector/InspectorBackend.cpp: Added.
-        * inspector/InspectorBackend.h: Added.
-        (WebCore::InspectorBackend::create):
-        (WebCore::InspectorBackend::inspectorController):
-        * inspector/InspectorBackend.idl: Added.
-        * inspector/InspectorController.idl: Removed.
-        * inspector/front-end/Resource.js:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-
-2009-07-25  Mike Fenton  <mike.fenton@torchmobile.com>
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout): Store the newly-created ScheduledAction in an OwnPtr and then hand it off
+        as the function argument.
+        (WebCore::JSDOMWindow::setInterval): Ditto.
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout): Ditto.
+        (WebCore::JSWorkerContext::setInterval): Ditto.
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create): Return a PassOwnPtr.
+        * bindings/js/ScheduledAction.h:
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer): Update argument type.
+        (WebCore::DOMTimer::install): Ditto.
+        * page/DOMTimer.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout): Ditto.
+        (WebCore::DOMWindow::setInterval): Ditto.
+        * page/DOMWindow.h:
 
-        Reviewed by George Staikos.
+2010-02-16  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        Update WebCore/page/Frame.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27654
+        Reviewed by David Hyatt.
 
+        SVG units don't stay consistently sized on zoom
+        https://bugs.webkit.org/show_bug.cgi?id=14004
+
+        Large step towards making WebKit an usable SVG viewer.
+
+        Make zooming into SVG documents work as expected, in both standalone and XHTML/SVG compound documents.
+        SVG applies a global scale to the document, whereas CSS zooms all individual length units (on full-page-zoom).
+        Scaling has to be avoided for all SVG specific CSS properties (already works) and for some selected CSS
+        properties shared between CSS & SVG that explicitely need a different treatment in the context of SVG.
+        To name a few: font-size, letter-spacing, etc. should stay invariant under zoom in SVG document fragments.
+
+        Some new rules regarding zooming:
+        - "Zoom text only" should never affect SVG documents, neither text nor content should zoom.
+          This option doesn't make much sense for SVG, so it's wise to avoid side-effects and disable it.
+          In compound documents the SVG would stay as-is and only text of surrounding XHTML content would zoom.
+
+        - "Full page zoom" is the only zoom mode affecting SVG. (Panning only works in standalone documents.)
+
+        Cover all mentioned cases above by a new set of layout tests.
+
+        Tests: svg/zoom/page/absolute-sized-document-no-scrollbars.svg
+               svg/zoom/page/absolute-sized-document-scrollbars.svg
+               svg/zoom/page/relative-sized-document-scrollbars.svg
+               svg/zoom/page/zoom-coords-viewattr-01-b.svg
+               svg/zoom/page/zoom-foreignObject.svg
+               svg/zoom/page/zoom-hixie-mixed-008.xml
+               svg/zoom/page/zoom-hixie-mixed-009.xml
+               svg/zoom/page/zoom-hixie-rendering-model-004.xhtml
+               svg/zoom/page/zoom-svg-float-border-padding.xml
+               svg/zoom/text/absolute-sized-document-no-scrollbars.svg
+               svg/zoom/text/absolute-sized-document-scrollbars.svg
+               svg/zoom/text/relative-sized-document-scrollbars.svg
+               svg/zoom/text/zoom-coords-viewattr-01-b.svg
+               svg/zoom/text/zoom-foreignObject.svg
+               svg/zoom/text/zoom-hixie-mixed-008.xml
+               svg/zoom/text/zoom-hixie-mixed-009.xml
+               svg/zoom/text/zoom-hixie-rendering-model-004.xhtml
+               svg/zoom/text/zoom-svg-float-border-padding.xml
+
+        * css/CSSStyleSelector.cpp: Blacklist certain properties not to be zoomed for SVG elements.
+        (WebCore::CSSStyleSelector::styleForDocument): Don't zoom font-sizes.
+        (WebCore::CSSStyleSelector::applyProperty): Ditto (+ letter/word-spacing).
+        (WebCore::CSSStyleSelector::setFontSize): Ditto.
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize): Never apply text zoom to SVG.
+        * css/CSSStyleSelector.h:
+        * css/SVGCSSStyleSelector.cpp: -webkit-shadow + SVG was incorrectly respecting zoom factor.
+        (WebCore::CSSStyleSelector::applySVGProperty):
         * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::~Frame):
-        (WebCore::Frame::setDocument):
-        (WebCore::Frame::firstRectForRange):
-        (WebCore::createRegExpForLabels):
-        (WebCore::Frame::searchForLabelsBeforeElement):
-        (WebCore::Frame::matchLabelsAgainstElement):
-        (WebCore::Frame::selectionLayoutChanged):
-        (WebCore::Frame::setZoomFactor):
-        (WebCore::Frame::reapplyStyles):
-        (WebCore::Frame::isContentEditable):
-        (WebCore::Frame::computeAndSetTypingStyle):
-        (WebCore::Frame::selectionStartStylePropertyValue):
-        (WebCore::Frame::selectionComputedStyle):
-        (WebCore::Frame::applyEditingStyleToBodyElement):
-        (WebCore::Frame::removeEditingStyleFromBodyElement):
-        (WebCore::Frame::applyEditingStyleToElement):
-        (WebCore::Frame::selectionBounds):
-        (WebCore::Frame::currentForm):
-        (WebCore::Frame::revealSelection):
-        (WebCore::Frame::styleForSelectionStart):
-        (WebCore::Frame::setSelectionFromNone):
-        (WebCore::Frame::findString):
-        (WebCore::Frame::markAllMatchesForText):
-        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
-        (WebCore::Frame::clearFormerDOMWindow):
-        (WebCore::Frame::unfocusWindow):
-        (WebCore::Frame::respondToChangedSelection):
-        (WebCore::Frame::documentAtPoint):
-        * page/Frame.h:
-        (WebCore::Frame::create):
-        (WebCore::Frame::displayStringModifiedByEncoding):
-        (WebCore::Frame::pageZoomFactor):
-        (WebCore::Frame::textZoomFactor):
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
+        (WebCore::Frame::shouldApplyTextZoom): Remove SVG special cases.
+        (WebCore::Frame::shouldApplyPageZoom): Ditto.
+        (WebCore::Frame::setZoomFactor): Don't force setZoomsTextOnly() - SVG now uses FPZ as well.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::calcReplacedWidth): CSSPropertyWidth is explicitely not scaled by CSSStyleSelector, fix that for outermost <svg> elements.
+        (WebCore::RenderSVGRoot::calcReplacedHeight): Ditto for CSSPropertyHeight.
+        (WebCore::RenderSVGRoot::layout): Simplify & cleanup code, take advantage of new calcWidth/Height functionality, no need to scale anything here.
+        (WebCore::RenderSVGRoot::paint): Use parentOriginToBorderBox() instead of duplicating code.
+        (WebCore::RenderSVGRoot::calcViewport): Simplify code.
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform): Calculate viewBoxToViewTransformation() against unscaled width()/height() values.
+        * rendering/RenderSVGRoot.h:
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport): Cleanup & document function.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::currentScale): Return pageZoomFactor(), not just the zoomFactor() - as we want to ignore text-only zoom.
+        (WebCore::SVGSVGElement::setCurrentScale): Pass isTextOnly=false to setZoomFactor().
 
-        Reviewed by Darin Adler.
+2010-02-16  Julie Parent  <jparent@chromium.org>
 
-        Add functions to print the glyph page trees for debugging
-        https://bugs.webkit.org/show_bug.cgi?id=27671
+        Unreviewed: Chromium build fix.
 
-        * platform/graphics/FontData.h: Defined a description() method.
+        https://bugs.webkit.org/show_bug.cgi?id=34998
 
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        (WebCore::GlyphPageTreeNode::showSubtree): Added. Prints the node and
-            its descendants.
-        (showGlyphPageTrees): Added. Prints all glyph page trees.
-        (showGlyphPageTree): Added. Prints the glyph page tree for a given page.
-        * platform/graphics/GlyphPageTreeNode.h:
+        Move include of JavaScriptProfile.h behind if (USE_JSC).
 
-        * platform/graphics/SegmentedFontData.cpp:
-        (WebCore::SegmentedFontData::description): Added.
+        * inspector/InspectorController.cpp:
 
-        * platform/graphics/SegmentedFontData.h:
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::description): Added. Uses the platform data
-            as the description for non-svg, non-custom fonts.
-        * platform/graphics/SimpleFontData.h:
+2010-02-16  Alexey Proskuryakov  <ap@apple.com>
 
-        * platform/graphics/gtk/FontPlatformData.h:
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        Reviewed by Geoffrey Garen and Kevin Decker.
 
-        * platform/graphics/mac/FontPlatformData.h:
-        * platform/graphics/mac/FontPlatformDataMac.mm:
-        (WebCore::FontPlatformData::description): Added. Returns the
-            description of the CGFont, the size and the synthetic style flags,
-            if set.
+        https://bugs.webkit.org/show_bug.cgi?id=34989
+        <rdar://problem/7417965> Cursor disappears on scroll bars that are over plugin content
 
-        * platform/graphics/qt/FontPlatformData.h:
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * html/HTMLPlugInElement.cpp: (WebCore::HTMLPlugInElement::defaultEventHandler): Added some
+        comments about the way we pass events down to plug-ins.
 
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataWin.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        * platform/graphics/wince/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-        * platform/graphics/wince/FontPlatformData.h:
+        Reviewed by Eric Carlson.
 
-        * platform/graphics/wx/FontPlatformData.h:
-        * platform/graphics/wx/FontPlatformDataWx.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        With hardware acceleration turned off, video frames never display if poster
+        image is specified
+        https://bugs.webkit.org/show_bug.cgi?id=34965
+        
+        HTMLVideoElement's m_shouldDisplayPosterImage was never updated after
+        the movie supplied its first video frame, so the poster would continue to show.
+        
+        Fixed by calling updatePosterImage() from mediaPlayerRepaint(), which is called
+        each time a new frame is available. updatePosterImage() is cheap.
+        
+        Also made updatePosterImage() virtual on HTMLMediaElement to avoid a number of
+        ugly casts.
 
-2009-07-24  Mads Ager  <ager@chromium.org>
+        Test: manual-tests/media-elements/video-replaces-poster.html
 
-        Reviewed by Adam Barth.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::noneSupported): Call updatePosterImage() without video check.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::setReadyState): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint): Call udpatePosterImage().
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::updatePosterImage): Make this an empty virtual
+        method on the base class.
+        * html/HTMLVideoElement.h: Override updatePosterImage().
 
-        SVG and XPath memory leaks in V8 bindings
-        https://bugs.webkit.org/show_bug.cgi?id=27488
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        Add proper 'create' methods to SVGPodTypeWrappers and
-        XPathNSResolvers in the V8 bindings to avoid memory leaks.
+        Build fix for platforms without ACCELERATED_COMPOSITING defined.
 
-        Introduce convertToV8Object methods that accept PassRefPtrs and
-        clean up the use of get() and release() on RefPtrs.
+        mediaPlayerRenderingModeChanged() is only available when ACCELERATED_COMPOSITING is defined.
         
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGPODTypeWrapperCreatorForList::create):
-        (WebCore::V8SVGPODTypeWrapperCreatorForList::V8SVGPODTypeWrapperCreatorForList):
-        (WebCore::V8SVGStaticPODTypeWrapper::create):
-        (WebCore::V8SVGStaticPODTypeWrapper::V8SVGStaticPODTypeWrapper):
-        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::create):
-        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::V8SVGStaticPODTypeWrapperWithPODTypeParent):
-        (WebCore::V8SVGStaticPODTypeWrapperWithParent::create):
-        (WebCore::V8SVGStaticPODTypeWrapperWithParent::V8SVGStaticPODTypeWrapperWithParent):
-        (WebCore::V8SVGDynamicPODTypeWrapper::create):
-        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
-        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::create):
-        * bindings/v8/custom/V8CustomXPathNSResolver.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
-        (WebCore::toV8):
-        * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
 
-2009-07-24  Brian Weinstein  <bweinstein@apple.com>
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Jon Honeycutt.
+        Reviewed by Eric Carlson.
 
-        Fix of <rdar://6310538> Middle-click panning should be springloaded while dragging
-        https://bugs.webkit.org/show_bug.cgi?id=21794
+        Autoplaying video with poster doesn't reliably show up
+        https://bugs.webkit.org/show_bug.cgi?id=34966
         
-        Create two new booleans to determine whether we have done a springloaded pan scroll, and update
-        the name of setPanScrollCursor to updatePanScrollState to more accurately describe what the function
-        does. 
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler): Initialized two new booleans.
-        (WebCore::EventHandler::autoscrollTimerFired):
-        (WebCore::EventHandler::updatePanScrollState): Renamed from setPanScrollCursor.
-        (WebCore::EventHandler::stopAutoscrollTimer): Clear the pan scrolling in progress flag.
-        (WebCore::EventHandler::handleMouseReleaseEvent): Clear the pan scrolling button pressed flag.
-        * page/EventHandler.h:
-
-2009-07-24  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27657
-        Add more wince port files to WebCore
+        A timing issue with compositing updates when replacing the poster image
+        with the video could cause the video to not display.
+        
+        Fix by making video layer hook up more similar to WebGL etc, by having the
+        video kick off a recalcStyle() via a SyntheticStyleChange. This requires
+        vending a PlaformLayer* from the media player, up through the element.
 
-        Written by Yong Li  <yong.li@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+        Test: media/video-replaces-poster.html
 
-        * loader/icon/wince/IconDatabaseWince.cpp: Added.
-        * rendering/RenderThemeWince.cpp: Added.
-        * rendering/RenderThemeWince.h: Added.
-        * storage/wince/DatabaseThreadWince.cpp: Added.
-        * storage/wince/DatabaseThreadWince.h: Added.
-        * storage/wince/LocalStorageThreadWince.cpp: Added.
-        * storage/wince/LocalStorageThreadWince.h: Added.
-        * svg/graphics/wince/SVGResourceFilterWince.cpp: Added.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingModeChanged): Use setNeedsStyleRecalc()
+        to kick off a compositing update.
 
-2009-07-24  Ryosuke Niwa  <rniwa@webkit.org>
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::platformLayer): Export the media engine's layer.
 
-        Reviewed by Justin Garcia.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        (WebCore::MediaPlayer::platformLayer):
 
-        execCommand('underline') can modify DOM outside of the contentEditable area
-        https://bugs.webkit.org/show_bug.cgi?id=24333
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingModeChanged): New client callback
+        to indicate that the rendering mode changed. The element uses this to kick off a
+        recalcStyle.
 
-        highestAncestorWithTextDecoration stops at the closest unsplittable element so that if text-decoration is applied
-        outside of it, we don't accidently modify the style attribute.
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformLayer): Method to vend the media layer.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Ditto
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer): No longer parent the layer directly
+        via setContentsToMedia().
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Tell the client that the
+        rendering mode changed.
+        (WebCore::MediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Call setContentsToMedia()
+        here.
 
-        Tests: editing/style/textdecoration-outside-of-rooteditable.html
-               editing/style/textdecoration-outside-of-unsplittable-element.html
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h: Add platformLayer().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Call mediaPlayerRenderingModeChanged()
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): Don't parent the layer ourselves any more.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init):
-        (WebCore::highestAncestorWithTextDecoration):
+        * rendering/RenderVideo.h: videoGraphicsLayer() is no longer needed.
+        * rendering/RenderVideo.cpp: Ditto.
 
-2009-07-24  Daniel Bates  <dbates@intudata.com>
+2010-02-12  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27639
-
-        Fixes false positives when evaluating certain strings that only contain 
-        non-canonical characters.
-
-        Test: http/tests/security/xssAuditor/script-tag-safe.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonCanonicalCharacter):
-        (WebCore::XSSAuditor::findInRequest):
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Changed WorkerContext destructor to not access possibly-freed WorkerThread.
-
-        Failed assertion in WorkerContext::~WorkerContext().
-        https://bugs.webkit.org/show_bug.cgi?id=27665
-
-       * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Removed assertion that relies on WorkerThread still being alive (moved to DedicatedWorkerContext destructor).
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
+        Code cleanup in ImageDecoders; no functional change.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
 
-        Reviewed by Adam Barth.
+        * Make code mostly comply with the style guide (switch indenting, use of
+          "!" vs. "== 0", don't unnecessarily wrap lines, etc.)
+        * Eliminate m_allDataReceived in ICO/BMP decoders since it's in the
+          base ImageDecoder class
+        * Remove some useless or wrong comments, add others
+        * Wrap comments at 80 columns (most already were) for
+          consistency/readability
+        * Avoid casts by using correct variable types
+        * Consistent naming of decode() function/args
+        * Shorter code in some places
+        * Make declaration and definition order match
 
-        Updated code generator to properly generate bindings for WorkerContext exposed functions.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::setSize):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::):
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::decodeHelper):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::isInfoHeaderValid):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::getAlpha):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::):
+        (WebCore::GIFImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h:
+        (GIFImageReader::~GIFImageReader):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::frameSizeAtIndex):
+        (WebCore::ICOImageDecoder::frameCount):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::compareEntries):
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::decodeDirectory):
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::):
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::skipBytes):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::error_exit):
+        (WebCore::fill_input_buffer):
+        (WebCore::term_source):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::setSize):
+        (WebCore::JPEGImageDecoder::frameBufferAtIndex):
+        (WebCore::JPEGImageDecoder::jpegComplete):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::decodingWarning):
+        (WebCore::headerAvailable):
+        (WebCore::rowAvailable):
+        (WebCore::pngComplete):
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageReader::createInterlaceBuffer):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setDecodedImage):
 
-        Storing a reference to WorkerContext.postMessage() and calling it later yields a TypeError
-        https://bugs.webkit.org/show_bug.cgi?id=27419
+2010-02-16  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Test: fast/workers/worker-call.html
+        [Qt] Unreviewed buildfix.
 
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJSDedicatedWorkerContext):
-        (WebCore::toJSWorkerContext):
-        Functions that convert from JSValue to the appropriate WorkerContext/DedicatedWorkerContext object.
-        * bindings/js/JSWorkerContextBase.h:
-        Added toJS*WorkerContext APIs.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Added code to appropriately check the passed-in this object when invoking functions at global scope.
+        * WebCore.pro: Missing backslash added.
 
-2009-07-24  Drew Wilson  <atwilson@google.com>
+2010-02-16  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Pavel Feldman.
 
-        Refactor WorkerContext to move DedicatedWorker-specific APIs into DedicatedWorkerContext
-        https://bugs.webkit.org/show_bug.cgi?id=27420
+        Move JSC-specific wrappers for Profile and ProfileNode to bindings/js.
 
-        No new tests as the existing tests already provide sufficient coverage (this is just a refactoring with no new functionality).
+        https://bugs.webkit.org/show_bug.cgi?id=34848
 
-        * DerivedSources.cpp:
-        Added JSDerivedWorkerContext.cpp
-        * DerivedSources.make:
-        Added DerivedWorkerContext files
         * GNUmakefile.am:
-        Added DerivedWorkerContext files
         * WebCore.gypi:
-        Added DerivedWorkerContext files
         * WebCore.pro:
-        Added DerivedWorkerContext files
         * WebCore.vcproj/WebCore.vcproj:
-        Added DerivedWorkerContext files
         * WebCore.xcodeproj/project.pbxproj:
-        Added DerivedWorkerContext files
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp: Added.
-        (WebCore::JSDedicatedWorkerContext::mark):
-        Custom mark function for onmessage event handler.
-        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JavaScriptProfile.cpp: Added.
+        (WebCore::profileCache):
+        (WebCore::getTitleCallback):
+        (WebCore::getHeadCallback):
+        (WebCore::getUniqueIdCallback):
+        (WebCore::focus):
+        (WebCore::exclude):
+        (WebCore::restoreAll):
+        (WebCore::finalize):
+        (WebCore::ProfileClass):
         (WebCore::toJS):
-        Supports conversion to JSDedicatedWorkerContext.
-        (WebCore::toEventTarget):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::mark):
-        Moved onmessage mark handling into DedicatedWorkerContext.
-        * bindings/js/WorkerScriptController.cpp:
-        Added appropriate casts to DedicatedWorkerContext for postMessage().
-        (WebCore::WorkerScriptController::initScript):
-        Manually sets up the prototype chain for the worker context.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Changed special case code for WorkerContext to be triggered by new IsWorkerContext attribute.
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Changed hard-coded tests for WorkerContext to support DedicatedWorkerContext.
-        * bindings/v8/DOMObjectsInclude.h:
-        Added DedicatedWorkerContext.h
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added V8DedicatedWorkerContext.cpp
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        Added code to reserve extra fields for V8DedicatedWorkerContext.
-        * bindings/v8/V8Index.cpp:
-        Now includes V8DedicatedWorkerContext.h in addition to V8WorkerContext.h
-        * bindings/v8/V8Index.h:
-        Added DedicatedWorkerContext as a non-node wrapper type.
-        Removed WORKERCONTEXT as a valid template type.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        Creates DedicatedWorkerContext instead of WorkerContext.
-        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
-        Returns DedicatedWorkerContext instead of WorkerContext.
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        Refactored to deal with DedicatedWorkerContext.
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp: Added.
-        Moved onmessage code from V8WorkerContextCustom.cpp
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        Moved onmessage code to V8DedicatedWorkerContextCustom.cpp
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toDedicatedWorkerContext):
-        * dom/EventTarget.h:
-        * workers/DedicatedWorkerContext.cpp: Added.
-        Moved DedicatedWorker-only APIs from WorkerContext.
-        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::reportException):
-        (WebCore::DedicatedWorkerContext::postMessage):
-        (WebCore::DedicatedWorkerContext::dispatchMessage):
-        * workers/DedicatedWorkerContext.h: Added.
-        Moved DedicatedWorker-only APIs from WorkerContext.
-        (WebCore::DedicatedWorkerContext::create):
-        (WebCore::DedicatedWorkerContext::toDedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::setOnmessage):
-        (WebCore::DedicatedWorkerContext::onmessage):
-        * workers/DedicatedWorkerContext.idl: Added.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Moved code that notifies parent that worker is closing down into DedicatedWorkerContext.
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isClosing):
-        Exposed closing flag as an API so derived classes can access it.
-        * workers/WorkerContext.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        Calls into DedicatedWorkerContext to handle message.
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
-        Creates a DedicatedWorkerContext when the thread starts up.
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Move more callers to using 3 argument toJS
-        https://bugs.webkit.org/show_bug.cgi?id=27661
-
-        No functional changes, thus no tests.
-        These are all the places where we can't yet pass the
-        correct globalObject because we don't have or don't know the right one.
-
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix the last of the x-frame constructor calls to have the right prototype chains
-        https://bugs.webkit.org/show_bug.cgi?id=27645
-
-        Fix the last few constructors to use their stored globalObject pointer when
-        constructing objects instead of the lexicalGlobalObject().
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::constructImage):
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::construct):
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::constructHTMLOptionElement):
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::constructWebKitPoint):
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-
-2009-07-24  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Cleanup exception handling in worker evaluation code.
-        https://bugs.webkit.org/show_bug.cgi?id=27282
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::evaluate):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::setException):
-
-2009-07-24  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by David Levin.
-
-        Reverting r46157, since it may be causing problems with Chromium
-        reliability (see http://crbug.com/17569).
-
-        https://bugs.webkit.org/show_bug.cgi?id=27388
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        REGRESSION: inspector seems broken in ToT WebKit
-        https://bugs.webkit.org/show_bug.cgi?id=27646
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Add the shadow style member to the ShadowData constructor and ==
-        operator
-
-        * rendering/style/ShadowData.cpp:
-        (WebCore::ShadowData::ShadowData):
-        (WebCore::ShadowData::operator==):
-
-2009-07-24  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] More V8 bindings changes to use ErrorEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=27630
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-07-24  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Dave Hyatt.
-
-        Clean up dependencies on Apple support libraries for non-Apple build.
-        http://bugs.webkit.org/show_bug.cgi?id=27532.
-
-        * platform/graphics/win/SimpleFontDataWin.cpp: Conditionalize references
-          to ApplicationServices.h and WebKitSystemInterface.h
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Another attempted build fix 
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Attempted build fix
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::toJS):
-
-2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Build fix for 64 bit Linux.
-
-        int64_t is long on Linux 64 bit and not long long, thus
-        getFileSize with a int64_t out value fails to build.
-
-        Use a temporary to work around the problem.
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::spaceNeeded):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Update all CREATE_DOM_*_WRAPPER callers to pass globalObject
-        https://bugs.webkit.org/show_bug.cgi?id=27644
-
-        This is another attempt at making the change for bug 27634 smaller.
-        I included the changes to make_names.pl as well as any file which
-        used CREATE_DOM_*_WRAPPER macros.
-
-        The changes to the construct* functions are what fix the cases in
-        fast/dom/constructed-objects-prototypes.html
-
-        The changes to passing globalObject through CREATE_* are what fix
-        fast/dom/prototype-inheritance-2.html
-
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSDOMBinding.h: updated macros to pass globalObject.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::setAttributeNode): use globalObject() for wrapping return value.
-        (WebCore::JSElement::setAttributeNodeNS): use globalObject() for wrapping return value.
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::JSEvent::clipboardData): pass globalObject.
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems): use globalObject() for wrapping returned collection items.
-        (WebCore::callHTMLCollection): use globalObject() for wrapping returned collection items.
-        (WebCore::JSHTMLCollection::item): use globalObject() for wrapping returned collection items.
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapper): pass globalObject.
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::constructWebKitCSSMatrix): use constructors globalObject when constructing
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest): use constructors globalObject when constructing
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::constructXSLTProcessor): use constructors globalObject when constructing
-        * dom/make_names.pl:
-            Pass globalObject through CREATE_* macros and various support functions.
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Update CodeGeneratorJS.pm to support passing JSDOMGlobalObject* to toJS calls
-        https://bugs.webkit.org/show_bug.cgi?id=27643
-
-        This is an attempt to make this change as small as possible.
-        I started by including all changes to CodeGeneratorJS.pm from bug 27634,
-        and then made the minimal amount of other changes needed to support that change.
-
-        Most toJS implementations ignore their passed JSDOMGlobalObject.
-        There are stub 2-argument toJS, toJSNewlyCreated implementations to help compiling.
-        All places where it is not clear what we should pass as the global object
-        (or where the global object is simply not available, like for some SVG bindings)
-        we pass deprecatedGlobalObjectForPrototype instead.
-
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::setDOMException): pass the wrong globalObject for now
-        * bindings/js/JSDOMBinding.h:
-            Pass the wrong global object to the CREATE_ macros for now.
-            In the next change we'll come back and pass the correct one.
-            That will require changes to make_names.pl.
-        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMObjectWithGlobalPointer::~DOMObjectWithGlobalPointer):
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::getDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        (WebCore::getDOMNodeWrapper):
-        (WebCore::toJS): added to convert 2 arg calls to 3 arg calls to limit the scope of this change.
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::toJS): DOMWindow always uses its own prototype chain.
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventTarget.h:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapper): pass globalObject to toJS(Document*) to avoid recursion
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::toJS): pass globalObject along
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        (WebCore::JSSVGMatrix::inverse): pass wrong globalObject for now.
-        (WebCore::JSSVGMatrix::rotateFromVector): pass wrong globalObject for now.
-        * bindings/js/JSSVGPathSegCustom.cpp:
+        * bindings/js/JavaScriptProfile.h: Added.
+        * bindings/js/JavaScriptProfileNode.cpp: Added.
+        (WebCore::profileNodeCache):
+        (WebCore::getFunctionName):
+        (WebCore::getURL):
+        (WebCore::getLineNumber):
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getVisible):
+        (WebCore::getCallUID):
+        (WebCore::finalize):
+        (WebCore::ProfileNodeClass):
         (WebCore::toJS):
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-            All of these methods need a globalObject, but most SVG binding don't have
-            space for one, so we just pass the lexicalGlobalObject for now.
-        (WebCore::JSSVGPathSegList::initialize):
-        (WebCore::JSSVGPathSegList::getItem):
-        (WebCore::JSSVGPathSegList::insertItemBefore):
-        (WebCore::JSSVGPathSegList::replaceItem):
-        (WebCore::JSSVGPathSegList::removeItem):
-        (WebCore::JSSVGPathSegList::appendItem):
-        * bindings/js/JSSVGPointListCustom.cpp:
-        (WebCore::finishGetter): pass wrong globalObject for now.
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        (WebCore::finishGetter): pass wrong globalObject for now.
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJS): WorkerContext always uses its own prototype chain since it's a GlobalObject subclass.
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-            All generated toJS calls now pass a globalObject.
-            All generated toJS implementations now expect a globalObject.
-            Simplified all the slot casts by using a "castedThis" local.
-            SVG bindings which don't have a globalObject() accessor pass the deprecated lexicalGlobalObject instead.
-            Simplified printing of constructor objects using a $constructorClassName variable.
-            All generated constructor functions follow the construct$className form to match the custom constructors.
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        typing "document.__proto__" in inspector throws exception
-        https://bugs.webkit.org/show_bug.cgi?id=27169
+        * bindings/js/JavaScriptProfileNode.h: Added.
+        * inspector/JavaScriptProfile.cpp: Removed.
+        * inspector/JavaScriptProfile.h: Removed.
+        * inspector/JavaScriptProfileNode.cpp: Removed.
+        * inspector/JavaScriptProfileNode.h: Removed.
 
-        * inspector/front-end/utilities.js:
-        (Object.type):
+2010-02-16  Alexander Pavlov  <apavlov@chromium.org>
 
-2009-07-24  Andrei Popescu  <andreip@google.com>
-
-        Reviewed by Anders Carlsson.
-
-        ApplicationCache should have size limit
-        https://bugs.webkit.org/show_bug.cgi?id=22700
-
-        https://lists.webkit.org/pipermail/webkit-dev/2009-May/007560.html
-
-        This change implements a mechanism for limiting the maximum size of
-        the application cache file. When this size is reached, a ChromeClient
-        callback is invoked asynchronously and the saving of the last (failed)
-        cache is retried automatically.
-        
-        This change also extends the ApplicationCacheStorage API by allowing
-        a client to query or modify the application cache without having to
-        load any resources into memory.
-
-        Test: http/tests/appcache/max-size.html
-
-        * WebCore.base.exp:
-        Exports the symbols required by the DumpRenderTree test application.
-        * loader/EmptyClients.h:
-        Adds empty implementation of the new ChromeClient methods.
-        * loader/appcache/ApplicationCache.cpp:
-        * loader/appcache/ApplicationCache.h:
-        Adds the ability to calculate the approximate size of an ApplicationCache object.
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        * loader/appcache/ApplicationCacheGroup.h:
-        Invokes the ChromeClient callback when the storage layer runs out of space.
-        After the callback is invoked, we re-attempt to store the newest cache,
-        in case the ChromeClient has freed some space.
-        * loader/appcache/ApplicationCacheResource.cpp:
-        * loader/appcache/ApplicationCacheResource.h:
-        Adds the ability to calculate the approximate size of an ApplicationCacheResource object.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        * loader/appcache/ApplicationCacheStorage.h:
-        Enforces a maximum size for the application cache file.
-        * page/ChromeClient.h:
-        Adds a new callback, invoked when the ApplicationCacheStorage reports that it has
-        reached the maximum size for its database file.
-        * platform/sql/SQLiteDatabase.cpp:
-        * platform/sql/SQLiteDatabase.h:
-        Adds a new method that allows querying for the amount of unused space inside the
-        application cache database file.
-
-2009-07-24  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Use TextEncoding facilities to convert between UTF16 and UTF8
-        instead of rolling our own solution.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (convertUniCharToUTF8):
-
-2009-07-24  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Fix confusion in g_substr between length in bytes and length in
-        characters. Was causing crashes in some situations when dealing
-        with non-ASCII text encoded as UTF8.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (g_substr):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Timothy Hatcher.
+        Web Inspector: Elements Panel: Limit the number of initially loaded element children
+        https://bugs.webkit.org/show_bug.cgi?id=34421
 
-        Inspector: Impossible to add an attribute to a node without attributes
-        https://bugs.webkit.org/show_bug.cgi?id=21108
+        Test: inspector/elements-panel-limited-children.html
 
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
         * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.createTreeElementFor):
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
         (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype.set hovered):
-        (WebInspector.ElementsTreeElement.prototype.toggleNewButton):
-        (WebInspector.ElementsTreeElement.prototype.ondblclick):
-        (WebInspector.ElementsTreeElement.prototype._startEditing):
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.set expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildCount):
+        (WebInspector.ElementsTreeElement.prototype.showChild):
+        (WebInspector.ElementsTreeElement.prototype.insertChildElement):
+        (WebInspector.ElementsTreeElement.prototype.moveChild):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.adjustCollapsedRange):
+        (WebInspector.ElementsTreeElement.prototype.handleLoadAllChildren):
+        ():
         * inspector/front-end/inspector.css:
 
-2009-07-24  Keishi Hattori  <casey.hattori@gmail.com>
+2010-02-16  Ismail Donmez  <ismail@namtrac.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        Web Inspector: Adds support for Firebug's magic $0 variable to access inspected node
-        https://bugs.webkit.org/show_bug.cgi?id=17907
+        Fix compilation with inspector disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32724
 
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI.{
-            _inspectedNodes, _addInspectedNode, $0, $1, $n}
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged): Stores the inspected node history
-            in _inspectorCommandLineAPI._inspectedNodes
-        (WebInspector.ElementsPanel):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::inspectorTimelineAgent):
 
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Dragging a resource in the sidebar should drag it's URL
-        https://bugs.webkit.org/show_bug.cgi?id=14410
+        Web Inspector: turn off line wrapping in source view.
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Double click on a resource in the sidebar should open that resource in Safari
-        https://bugs.webkit.org/show_bug.cgi?id=14409
+        https://bugs.webkit.org/show_bug.cgi?id=34935
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick): open a resource url
-
-2009-07-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        Bump pango version requirement to 1.12 and remove unnecessary #ifdefs.
-
-        * platform/graphics/gtk/FontGtk.cpp:
-        (WebCore::getDefaultPangoLayout):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        * platform/gtk/Language.cpp:
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/textViewer.css:
+        * inspector/front-end/utilities.js:
 
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Missing UIString and other localizedString.js fixes
-        https://bugs.webkit.org/show_bug.cgi?id=27288
-
-        * English.lproj/localizedStrings.js:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
+        Web Inspector: let search iterate over views in Resources
+        and keep the view in Scripts.
 
-        Inspector: Should Syntax Highlight JSON
-        https://bugs.webkit.org/show_bug.cgi?id=27503
+        https://bugs.webkit.org/show_bug.cgi?id=34968
 
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.showSourceLineForURL):
+        (WebInspector.Panel.prototype.searchIteratesOverViews):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourcesPanel.prototype.searchIteratesOverViews):
         * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._contentLoaded):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27624
-
-        * page/DragController.cpp:
-        (WebCore::DragController::~DragController):
-        (WebCore::documentFragmentFromDragData):
-        (WebCore::DragController::dragEnded):
-        (WebCore::DragController::dragEntered):
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::dragUpdated):
-        (WebCore::DragController::performDrag):
-        (WebCore::asFileInput):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::delegateDragSourceAction):
-        (WebCore::DragController::concludeEditDrag):
-        (WebCore::DragController::canProcessDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::mayStartDragAtEventLocation):
-        (WebCore::getCachedImage):
-        (WebCore::getImage):
-        (WebCore::prepareClipboardForImageDrag):
-        (WebCore::dragLocForDHTMLDrag):
-        (WebCore::DragController::startDrag):
-        (WebCore::DragController::doImageDrag):
-        (WebCore::DragController::doSystemDrag):
-        (WebCore::DragController::placeDragCaret):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/Chrome.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27608
-
-        * page/Chrome.cpp:
-        (WebCore::Chrome::runBeforeUnloadConfirmPanel):
-        (WebCore::Chrome::runJavaScriptAlert):
-        (WebCore::Chrome::runJavaScriptConfirm):
-        (WebCore::Chrome::runJavaScriptPrompt):
-        (WebCore::Chrome::shouldInterruptJavaScript):
-        (WebCore::Chrome::setToolTip):
-        (WebCore::Chrome::requestGeolocationPermissionForFrame):
-        (WebCore::ChromeClient::generateReplacementFile):
-        (WebCore::ChromeClient::paintCustomScrollbar):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/Coordinates.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27614
-
-        * page/Coordinates.cpp:
-        (WebCore::Coordinates::toString):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMSelection.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27614
-
-        * page/DOMSelection.cpp:
-        (WebCore::DOMSelection::setBaseAndExtent):
-        (WebCore::DOMSelection::modify):
-        (WebCore::DOMSelection::addRange):
-        (WebCore::DOMSelection::deleteFromDocument):
-        * page/DOMSelection.h:
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+        (WebInspector.SourceView.prototype.showingLastSearchResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.focusSearchField):
 
-        Reviewed by Eric Seidel.
+2010-02-16  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27618
+        Reviewed by Ariya Hidayat.
 
-        * page/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::~DOMTimer):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::suspend):
-        (WebCore::DOMTimer::resume):
-        (WebCore::DOMTimer::canSuspend):
-        * page/DOMTimer.h:
-        (WebCore::DOMTimer::minTimerInterval):
-        (WebCore::DOMTimer::setMinTimerInterval):
+        [Qt] canvas clipping is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=32405
 
-2009-07-24  Eric Seidel  <eric@webkit.org>
+        Apparently the bug was in GraphicsContext::roundToDevicePixels, we
+        didn't take unto accounts rotation, so the device pixels were rounded
+        incorrectly. The new formula is a 1:1 copy from GraphicsContextCG so
+        it should be rather safe
 
-        Reviewed by Adam Barth.
+        Test: http://glimr.rubyforge.org/cake/canvas.html#Polaroids now looks right
 
-        Classes call DOMObject::mark() explicitly, should call DOMObjectWithGlobal::mark() instead
-        https://bugs.webkit.org/show_bug.cgi?id=27641
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Copy the formula from
+        GraphicsContextCG
 
-        Nothing uses globalObject() yet, but this was causing crashes
-        in the patch for bug 27634.  This is covered by fast/dom/gc-6.html.
+2010-02-16  Yury Semikhatsky  <yurys@chromium.org>
 
-        I decided to change these to Base:: instead of DOMObjectWithGlobal::
-        for future-proofing.  All autogenerated classes use a typedef Base
-        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
+        Not Reviewed, build fix.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::mark):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::mark):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::mark):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::getOwnPropertySlot):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::mark):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::mark):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::mark):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::mark):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::mark):
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center): make conversion from float to int explicit so that compiler
+        doesn't complain about that.
 
-2009-07-22  Eric Seidel  <eric@webkit.org>
+2010-02-15  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Fraser.
 
-        Make most DOMObjects hold onto a JSDOMGlobalObject*
-        https://bugs.webkit.org/show_bug.cgi?id=27588
+        <rdar://problem/7645609> [webView selectionRect] API is broken for multicolumn layout
 
-        This change is almost entirely plumbing.  Only one functional
-        change as part of this all (window.document.constructor has the correct prototype)
-        Changes are detailed below.
+        Refine the fix for https://bugs.webkit.org/show_bug.cgi?id=34923 by using the center of
+        a quad’s bounding box, rather than its top left, as the reference point passed to
+        offsetFromContainer(). This ensures that if a sliver off the top of the selection rect is in
+        one column, but most of it is on another column, the single rect we return will be for the
+        second column.
 
-        inner.document.constructor is fixed because all properties on the window
-        object are created with the correct globalObject (instead of the lexical one).
-        Since all objects now carry a globalObject pointer, when document creates
-        HTMLDocumentConstructor it now has the right globalObject to use.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center): Added.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToContainerQuad): Use the center instead of the top left.
 
-        Tests:
-          fast/dom/prototype-inheritance.html
-          fast/dom/prototype-inheritance-2.html
+2010-02-15  MORITA Hajime  <morrita@gmail.com>
 
-        * bindings/js/DOMObjectWithSVGContext.h:
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-            Update the comment and add an ignored globalObject argument.
-        * bindings/js/JSDOMBinding.h:
-            Pass a globalObject to all DOMObjects during creation.  Currently it's the wrong global object.
-            Once toJS is passed a globalObject it will be the right one.
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::globalObject): Makes binding generation easier.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::history): JSHistory is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        (WebCore::JSDOMWindow::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        * bindings/js/JSHTMLCollectionCustom.cpp: Re-factoring needed to pass globalObject to JSNamedNodesCollection constructor.
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::canGetItemsForName):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp:
-             Now passed globalObject.  This is tested by inner.document.forms.testForm.
-             The passed globalObject is still wrong until toJS is fixed.
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-             Add DOMConstructorObject missed by http://trac.webkit.org/changeset/45938
-             This class is not compiled by default, so not testable.
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        * bindings/js/JSSharedWorkerConstructor.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-             Make all bindings objects carry a globalObject pointer using DOMObjectWithGlobalPointer.
-             SVG bindings which need a context() pointer do not have enough space for globalObject() too.
-             WorkerContext does not need a globalObject (it is one), so special case it.
-             Make all .constructor calls use the stored globalObject().  This is what fixes window.document.constructor.
-             Make all constructors inherit from DOMConstructorObject for consistency.  Since the auto-bound constructors
-             override createStructure anyway, there is no functional change here.  Just completing work started in r45938.
+        Reviewed by Nikolas Zimmermann.
 
-2009-07-23  Brady Eidson  <beidson@apple.com>
+        SVG text refactor: reduce paint specific callbacks on SVGTextChunkWalker
 
-        Reviewed by Geoff Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=34831
 
-        WebCore has a few places that don't gracefully handle a null request returned from willSendRequest.
-        https://bugs.webkit.org/show_bug.cgi?id=27595
+        No new tests, no change of functionality.
 
-        Test: http/tests/misc/will-send-request-returns-null-on-redirect.html
-        
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::removeResource): Null-check the request URL.
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        Removed setupBackground(), setupFill(), setupFillSelection(),
+        setupStroke(), setupStrokeSelection(), setupForeground()
+        and associated member variables.
         
-        * platform/network/cf/ResourceHandleCFNet.cpp: Ditto, and return null instead of creating an empty one.
-        (WebCore::willSendRequest):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::setupBackground):
+        renamed from chunkSetupBackgroundCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupFill):
+        renamed from chunkSetupFillCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupFillSelection):
+        renamed from chunkSetupFillSelectionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupStroke):
+        renamed from chunkSetupStrokeCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupStrokeSelection):
+        renamed from chunkSetupStrokeSelectionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupForeground):
+        renamed from chunkSetupForegroundCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::paintChunk):
+        renamed from chunkPortionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        extracted from walkTextChunks.
+        (WebCore::SVGRootInlineBox::paint):
+        follow SVGTextChunkWalker change.
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        moved paint some specific code to SVGRootInlineBoxPaintWalker::chunkPortionCallback().
+        
+2010-02-15  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix the Chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
 
-2009-07-23  Chris Fleizach  <cfleizach@apple.com>
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Darin Adler.
 
-        Bug 27633 - AXLoadComplete can be fired off to frequently
-        https://bugs.webkit.org/show_bug.cgi?id=27633
-
-        An integration issue left out some curly braces.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
 
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
+        PtrAndFlags has now been removed; remove forwarding header.
 
-2009-07-23  Darin Adler  <darin@apple.com>
+        * ForwardingHeaders/wtf/PtrAndFlags.h: Removed.
 
-        Reviewed by Brady Eidson.
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
 
-        URL appears in back/forward button menu instead of title for items with custom representation
-        https://bugs.webkit.org/show_bug.cgi?id=27586
-        rdar://problem/5060337
+        Reviewed by Geoff Garen.
 
-        * WebCore.base.exp: Exported DocumentLoader::setTitle for use by Mac WebKit.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::didChangeTitle): Tightened code to check if the document
-        loader is the correct one; previously this would never happen because we'd
-        commit the load before any title changes could be registered, but now we can
-        encounter a case where we get a title during a provisional load.
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
 
-2009-07-23  Dan Bernstein  <mitz@apple.com>
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
 
-        Reviewed by Dave Hyatt.
+2010-02-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        [CSS3 Backgrounds and Borders] Add support for inset box shadows
-        https://bugs.webkit.org/show_bug.cgi?id=27582
+        Reviewed by Xan Lopez.
 
-        Test: fast/box-shadow/inset.html
+        [GTK] Crashes when going back to a page that has data: URIs, with page cache enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34944
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForShadow): Set the ShadowValue’s shadow style to 'inset'
-            as needed.
+        Set the URL in the newly created response, when parsing data:
+        URIs.
 
-        * css/CSSParser.cpp:
-        (WebCore::ShadowParseContext::ShadowParseContext): Added style and allowStyle
-            members. Initialize the allowStyle member.
-        (WebCore::ShadowParseContext::commitValue): Pass the style value to the
-            ShadowValue constructor. Reset allowStyle.
-        (WebCore::ShadowParseContext::commitLength): Update allowStyle.
-        (WebCore::ShadowParseContext::commitColor): Ditto.
-        (WebCore::ShadowParseContext::commitStyle): Added. Sets the style member and
-            updates the state.
-        (WebCore::CSSParser::parseShadow): Parse the 'inset' keyword.
+        Test: fast/harness/page-cache-crash-on-data-urls.html
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the style value from the
-            shadow value and pass it to the ShadowData constructor.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        * css/ShadowValue.cpp:
-        (WebCore::ShadowValue::ShadowValue): Added style.
-        (WebCore::ShadowValue::cssText): Added style.
+2010-02-15  Dan Bernstein  <mitz@apple.com>
 
-        * css/ShadowValue.h:
-        (WebCore::ShadowValue::create): Added style.
+        Reviewed by Simon Fraser.
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc): Added a blend function for shadow styles. When blending
-            between normal and inset shadows, all intermediate values map to normal.
-        (WebCore::PropertyWrapperShadow::blend): Added normal style to the default
-            shadow.
-            
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintBoxShadow): Added a shadow style parameter,
-            which is passed through to RenderBoxModelObject::paintBoxShadow().
+        <rdar://problem/7647300> Incorrect client rects for blocks the span multiple columns and their descendants
+        https://bugs.webkit.org/show_bug.cgi?id=34923
 
-        (WebCore::InlineFlowBox::paintBoxDecorations): Paint inset shadows on top of
-            the background.
+        Test: fast/multicol/client-rects.html
 
-        * rendering/InlineFlowBox.h:
+        In column layout, a different transform applies to different points in
+        the block and its descendants, depending on their y coordinate within the
+        block. offsetFromContainer() used to return the offset that applied to
+        the origin. With this change, it returns the offset that applies to a
+        given reference point. When mapping a quad from local to absolute
+        coordinates, the top left of the quad’s bounding box is used as that
+        reference point.
 
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout): Pass the caret’s origin as the
+        reference point to offsetFromContainer().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForColumns): Adds the offset between the
+        given point and its image under the column paint-time transform to the
+        given offset. Used by offsetFromContainer() where it had previously used
+        adjustRectForColumns(), which takes a rect and operates less efficiently.
+        * rendering/RenderBlock.h:
         * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations): Paint inset shadows on top of the
-            background.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Added a shadow style
-            parameter, and code to paint inset shadows.
-
-        * rendering/RenderBoxModelObject.h:
-
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations): Paint inset shadows on top of
-            the background.
-
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations): Ditto.
-
+        (WebCore::RenderBox::mapLocalToContainer): Pass the transformed point as
+        the reference point to offsetFromContainer().
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint): Pass a point to
+        offsetFromContainer().
+        (WebCore::RenderBox::offsetFromContainer): Use adjustForColumns() instead
+        of adjustRectForColumns(), and use the reference point to get the right
+        adjustment for the point of interest, instead of the origin, in case this
+        box spans multiple columns.
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer): Ditto. Actually apply the
+        column offset to the computation, which previously this function didn’t
+        do.
+        (WebCore::RenderInline::mapLocalToContainer): Pass the transformed point
+        as the reference point to offsetFromContainer().
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint): Pass a point to
+        offsetFromContainer().
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::mapLocalToContainer): Apply column adjustment,
+        based on the reference point, to the transform if needed.
+        (WebCore::RenderObject::localToContainerQuad): Initialize the
+        TransformState with the top left corner of the quad’s bounding box. It
+        is later used as the reference point when deciding on which column to
+        base the calculations.
+        (WebCore::RenderObject::offsetFromContainer): Adjust for columns.
+        (WebCore::RenderObject::offsetFromAncestorContainer): Pass the origin
+        as the reference point to offsetFromContainer().
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::adjustForColumns): Added.
         * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
-
-        * rendering/style/ShadowData.h:
-        Added a ShadowStyle enum.
-        (WebCore::ShadowData::ShadowData): Add and initialize a style member.
-
-2009-07-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the build with UNUSED_PARAM(frame) for when ENABLE(3D_RENDERING) is not defined.
-
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::transform_3dMediaFeatureEval):
-
-2009-07-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        3d-transforms media query needs to look check that accelerated compositing is enabled
-        https://bugs.webkit.org/show_bug.cgi?id=27621
-        
-        When evaluating a media query with '-webkit-transform-3d', we need to check the
-        runtime switch that toggles accererated compositing, and therefore 3D.
-        
-        No test because we can't disable the pref dynamically in DRT.
-
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::transform_3dMediaFeatureEval):
-
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
+        (WebCore::RenderTableCell::offsetFromContainer): Pass the reference
+        point through.
+        * rendering/RenderTableCell.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRectsForRange): Map (the origin of) each
+        rect to absolute coordinates individually.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::convertToPaintingRect): Pass a point to
+        offsetFromContainer().
 
-        execCommand('underline') can't remove <U> underlines
-        https://bugs.webkit.org/show_bug.cgi?id=20215
+2010-02-12  Alexey Proskuryakov  <ap@apple.com>
 
-        This patch adds support for u, s, and strike to implicitlyStyledElementShouldBeRemovedWhenApplyingStyle so that
-        WebKit can remove those presentational tags when necessary.
-        It also modifies StyleChange::init not to add "text-decoration: none".  Not only is this style meaningless
-        (does not override inherited styles) but it was also causing WebKit to generate extra spans with this style.
+        Reviewed by Kevin Decker.
 
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::hasValue): True if the property contains the specified value
-        * css/CSSValueList.h: Updated prototype
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init): No longer adds "text-decoration: none"
-        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): Supports text-decoration-related elements
+        <rdar://problem/7130641> Browser objects identity is not preserved by Safari
 
-2009-07-23  Jessie Berlin  <jberlin@apple.com>
-        
-        Reviewed by Dan Bernstein.
+        Test: plugins/netscape-browser-object-identity.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=27554
-        Expose the value of text-overflow in getComputedStyle.
+        * bridge/runtime_root.h: (JSC::Bindings::RootObject::addInvalidationCallback):
+        RootObject can now call out during invalidation, making it possible for other code to know
+        when this happens.
 
-        Test: fast/css/getComputedStyle/getComputedStyle-text-overflow.html
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::InvalidationCallback::~InvalidationCallback): Empty destructor,
+        in cpp file since it's virtual.
+        (JSC::Bindings::RootObject::invalidate): Invoke invalidation callbacks.
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        Add text-overflow to the list of computedProperties.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        Return the value of the text-overflow property.
-
-2009-07-23  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        * bridge/NP_jsobject.cpp:
+        (ObjectMap): Keep a JSObject->NPObject map for each RootObject. It somewhat cleaner to
+        keep it outside RootObject, because (1) it is agnostic of what kinds of objects can wrap
+        JSObject, and (2) out of process NPAPI implementation also keeps its corresponding map
+        separately, due to supporting per-instance granularity (as opposed to per-RootObject here).
+        (jsDeallocate): Remove the corresponding map entry.
+        (_NPN_CreateScriptObject): Try to fetch existing object from the map, incrementing refcount.
 
-        Reviewed by Simon Hausmann.
+2010-02-15  Philippe Normand  <pnormand@igalia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27510
+        Rubber-stamped by Gustavo Noronha Silva.
 
-        [S60 QtWebKit] Don't put some intermediate generated files into the final mmp project
-        file for linking. This is a temporary workaround for qmake bug in Symbian port, should 
-        be reverted after qmake is fixed.
+        Removed redefine of LOG_VERBOSE. This should not have commited in
+        the first place.
 
-        * WebCore.pro:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-2009-07-23  Jian Li  <jianli@chromium.org>
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Timothy Hatcher.
 
-        [V8] Fix an assert in running workers in Chrome.
-        https://bugs.webkit.org/show_bug.cgi?id=27620
+        Web Inspector: incorrect syntax highlighting as HTML in a script tag.
+        We were preserving initial lexer state upon entering other tags while in <script>
+        but were not doing it for <script tag itself. As a result, nested script
+        tags were failing to highlight.
 
-        The fix is to change V8DOMMap::removeAllDOMObjectsInCurrentThreadHelper
-        to do not call removeObjectsFromWrapperMap for certain types of DOM
-        objects that exist only in main thread.
+        https://bugs.webkit.org/show_bug.cgi?id=34934
 
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
 
-2009-07-23  David Hyatt  <hyatt@apple.com>
+2010-02-15  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27572
-        Implement support for background-attachment:local.
+        Add a progress-indicator logging channel to WebCore, and convert the old WebKit Logging
+        messages over to WebCore-style.
 
-        Added new test fast/overflow/overflow-with-local-attachment.html.
+        No new tests. (Logging changes only)
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillAttachment):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillAttachment):
-        * css/CSSValueKeywords.in:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::attachment):
-        (WebCore::FillLayer::setAttachment):
-        (WebCore::FillLayer::hasFixedImage):
-        (WebCore::FillLayer::initialFillAttachment):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundAttachment):
-        (WebCore::InheritedFlags::maskAttachment):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-07-23  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        copyInheritableProperties and removeComputedInheritablePropertiesFrom should be deprecated
-        https://bugs.webkit.org/show_bug.cgi?id=27325
-
-        This patch deprecates copyInheritableProperties because it has been used for two different purposes:
-        1.  Calculating the typing style.
-        2.  Moving HTML subtrees and seeking to remove redundant styles.
-        These tasks should be broken out into two separate functions.  New code should not use this function.
-
-        It deletes removeComputedInheritablePropertiesFrom because it hasn't been used anywhere.
-
-        There is no test since the patch does not change any behavior.
-
-        * css/CSSComputedStyleDeclaration.cpp: removeComputedInheritablePropertiesFrom has been removed
-        (WebCore::CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties): has been renamed from copyInheritableProperties
-        * css/CSSComputedStyleDeclaration.h: ditto
-        * editing/DeleteSelectionCommand.cpp: ditto
-        (WebCore::removeEnclosingAnchorStyle): ditto
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState): ditto
-        * editing/EditCommand.cpp: ditto
-        (WebCore::EditCommand::styleAtPosition): ditto
-        * editing/RemoveFormatCommand.cpp: ditto
-        (WebCore::RemoveFormatCommand::doApply): ditto
-        * editing/ReplaceSelectionCommand.cpp: ditto
-        (WebCore::handleStyleSpansBeforeInsertion): ditto
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans): ditto
-        * editing/markup.cpp: ditto
-        (WebCore::removeEnclosingMailBlockquoteStyle): ditto
-        (WebCore::removeDefaultStyles): ditto
-        (WebCore::createMarkup): ditto
-
-2009-07-22  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Audio element at default width shouldn't have time field.
-        https://bugs.webkit.org/show_bug.cgi?id=27589
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimeDisplayElement::setVisible): Make sure we don't
-        forget to remember the visibility if there is no renderer.
-
-2009-07-23  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27598 Clean up the 
-        AccessibilityObject class
-
-        Mostly this is just moving empty stubs into the header rather than 
-        muddying the cpp file with them. A few functions were made pure 
-        virtual.
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::isARIAControl):
-        (WebCore::AccessibilityObject::clickPoint):
-        (WebCore::AccessibilityObject::documentFrameView):
-        (WebCore::AccessibilityObject::actionVerb):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::intValue):
-        (WebCore::AccessibilityObject::layoutCount):
-        (WebCore::AccessibilityObject::doAccessibilityHitTest):
-        (WebCore::AccessibilityObject::focusedUIElement):
-        (WebCore::AccessibilityObject::firstChild):
-        (WebCore::AccessibilityObject::lastChild):
-        (WebCore::AccessibilityObject::previousSibling):
-        (WebCore::AccessibilityObject::nextSibling):
-        (WebCore::AccessibilityObject::parentObjectIfExists):
-        (WebCore::AccessibilityObject::observableObject):
-        (WebCore::AccessibilityObject::linkedUIElements):
-        (WebCore::AccessibilityObject::titleUIElement):
-        (WebCore::AccessibilityObject::ariaRoleAttribute):
-        (WebCore::AccessibilityObject::isPresentationalChildOfAriaRole):
-        (WebCore::AccessibilityObject::ariaRoleHasPresentationalChildren):
-        (WebCore::AccessibilityObject::roleValue):
-        (WebCore::AccessibilityObject::ariaAccessiblityName):
-        (WebCore::AccessibilityObject::ariaLabeledByAttribute):
-        (WebCore::AccessibilityObject::ariaDescribedByAttribute):
-        (WebCore::AccessibilityObject::accessibilityDescription):
-        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
-        (WebCore::AccessibilityObject::axObjectCache):
-        (WebCore::AccessibilityObject::axObjectID):
-        (WebCore::AccessibilityObject::setAXObjectID):
-        (WebCore::AccessibilityObject::anchorElement):
-        (WebCore::AccessibilityObject::actionElement):
-        (WebCore::AccessibilityObject::boundingBoxRect):
-        (WebCore::AccessibilityObject::selectedTextRange):
-        (WebCore::AccessibilityObject::selectionStart):
-        (WebCore::AccessibilityObject::selectionEnd):
-        (WebCore::AccessibilityObject::url):
-        (WebCore::AccessibilityObject::selection):
-        (WebCore::AccessibilityObject::stringValue):
-        (WebCore::AccessibilityObject::title):
-        (WebCore::AccessibilityObject::helpText):
-        (WebCore::AccessibilityObject::textUnderElement):
-        (WebCore::AccessibilityObject::text):
-        (WebCore::AccessibilityObject::textLength):
-        (WebCore::AccessibilityObject::selectedText):
-        (WebCore::AccessibilityObject::accessKey):
-        (WebCore::AccessibilityObject::widget):
-        (WebCore::AccessibilityObject::widgetForAttachmentView):
-        (WebCore::AccessibilityObject::setFocused):
-        (WebCore::AccessibilityObject::setSelectedText):
-        (WebCore::AccessibilityObject::setSelectedTextRange):
-        (WebCore::AccessibilityObject::setValue):
-        (WebCore::AccessibilityObject::setSelected):
-        (WebCore::AccessibilityObject::makeRangeVisible):
-        (WebCore::AccessibilityObject::childrenChanged):
-        (WebCore::AccessibilityObject::addChildren):
-        (WebCore::AccessibilityObject::hasChildren):
-        (WebCore::AccessibilityObject::selectedChildren):
-        (WebCore::AccessibilityObject::visibleChildren):
-        (WebCore::AccessibilityObject::visiblePositionRange):
-        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
-        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
-        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
-        (WebCore::AccessibilityObject::visiblePositionForPoint):
-        (WebCore::AccessibilityObject::nextVisiblePosition):
-        (WebCore::AccessibilityObject::previousVisiblePosition):
-        (WebCore::AccessibilityObject::visiblePositionForIndex):
-        (WebCore::AccessibilityObject::indexForVisiblePosition):
-        (WebCore::AccessibilityObject::index):
-        (WebCore::AccessibilityObject::doAXRangeForLine):
-        (WebCore::AccessibilityObject::doAXRangeForIndex):
-        (WebCore::AccessibilityObject::doAXStringForRange):
-        (WebCore::AccessibilityObject::doAXBoundsForRange):
-        (WebCore::AccessibilityObject::updateBackingStore):
-
-2009-07-23  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Fix of <rdar://4877658> Dragging from the area between the horizontal/vertical scrollbars when status bar is showing starts a selection and autoscroll.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
-        * platform/ScrollView.h:
-
-2009-07-23  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27581
-        Drop the prefix from the box-shadow property.
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted):
+        (WebCore::ProgressTracker::progressCompleted):
+        (WebCore::ProgressTracker::finalProgressComplete):
+        (WebCore::ProgressTracker::incrementProgress):
 
-        * css/CSSComputedStyleDeclaration.cpp:
+        * platform/Logging.cpp:
         (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-07-22  Viet-Trung Luu  <viettrungluu@gmail.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27289
-        When a mouse click occurs on a scrollbar without a preceding mouse move
-        onto it, the release isn't handled correctly (since
-        EventHandler::m_lastScrollbarUnderMouse isn't set on mouse down, but
-        only on mouse move). (Side comment: That scrollbar-handling code
-        in EventHandler is ugly. It should be fixed properly.)
-
-        Tests: scrollbars/scrollbar-miss-mousemove.html
-               scrollbars/scrollbar-miss-mousemove-disabled.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
-        * page/EventHandler.h:
-
-2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/BarInfo.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27606
-
-        * page/BarInfo.cpp:
-        (WebCore::BarInfo::visible):
-
-2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/Console.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27606
-
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        (WebCore::Console::profile):
-        (WebCore::Console::time):
-
-2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
 
-        Reviewed by Holger Freyther.
+2010-02-15  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Fix crashes with the QObject bindings after garbage collection.
+        Reviewed by Simon Hausmann.
 
-        There is one QtInstance per wrapped QObject, and that QtInstance keeps
-        references to cached JSObjects for slots. When those objects get
-        deleted due to GC, then they becoming dangling pointers.
+        [Qt] QtWebkit bridge: enable passing a QWebElement to a signal/slot/property
+        https://bugs.webkit.org/show_bug.cgi?id=34901
 
-        When a cached member dies, it is now removed from the QtInstance's
-        cache.
+        When a signal/slot/property is of type QWebElement, it can seamlessly
+        connect with JS objects that hold a WebCore element.
 
-        As we cannot track the lifetime of the children, we have to remove
-        them from QtInstance alltogether. They are not cached and were
-        only used for mark(), but we _want_ them to be subject to gc.
+        New tests, see WebKit/qt/ChangeLog
 
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::~QtInstance): Minor coding style cleanup,
-        use qDeleteAll().
-        (JSC::Bindings::QtInstance::removeCachedMethod): New function, to
-        clean m_methods and m_defaultMethod.
-        (JSC::Bindings::QtInstance::mark): Avoid marking already marked objects.
-        (JSC::Bindings::QtField::valueFromInstance): Don't save children for
-        marking.
-        * bridge/qt/qt_instance.h: Declare removeCachedMethod.
         * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod): Call removeCachedMethod
-        with this on the instance.
-
-2009-07-23  Xan Lopez  <xlopez@igalia.com>
+        (JSC::Bindings::QtWebElementRuntime::create): A proxy to QWebElement
+        constructor
+        (JSC::Bindings::QtWebElementRuntime::get): A proxy to
+        QWebElement::element
+        (JSC::Bindings::convertValueToQVariant): handle QWebElement
+        (JSC::Bindings::convertQVariantToValue): handle QWebElement
 
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27599
-        'const unsigned' in return value
-
-        Remove const modifier from unsigned return value, as it does not
-        make sense.
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-        * dom/ErrorEvent.h:
-
-2009-07-22  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by David Levin.
+        Not reviewed, Chromium build fix (force conversion of property names to
+        strings in Web Inspector's injected script).
 
-        Bug 22784: Improve keyboard navigation of Select elements.
-        Home/End and PageUp/PageDn buttons do not do anything in drop down lists,
-        on non-Mac platforms.
-        https://bugs.webkit.org/show_bug.cgi?id=22784
-        http://code.google.com/p/chromium/issues/detail?id=4576
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        New test: LayoutTests/fast/forms/select-popup-pagekeys.html
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-        * dom/SelectElement.cpp:
-        (WebCore::nextValidIndex): 
-        New utility fn for traversing items of a select's list.
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-        Added code to handle Home/End and PageUp/PageDn when ARROW_KEYS_POP_MENU is false.
+        Not reviewed: touch InspectorController in order to kick win bot tests
+        with new injected script contents.
 
-2009-07-23  Xan Lopez  <xlopez@igalia.com>
+        * inspector/InspectorController.cpp:
 
-        Reviewed by Mark Rowe.
+2010-02-14  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix a couple of compiler warnings.
+        Reviewed by Timothy Hatcher.
 
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (copySurface):
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
+        Web Inspector: highlight actual search match in elements panel.
 
-2009-07-22  Simon Hausmann  <simon.hausmann@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34251
 
-        Rubber-stamped by David Levin.
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult):
+        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.ElementsPanel.prototype._highlightCurrentSearchResult):
+        (WebInspector.ElementsPanel.prototype._hideSearchHighlights):
+        * inspector/front-end/InjectedScript.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.findSearchMatches):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/textViewer.css:
+        * inspector/front-end/utilities.js:
 
-        Enable HTML5 Datagrid defines for the Qt build.
+2010-02-14  Pavel Feldman  <pfeldman@chromium.org>
 
-        * WebCore.pro:
+        Reviewed by Timothy Hatcher.
 
-2009-07-22  Adam Barth  <abarth@webkit.org>
+        Web Inspector: XPathResult objects are not expanded in console.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=34926
 
-        [V8] Make Node wrappers go fast
-        https://bugs.webkit.org/show_bug.cgi?id=27597
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/Section.js:
+        (WebInspector.Section):
+        * inspector/front-end/inspector.css:
 
-        Profiles indicate we're spending a lot of time asking whether we're on
-        the main thread when looking up DOM wrappers for Nodes, but there isn't
-        much point in doing that work because Nodes only exist on the main
-        thread.  I've also added an assert to keep us honest in this regard.
+2010-02-10  Philippe Normand  <pnormand@igalia.com>
 
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::):
-        (WebCore::getDOMNodeMap):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::getCurrentMainThread):
+        Reviewed by Gustavo Noronha Silva.
 
-2009-07-22  Adam Barth  <abarth@webkit.org>
+        [Gtk] wrong video aspect ratio
+        https://bugs.webkit.org/show_bug.cgi?id=34790
 
-        Reviewed by Alexey Proskuryakov.
+        Fixed natural size calculation regarding pixel aspect ratio and
+        display aspect ratio.
 
-        Remove unneeded virtual destructor from ScriptSourceProvider
-        https://bugs.webkit.org/show_bug.cgi?id=27563
+        Test: media/video-display-aspect-ratio.html
 
-        * bindings/js/ScriptSourceProvider.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::greatestCommonDivisor):
+        (WebCore::MediaPlayerPrivate::naturalSize):
 
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-14  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darin Adler.
 
-        execCommand('underline' / 'strikeThrough') doesn't work properly with multiple styles in text-decoration
-        https://bugs.webkit.org/show_bug.cgi?id=27476
+        HTML5 iframe sandbox bypass of window.top.location navigation via <form target="_top">
+        https://bugs.webkit.org/show_bug.cgi?id=33277
 
-        executeStrikethrough and executeUnderline were toggling between "line-through" / "underline" and "none".
-        This patch adds executeToggleStyleInList that toggles a style in CSSValueList instead of toggling the entire value.
-        It modifies CSSComputedStyleDeclaration to return CSSValueList instead of CSSPrimitiveValue for text decorations,
-        and adds removeAll member function to CSSValueList.
+        submitForm wasn't respecting shouldAllowNavigation.  Instead of calling
+        the wrapper function, we need to call shouldAllowNavigation because we
+        need to handle the "frame not found" case differently than the
+        "navigation denied" case.
 
-        Tests: editing/execCommand/toggle-text-decorations.html
-               fast/css/getComputedStyle/getComputedStyle-text-decoration.html
+        Test: http/tests/security/sandboxed-iframe-form-top.html
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::renderTextDecorationFlagsToCSSValue): Creates a CSSValueList
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Returns a CSSValueList instead of CSSValue
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Text decorations are space separated instead of comma separated
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::removeAll): Removes all values that match the specified value
-        * css/CSSValueList.h:
-        * editing/EditorCommand.cpp:
-        (WebCore::applyCommandToFrame): Apply style to a frame using specified command
-        (WebCore::executeApplyStyle): Uses applyCommandToFrame
-        (WebCore::executeToggleStyleInList): Uses applyCommandToFrame
-        (WebCore::executeToggleStyle): Toggles a style in CSSValueList
-        (WebCore::executeStrikethrough): Uses executeToggleStyleInList
-        (WebCore::executeUnderline): Uses executeToggleStyleInList
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
 
-2009-07-22  Daniel Bates  <dbates@intudata.com>
+2010-02-14  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Adam Barth.
+        No review. Touch RenderRuny*.cpp to fix Chromium/Windows build bot.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27174
-        And
-        https://bugs.webkit.org/show_bug.cgi?id=26938
-        
-        Code cleanup. Implements support for detecting attacks transformed by 
-        PHP Magic Quotes/PHP addslashes().
+        * rendering/RenderRuby.cpp: Add a comment for #endf.
+        * rendering/RenderRubyBase.cpp: Add a comment for #endf.
+        * rendering/RenderRubyRun.cpp: Add a comment for #endf.
+        * rendering/RenderRubyText.cpp: Add a comment for #endf.
 
-        Tests: http/tests/security/xssAuditor/script-tag-addslashes-backslash.html
-               http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html
-               http/tests/security/xssAuditor/script-tag-addslashes-null-char.html
-               http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html
+2010-02-13  Pavel Feldman  <pfeldman@chromium.org>
 
-        * page/XSSAuditor.cpp:
-        (WebCore::isInvalidCharacter):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::normalize): Decodes HTML entities, removes backslashes,
-        and removes control characters that could otherwise cause a discrepancy between
-        the source code of a script and the outgoing HTTP parameters.
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::decodeHTMLEntities):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
+        Reviewed by Timothy Hatcher.
 
-2009-07-22  Oliver Hunt  <oliver@apple.com>
+        Web Inspector: cache created row, span and text elements
+        in TextView to improve scroller performance on debug build.
 
-        Reviewed by Adele Peterson.
+        https://bugs.webkit.org/show_bug.cgi?id=34921
 
-        Null deref in JSObject::mark due to null xhr wrapper
-        https://bugs.webkit.org/show_bug.cgi?id=27565
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.set visible):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.freeCachedElements):
+        (WebInspector.TextViewer.prototype._buildChunks):
+        (WebInspector.TextViewer.prototype._makeLineAChunk):
+        (WebInspector.TextViewer.prototype._paintLine):
+        (WebInspector.TextViewer.prototype._releaseLines):
+        (WebInspector.TextViewer.prototype._appendSpan):
+        (WebInspector.TextViewer.prototype._appendTextNode):
+        (WebInspector.TextChunk):
+        (WebInspector.TextChunk.prototype.set expanded):
+        (WebInspector.TextChunk.prototype._lineNumberText):
+        (WebInspector.TextChunk.prototype._createRow):
+
+2010-02-13  Kent Tamura  <tkent@chromium.org>
 
-        Make event target binding for appcache and xhr behave in the same way as
-        it does for all other events.
+        Reviewed by Darin Adler.
 
-        No test as I couldn't make a testcase which was remotely reliable.
+        Refactor parsing/serialization functions in HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34852
 
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
+        - Rename formStringToDouble() to parseToDoubleForNumberType()
+        - Rename formStringToDateComponents() to parseToDateComponents()
+        - Rename formStringFromDouble() to serializeForNumberType()
+        - Add serializeForDateTimeTypes()
+          The code is moved from setValueAsDate() and setDateValue().
+        - Add serialize()
+        
+        parseToDouble() is the top-level function to parse a
+        type-dependent string and return a double
+        value. parseToDoubleForNumber() and parseToDateComponents()
+        functions are helper functions for it. serialize() is the
+        top-level function to serialize a double value to a type-dependent
+        string, and serializeForNumberType() and
+        serializeForDateTimeTypes() are helper functions for it.
 
-2009-07-22  Mads Ager  <ager@chromium.org>
+        No tests because of no functional changes.
 
-        Reviewed by David Levin.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::parseToDouble):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::serializeForDateTimeTypes):
+        (WebCore::HTMLInputElement::serialize):
+        (WebCore::HTMLInputElement::serializeForNumberType):
+        (WebCore::HTMLInputElement::parseToDoubleForNumberType):
+        (WebCore::HTMLInputElement::parseToDateComponents):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::valueFromElement):
+        (WebCore::RenderSlider::updateFromElement):
+        (WebCore::RenderSlider::setValueForPosition):
 
-        Inform V8 of the amount of WebCore string memory it is keeping alive.
-        https://bugs.webkit.org/show_bug.cgi?id=27537
+2010-01-05  Ojan Vafai  <ojan@chromium.org>
 
-        V8 uses external strings that are backed by WebCore strings. Since
-        the external strings themselves are small, V8 has no way of
-        knowing how much memory it is actually holding on to. With this
-        change, we inform V8 of the amount of WebCore string data it is
-        holding on to with external strings.
+        Reviewed by Dan Bernstein.
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        Improve text control intrinsic widths.
+        https://bugs.webkit.org/show_bug.cgi?id=25566
+        https://bugs.webkit.org/show_bug.cgi?id=25581
+        https://bugs.webkit.org/show_bug.cgi?id=25958
 
-2009-07-22  David Hyatt  <hyatt@apple.com>
+        For Mac fonts that have invalid avgCharWidth entries in the OS/2 table,
+        fallback to the Safari 4- behavior of using the width of a zero. For other
+        fonts, make Mac match Windows (and thus IE) metrics.
 
-        Reviewed by Beth Dakin.
+        Lucida Grande is hard-coded to match MS Shell Dlg for inputs and
+        Courier New for textareas in order to match Safari Win, Firefox and, in
+        some cases IE (IE uses different default fonts depending on encoding).
 
-        https://bugs.webkit.org/show_bug.cgi?id=27562
-        Add the finalized versions of background-clip and background-origin.  Remove background-clip from
-        the background shorthand and have it be auto-set based off background-origin's value.
+        The only case where we still don't match Windows is if no font-size is
+        set. The default font-size for form controls on the Mac is smaller and
+        thus text-control widths will be slightly smaller.
 
-        Three new tests added in fast/backgrounds/size
+        No new tests. Covered by existing tests.
 
-        * css/CSSComputedStyleDeclaration.cpp:
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
         (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillShorthand):
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-
-2009-07-22  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Hook up V8 bindings for DataGrid elements.
-        https://bugs.webkit.org/show_bug.cgi?id=27383
-        http://code.google.com/p/chromium/issues/detail?id=16730
-
-        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
-        to handle exceptions, check appropriate JS prototypes, and
-        test column-list's item() method as well as array-indexing.
-
-        * WebCore.gypi: Added new source files.
-        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
-        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
-        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
-        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
-        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
-        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
-        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::create):
-        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
-        (WebCore::V8DataGridDataSource::jsDataSource):
-        (WebCore::asV8DataGridDataSource):
-        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
-        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
-        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
-        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Added.
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        pushDownTextDecorationStyleAroundNode needs clean up
-        https://bugs.webkit.org/show_bug.cgi?id=27556
-
-        Cleaned up. pushDownTextDecorationStyleAroundNode traverses tree vertically from highestAncestor to targetNode
-        While traversing, it will apply the specified style to all nodes but targetNode.
-        i.e. the style is applies to all ancestor nodes and their siblings of targetNode.
+        (WebCore::RenderTextControl::hasValidAvgCharWidth):
+        (WebCore::RenderTextControl::getAvgCharWidth):
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::scaleEmToUnits):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::getAvgCharWidth):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        * rendering/RenderTextControlSingleLine.h:
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Cleaned up and added comments
-        * editing/ApplyStyleCommand.h: Updated prototype
+2010-02-11  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-07-22  Peter Kasting  <pkasting@google.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by David Kilzer.
+        [Qt] Unnecessary QBrush construction for doing a solid color stroke
+        https://bugs.webkit.org/show_bug.cgi?id=34874
 
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Handle any type of line endings in WebCore/css/*CSSPropertyNames.in.
+        Use the similar trick like in r54347, i.e. use the special brush for
+        solid color to avoid expensive QBrush constructor.
 
-        * DerivedSources.make:
-        * css/makeprop.pl:
-        * css/makevalues.pl:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
 
-2009-07-22  Paul Godavari  <paul@chromium.org>
+2010-02-11  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Jeremy Orlow.
 
-        Chromium has a build break after removal of JSRGBColor bindings
-        https://bugs.webkit.org/show_bug.cgi?id=27548
+        Pass the Document along to the ChromiumBridge cookie methods.
 
-        Fix a build break in Chromium V8 after the JSRGBColor bindings change:
-        https://bugs.webkit.org/show_bug.cgi?id=27242
+        https://bugs.webkit.org/show_bug.cgi?id=34878
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
 
-2009-07-22  Adam Langley  <agl@google.com>
+2010-02-12  Eric Seidel  <eric@webkit.org>
 
-        Reviewed by Darin Fisher.
+        No review, rolling out r54694.
+        http://trac.webkit.org/changeset/54694
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        Chromium Linux: add static functions to FontPlatformData which allow
-        for setting the global font rendering preferences.
+        This appears to have caused crashes on the Leopard bot.  See
+        bug 34898.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27513
-        http://code.google.com/p/chromium/issues/detail?id=12179
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-        This should not affect any layout tests.
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
 
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::setHinting):
-        (WebCore::FontPlatformData::setAntiAlias):
-        (WebCore::FontPlatformData::setSubpixelGlyphs):
-        (WebCore::FontPlatformData::setupPaint):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        Reviewed by Sam Weinig.
 
-2009-07-22  Mikhail Naganov  <mnaganov@chromium.org>
+        Workers' EventListeners should be removed before JSGlobalData is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=34903
 
-        Reviewed by Timothy Hatcher.
+        (Patch co-developed with Alexey Proskuryakov).
 
-        Move Inspector panels creation into a function to make possible introducing
-        custom panels.
+        Since http://trac.webkit.org/changeset/54460 the EventListeners registered by a
+        worker thread are not removed until after the thread's JSGlobalData has been
+        destroyed.  This is slightly worrisome since the JSEventListener contains
+        JSObject*s, which will be dangling once the heap is destroyed.  The
+        JSEventListeners may also reference the worker thread's normal world, which
+        again it makes no sense to keep around after the JSGlobalData is freed.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-        (WebInspector.loaded):
+        Remove all event listeners immediately prior to tearing down the JSGlobalData.
 
-2009-07-22  Pavel Feldman  <pfeldman@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34728 addressed the symptoms of this
+        problem, and it is probably cleaner to make the client data's normal world no
+        longer be a member (since it is a ref-counted object), however they should be
+        no requirement to 'detatch' – it makes no sense for anyone to be referencing
+        the world after the JSGlobalData has gone away (the world's purpose is to hold
+        wrapper objects in the JSGlobalData's heap).  Keep the restructuring that makes
+        the normal world no longer be a member, but remove the detach mechanism this
+        patch added & replace with stronger ASSERTs.
 
-        Reviewed by Timothy Hatcher.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
 
-        WebInspector: Print console command message upon evaluate
-        selection request; Handle errors in evaluation request
-        properly.
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27535
+        Reviewed by Sam Weinig.
 
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
 
-2009-07-22  Xan Lopez  <xlopez@igalia.com>
+        These break the OS X Leaks tool.  Use a bits stolen from the refCount to hold the
+        'InTable' and 'HasTerminatingNullCharacter' flags, along with the string type
+        (fixes a leak where the string data is allocated at the address (this + 1), and is
+        misinterpreted as being an internal buffer).
 
-        Attempt to fix the GTKbuild.
+        * WebCore.base.exp:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::):
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::ref):
+        (WebCore::StringImpl::deref):
+        (WebCore::StringImpl::hasOneRef):
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::bufferOwnership):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-02-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Repaint bug on Text selection in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16939
+
+        Tests: svg/overflow/overflow-on-foreignObject.svg
+               svg/text/foreignObject-text-clipping-bug.xml
+
+        Selecting text contained in <foreignObject> leads to artefacts. Same for zooming/panning.
+        RenderForeignObject contained old legacy code returning FloatRect() for repaintRectInLocalCoordinates,
+        which is obviously wrong. Fixing that leads to even more problems, as the underlying RenderBlock
+        did not reflect the x/y translation set on the <foreignObject>. This is problematic, as laying out
+        positioned objects in the XHTML subtree depends on proper size/location values of the frameRect.
+
+        Correctly clip on overflow="hidden". overflow="scroll" & friends are not yet supported, see lengthy
+        comment in RenderSVGBlock why we either need RenderLayer for RenderForeignObject or need to rework
+        overflow handling to avoid RenderLayer.
+
+        SVGForeignObjectElement uses a hacky custom solution to synchronize CSS width/height properties with
+        the SVG width/height attributes. Remove all of that code and just implement calcWidth/calcHeight in
+        RenderForeignObject, grabbing the right values from SVGForeignObjectElement::width/height upon layout.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint): Clip properly to the actual bounds of the foreignObject, respecting that x/y translation is handled by RenderBlock now.
+        (WebCore::RenderForeignObject::clippedOverflowRectForRepaint): Added missing function, forward to SVGRenderBase just like all other SVG renderers.
+        (WebCore::RenderForeignObject::computeRectForRepaint): Remove manual implementation, forward to SVGRenderBase.
+        (WebCore::RenderForeignObject::localToParentTransform): Respect x/y translation here _after_ applying localTransform().
+        (WebCore::RenderForeignObject::calcWidth): Override RenderBlock::calcWidth to grab width() from SVGForeignObjectElement.
+        (WebCore::RenderForeignObject::calcHeight): Override RenderBlock::calcHeight to grab height() from SVGForeignObjectElement.
+        (WebCore::RenderForeignObject::layout): Calculate viewport once and cache it. Push x/y location down to RenderBlock - analogous to RenderSVGText.
+        (WebCore::RenderForeignObject::nodeAtFloatPoint): Adapt to x/y translation changes (map through localTransform, not localToParentTransform). Respect overflow clipping.
+        (WebCore::RenderForeignObject::mapLocalToContainer): Set useTransforms=true, to avoid assertions when selecting text in foreign objects.
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::objectBoundingBox): Return cached m_viewport.
+        (WebCore::RenderForeignObject::strokeBoundingBox): Ditto.
+        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): Ditto.
+        * rendering/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::setStyle): Cleanup code, move setHasOverflowClip() overrides in updateBoxModelInfoFromStyle where it belongs.
+        (WebCore::RenderSVGBlock::updateBoxModelInfoFromStyle): Added to force setting setHasOverflowClip(false).
+        * rendering/RenderSVGBlock.h:
+        * svg/SVGForeignObjectElement.cpp: Kill a lot of custom code - it was just plain wrong to utilize CSS to push width/height information down to RenderBlock.
+        (WebCore::SVGForeignObjectElement::svgAttributeChanged):
 
-        * GNUmakefile.am:
+2010-02-12  Dan Bernstein  <mitz@apple.com>
 
-2009-07-21  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by Simon Fraser.
 
-        Fix the Qt build.
+        <rdar://problem/7609268> REGRESSION (r50301): Problem selecting text in a Devanagari website
+        https://bugs.webkit.org/show_bug.cgi?id=34865
 
-        * WebCore.pro: Add RGBColor.cpp to the build, remove JSRGBColor.
+        Test: fast/text/glyph-reordering.html
 
-2009-07-21  Daniel Bates  <dbates@intudata.com>
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::setIsNonMonotonic): Added. Sets m_isMonotonic
+        and populates m_glyphEndOffsets with the end offsets of each glyph’s corresponding character range.
+        (WebCore::ComplexTextController::advance): For non-monotonic runs, use endOffsetAt() to get
+        glyphs’ end offsets.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Check for monotonicity and call
+        setIsNonMonotonic() if needed.
+        * platform/graphics/mac/ComplexTextController.h:
+        (WebCore::ComplexTextController::ComplexTextRun::lastIndexAt): Added this getter.
+        (WebCore::ComplexTextController::ComplexTextRun::isMonotonic): Ditto.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_isMonotonic.
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Ditto.
 
-        Reviewed by Adam Barth.
+2010-02-12  Alexey Proskuryakov  <ap@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27494
+        Reviewed by David Levin.
 
-        Fixes an issue that can cause a crash or unexpected behavior when calling
-        WebCore::ScriptSourceCode::source on a cached script.
+        https://bugs.webkit.org/show_bug.cgi?id=34866
+        Leopard Debug Bot crashed on fast/forms/old-names.html
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/CachedScriptSourceProvider.h: Modified to inherit from 
-        WebCore::ScriptSourceCode.
-        (WebCore::CachedScriptSourceProvider::source):
-        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode): Separated out source provider and
-        rewrote to use WebCore::ScriptSourceProvider.
-        (WebCore::ScriptSourceCode::source):
-        * bindings/js/ScriptSourceProvider.h: Added.
-        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
-        (WebCore::ScriptSourceProvider::~ScriptSourceProvider):
-        * bindings/js/StringSourceProvider.h: Modified to inherit from 
-        WebCore::ScriptSourceCode.
-        (WebCore::StringSourceProvider::StringSourceProvider):
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Another attempt to fix the Windows build.
+        * html/HTMLFormCollection.cpp: (WebCore::HTMLFormCollection::formCollectionInfo): Removed
+        a misplaced checkConsistency() call. We are not looking at cache content at this point, and
+        caches will be reset on next access.
 
-        * WebCore.vcproj/WebCore.vcproj:
+2010-02-12  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-07-21  Sam Weinig  <sam@webkit.org>
+        Reviewed by Timothy Hatcher.
 
-        Attempt to fix the Windows build.
+        Web Inspector: restore highlighting animation, bring back
+        keyboard navigation, beautify search results.
 
-        * DerivedSources.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=34853
 
-2009-07-21  Sam Weinig  <sam@webkit.org>
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        * inspector/front-end/textViewer.css:
 
-        Attempt to fix the GTK build.
+2010-02-12  Anton Muhin  <antonm@chromium.org>
 
-        * GNUmakefile.am:
+        Reviewed by Adam Barth.
 
-2009-07-21  Sam Weinig  <sam@webkit.org>
+        [v8] handle to the document can only own Objects, not Values
+        https://bugs.webkit.org/show_bug.cgi?id=34854
 
-        Reviewed by Dan Bernstein.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapper):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
 
-        Autogenerate Objective-C binding implementation for RGBColor.
+2010-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        No functionality change.
+        Reviewed by Holger Freyther.
 
-        * WebCore.xcodeproj/project.pbxproj: 
-        * bindings/objc/DOMRGBColor.mm: Removed.
-        * bindings/scripts/CodeGeneratorObjC.pm: Add logic to convert from
-        WebCore::Color to NSColor*.
-        * css/RGBColor.idl:
+        Replaced stray CRLF with LF.
 
-2009-07-21  Sam Weinig  <sam@webkit.org>
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::suggestedValue):
+        * wml/WMLInputElement.h:
 
-        Reviewed by Dan Bernstein.
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27242
-        JSC bindings should use an auto-bound RGBColor class instead of hand-rolled JSRGBColor
+        Reviewed by Tor Arne Vestbø.
 
-        Move the JSC and Objective-C bindings onto using the RGBColor object instead
-        of just an unsigned int. The JSC bindings are now completely autogenerated for
-        this class. (Also removes the last lut from WebCore).
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSRGBColor.cpp: Removed.
-        * bindings/js/JSRGBColor.h: Removed.
-        * bindings/objc/DOM.mm:
-        (-[DOMRGBColor _color]):
-        * bindings/objc/DOMRGBColor.mm:
-        (-[DOMRGBColor dealloc]):
-        (-[DOMRGBColor finalize]):
-        (-[DOMRGBColor red]):
-        (-[DOMRGBColor green]):
-        (-[DOMRGBColor blue]):
-        (-[DOMRGBColor alpha]):
-        (-[DOMRGBColor color]):
-        * bindings/scripts/CodeGenerator.pm:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseColor):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::getRGBColorValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::getRGBA32Value):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
-        * css/RGBColor.cpp:
-        (WebCore::RGBColor::alpha):
-        * css/RGBColor.h:
-        (WebCore::RGBColor::color):
-        (WebCore::RGBColor::RGBColor):
-        * css/RGBColor.idl:
-        * page/DOMWindow.idl:
-        * svg/SVGColor.cpp:
-        (WebCore::SVGColor::rgbColor):
-        * svg/SVGColor.h:
-
-2009-07-21  Jian Li  <jianli@chromium.org>
 
-        Reviewed by David Levin.
-
-        Implement AbstractWorker::dispatchScriptErrorEvent by generating an ErrorEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=27515
-
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-
-2009-07-21  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Move m_context out of generator into a superclass
-        https://bugs.webkit.org/show_bug.cgi?id=27521
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Mostly this is removing code from CodeGeneratorJS
-        and instead using a DOMObjectWithSVGContext superclass in JSDOMBinding.h.
+        Reviewed by Tor Arne Vestbø.
 
-        DOMObjectWithSVGContext.h is its own file so that WebKit doesn't need to
-        know about SVGElement.h (WebKit includes JSDOMBinding.h for some reason).
+        [Qt] Ensure relative paths in generated .pri files to ensure that
+        a source package with pre-generated derived sources can be compiled.
 
-        I also removed context pointer from SVGZoomEvent since it was never used.
+        - Re-add a separate headers.pri file for WEBKIT_API_HEADERS
+        - Rename the generated headers.pri to classheaders.pri to avoid
+        confusion with the one generated by synqt since they don't have the
+        same content.
+        - Remove private headers list variable from classheaders.pri
+        - Use $$PWD in classheaders.pri
+        - Remove classheaders.pri from the installed files
 
-        * WebCore.gypi:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/DOMObjectWithSVGContext.h: Added.
-        (WebCore::DOMObjectWithSVGContext::context):
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-07-21  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        REGRESSION (r46142):  editing/execCommand/19087.html & editing/execCommand/19653-1.html fail in Windows build
-        https://bugs.webkit.org/show_bug.cgi?id=27480
-
-        Because m_anchorType : 2 is treated as a signed integer by cl.exe, anchorType() wasn't returning the correct value.
-        We made m_anchorType unsigned so that anchorType() returns the correct value.
 
-        * dom/Position.h:
-        (WebCore::Position::anchorType): statically cast to AnchorType
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Add V8 bindings for onerror in WorkerContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27518
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Fix the incorrect patch being landed for bug 27516 that has already been reviewed.
-        https://bugs.webkit.org/show_bug.cgi?id=27516
-
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::setOnerror):
-        (WebCore::WorkerContext::onerror):
-        * workers/WorkerContext.idl:
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Add onerror to WorkerContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27516
-
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::mark):
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::setOnerror):
-        (WebCore::WorkerContext::onerror):
-        * workers/WorkerContext.idl:
+        Reviewed by Tor Arne Vestbø.
 
-2009-07-21  Yong Li  <yong.li@torchmobile.com>
+        [Qt] Manually add support for the install target on Symbian.
 
-        Reviewed by George Staikos.
+        This is required to copy the headers over the ones in Qt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27509
-        Add font-related files for the WinCE port.
+        * WebCore.pro:
 
-        Written by Yong Li <yong.li@torchmobile.com>
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * platform/graphics/wince/FontCacheWince.cpp: Added.
-        * platform/graphics/wince/FontCustomPlatformData.cpp: Added.
-        * platform/graphics/wince/FontCustomPlatformData.h: Added.
-        * platform/graphics/wince/FontPlatformData.cpp: Added.
-        * platform/graphics/wince/FontPlatformData.h: Added.
-        * platform/graphics/wince/FontWince.cpp: Added.
-        * platform/graphics/wince/GlyphPageTreeNodeWince.cpp: Added.
-        * platform/graphics/wince/SimpleFontDataWince.cpp: Added.
+        Reviewed by Tor Arne Vestbø.
 
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+        [Qt] Minor fixes on QtWebKit headers generation.
 
-        Fix the Windows build, and update the comment on top now that wx uses WebCorePrefix.h too.
+        - Adds QtWebKit to the generated headers destination path
+        - Improve compatibility with MinGW
 
-        * WebCorePrefix.h:
+        * WebCore.pro:
 
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        WebCorePrefix.h build fixes for non-Mac and wx / CURL builds.
+        Reviewed by Alexey Proskuryakov.
 
-        * WebCorePrefix.h:
+        WebSocket ignores HttpOnly cookies, but should use in Handshake.
+        https://bugs.webkit.org/show_bug.cgi?id=34289
 
-2009-07-21  Eric Seidel  <eric@webkit.org>
+        Test: websocket/tests/cookies/httponly-cookie.pl
 
-        Reviewed by Adam Barth.
+        * platform/CookieJar.h: add cookieRequestHeaderFieldValue()
+        * platform/chromium/ChromiumBridge.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/android/CookieJarAndroid.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage): use cookieRequestHeaderFieldValue() instead of cookies() to include HttpOnly cookies.
 
-        All DOMConstructorObjects should hold a pointer to the JSDOMGlobalObject
-        https://bugs.webkit.org/show_bug.cgi?id=27478
+2010-02-16  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
 
-        This is just moving code.
-        I've added two new classes: DOMObjectWithGlobalPointer and DOMConstructorWithDocument.
+        Reviewed by Gustavo Noronha Silva.
 
-        DOMObjectWithGlobalPointer is a new baseclass for DOMConstructorObject.
-        (It's a baseclass because eventually all DOMObjects will have a global pointer, but
-        I'll be moving them onto DOMObjectWithGlobalPointer in stages.)
+        Notify about size changes in the WebKit GStreamer source.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34881
 
-        DOMConstructorWithDocument is a new baseclass for the 3 constructor objects
-        which require a backpointer to the Document to function.  I made this a subclass of
-        DOMConstructorObject to make clear that most constructors can hold no-such assumptions
-        about having a back-pointer to the Document (since many constructors can be used from Workers).
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.cpp:
+        (webkit_web_src_init):
+        (StreamingClient::didReceiveResponse):
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.h:
+        This makes sure that other GStreamer elements know about the
+        size and on-disk buffering actually works.
+        Only notify about size changes if gst-plugins-base before
+        0.10.27 is used, because from that version onwards this is
+        automatically handled.
+        
+        If appsrc 0.10.27 or later is used, set the min-percent property
+        to 20% to allow more time to pass between the need-data signal
+        and starvation of the pipeline.
+        
+        Also reset the size when stopping the source and send EOS
+        on seeking failures. 
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::globalObject):
-        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMObjectWithGlobalPointer::mark):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        (WebCore::DOMConstructorWithDocument::document):
-        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-
-2009-07-21  James Hawkins  <jhawkins@google.com>
+2010-02-11  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        Reviewed by David Hyatt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27453
-        Initialize isInt when creating a CSSParserValue for a function.
+        [Qt] Use clipRegion instead of clipPath to save lots of CPU cycles.
 
-        No change in behavior, so no tests.
+        https://bugs.webkit.org/show_bug.cgi?id=32375
 
-        * css/CSSFunctionValue.cpp:
-        (WebCore::CSSFunctionValue::parserValue):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
 
-2009-07-20  Jens Alfke  <snej@google.com>
- 
-         Reviewed by David Levin.
- 
-         Bug 27448: [Chromium] On Mac, arrow keys should cause Select to pop up its menu.
-         Mac build of Chromium doesn't follow Mac HI guidelines to pop up the menu when
-         an arrow key is pressed.
-         https://bugs.webkit.org/show_bug.cgi?id=27448
- 
-         No new tests; affects only control response to user input.
- 
-         * dom/SelectElement.cpp:
-         Changed definition of ARROW_KEYS_POP_MENU to make it true in Mac Chromium,
-         so it will behave compatibly with Mac HI guidelines on pop-up menus.
-         It's not possible to have PLATFORM(MAC) be true in the Mac build of Chromium.
- 
-2009-07-21  Paul Godavari  <paul@chromium.org>
+2010-02-11  Yuzo Fujishima  <yuzo@google.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Shinichiro Hamaji.
 
-        [Chromium] popup menus can crash when the selected index is -1
-        https://bugs.webkit.org/show_bug.cgi?id=27275
+        Rename underscored identifiers in WebCore/css/CSSParser.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=34877
+        Also fix whitespace erros that surface due to the above fix.
 
-        Crash reports from users indicate a crash can occur when PopupListBox::isSelectableItem
-        is passed an index of less than 0 (which is possible under certain circumstances). This
-        change prevents such a value from causing a crash by enforcing valid index values passed
-        by all callers of isSelectableItem. isSelectableItem is now a private method of
-        PopupListBox, as there are no external callers.
+        This doesn't change the code logic. Hence no new tests are required.
 
-        Also cleaned up a small amount of code for style and grammar errors.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
 
-        No automatic test is provided since we cannot send events to the child window used by
-        the popup menu.
+2010-02-11  Joseph Pecoraro  <joepeck@webkit.org>
 
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::acceptIndex):
-        (WebCore::PopupListBox::selectIndex):
-        (WebCore::PopupListBox::isSelectableItem):
-        (WebCore::PopupListBox::selectPreviousRow):
+        Reviewed by Timothy Hatcher.
 
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+        Web Inspector: Focusing a resource in the inspector should default to content not header
+        https://bugs.webkit.org/show_bug.cgi?id=34861
 
-        wx build fix. Don't include winsock2.h on wx, it conflicts with wx's inclusion of winsock.
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load): changed initial default to content tab
 
-        * platform/network/curl/ResourceHandleManager.h:
+2010-02-11  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-07-21  Adam Roben  <aroben@apple.com>
+        Reviewed by Timothy Hatcher.
 
-        Roll out r46153, r46154, and r46155
+        Web Inspector: Editing Styles Cannot Tab Backwards from a New Style Item
+        https://bugs.webkit.org/show_bug.cgi?id=34872
 
-        These changes were causing build failures and assertion failures on
-        Windows.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
-        * platform/graphics/cg/ImageBufferCG.cpp:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.update): triggers afterUpdate
+        (WebInspector.StylePropertiesSection.prototype.afterUpdate): factored out _afterUpdate handling
 
-2009-07-21  Jian Li  <jianli@chromium.org>
+2010-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
 
         Reviewed by Eric Seidel.
 
-        Implement ErrorEvent API.
-        https://bugs.webkit.org/show_bug.cgi?id=27387
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * dom/ErrorEvent.cpp: Added.
-        * dom/ErrorEvent.h: Added.
-        * dom/ErrorEvent.idl: Added.
-        * dom/Event.cpp:
-        (WebCore::Event::isErrorEvent):
-        * dom/Event.h:
-
-2009-07-21  Priit Laes  <plaes@plaes.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
-        https://bugs.webkit.org/show_bug.cgi?id=24602
+        Add roundedIntSize() convenience method converting FloatSize to IntSize, just like roundedIntPoint() converting FloatPoint to IntPoint.
 
-        Remove workaround required for <=libsoup-2.26.1
+        * platform/graphics/FloatSize.h:
+        (WebCore::roundedIntSize):
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
+2010-02-11  Kent Tamura  <tkent@chromium.org>
 
-2009-07-21  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by David Levin.
+        Fix two issues on maxLength.
+        https://bugs.webkit.org/show_bug.cgi?id=34783
 
-        V8IsolatedWorld keeps a handle to a disposed context
-        https://bugs.webkit.org/show_bug.cgi?id=27397
+        - ValidityState.tooLong behavior was inconsistent with UIs of
+        <input> and <textarea>. tooLong checked Unicode code point length
+        though the UIs checks grapheme cluster length.
 
-        Make a copy of the context handle before making it weak.  We don't want
-        to make the original handle weak because we want it to survive for the
-        length of the V8IsolatedWorld::evaluate method.
+        - Setting HTMLTextAreaElement::value didn't update the dirty flag.
 
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong): Use numGraphemeClusters() instead of length().
+        * html/HTMLTextAreaElement.cpp:
+          Rename setValue() to setNonDirtyValue(), and introduce setValue()
+          which calls setNonDirtyValue() and sets the dirty flag.
+        (WebCore::HTMLTextAreaElement::childrenChanged):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
+        (WebCore::HTMLTextAreaElement::setDefaultValue):
+        (WebCore::HTMLTextAreaElement::tooLong): Use numGraphemeClusters() instead of length().
+        * html/HTMLTextAreaElement.h:
 
-2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Alexey Proskuryakov.
 
-        Web Inspector: Add ability to evaluate selection while on break point.
+        WebSocket bufferedAmount should not be 0 when send after close.
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        https://bugs.webkit.org/show_bug.cgi?id=27502
+        Test: websocket/tests/bufferedAmount-after-close.html
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-        (WebInspector.SourceFrame.prototype._documentKeyDown):
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Alexey Proskuryakov.
 
-        WebInspector: Special case ConsolePanel opening since
-        it is a 'fast view'.
+        WebSocket in Worker failed to close
+        https://bugs.webkit.org/show_bug.cgi?id=34785
 
-        https://bugs.webkit.org/show_bug.cgi?id=27493
+        Tests: websocket/tests/workers/close-in-shared-worker.html
+               websocket/tests/workers/close-in-worker.html
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::close):
 
-2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-02-11  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Fix Qt code to follow the WebKit Coding Style.
+        [BREWMP] Add dummy Cursor
+        https://bugs.webkit.org/show_bug.cgi?id=34672
 
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::qstring):
-        (WebCore::fixSpacing):
-        * platform/graphics/qt/FontQt43.cpp:
-        (WebCore::generateComponents):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::cursorToX):
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtFillRule):
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::getWindowsContext):
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::paint):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameDurationAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::create):
-        (WebCore::MediaPlayerPrivate::bytesLoaded):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::isEmpty):
-        * platform/graphics/qt/TransformationMatrixQt.cpp:
-        (WebCore::TransformationMatrix::operator QTransform):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::ClipboardQt):
-        (WebCore::ClipboardQt::clearData):
-        (WebCore::ClipboardQt::clearAllData):
-        (WebCore::ClipboardQt::getData):
-        (WebCore::ClipboardQt::setData):
-        (WebCore::ClipboardQt::setDragImage):
-        (WebCore::getCachedImage):
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
-        (WebCore::ClipboardQt::writeURL):
-        (WebCore::ClipboardQt::writeRange):
-        (WebCore::ClipboardQt::hasData):
-        * platform/qt/ClipboardQt.h:
-        * platform/qt/ContextMenuItemQt.cpp:
-        (WebCore::ContextMenuItem::action):
-        (WebCore::ContextMenuItem::title):
-        * platform/qt/CursorQt.cpp:
-        (WebCore::westPanningCursor):
-        (WebCore::notAllowedCursor):
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::containsFiles):
-        (WebCore::DragData::asFilenames):
-        (WebCore::DragData::asPlainText):
-        (WebCore::DragData::asFragment):
-        * platform/qt/DragImageQt.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::getFileSize):
-        (WebCore::unloadModule):
-        * platform/qt/Localizations.cpp:
-        (WebCore::contextMenuItemTagShowSpellingPanel):
-        * platform/qt/MIMETypeRegistryQt.cpp:
-        (WebCore::):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::plainText):
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::fallbackStyle):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::applyTheme):
-        (WebCore::WorldMatrixTransformer::WorldMatrixTransformer):
-        (WebCore::RenderThemeQt::paintMediaBackground):
-        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScreenQt.cpp:
-        (WebCore::screenRect):
-        (WebCore::usableScreenRect):
-        * platform/qt/ScrollbarQt.cpp:
-        (WebCore::Scrollbar::contextMenu):
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::scPart):
-        (WebCore::scrollbarPart):
-        * platform/qt/ScrollbarThemeQt.h:
-        * platform/qt/SharedBufferQt.cpp:
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (PluginDatabase::defaultPluginDirectories):
-        (PluginDatabase::getPluginPathsInDirectories):
-        (PluginDatabase::isPreferredPluginDirectory):
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::userIdleTime):
-        (WebCore::prefetchDNS):
-        * platform/text/qt/StringQt.cpp:
-        (WebCore::String::String):
-        * platform/text/qt/TextBoundaries.cpp:
-        * platform/text/qt/TextBreakIteratorQt.cpp:
-        (WebCore::TextBreakIterator::following):
-        (WebCore::TextBreakIterator::preceding):
-        (WebCore::WordBreakIteratorQt::first):
-        (WebCore::WordBreakIteratorQt::next):
-        (WebCore::WordBreakIteratorQt::previous):
-        (WebCore::CharBreakIteratorQt::first):
-        (WebCore::CharBreakIteratorQt::next):
-        (WebCore::CharBreakIteratorQt::previous):
-        (WebCore::characterBreakIterator):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::userAgentStatic):
-        (WebCore::PluginView::handlePostReadFile):
-        (WebCore::PluginView::init):
-
-2009-07-21  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by David Levin.
-
-        Added a first bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26988
-
-        * platform/haiku/ClipboardHaiku.cpp: Added.
-        (WebCore::ClipboardHaiku::ClipboardHaiku):
-        (WebCore::ClipboardHaiku::clearData):
-        (WebCore::ClipboardHaiku::clearAllData):
-        (WebCore::ClipboardHaiku::getData):
-        (WebCore::ClipboardHaiku::setData):
-        (WebCore::ClipboardHaiku::types):
-        (WebCore::ClipboardHaiku::files):
-        (WebCore::ClipboardHaiku::dragLocation):
-        (WebCore::ClipboardHaiku::dragImage):
-        (WebCore::ClipboardHaiku::setDragImage):
-        (WebCore::ClipboardHaiku::dragImageElement):
-        (WebCore::ClipboardHaiku::setDragImageElement):
-        (WebCore::ClipboardHaiku::createDragImage):
-        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
-        (WebCore::ClipboardHaiku::writeURL):
-        (WebCore::ClipboardHaiku::writeRange):
-        (WebCore::ClipboardHaiku::hasData):
-        * platform/haiku/ClipboardHaiku.h: Added.
-        (WebCore::ClipboardHaiku::create):
-        (WebCore::ClipboardHaiku::~ClipboardHaiku):
-        * platform/haiku/CookieJarHaiku.cpp: Added.
-        (WebCore::setCookies):
-        (WebCore::cookies):
-        (WebCore::cookiesEnabled):
-        * platform/haiku/CursorHaiku.cpp: Added.
+        * platform/brew/CursorBrew.cpp: Added.
         (WebCore::Cursor::Cursor):
         (WebCore::Cursor::~Cursor):
         (WebCore::Cursor::operator=):
+        (WebCore::dummyCursor):
         (WebCore::pointerCursor):
-        (WebCore::moveCursor):
         (WebCore::crossCursor):
         (WebCore::handCursor):
+        (WebCore::moveCursor):
         (WebCore::iBeamCursor):
         (WebCore::waitCursor):
         (WebCore::helpCursor):
@@ -45290,5690 +21450,4010 @@ form controls that have different validity states.
         (WebCore::notAllowedCursor):
         (WebCore::zoomInCursor):
         (WebCore::zoomOutCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
         (WebCore::grabCursor):
         (WebCore::grabbingCursor):
 
-2009-07-21  Albert Astals Cid <aacid@kde.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Change #error line not to have a ' (single quote)
-
-        * DerivedSources.cpp:
-
-2009-07-21  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by David Levin.
-
-        Add ENABLE_RUBY to list of build options
-        https://bugs.webkit.org/show_bug.cgi?id=27324
-
-        Added flag ENABLE_RUBY:
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-07-21  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27467
-        Return an empty path in PlatformContextSkia::currentPathInLocalCoordinates
-        if matrix.invert() fails.  This prevents the use of an uninitialized
-        value in inverseMatrix.
-
-        No new tests added.  Run
-        LayoutTests/svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
-        under valgrind and notice there are no errors.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates):
-
-2009-07-21  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27388
-
-        Fix dotted and dashed borders on Chromium/skia.  This follows
-        the logic in the Cg path, so results are much closer to Safari now 
-        (some tests won't be exactly the same due to font layout differences).
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
+2010-02-11  Nate Chapin  <japhet@chromium.org>
 
-2009-07-20  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Make it harder to misuse try* allocation routines
-        https://bugs.webkit.org/show_bug.cgi?id=27469
-
-        Add forwarding header for PossiblyNull type, and add missing null check
-        to ImageBuffer creation.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Guard access to installedMediaEngines()[0].
-
-        https://bugs.webkit.org/show_bug.cgi?id=27479
-        http://code.google.com/p/chromium/issues/detail?id=16541
-
-        Else where in the file, installedMediaEngines is always checked for
-        being empty because access. This patch adds a case which missed that
-        check.
-
-        This triggered a crash in Chromium:
-            http://www.yakeze.com/chat/example-chromium-crash/
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::load):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Allow search entries to render with a CSS border if the RenderTheme
-        doesn't paint them.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27466
-        http://code.google.com/p/chromium/issues/detail?id=16958
-
-        <input type="search"> is very much like a text entry except that,
-        currently, if the RenderTheme doesn't deal with it, nothing is
-        rendered. With this patch, the default CSS border is rendered if the
-        RenderTheme requests it.
-
-        This will affect many layout tests, but only for Chromium Linux and
-        those results are not currently in the WebKit tree.
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paintBorderOnly):
-
-2009-07-17  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
+        Reviewed by Dimitri Glazkov.
 
-        Switch to faster methods to access internal fields.
-        https://bugs.webkit.org/show_bug.cgi?id=27372
+        [V8] Add back in a fast path for v8 object wrapping
+        when it's not possible we're in a WorkerContext (the fast
+        path is important for performance).
 
-        Minor refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=34805
 
         * bindings/scripts/CodeGeneratorV8.pm:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::instantiateV8ObjectInWorkerContext):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
         * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
 
-2009-07-20  Adam Langley  <agl@google.com>
+2010-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Dirk Schulze.
 
-        Chromium Linux: cache Harfbuzz faces.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27473
-
-        Previously, we recreated the Harfbuzz face for each script-run. With
-        this patch, we keep the Harfbuzz face in the FontPlatformData (created
-        as needed) and so they will persist for the duration of the
-        FontPlatformData.
-
-        Shouldn't affect any layout tests. Results in a significant win on the
-        intl2 page cycler time.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::setupFontForScriptRun):
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::~RefCountedHarfbuzzFace):
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::harfbuzzFace):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::create):
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::face):
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::RefCountedHarfbuzzFace):
-        * platform/graphics/chromium/HarfbuzzSkia.h: Added.
-
-2009-07-20  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Simon Fraser.
-
-        REGRESSION (r46142): Need to remove showTreeThisForThis
-        https://bugs.webkit.org/show_bug.cgi?id=27475
-
-        Removes showTreeThisForThis
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::appendParagraphIntoNode):
-
-2009-07-19  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Refactoring of indentRegion to fix bugs 26816 and 25317
-        https://bugs.webkit.org/show_bug.cgi?id=26816
-        https://bugs.webkit.org/show_bug.cgi?id=25317
-        https://bugs.webkit.org/show_bug.cgi?id=23995 (partially)
-
-        This patch implements appendParagraphIntoNode, a simpler specialized version of moveParagraph
-        and replaces all calls inside indentRegion. The following is the new behavior of indentRegion.
-
-        1. We try to indent as many wrapping nodes as possible.
-           e.g. when indenting "hello" in <div>hello</div>, we try to indent div as well.
-        2. We do not delete any wrapping elements
-           With moveParagraph, we used to remove all wrapping nodes, and replaced with a blockquote.
-           This was causing https://bugs.webkit.org/show_bug.cgi?id=23995 for indentation.
-           With appendParagraphIntoNode, we can preserve all wrapping nodes.
-        3. We only split the tree until the closest block node instead of until the root editable node.
-           This behavioral change fixes the bug 25317.
-        4. When multiple paragraphs are indented, we indent the highest common ancestor within the selection.
-           e.g. when a list is a child node of a div, and the entire div is intended,
-                we enclose the div by a single blockquote.
-
-        Note that new behavior is more consistent with that of Internet Explorer and Firefox.
-        To demonstrate this, the following tests are added.
-
-        Tests: editing/execCommand/indent-div-inside-list.html
-               editing/execCommand/indent-nested-blockquotes.html
-               editing/execCommand/indent-nested-div.html
-               editing/execCommand/indent-second-paragraph-in-blockquote.html
-
-        * editing/IndentOutdentCommand.cpp: prepareBlockquoteLevelForInsertion is removed
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): uses appendParagraphIntoNode now
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): uses appendParagraphIntoNode now
-        (WebCore::IndentOutdentCommand::appendParagraphIntoNode): removes a paragraph and appends it to a new node
-        (WebCore::IndentOutdentCommand::removeUnnecessaryLineBreakAt): removes a break element at the specified position
-        (WebCore::IndentOutdentCommand::indentRegion): exhibits the described behavior
-        * editing/IndentOutdentCommand.h: updated prototype
-
-2009-07-20  Dan Bernstein  <mitz@apple.com>
-
-        Try to fix release builds after r46136
-
-        * dom/Element.cpp:
-
-2009-07-17  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Media Controls: We are specifying the text height, where it is unneeded and the slider is 2px off.
-        https://bugs.webkit.org/show_bug.cgi?id=27380
-
-        Adjust the margin of the slider and remove useless height specification to fix alignement of the media controls.
-
-        * css/mediaControlsQT.css:
-
-2009-07-20  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27468
-        Back out r46060, which caused problems for some Apple developers.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-07-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        When loading a custom view into a frame, the old document is still
-        around
-        <rdar://problem/5145841>
-
-        Safari fires onload before PDF is loaded into the browser
-        <rdar://problem/6618869>
-
-        Test: fast/loader/non-html-load-event.html
-
-        * GNUmakefile.am: Added PlaceholderDocument.{cpp,h}
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-        * dom/Document.h:
-        (WebCore::Document::setStyleSelector): Added this protected accessor for
-            PlaceholderDocument to use.
-        * dom/Element.cpp:
-        (WebCore::Element::clientWidth): Check whether the document has a
-            renderer.
-        (WebCore::Element::clientHeight): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin): Create a PlaceholderDocument for frames
-            that do not use an HTML view. Do not nullify the content size in
-            that case.
-        (WebCore::FrameLoader::transitionToCommitted): For frames that do not
-            use an HTML view, call receivedFirstData(), which sets up the
-            frame with a new PlaceHolderDocument.
-        * loader/PlaceholderDocument.cpp: Added.
-        (WebCore::PlaceholderDocument::attach): Sets up the style selector but
-            does not create a RenderView.
-        * loader/PlaceholderDocument.h: Added.
-        (WebCore::PlaceholderDocument::create):
-        (WebCore::PlaceholderDocument::PlaceholderDocument):
-
-2009-07-20  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Handle opacity and opacity animations on transform layers in Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=27398
-
-        This makes two changes, and only for Leopard. 
-
-        First, whenever opacity is changed on a layer I propagate the 
-        change into the content layer and all the children if the layer 
-        on which opacity is set is a transform layer (preserve3D is true). 
-        The opacity set is the accumulated opacity from this layer
-        and all its direct ancestor transform layers. Second, I turn off all 
-        hardware opacity animation.
-
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::accumulatedOpacity):
-        (WebCore::GraphicsLayer::distributeOpacity):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setOpacityInternal):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setPreserves3D):
-        (WebCore::GraphicsLayerCA::setOpacity):
-        (WebCore::GraphicsLayerCA::animateFloat):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::setOpacityInternal):
-        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
-
-2009-07-20  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27349
-        Add GraphicsContext implementation for the WinCE port.
-
-        Written by Yong Li <yong.li@torchmobile.com>, George Staikos <george.staikos@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
-        with trivial style fixes by Adam Treat <adam.treat@torchmobile.com>
-
-        * platform/graphics/wince/GraphicsContextWince.cpp: Added.
+        Small cleanups in SVG render tree code.
+        Centralize calls to inflateShadow(), in SVGRenderSupport::computeRectForRepaint,
+        instead of spreading them around the subclasses. All classes should inherit
+        protected from SVGRenderBase, made it consistent.
+        
+        Doesn't affect layout tests.
 
-2009-07-20  Dumitru Daniliuc  <dumi@chromium.org>
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::layout):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::computeRectForRepaint):
+        * rendering/SVGRootInlineBox.h:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-11  David Hyatt  <hyatt@apple.com>
 
-        Adding the Win SQLite VFS implementation for Chromium, and stubs
-        for the Mac and Linux VFSs.
+        Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26940
+        https://bugs.webkit.org/show_bug.cgi?id=34857
+        Move InlineIterator and BidiRun into new files so subclasses can access them.
 
+        * GNUmakefile.am:
         * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
-
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27097
-        [Gtk] Segfault when examining an object of ROLE_TABLE via at-spi
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/BidiRun.cpp: Added.
+        (WebCore::BidiRun::destroy):
+        (WebCore::throw):
+        (WebCore::BidiRun::operator delete):
+        * rendering/BidiRun.h: Added.
+        (WebCore::BidiRun::BidiRun):
+        (WebCore::BidiRun::next):
+        * rendering/InlineIterator.h: Added.
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::atEnd):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineIterator::direction):
+        (WebCore::InlineBidiResolver::increment):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::requiresLineBox):
 
-        Check that an object is a RenderObject before trying to access its
-        renderer and related node.
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_role):
+        Reviewed by Dimitri Glazkov.
 
-2009-07-20  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+        Fixes CodeGeneratorV8.pm to include the header for the indexer type when using setCollectionIndexedGetter()
+        https://bugs.webkit.org/show_bug.cgi?id=34836
 
-        Reviewed by Simon Hausmann.
+        setCollectionIndexedGetter() uses getIndexedPropertyOfCollection(),
+        which in turn uses toV8() with the indexer type, which is declared in
+        the header for the indexer type.
 
-        [Qt] font cache reworking
-        https://bugs.webkit.org/show_bug.cgi?id=27265
+        No new tests, build fix only.
 
-        Reimplemented Qt's FontCache in a way that follows the shared one.
-        Now we can release its elements when those became inactive.
-        FontFallbackList had been changed to be able to hold WebCore fonts in its list and to be able to release a FontData what is in the cache.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        No change in behavior, so no tests.
+2010-02-11  Pavel Feldman  <pfeldman@chromium.org>
 
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
-        (WebCore::FontPlatformDataCacheKey::): Key type for the cache of FontPlatformData objects.
-        It can be constructed from a FontPlatformData or from a FontDescription. The keys have to be consistent
-        with FontPlatformData::FontPlatformData(const FontDescription&) - if we create the same
-        FontPlatformData from two FontDescription then we have to create the same key from them, and vica versa.
-        (WebCore::FontPlatformDataCacheKey::operator==):
-        (WebCore::FontPlatformDataCacheKey::hash):
-        (WebCore::FontPlatformDataCacheKey::computeHash):
-        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
-        (WebCore::FontPlatformDataCacheKeyHash::hash):
-        (WebCore::FontPlatformDataCacheKeyHash::equal):
-        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
-        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
-        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
-        (WebCore::FontCache::getCachedFontPlatformData): Get a FontDescription and returns a FontPlatformData.
-        (WebCore::FontCache::getCachedFontData): Get a FontPlatformData and returns a SimpleFontData.
-        (WebCore::FontCache::releaseFontData): Get a SimpleFontData and releases it from the cache. Also releases the appropriate FontPlatformData.
-        (WebCore::FontCache::purgeInactiveFontData): Frees inactive elements.
-        (WebCore::FontCache::invalidate): Frees all inactive elements (call purgeInactiveFontData with default argument)
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::releaseFontData):
-        (WebCore::FontFallbackList::fontDataAt):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::family): Getter. It is needed for FontPlatformDataCacheKey.
-        (WebCore::FontPlatformData::bold): Ditto.
-        (WebCore::FontPlatformData::italic): Ditto.
-        (WebCore::FontPlatformData::smallCaps): Ditto.
-        (WebCore::FontPlatformData::pixelSize): Ditto.
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::FontPlatformData): Set m_bold.
+        Reviewed by Timothy Hatcher.
 
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+        Web Inspector: split source code into chunks in order to improve text
+        viewer performance on large files.
 
-        Reviewed by Holger Freyther.
+        https://bugs.webkit.org/show_bug.cgi?id=34816
 
-        https://bugs.webkit.org/show_bug.cgi?id=26716
-        [Gtk] Each XMLHttpRequest leaks memory.
+        This change brings back SourceFrame's canvas+style magic, restores line
+        wrapping and makes things a lot like they used to be.
+        It removes TextEditor for now and renames NativeTextViewer into TextViewer.
+        TextViewer is no longer derived from TextEditor.
+        This TextViewer is still based on TextEditorModel, no iframes are involved.
 
-        Free the SoupURI we create to check the URI. Fix suggested by John
-        Kjellberg.
+        Instead of creating div per line, TextViewer splits source code into 50 line
+        chunks. Upon scroll event, visible chunks are sharded into lines and individual
+        lines are highlighted. Whenever highlighted region gets outside of the visible
+        area, highlight spans are thrown away and region is replaced with the original
+        plain text chunk.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
+        Complex stuff:
+        - Whenever there is a need to manipulate individual lines (add message bubble /
+        set breakpoint / reveal / etc.), individual chunks for such lines are created.
+        - There is also an implicit machinery that is maintaining selection when it
+        goes beyond the visible area.
+        - Search occurrences are implemented as artificial spans interweaving
+        highlighting markup.
 
-2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/NativeTextViewer.js: Removed.
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._createViewerIfNeeded):
+        (WebInspector.SourceFrame.prototype.markAndRevealRange):
+        (WebInspector.SourceFrame.prototype.clearMarkedRange):
+        (WebInspector.SourceFrame.prototype._breakpointChanged):
+        (WebInspector.SourceFrame.prototype._updateExecutionLine):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        (WebInspector.SourceFrame.prototype._keyDown):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.SourceFrame.prototype._drawProgramCounterInContext):
+        (WebInspector.SourceFrame.prototype._drawProgramCounterImageIfNeeded):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype._removeBreakpoint):
+        (WebInspector.SourceView.prototype.searchCanceled):
+        (WebInspector.SourceView.prototype._jumpToSearchResult):
+        * inspector/front-end/TextEditor.js: Removed.
+        * inspector/front-end/TextViewer.js: Added.
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.set mimeType):
+        (WebInspector.TextViewer.prototype.get textModel):
+        (WebInspector.TextViewer.prototype.revealLine):
+        (WebInspector.TextViewer.prototype.addDecoration):
+        (WebInspector.TextViewer.prototype.removeDecoration):
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        (WebInspector.TextViewer.prototype._textChanged):
+        (WebInspector.TextViewer.prototype._createChunkRow):
+        (WebInspector.TextViewer.prototype._makeLineAChunk):
+        (WebInspector.TextViewer.prototype._indexChunks):
+        (WebInspector.TextViewer.prototype._highlightChanged):
+        (WebInspector.TextViewer.prototype._scroll):
+        (WebInspector.TextViewer.prototype.setCoalescingUpdate):
+        (WebInspector.TextViewer.prototype._repaintAll):
+        (WebInspector.TextViewer.prototype._chunkForOffset):
+        (WebInspector.TextViewer.prototype._chunkNumberForLine):
+        (WebInspector.TextViewer.prototype._chunkStartLine):
+        (WebInspector.TextViewer.prototype._restoreChunks):
+        (WebInspector.TextViewer.prototype._repaint):
+        (WebInspector.TextViewer.prototype._getSelection):
+        (WebInspector.TextViewer.prototype._restoreSelection):
+        (WebInspector.TextViewer.prototype._selectionToPosition):
+        (WebInspector.TextViewer.prototype._createLineRow):
+        (WebInspector.TextViewer.prototype._paintLine):
+        (WebInspector.TextViewer.prototype._createSpan):
+        (WebInspector.TextViewer.prototype._createLink):
+        (WebInspector.TextViewer.prototype._rewriteHref):
+        (WebInspector.TextViewer.prototype._markRange):
+        (WebInspector.TextViewer.prototype._decimalDigits):
+        (WebInspector.TextViewer.prototype.resize):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css: Removed.
+        * inspector/front-end/textViewer.css: Added.
+        * inspector/front-end/utilities.js:
+        (Node.prototype.traverseNextTextNode):
+        (Node.prototype.rangeBoundaryForOffset):
 
-        Reviewed by Holger Freyther.
+2010-02-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        [Qt] On Symbian link against system sqlite3
-        https://bugs.webkit.org/show_bug.cgi?id=27368
+        Reviewed by Tor Arne Vestbø.
 
-        Add an option to force linking against system sqlite3
-        by adding system-sqlite to the CONFIG variable.
+        [Qt] ENABLE_RUBY flag was restored by r54649, but default value wasn't added for Qt port.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
-        The Symbian specific part of this patch is contributed by 
-        Norbert Leser.
+        * WebCore.pri: Add ENABLE_RUBY=1 as default setting.
 
-        * WebCore.pro:
+2010-02-11  Steve Block  <steveblock@google.com>
 
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Gustavo Noronha.
+        Updates Android V8 Makefile to generate Notifications and WebSockets headers required by V8DOMWrapper.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34815
 
-        Change the glib version check to check for the first unstable
-        release with g_mapped_file_unref. Otherwise this would be useless
-        until 2.22 is released, a few months from now.
+        No new tests, build fix only.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::startHttp):
+        * Android.derived.v8bindings.mk:
 
-2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        Reviewed by and done with Tor Arne Vestbø.
+        Reviewed by Jeremy Orlow.
 
-        Fix fast/css/pseudo-required-optional-*.html in the Qt build
-        after r46062.
+        Updates Android V8 Makefile to generate XPath header required by V8Proxy.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34814
 
-        These tests triggered a bug in RenderThemeQt where we did not fall back
-        to the unstyled painting of text areas and input fields when they have
-        a styled background.
+        No new tests, build fix only.
 
-        Our re-implementation of isControlStyled incorrectly only checked the
-        border for determining whether to style or not. The base-implementation
-        performs the same check, but also includes the background. Removing
-        our implementation fixes the appearance.
+        * Android.derived.v8bindings.mk:
 
-        * platform/qt/RenderThemeQt.cpp: Removed isControlStyled reimplementation.
-        * platform/qt/RenderThemeQt.h: Ditto.
+2010-02-11  Steve Block  <steveblock@google.com>
 
-2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by Nate Chapin.
 
-        Rubber-stamped by Tor Arne Vestbø.
+        Update Android V8 Makefile to generate Inspector headers required by V8 ScriptObject.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34806
 
-        Add missing (sorted) header files to the HEADERS variable in the qmake
-        .pro file for improved completion in IDEs.
+        No new tests, build fix only.
 
-        * WebCore.pro:
+        * Android.derived.v8bindings.mk:
 
-2009-07-19  Adam Barth  <abarth@webkit.org>
+2010-02-11  Steve Block  <steveblock@google.com>
 
         Reviewed by David Levin.
 
-        [V8] Factor V8ConsoleMessage out of V8Proxy
-        https://bugs.webkit.org/show_bug.cgi?id=27421
+        Guards SVG code in V8 bindings with ENABLE(SVG)
+        https://bugs.webkit.org/show_bug.cgi?id=34812
 
-        No behavior change.
+        Also updates Android V8 Makefile to generate required SVG headers.
 
-        * WebCore.gypi:
-        * bindings/v8/V8ConsoleMessage.cpp: Added.
-        (WebCore::V8ConsoleMessage::V8ConsoleMessage):
-        (WebCore::V8ConsoleMessage::dispatchNow):
-        (WebCore::V8ConsoleMessage::dispatchLater):
-        (WebCore::V8ConsoleMessage::processDelayed):
-        (WebCore::V8ConsoleMessage::handler):
-        * bindings/v8/V8ConsoleMessage.h: Added.
-        (WebCore::V8ConsoleMessage::Scope::Scope):
-        (WebCore::V8ConsoleMessage::Scope::~Scope):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::logInfo):
-        (WebCore::reportUnsafeAccessTo):
-        (WebCore::V8Proxy::runScript):
-        (WebCore::V8Proxy::callFunction):
-        (WebCore::V8Proxy::newInstance):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::processConsoleMessages):
+        No new tests, build fix only.
 
-2009-07-19  Rob Buis  <rwlbuis@gmail.com>
+        * Android.derived.v8bindings.mk:
+        * bindings/v8/custom/V8CSSValueCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::toV8):
 
-        Reviewed by Adam Barth.
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
 
-        Remove unused member variable.
+        Reviewed by Cameron Zwarich.
 
-        * svg/SVGPolyElement.h:
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
-2009-07-19  Eric Carlson  <eric.carlson@apple.com>
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * html/HTMLTagNames.in: Make the ruby-related tag names conditional.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): ifdef the code that would create ruby elements.
+        * rendering/RenderObject.h: ditto above
+        * rendering/RenderRuby.cpp: ifdef this whole file
+        * rendering/RenderRuby.h: ditto
+        * rendering/RenderRubyBase.cpp: ditto
+        * rendering/RenderRubyBase.h: ditto
+        * rendering/RenderRubyRun.cpp: ditto
+        * rendering/RenderRubyRun.h: ditto
+        * rendering/RenderRubyText.cpp: ditto
+        * rendering/RenderRubyText.h: ditto
+
+2010-02-11  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Darin Adler.
 
-        HTMLAudioElement: constructor should set "autobuffer" attribute
-        https://bugs.webkit.org/show_bug.cgi?id=27422
+        Step attribute support for date&time types.
+        https://bugs.webkit.org/show_bug.cgi?id=30847
 
-        Test: media/audio-constructor-autobuffer.html
+        - Add implementation for ValidityState.stepMismatch, stepUp() and
+          stepDown() for date, datetime, datetime-local, month, time, week types.
+        - Fix string representation of DateComponents.
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-            Set 'autobuffer' attribute.
+        Tests: fast/forms/ValidityState-stepMismatch.html
+               fast/forms/input-stepup-stepdown.html
 
-2009-07-19  Thierry Bastian <thierry.bastian@nokia.com>
+        * html/HTMLInputElement.cpp:
+          - Change monthDefaultMaximum so that DateComponents::m_year doesn't overflow.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::applyStep):
+          Renamed from applyStepForNumberOrRange(), and add support for other types.
+        (WebCore::HTMLInputElement::stepUp): Rename applyStepForNumberOrRange().
+        (WebCore::HTMLInputElement::stepDown): Rename applyStepForNumberOrRange().
+        (WebCore::HTMLInputElement::setValueAsDate): Use setDateValue().
+        (WebCore::HTMLInputElement::setDateValue):
+          A helper function to make the best representation of DateComponents.
+        (WebCore::HTMLInputElement::setValueAsNumber):  Use setDateValue().
+        * html/HTMLInputElement.h:
 
-        Reviewed by Simon Hausmann.
+2010-02-10  Oliver Hunt  <oliver@apple.com>
 
-        Fix the Qt build with mingw.
+        Reviewed by Gavin Barraclough.
 
-        * WebCore.pro: Don't use MSVC commandline options to disable warnings
-        with mingw.
+        postMessage does not send ImageData
+        https://bugs.webkit.org/show_bug.cgi?id=34825
 
-2009-07-19  Adam Barth  <abarth@webkit.org>
+        Implement serialisation of ImageData, and for testing reasons
+        expose the ImageData constructor (which should already have
+        been exposed).
 
-        Reviewed by David Levin.
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedImageData::create):
+        (WebCore::SerializedImageData::width):
+        (WebCore::SerializedImageData::height):
+        (WebCore::SerializedImageData::data):
+        (WebCore::SerializedImageData::SerializedImageData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asImageData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asImageData):
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::data):
+        * page/DOMWindow.idl:
 
-        [V8] Phase 2: Remove event listener methods from V8Proxy
-        https://bugs.webkit.org/show_bug.cgi?id=27415
+2010-02-10  Adam Barth  <abarth@webkit.org>
 
-        No behavior change.
+        Reviewed by Darin Adler.
 
-        * bindings/v8/V8ObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::disconnectEventListeners):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::eventListeners):
-        (WebCore::V8Proxy::objectListeners):
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::getEventListener):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::~V8EventListener):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::getEventListener):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        Address last round of review comments on r53607
+        https://bugs.webkit.org/show_bug.cgi?id=33940
 
-2009-07-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Mostly renaming and cleaning up.
 
-        Reviewed by Gustavo Noronha.
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create):
+        (WebCore::CSSStyleSheet::createInline):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::href):
+        (WebCore::StyleSheet::setFinalURL):
+        (WebCore::StyleSheet::finalURL):
+        * dom/Document.cpp:
+        (WebCore::Document::updateBaseURL):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::create):
+        (WebCore::XSLStyleSheet::createInline):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::parseString):
+        (WebCore::XSLStyleSheet::loadChildSheets):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
 
-        [Gtk] soup/ResourceHandleSoup.cpp:533: error: 'g_mapped_file_free' was not declared in this scope
-        https://bugs.webkit.org/show_bug.cgi?id=27230
+2010-02-10  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Use g_mapped_file_unref for GLIB version 2.22 onwards.
+        Reviewed by Ariya Hidayat.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::startHttp):
+        [Qt] GraphicsLayer: somtimes the item flickers at the end of an animation
+        This is because we try to delete the animation when finished: that is
+        unnecessary. WebCore manages the animation's lifecycle and makes sure
+        to call the right function when the animation can be deleted.
 
-2009-07-18  Dan Bernstein  <mitz@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34761
 
-        Reviewed by Anders Carlsson.
+        No new tests.
 
-        Add spread radius support to -webkit-box-shadow
-        https://bugs.webkit.org/show_bug.cgi?id=27417
-        rdar://problem/7072267
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQt::addAnimation): No need to delete here
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty): deleteLater
 
-        Test: fast/box-shadow/spread.html
+2010-02-10  Kevin Ollivier  <kevino@theolliviers.com>
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForShadow): Added a property ID parameter and used it to
-            include the spread length for box-shadow but not for text-shadow.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-            Pass the property ID to valueForShadow().
+        [wx] Build fix for wxMac/Cocoa.
 
-        * css/CSSParser.cpp:
-        (WebCore::ShadowParseContext::ShadowParseContext): Added property,
-            spread, and allowSpread members. Added a property ID parameter to
-            the constructor. Initialize the property and allowSpread members.
-        (WebCore::ShadowParseContext::allowLength): Added allowSpread.
-        (WebCore::ShadowParseContext::commitValue): Pass the spread value to
-            the ShadowValue constructor. Reset allowSpread.
-        (WebCore::ShadowParseContext::commitLength): Allow spread after blur
-            for the box-shadow property.
-        (WebCore::ShadowParseContext::commitColor): Reset allowSpread.
-        (WebCore::CSSParser::parseShadow): Pass the property ID to
-            ShadowParseContext().
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp: Removed.
+        * platform/wx/wxcode/mac/carbon/fontprops.mm: Copied from WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp.
+        * wscript:
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the spread value from
-            the shadow value and pass it to the ShadowData constructor.
+2010-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        * css/ShadowValue.cpp:
-        (WebCore::ShadowValue::ShadowValue): Added spread.
-        (WebCore::ShadowValue::cssText): Added spread.
+        REGRESSION(24929): PDF page doesn't load in background tab
 
-        * css/ShadowValue.h:
-        (WebCore::ShadowValue::create): Added spread.
+        Reviewed by Dan Bernstein.
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc): Blend the spread value.
-        (WebCore::PropertyWrapperShadow::blend): Added 0 spread to the default
-            shadow.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        Only delay loading of the plug-in if we'll kick off our own load of the
+        plug-in data later, in start().
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally): Account for spread in
-            the visual overflow calculations.
-        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
-        (WebCore::InlineFlowBox::paint): Ditto.
+2010-02-10  Enrica Casucci  <enrica@apple.com>
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::overflowHeight): Ditto.
-        (WebCore::RenderBlock::overflowWidth): Ditto.
-        (WebCore::RenderBlock::overflowLeft): Ditto.
-        (WebCore::RenderBlock::overflowTop): Ditto.
-        (WebCore::RenderBlock::overflowRect): Ditto.
-        (WebCore::RenderBlock::layoutBlock): Ditto.
+        Reviewed by Simon Fraser.
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Inflate the shadow-
-            casting rect by the shadow spread value. Adjust border radii if
-            necessary.
+        Crash in WebKit!WebCore::RenderTextControlSingleLine::createInnerTextStyle doing anything in Safari after sitting on a page with 3D site        
+        <rdar://problem/7557201>
+        https://bugs.webkit.org/show_bug.cgi?id=34823
+        
+        No tests added because the code is exercised by the existing tests.
+        
+        The root cause was the fact that we were not releasing a reference that was held by CA.
+        In debug builds we had an assert in the destructor of WKCACFLayer.
+        
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::~GraphicsLayerCACF):
 
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Account for spread in the
-            visual overflow calculations.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateRects): Ditto.
+2010-02-10  Kwang Yul Seo  <skyul@company100.net>
 
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Account for spread.
-        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Ditto.
+        Reviewed by Eric Seidel.
 
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+        [BREWMP] Typedef DragImageRef
+        https://bugs.webkit.org/show_bug.cgi?id=34791
 
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setTextShadow): Assert that text shadows do not
-            have spread.
+        Use IImage* as it is the BREW's image type.
 
-        * rendering/style/ShadowData.cpp:
-        (WebCore::ShadowData::ShadowData): Added spread.
-        (WebCore::ShadowData::operator==): Compare spread.
-        * rendering/style/ShadowData.h:
-        (WebCore::ShadowData::ShadowData): Added spread.
+        * platform/DragImage.h:
 
-2009-07-18  Adam Barth  <abarth@webkit.org>
+2010-02-10  Beth Dakin  <bdakin@apple.com>
 
-        Reviewed by Jan Alonzo.
+        Reviewed by Simon Fraser and Darin Adler.
 
-        Minor FrameLoader.cpp cleanup
-        https://bugs.webkit.org/show_bug.cgi?id=27406
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34185 REGRESSION: 
+        Mask not invalidating
 
-        No behavior change.
+        SVGMaskElement is the only class that keeps a HashMap of canvas 
+        resources rather than just a pointer to a resource. This 
+        patch makes SVGMaskElement invalidate all of its resources in the 
+        HashMap instead of just one.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::invalidateCanvasResources):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        (WebCore::SVGStyledElement::invalidateCanvasResources):
+        * svg/SVGStyledElement.h:
 
-2009-07-18  Adam Barth  <abarth@webkit.org>
+2010-02-10  Stephan Aßmus  <superstippi@gmx.de>
 
-        Reviewed by Darin Fisher.
+        Reviewed by David Levin.
 
-        [V8] Move event listener methods from V8Proxy to V8EventListenerList
-        https://bugs.webkit.org/show_bug.cgi?id=27408
+        Fixes to rect conversion and image rendering on Haiku
+        https://bugs.webkit.org/show_bug.cgi?id=34684
 
-        Move some event listener code out of V8Proxy and into the event
-        listener list.
+        Covered by existing tests.
 
-        I'd like to remove these methods from V8Proxy entirely and just expose
-        getters for the lists themselves, but I'll do that in a follow up
-        patch.
+        The changes to the rect conversions are indeed correct. In Haiku (to stay
+        compatibly with BeOS), a BRect specifies the left/top and bottom/right pixel
+        *indices*, even though the values are floating point. So a rectangle covering
+        just one pixel would be specified as BRect(0, 0, 0, 0). In WebCore and other
+        frame works, such rectangles would be expressed as 0, 0, 1, 1. In WebCore, the
+        width and height of rectangles refer to the distance between pixels, while on
+        Haiku, a one pixel rect has indeed a width and height of 0, as confusing as
+        that may be.
 
-        * bindings/v8/V8EventListenerList.cpp:
-        (WebCore::V8EventListenerList::findWrapper):
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::findV8EventListener):
-        (WebCore::V8Proxy::findOrCreateV8EventListener):
-        (WebCore::V8Proxy::removeV8EventListener):
-        (WebCore::V8Proxy::findObjectEventListener):
-        (WebCore::V8Proxy::findOrCreateObjectEventListener):
-        (WebCore::V8Proxy::removeObjectEventListener):
-        * bindings/v8/V8Proxy.h:
+        The part of the patch that affects
+        WebCore/platform/graphics/haiku/ImageHaiku.cpp also implements the drawing
+        methods more correctly. Image observers are notified, and pattern drawing takes
+        the "phase" into account which makes scrolled backgrounds render correctly.
+        Transformations are still not supported, since the Haiku drawing backend itself
+        does not yet support them.
 
-2009-07-18  Jeremy Orlow  <jorlow@chromium.org>
+        Use OwnPtr when creating the BBitmap to avoid future leaks with early returns.
 
-        Rubber stamped by Adam Barth.
+        Convert the bitmap data to non pre-multiplied until Haiku supports drawing
+        pre-multiplied bitmaps.
 
-        Revert https://bugs.webkit.org/show_bug.cgi?id=27383
-        https://bugs.webkit.org/show_bug.cgi?id=27407
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Fixed conversion
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw): Fixed placement, notify observers
+        (WebCore::Image::drawPattern): Implemented using "phase" to fix scrolling, notify observers
+        * platform/graphics/haiku/IntRectHaiku.cpp: Fixed conversion
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Fixed conversion
 
-        Revert Jens' patch.  I believe he forgot to include a file.
+2010-02-10  Simon Fraser  <simon.fraser@apple.com>
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8DataGridDataSource.cpp: Removed.
-        * bindings/v8/V8DataGridDataSource.h: Removed.
-        * bindings/v8/V8GCController.h:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
+        Reviewed by David Levin.
 
-2009-07-17  Daniel Bates  <dbates@intudata.com>
+        Clean up unused member var and initialization in Document
+        https://bugs.webkit.org/show_bug.cgi?id=34820
 
-        Reviewed by Adam Barth.
+        Remove unused m_secureForms member variable in Document.
         
-        https://bugs.webkit.org/show_bug.cgi?id=27405
-
-        Fixes an issue when decoding HTML entities with an unknown named entity that 
-        caused null-characters to be inserted into the decoded result.
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
 
-        Test: http/tests/security/xssAuditor/link-onclick-ampersand.html
-              http/tests/security/xssAuditor/javascript-link-ampersand.html
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeHTMLEntities): Added check to conditional so that
-        non-zero entity values are not inserted during decoding process.
+        Reviewed by Kevin Ollivier.
 
-2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34759
+        
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::roundsGlyphAdvances):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::hfont):
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::scriptFontProperties):
+        (WebCore::SimpleFontData::initGDIFont):
+        (WebCore::SimpleFontData::platformCommonDestroy):
+        (WebCore::SimpleFontData::widthForGDIGlyph):
+        * platform/wx/wxcode/fontprops.h:
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/win/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * wscript:
 
-        <http://webkit.org/b/18363> [GTK] Combo boxes cannot be opened pressing space
+2010-02-10  Kwang Yul Seo  <skyul@company100.net>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Holger Freyther.
+        [BREWMP] Add dummy Frame::dragImageForSelection
+        https://bugs.webkit.org/show_bug.cgi?id=34792
 
-        Add Gtk to platforms that want to open the menulist using the
-        spacebar.
+        Add FrameBrew.cpp which contains a dummy implementation of
+        Frame::dragImageForSelection.
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
+        * page/brew/FrameBrew.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
 
-2009-07-17  Mario Sanchez Prada  <msanchez@igalia.com>
+2010-02-10  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Reviewed by Jan Alonzo.
+        [wx] Build fix. Switch drawPattern to Image class like other platforms.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25523
-        [GTK] The text displayed by push buttons is not exposed to assistive technologies
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
 
-        Add new public method text() to RenderButton and use it from
-        AccessibilityRenderObject::stringValue().
+2010-02-10  Chris Marrin  <cmarrin@apple.com>
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::stringValue):
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::text):
-        * rendering/RenderButton.h:
+        Reviewed by Darin Adler.
 
-2009-07-17  Anton Muhin  <antonm@chromium.org>
+        Added CA_PRINT_TREE functionality to WKCACFLayer implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34779
+        
+        I've tried to duplicate the look of the output on Mac, but
+        it's not quite the same. It shows all the useful information though.
+        It is enabled by setting the environment variable CA_PRINT_TREE=1
+        
+        * platform/graphics/win/WKCACFLayer.cpp:Implementation of printTree
+        (WebCore::WKCACFLayer::isTransformLayer):
+            Moved function to cpp file because it needs to use the function form
+            of kCACFTransformLayer because the DLL is delay loaded, and that function
+            can only be called from the cpp file.
+        (WebCore::WKCACFLayer::sublayerAtIndex):
+        (WebCore::printIndent):
+        (WebCore::printTransform):
+        (WebCore::WKCACFLayer::printTree):Prints from this layer down
+        (WebCore::WKCACFLayer::printLayer):Prints this layer and recursively calls sublayers
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::createRenderer):Adds a name to the root layers
+        (WebCore::WKCACFLayerRenderer::render):Calls printTree when CA_PRINT_TREE is 1
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        
+2010-02-10  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        Restore proxy retrieval
-        https://bugs.webkit.org/show_bug.cgi?id=27369
+        Change V8DOMWrapper::lookupDOMWrapper() and configureTemplate()
+        to not use V8ClassIndex.
 
-        No new tests are needed.
+        https://bugs.webkit.org/show_bug.cgi?id=34768
 
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-
-2009-07-17  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27351
-        Added platform "Symbian" to WEBCORE_NAVIGATOR_PLATFORM
-        Use uname to find the correct platform for Linux.
-
-        * page/NavigatorBase.cpp:
-        (WebCore::NavigatorBase::platform):
-
-2009-07-17  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Hook up V8 bindings for DataGrid elements.
-        https://bugs.webkit.org/show_bug.cgi?id=27383
-        http://code.google.com/p/chromium/issues/detail?id=16730
-
-        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
-        to handle exceptions, check appropriate JS prototypes, and
-        test column-list's item() method as well as array-indexing.
-
-        * WebCore.gypi: Added new source files.
-        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
-        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
-        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
-        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
-        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
-        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
-        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::create):
-        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
-        (WebCore::V8DataGridDataSource::jsDataSource):
-        (WebCore::asV8DataGridDataSource):
-        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
-        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
-        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        StorageArea should only contain methods we intend to proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27181
-
-        Right now, StorageAreaSync takes in a StorageArea* and calls methods
-        like importItem.  Really, StorageAreaSync should be operating directly
-        on StorageAreaImpl* and those methods should be removed from StorageArea
-        since StorageAreaSync should never be attached to anything other than a
-        StorageAreaImpl.
-
-        This was pointed out in the review for
-        https://bugs.webkit.org/show_bug.cgi?id=27072
-
-        Also clean up StorageNamespaceImpl to operate directly on
-        StorageAreaImpl.  Also, get rid of the factory for StorageArea
-        since nothing should ever create a StorageArea directly.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageArea.cpp: Removed.
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::~StorageArea):
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::copy):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::create):
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add v8 implementation for DOM Storage ScriptObjectQuarantine.
-        https://bugs.webkit.org/show_bug.cgi?id=27327
-
-        Wrap the storage object with a generic object as is done elsewhere in
-        the file (but continue to hit a NOTIMPLEMENTED if DOM_STORAGE is not
-        enabled.
-
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
 
-2009-07-17  Mads Ager  <ager@chromium.org>
+2010-02-10  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27394
-        Fix access to global object wrappers after navigation of their
-        frame in the V8 bindings.  This fixes selenium test failures.
+        [V8] Handle the possibility that ScheduledAction::execute() may
+        retrieve a null V8Proxy* even if not in a WorkerContext (e.g., if
+        JS was disallowed).
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocument):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
 
-2009-07-17  Mark Rowe  <mrowe@apple.com>
+2010-02-10  Kenneth Russell  <kbr@google.com>
 
-        Fix the 32-bit build by removing implicit float <-> double conversions.
+        Reviewed by Oliver Hunt.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::constrainedAttachedWindowHeight):
+        Remove automatic viewport resizing
+        https://bugs.webkit.org/show_bug.cgi?id=34766
 
-2009-07-17  Brian Weinstein  <bweinstein@apple.com>
+        Removed automatic viewport resizing per conclusions on the WebGL
+        mailing list. Added test verifying new behavior and updated a
+        couple of previous tests failing after this change.
 
-        Reviewed by Adam Roben.
+        Test: fast/canvas/webgl/viewport-unchanged-upon-resize.html
 
-        Fix of <rdar://problem/5712795> Win: Cannot change the height of the docked Web Inspector (14272)
-        https://bugs.webkit.org/show_bug.cgi?id=14272
-        
-        Moved preference setting for attached inspector height and inspector height calculation from
-        WebInspectorClient.mm into InspectorController.cpp, to make this code cross-platform and enable
-        Windows resizing of attached inspector.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::reshape):
 
-        * inspector/InspectorController.cpp:
-        * inspector/InspectorController.h:
+2010-02-10  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-07-17  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Another attempt at fixing the build after r46063
+        [Qt] Implement image interpolation quality.
 
-        * WebCore.xcodeproj/project.pbxproj: Made ExceptionCode.h a private
-            header, because it is now included from htmlediting.h, which is
-            a private header.
+        https://bugs.webkit.org/show_bug.cgi?id=34629
 
-2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
 
-        Reviewed by Dan Bernstein.
+2010-02-10  Eric Seidel  <eric@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27396
-        Moving cursor in Thai text sometimes jumps over two characters
+        No review, Mac build fix.
 
-        Test: editing/text-iterator/thai-cursor-movement.html
+        Crash in Flash at http://www.cctv.com/
+        https://bugs.webkit.org/show_bug.cgi?id=34673
 
-        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator): Added a special
-        case for five Thai characters, matching ICU/CLDR changes.
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::getValueStatic):
 
-2009-07-14  Eric Seidel  <eric@webkit.org>
+2010-02-10  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Xan Lopez.
 
-        Some constructor objects exposed on Window have the wrong prototype chain
-        https://bugs.webkit.org/show_bug.cgi?id=27276
+        [GTK] Hits assertion on history back, with page cache enabled, in specific conditions
+        https://bugs.webkit.org/show_bug.cgi?id=34773
 
-        Several Constructor classes were already being passed a global object
-        during construction, but they were ignoring it for prototype lookup.
-        I've fixed those to use the passed global object instead.
+        When unsetting the adjustments from a ScrollView, also disconnect
+        them from the Scrollbars.
 
-        Most of these Constructor classes should just be auto-generated, but I
-        refrained from changing them over to auto-gen in this patch.
+        Test: fast/frames/frame-crash-with-page-cache.html
 
-        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
-        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
-        to match existing behavior.
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setGtkAdjustments):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::~ScrollbarGtk):
+        (ScrollbarGtk::detachAdjustment):
+        * platform/gtk/ScrollbarGtk.h:
 
-        Test: fast/dom/prototype-inheritance.html
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
-        (WebCore::deprecatedGetDOMStructure):
-        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webKitPoint): pass "this" for the global object.
-        (WebCore::JSDOMWindow::webKitCSSMatrix): pass "this" for the global object.
-        (WebCore::JSDOMWindow::xsltProcessor): pass "this" for the global object.
-        (WebCore::JSDOMWindow::worker): pass "this" for the global object.
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWebKitCSSMatrixConstructor.h:
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWebKitPointConstructor.h:
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWorkerConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
-         -- XMLHttpRequest constructor was also missing a length.  Added one.
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
+        Reviewed by Geoffrey Garen.
 
-2009-07-17  Dan Bernstein  <mitz@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
 
-        Build fix
+        Test: fast/images/destroyed-image-load-event.html
 
-        * editing/htmlediting.cpp:
-        (WebCore::visiblePositionBeforeNode):
-        (WebCore::visiblePositionAfterNode):
+        * ForwardingHeaders/wtf/ValueCheck.h: Added.
 
-2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        * loader/ImageLoader.cpp:
+        (WTF::ValueCheck): Special case value check for ImageLoader - it's allocated inside elements,
+        so check the owner instead.
+        (WebCore::ImageEventSender::hasPendingEvents): Added a debugging aid for ImageLoader destructor.
+        (WebCore::ImageLoader::~ImageLoader): Assert that we're not going to leave dangling pointers
+        in ImageEventSender.
+        (WebCore::ImageLoader::setImage): Cancel events that could be dispatched for the previous
+        image. The only client using this method that I could find was DeleteButton, which doesn't
+        care about load events for the new image, so I didn't add any code for firing those.
+        (WebCore::ImageLoader::setLoadingImage): This method only existed to confuse readers -
+        there wasn't any meaningful code shared (callers just undid most assignments made there).
+        Merged the logic into callers.
+        (WebCore::ImageLoader::updateFromElement): We're forgetting the old image, so forget its
+        old events, too.
+        (WebCore::ImageLoader::notifyFinished): This can be called from setImage(), in which case
+        no one is going to dispatch the event "soon". So, don't queue it.
+        (WebCore::ImageEventSender::dispatchPendingEvents): Call checkConsistency(). This didn't
+        help catch this particuar bug, but seems like a useful check anyway.
+
+        * loader/ImageLoader.h: Removed setLoadingImage().
+
+2010-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix. Unreviewed.
 
-        Gtk build fix for symbol lookup error.
+        * WebCore.xcodeproj/project.pbxproj:
+        Add PluginViewNone.cpp to the Mac project.
 
-        Move AbstractWorker from SHARED_WORKERS to WORKERS as Worker derives from it now
-        Changed in http://trac.webkit.org/changeset/46048
+2010-02-10  Adam Roben  <aroben@apple.com>
 
-        * GNUmakefile.am:
+        Optimize ImageBuffer::toDataURL's CG implementation
 
-2009-07-17  Ryosuke Niwa  <ryosuke.niwa@gmail.com>
+        There was some unused code that could have been removed in r31830 when
+        this function was changed not to flip the CG image anymore.
 
-        Reviewed by Eric Seidel.
+        Fixes <http://webkit.org/b/34808> ImageBuffer::toDataURL allocates
+        unnecessary memory under CoreGraphics
 
-        htmlediting.cpp needs more utility functions to fix the bug 26816
-        https://bugs.webkit.org/show_bug.cgi?id=27038
+        Reviewed by Sam Weinig.
 
-        In order to fix the bug 26816, we need several utility functions be added to htmlediting.cpp
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::toDataURL): Don't allocate an unused CGImageRef
+        and buffer, and switch to the new overload of base64Encode that
+        doesn't require us to copy all the image data into a Vector first.
 
-        No tests because functions haven't been used anywhere yet.
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        * platform/text/Base64.h:
+        Added an overload that takes a raw data pointer and length, just like
+        we have for base64Decode. The overload that takes a Vector as input
+        just calls through to the new overload.
 
-        * dom/Range.cpp:
-        (WebCore::Range::create):
-        (WebCore::Range::comparePoint): added const qualifier
-        (WebCore::Range::compareNode): added const qualifier
-        * dom/Range.h:
-        * editing/htmlediting.cpp:
-        (WebCore::unsplittableElementForPosition): find the enclosing unsplittable element (editing root & table cell)
-        (WebCore::positionBeforeNode): added ASSERT(node)
-        (WebCore::positionAfterNode): added ASSERT(node)
-        (WebCore::visiblePositionBeforeNode):
-        (WebCore::visiblePositionAfterNode):
-        (WebCore::createRange): create a range object from two visible positions
-        (WebCore::extendRangeToWrappingNodes): extend range to include nodes that starts and ends at the boundaries
-        (WebCore::canMergeLists): typo
-        (WebCore::indexForVisiblePosition): added const qualifier
-        (WebCore::isVisiblyAdjacent): typo
-        (WebCore::isNodeVisiblyContainedWithin): determine if a node is inside a range or within the visible boundaries of the range
-        * editing/htmlediting.h:
+2010-02-10  Dan Bernstein  <mitz@apple.com>
 
-2009-07-17  Michelangelo De Simone  <micdesim@gmail.com>
+        Reviewed by Dave Hyatt.
 
-        Reviewed by Darin Adler.
+        Complete the fix for <rdar://problem/7577604> Drag and Drop: background elements are bleeding through
+        https://bugs.webkit.org/show_bug.cgi?id=34546
 
-        https://bugs.webkit.org/show_bug.cgi?id=25551
-        Added support for the "required" attribute, the valueMissing flag
-        to the ValidityState object and :required/:optional CSS pseudoclasses.
-        Part of HTML5 sec. Forms specs.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-required
-
-        Tests: fast/css/pseudo-required-optional-001.html
-               fast/css/pseudo-required-optional-002.html
-               fast/css/pseudo-required-optional-003.html
-               fast/css/pseudo-required-optional-004.html
-               fast/css/pseudo-required-optional-005.html
-               fast/css/pseudo-required-optional-006.html
-               fast/forms/ValidityState-valueMissing-001.html
-               fast/forms/ValidityState-valueMissing-002.html
-               fast/forms/ValidityState-valueMissing-003.html
-               fast/forms/ValidityState-valueMissing-004.html
-               fast/forms/ValidityState-valueMissing-005.html
-               fast/forms/ValidityState-valueMissing-006.html
-               fast/forms/ValidityState-valueMissing-007.html
-               fast/forms/ValidityState-valueMissing-008.html
-               fast/forms/ValidityState-valueMissing-009.html
-               fast/forms/required-attribute-001.html
-               fast/forms/required-attribute-002.html
+        * manual-tests/drag-image-table-part-decorations.html:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint): Don’t paint collapsed borders if this object shouldn’t
+        paint within the current painting root.
 
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): pseudoRequired/pseudoOptional
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::): ditto
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto
-        * dom/Element.h:
-        (WebCore::Element::isOptionalFormControl): check for optional controls
-        (WebCore::Element::isRequiredFormControl): check for required controls
-        * html/HTMLAttributeNames.in: required attribute
-        * html/HTMLButtonElement.h:
-        (WebCore::HTMLButtonElement::isOptionalFormControl): ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::required): requiredAttr getter
-        (WebCore::HTMLFormControlElement::setRequired): requiredAttr setter
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMissing): method definition
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::valueMissing): validation code
-        (WebCore::HTMLInputElement::isRequiredFormControl): ditto
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::isOptionalFormControl): ditto
-        * html/HTMLInputElement.idl: required DOM attribute
-        * html/HTMLSelectElement.h:
-        (WebCore::HTMLSelectElement::isOptionalFormControl): ditto
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::valueMissing): validation code
-        (WebCore::HTMLTextAreaElement::isOptionalFormControl): ditto
-        (WebCore::HTMLTextAreaElement::isRequiredFormControl): ditto
-        * html/HTMLTextAreaElement.idl: required DOM attribute
-        * html/ValidityState.cpp:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::valueMissing): validation flag
+2010-02-08  Jon Honeycutt  <jhoneycutt@apple.com>
 
-2009-07-17  Beth Dakin  <bdakin@apple.com>
+        <rdar://problem/7436875> Crash in Flash when visiting
+        http://www.cctv.com/default.shtml (WER ID 819298200) [watson 2502260]
 
         Reviewed by Darin Adler.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27390 CSS custom 
-        cursor hotspots should work in quirks mode
-        - and corresponding <rdar://problem/6554340>
+        Test: platform/win/plugins/plugin-delayed-destroy.html
 
-        Enable hotspots in quirks mode.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Evaluate):
+        If Flash calls this to evaluate a script that destroys the PluginView,
+        we crash when returning to Flash code. Before evaluating the script,
+        call PluginView::keepAlive() to hold a ref to this instance (and release
+        it asynchronously).
 
-        Update this manual test to reflect the fact that hotspots are now 
-        expected to work in quirks mode.
-        * manual-tests/css3-cursor-fallback-quirks.html:
+        * plugins/PluginView.cpp:
+        (WebCore::instanceMap):
+        Return a map from the NPP to the PluginView.
+        (WebCore::PluginView::~PluginView):
+        Assert that the keep alive timer is not running; remove ourselves from
+        the instance map.
+        (WebCore::PluginView::performRequest):
+        The parent Frame is now a RefPtr; use .get().
+        (WebCore::PluginView::status):
+        Ditto.
+        (WebCore::PluginView::didReceiveResponse):
+        Ditto.
+        (WebCore::PluginView::PluginView):
+        Add the view to the instance map.
+        (WebCore::PluginView::lifeSupportTimerFired):
+        Deref the PluginView.
+        (WebCore::PluginView::keepAlive):
+        Ref the PluginView, then start a time to release the reference
+        asynchronously.
+        (WebCore::PluginView::keepAlive):
+        Find the PluginView in the map, and call its keepAlive() function.
 
-2009-07-17  Peter Kasting  <pkasting@google.com>
+        * plugins/PluginView.h:
+        Made m_parentFrame a RefPtr, so that it will remain valid when the
+        keep alive timer fires.
+        (WebCore::PluginView::parentFrame):
+        Use .get().
 
-        Reviewed by Steve Falkenburg.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use .get().
+        (WebCore::PluginView::handleKeyboardEvent):
+        Use .get().
+        (WebCore::PluginView::handleMouseEvent):
+        Use .get().
 
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Only add Cygwin to the path when it isn't already there.  This avoids
-        causing problems for people who purposefully have non-Cygwin versions of
-        executables like svn in front of the Cygwin ones in their paths.
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::keepAlive):
+        Stubbed.
 
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
+2010-02-10  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by David Levin.
+        Support frameset flattening
+        https://bugs.webkit.org/show_bug.cgi?id=32717
 
-        https://bugs.webkit.org/show_bug.cgi?id=27384
-        Random crashes in appcache/update-cache.html test
+        Add support for enabling/disabling FrameSet Flattening on the Mac port.
 
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didReceiveResponse): Reorder code to avoid using a handle
-        after canceling it.
+        * WebCore.base.exp:
 
-2009-07-17  Drew Wilson  <atwilson@google.com>
+2010-02-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by David Levin.
+        Revert 54599 because it breaks a lot of tests on Windows Chrome
 
-        Need to refactor Worker to derive from AbstractWorker
-        https://bugs.webkit.org/show_bug.cgi?id=26948
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        ():
+        * inspector/front-end/inspector.css:
 
-        Changed Worker to derive from AbstractWorker, which involved moving
-        AbstractWorker files from being wrapped by ENABLE_SHARED_WORKERS to
-        ENABLE_WORKERS.
+2010-02-10  Adam Roben  <aroben@apple.com>
 
-        Removed obsolete functionality from the JS/V8 bindings that is now
-        inherited from AbstractWorker.
+        Fix bad paths in WebCore.vcproj
 
-        * WebCore.pro:
-        Moved AbstractWorker files out of SHARED_WORKERS section and into WORKERS.
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * bindings/js/JSWorkerCustom.cpp:
-        Removed obsolete event listener code (now in base class)
-        (WebCore::JSWorker::mark):
-        No longer need to explicitly mark event listeners (handled by base class).
-        * bindings/v8/V8Index.h:
-        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * bindings/v8/custom/V8CustomBinding.h:
-        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        Removed obsolete event listener code that now lives in the base class.
-        (WebCore::V8WorkerConstructor): Cleaned up legacy style nits.
-        * workers/AbstractWorker.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * workers/AbstractWorker.h:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * workers/Worker.cpp:
-        Removed event listener code (now in base class).
-        (WebCore::Worker::Worker): Now derives from AbstractWorker.
-        (WebCore::Worker::notifyFinished): Calls dispatchLoadErrorEvent on base class.
-        * workers/Worker.h:
-        Removed APIs that now live in the base class.
-        * workers/Worker.idl:
-        Now derives from AbstractWorker.
-        Removed APIs that live in the base class, and added a GenerateToJS flag.
+        These were harmless in VS2005, but cause project conversion errors in
+        VS2010 RC.
 
-2009-07-17  David Hyatt  <hyatt@apple.com>
+        Fixes <http://webkit.org/b/34801>.
 
         Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27379
-        Absolutely-positioned elements with a scrollbar wrap prematurely.  Make sure to include
-        the vertical scrollbar width for overflow:scroll elements.
-
-        Added fast/css/positioned-overflow-scroll.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::calcPrefWidths):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::calcPrefWidths):
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Need a DOM_STORAGE guard in DerivedSroucesAllInOne.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27375
-
-        In https://bugs.webkit.org/show_bug.cgi?id=27360 I added Storage.cpp
-        and StorageEvent.cpp.  Unfortunately, until later this afternoon,
-        DOM_STORAGE is not turned on by default in Chromium, and so these two
-        files are never generated.  This breaks the compile.
+        * WebCore.vcproj/WebCore.vcproj: Removed leading "." from paths to
+        JSHTMLFrameSetElement.{cpp,h}.
 
-        There are no other instances of guards in the file, which puzzles me...
-        but I think adding guards is the right way to go about this.
+2010-02-10  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        * bindings/v8/DerivedSourcesAllInOne.cpp:  Added the guard.
-
-2009-07-17  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
+        Not reviewed (build fix).
 
-        https://bugs.webkit.org/show_bug.cgi?id=26496
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): Return a
+        SimpleFontData here.
 
-        Let WebCore always enforce the connection-per-host limit itself.
+2010-02-10 Julien Chaffraix  <jchaffraix@pleyo.com>
 
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
+        Reviewed by Eric Seidel.
 
-2009-07-17  Chris Marrin  <cmarrin@apple.com>
+        Bug 23287 -  Avoid using FontPlatformData outside the FontCache
 
-        Reviewed by David Hyatt.
+        No functional change, only refactored the code using FontPlatformData to use SimpleFontData.
 
-        Some transitions don't work correctly on Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=27356
+        This change leaves the class FontCached as it needs some thoughts and more refactoring.
 
-        We only have code to do component animation using valueFunction.
-        So on Leopard we always need to do matrix animation in hardware.
-        This fix ensures that. 
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData): Call getCachedFontData with the 2 parameters directly.
+        * css/CSSFontSelector.cpp:
+        (WebCore::fontDataForGenericFamily): Ditto.
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::getCachedFontData): This method is meant to replace getCachedFontPlatformData
+        that was moved in the private section of the class. It calls getCachedFontPlatformData and cache
+        the returned FontPlatformData if it is not null.
+        (WebCore::FontCache::getFontData): Updated to use the new getCachedFontData.
+        * platform/graphics/FontCache.h: Updated several methods to return a SimpleFontData in lieu of a
+        FontPlatformData. Moved some method in the private sections.
 
-        This is currently not testable because it appears only in the
-        hardware animation and we can't yet do pixel tests while 
-        hardware animating.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/haiku/FontCacheHaiku.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/wince/FontCacheWince.cpp:
+        * platform/graphics/wx/FontCacheWx.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        Updated all the previous platform methods to return a SimpleFontData.
 
-2009-07-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getSimilarFontPlatformData): Updated to return a SimpleFontData.
+        (WebCore::FontCache::getLastResortFallbackFont): Ditto. Also refactored the code
+        and moved a DEFINE_STATIC_LOCAL where it is needed.
 
-        Reviewed by Gustavo Noronha.
+2010-02-10  Alexander Pavlov  <apavlov@chromium.org>
 
-        [GTK+] Crash in screenAvailable due a null Widget*
+        Reviewed by Pavel Feldman.
 
-        JSDOMWindow::open called screenAvailableRect(0). The other
-        Screen methods can be called with a null widget as well, fix the
-        crashing test by checking for null.
+        Web Inspector: Elements Panel: Limit the number of initially loaded element children
+        https://bugs.webkit.org/show_bug.cgi?id=34421
 
-        In screenRect and screenAvailableRect it is not tried to use
-        a default screen as the existing implementation didn't try either
-        in case of not having a toplevel widget.
+        Test: inspector/elements-panel-limited-children.html
 
-        LayoutTests/fast/frames/crash-removed-iframe.html caused a crash.
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.createTreeElementFor):
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.set expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildCount):
+        (WebInspector.ElementsTreeElement.prototype.showChild):
+        (WebInspector.ElementsTreeElement.prototype.insertChildElement):
+        (WebInspector.ElementsTreeElement.prototype.moveChild):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.adjustCollapsedRange):
+        (WebInspector.ElementsTreeElement.prototype.handleLoadAllChildren):
+        ():
+        * inspector/front-end/inspector.css:
 
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::getVisual): New method to get a visual or return zero.
-        (WebCore::screenDepth): Use getVisual.
-        (WebCore::screenDepthPerComponent): Use getVisual.
-        (WebCore::screenIsMonochrome): Use screenDepth which will do the null checking
-        (WebCore::screenRect): Check for !widget.
-        (WebCore::screenAvailableRect): Check for !widget.
+2010-02-10  Mikhail Naganov  <mnaganov@chromium.org>
 
-2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Simon Hausmann.
+        Remove several #if USE(JSC) branches. Introduce ScriptDebugServer class for
+        making JavaScriptDebugServer engine-agnostic.
 
-        [Qt] Fix the include path for the Symbian port
-        https://bugs.webkit.org/show_bug.cgi?id=27358
+        https://bugs.webkit.org/show_bug.cgi?id=34795
 
+        * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptDebugServer.cpp: Added.
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        * bindings/js/ScriptDebugServer.h: Added.
+        * bindings/v8/ScriptDebugServer.cpp: Added.
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        * bindings/v8/ScriptDebugServer.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
 
-2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Simon Hausmann.
-
-        Make it possible to set the plugin directories from the DRT.
-        Part of https://bugs.webkit.org/show_bug.cgi?id=27215
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::installedPlugins): Now optionally takes
-        a populate argument, so we can avoid loading system plugins from the
-        DRT and thus avoid their strerr errors that can make tests fail.
-        (WebCore::PluginDatabase::clear): Make it possible to clear the
-        database. Called from setPluginDirectories.
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::setPluginDirectories): Make public
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        PluginViewMac: Stop the plugin when loading fails
-
-        Also, prevent event propagation when in the stopped state
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        PluginViewMac: Allow query and set of drawing and event models
-
-        We now support querying and setting of the drawing and event model,
-        but we still only support the CoreGraphics drawing model, and the
-        Carbon event model.
-
-        If unsupported drawing or event models are detected we show the
-        missing-plugin icon.
-
-        * plugins/PluginView.cpp:
-        * plugins/PluginView.h:
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Initialize two PluginView members using memset
-
-        m_npWindow is used on all platforms, not just for XP_UNIX,
-        so always initialize it. m_npCgContext on the other hand
-        is only used for XP_MACOSX.
-
-        * plugins/PluginView.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add more debug logging in PluginView
-
-        * plugins/PluginView.cpp: Add debug for setValue
-        * plugins/gtk/PluginViewGtk.cpp: Add debug for getValue
-        * plugins/mac/PluginViewMac.cpp: Add debug for getValue and more
-        * plugins/qt/PluginViewQt.cpp: Add debug for getValue
-        * plugins/win/PluginViewWin.cpp: Add debug for getValue
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Use same license in PluginDebug.cpp as in the original PluginDebug.h
-
-        * plugins/PluginDebug.cpp: Use license from PluginDebug.h
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add more debugging functionality for the WebCore NPAPI layer
-
-        * GNUmakefile.am: Add PluginDebug.cpp
-        * WebCore.gypi: Add PluginDebug.cpp
-        * WebCore.pro: Add PluginDebug.cpp
-        * WebCore.vcproj/WebCore.vcproj: Add PluginDebug.cpp
-        * WebCoreSources.bkl: Add PluginDebug.cpp
-        * plugins/PluginDebug.h: Move errorStrings to PluginDebug.cpp
-        * plugins/PluginDebug.cpp: New file
+        Make JObjectWrapper::ref() and deref() public accessible to derefIfNull().
 
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+        Will be reverted when the following winscw compiler bug is fixed.
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=28054
 
-        Fix Chromium build with DOM_STORAGE enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=27360
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jni/v8/JavaInstanceV8.h:
 
-        2 minor changes as noted below:
+2010-02-10  Yaar Schnitman  <yaar@chromium.org>
 
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Add the generated .cpp files.
-        * storage/StorageAreaImpl.cpp:  #include "DOMWindow.h"
+        Reviewed by Adam Barth.
 
-2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
+        Simplified RuntimeEnabledFeatures and corresponding v8 generated code
+        https://bugs.webkit.org/show_bug.cgi?id=34667
 
-        Reviewed by David Levin.
+        * WebCore.gypi:
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Added.
+        (WebCore::RuntimeEnabledFeatures::audioEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlMediaElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlAudioElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlVideoElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::mediaErrorEnabled):
+        (WebCore::RuntimeEnabledFeatures::sharedWorkerEnabled):
+        (WebCore::RuntimeEnabledFeatures::webSocketEnabled):
+        (WebCore::RuntimeEnabledFeatures::openDatabaseEnabled):
+        * bindings/generic/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setWebkitNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::setGeolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::geolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::setIndexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::indexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Removed.
+        * bindings/v8/RuntimeEnabledFeatures.h: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
 
-        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
-        https://bugs.webkit.org/show_bug.cgi?id=27206
-        
-        Add ENABLE_WEB_SOCKETS
+2010-02-09  Alexander Pavlov  <apavlov@chromium.org>
 
-        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
-        * GNUmakefile.am: add ENABLE_WEB_SOCKETS
-        * WebCore.vcproj/WebCoreCommon.vsprops: add ENABLE_WEB_SOCKETS
-        * WebCore.vcproj/build-generated-files.sh: add ENABLE_WEB_SOCKETS
+        Reviewed by Pavel Feldman.
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+        Web Inspector: Add two basic categories for the Audits panel
+        https://bugs.webkit.org/show_bug.cgi?id=32930
 
-        Reviewed by Oliver Hunt.
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditCategories.js: Added.
+        (WebInspector.AuditCategories.PagePerformance):
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        (WebInspector.AuditCategories.NetworkUtilization):
+        (WebInspector.AuditCategories.NetworkUtilization.prototype.initialize):
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype.show):
+        * inspector/front-end/AuditRules.js: Added.
+        (WebInspector.AuditRules.arrayAsUL):
+        (WebInspector.AuditRules.getDomainToResourcesMap):
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.GzipRule):
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.GzipRule.prototype._isCompressed):
+        (WebInspector.AuditRules.GzipRule.prototype._shouldCompress):
+        (WebInspector.AuditRules.CombineExternalResourcesRule):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineJsResourcesRule):
+        (WebInspector.AuditRules.CombineCssResourcesRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.UnusedCssRule):
+        (WebInspector.AuditRules.UnusedCssRule.prototype._getUnusedStylesheetRatioMessage):
+        (WebInspector.AuditRules.UnusedCssRule.prototype._getUnusedTotalRatioMessage):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule):
+        (WebInspector.AuditRules.CacheControlRule.prototype.InfoCheck.1.FailCheck.0.WarningCheck.1.SevereCheck.2.doRun):
+        (WebInspector.AuditRules.CacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.CacheControlRule.prototype._cacheableAndNonCacheableResources):
+        (WebInspector.AuditRules.CacheControlRule.prototype.execCheck):
+        (WebInspector.AuditRules.CacheControlRule.prototype.freshnessLifetimeGreaterThan):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasResponseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isCompressible):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isPubliclyCacheable):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeaderMatch):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasExplicitExpiration):
+        (WebInspector.AuditRules.CacheControlRule.prototype._isExplicitlyNonCacheable):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isCacheableResource):
+        (WebInspector.AuditRules.BrowserCacheControlRule):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._missingExpirationCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._varyCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._oneMonthExpirationCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._oneYearExpirationCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._questionMarkCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._publicCachingCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._setCookieCacheableCheck):
+        (WebInspector.AuditRules.ImageDimensionsRule):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasDimension):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasWidth):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasHeight):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CssInHeadRule):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine.allViews):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.StylesScriptsOrderRule):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CookieRuleBase):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun.resultCallback):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.mapResourceCookies):
+        (WebInspector.AuditRules.CookieRuleBase.prototype._callbackForResourceCookiePairs):
+        (WebInspector.AuditRules.CookieSizeRule):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._average):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._max):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies.avgSizeSorter):
+        (WebInspector.AuditRules.StaticCookielessRule):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype._collectorCallback):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._constructCategories):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype._updateLauncherViewControls):
+        (WebInspector.AuditCategory):
+        (WebInspector.AuditCategory.prototype.get id):
+        (WebInspector.AuditCategory.prototype.get ruleCount):
+        (WebInspector.AuditCategory.prototype.runRules):
+        (WebInspector.AuditCategory.prototype._ensureInitialized):
+        (WebInspector.AuditCategoryResult):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/audits.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.addPanelToolbarIcon):
+        (WebInspector.documentKeyDown):
 
-        Added a third bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26952
+2010-02-10  Adam Barth  <abarth@webkit.org>
 
-        Adding five files, EventLoopHaiku.cpp, FileChooserHaiku.cpp,
-        FileSystemHaiku.cpp, KeyboardCodes.h and MIMETypeRegistryHaiku.cpp
+        Reviewed by Darin Adler.
 
-        * platform/haiku/EventLoopHaiku.cpp: Added.
-        (WebCore::EventLoop::cycle):
-        * platform/haiku/FileChooserHaiku.cpp: Added.
-        (WebCore::FileChooser::FileChooser):
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/haiku/FileSystemHaiku.cpp: Added.
-        (WebCore::fileSystemRepresentation):
-        (WebCore::homeDirectoryPath):
-        (WebCore::openTemporaryFile):
-        (WebCore::closeFile):
-        (WebCore::writeToFile):
-        (WebCore::unloadModule):
-        (WebCore::listDirectory):
-        * platform/haiku/KeyboardCodes.h: Added.
-        * platform/haiku/MIMETypeRegistryHaiku.cpp: Added.
-        (WebCore::):
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        Freeze sandbox attributes on creation
+        https://bugs.webkit.org/show_bug.cgi?id=34184
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+        This is how the spec works now.
 
-        Reviewed by Oliver Hunt.
+        Test: fast/frames/sandboxed-iframe-forms-dynamic.html
 
-        Added a second bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26952
-
-        Adding four files, ContextMenuHaiku.cpp, ContextMenuItemHaiku.cpp,
-        DragDataHaiku.cpp and DragImageHaiku.cpp
-
-        * platform/haiku/ContextMenuHaiku.cpp: Added.
-        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
-        (WebCore::ContextMenuReceiver::HandleMessage):
-        (WebCore::ContextMenuReceiver::Result):
-        (WebCore::ContextMenu::ContextMenu):
-        (WebCore::ContextMenu::~ContextMenu):
-        (WebCore::ContextMenu::appendItem):
-        (WebCore::ContextMenu::itemCount):
-        (WebCore::ContextMenu::insertItem):
-        (WebCore::ContextMenu::platformDescription):
-        (WebCore::ContextMenu::setPlatformDescription):
-        * platform/haiku/ContextMenuItemHaiku.cpp: Added.
-        (ContextMenuItem::ContextMenuItem):
-        (ContextMenuItem::~ContextMenuItem):
-        (ContextMenuItem::releasePlatformDescription):
-        (ContextMenuItem::type):
-        (ContextMenuItem::setType):
-        (ContextMenuItem::action):
-        (ContextMenuItem::setAction):
-        (ContextMenuItem::title):
-        (ContextMenuItem::setTitle):
-        (ContextMenuItem::platformSubMenu):
-        (ContextMenuItem::setSubMenu):
-        (ContextMenuItem::setChecked):
-        (ContextMenuItem::setEnabled):
-        (ContextMenuItem::enabled):
-        * platform/haiku/DragDataHaiku.cpp: Added.
-        (WebCore::DragData::canSmartReplace):
-        (WebCore::DragData::containsColor):
-        (WebCore::DragData::containsFiles):
-        (WebCore::DragData::asFilenames):
-        (WebCore::DragData::containsPlainText):
-        (WebCore::DragData::asPlainText):
-        (WebCore::DragData::asColor):
-        (WebCore::DragData::createClipboard):
-        (WebCore::DragData::containsCompatibleContent):
-        (WebCore::DragData::containsURL):
-        (WebCore::DragData::asURL):
-        (WebCore::DragData::asFragment):
-        * platform/haiku/DragImageHaiku.cpp: Added.
-        (WebCore::dragImageSize):
-        (WebCore::deleteDragImage):
-        (WebCore::scaleDragImage):
-        (WebCore::dissolveDragImageToFraction):
-        (WebCore::createDragImageFromImage):
-        (WebCore::createDragImageIconForCachedImage):
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        * bindings/generic/BindingDOMWindow.h:
+        (WebCore::::createWindow):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        (WebCore::FrameLoader::updateSandboxFlags):
+        * page/SecurityOrigin.cpp:
+        * page/SecurityOrigin.h:
 
-2009-07-16  Stephen White  <senorblanco@chromium.org>
+2010-02-09  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        Reviewed by Darin Fisher and Brett Wilson.
+        Rubber-stamped by Kenneth Rohde Christiansen.
 
-        Refactor Skia implementation of gradients and patterns.
+        [Qt] Remove old, outdated unused code block.
 
-        http://bugs.webkit.org/show_bug.cgi?id=26618
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-        The following layout tests were breaking on Chromium/Linux:
+2010-02-09  Chris Guillory  <ctguil@google.com>
 
-        LayoutTests/svg/custom/js-late-gradient-creation.svg (bad baseline PNG)
-        LayoutTests/svg/custom/js-late-gradient-and-object.creation.svg
-        LayoutTests/svg/custom/js-late-pattern-creation.svg (bad baseline PNG)
-        LayoutTests/svg/custom/js-late-pattern-and-object-creation.svg
+        Reviewed by Darin Fisher.
 
-        I could've fixed these the easy way, by copying the same 5
-        lines of code we use everywhere we need patterns or gradients, but
-        I decided to fix it the hard way:  by refactoring the code so that
-        PlatformContextSkia::setupPaintForFilling() and
-        PlatformContextSkia::setupPaintForStroking() do the right thing,
-        and also handle gradients and patterns.
+        [Chromium] Notify ChromeClientChromium of state change notifications.
         
-        This required pushing the gradients and patterns set in 
-        (generic) GraphicsContext::setFillPattern() and friends down into
-        PlatformContextSkia.  For this, I followed the setPlatformXXX()
-        pattern used elsewhere in GraphicsContext, and stubbed them out on
-        the other platforms with #if !PLATFORM(SKIA).  This also required
-        pushing changes to the gradientSpaceTransform from the Gradient into 
-        GradientSkia.
-
-        Since it's a Skia context, I decided to cache the values as
-        SkShaders.  There were existing m_pattern and m_gradient SkShaders,
-        but they were unused, and whose use was ambiguous, so I
-        replaced them with one SkShader each for filling and stroking.
-
-        * platform/graphics/Gradient.cpp:
-        (WebCore::Gradient::setGradientSpaceTransform):
-        (WebCore::Gradient::setPlatformGradientSpaceTransform):
-        * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::setStrokePattern):
-        (WebCore::GraphicsContext::setFillPattern):
-        (WebCore::GraphicsContext::setStrokeGradient):
-        (WebCore::GraphicsContext::setFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/skia/GradientSkia.cpp:
-        (WebCore::Gradient::setPlatformGradientSpaceTransform):
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::strokeRect):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):
-        (PlatformContextSkia::State::~State):
-        (PlatformContextSkia::drawRect):
-        (PlatformContextSkia::setupPaintCommon):
-        (PlatformContextSkia::setupPaintForFilling):
-        (PlatformContextSkia::setupPaintForStroking):
-        (PlatformContextSkia::setFillColor):
-        (PlatformContextSkia::setStrokeColor):
-        (PlatformContextSkia::setStrokeShader):
-        (PlatformContextSkia::setFillShader):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/skia/SkiaFontWin.cpp:
-        (WebCore::skiaDrawText):
-        (WebCore::paintSkiaText):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::SVGPaintServer::teardown):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added Haiku-specific files for WebCore/platform/image-decoders/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
-
-        Adding a new file, ImageDecoderHaiku.cpp.
-
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Added.
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::asNewNativeImage):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added Haiku-specific files for WebCore/page/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
-
-        Adding three new files, DragControllerHaiku.cpp, EventHandlerHaiku.cpp
-        and FrameHaiku.cpp
-
-        * page/haiku/DragControllerHaiku.cpp: Added.
-        (WebCore::DragController::isCopyKeyDown):
-        (WebCore::DragController::dragOperation):
-        (WebCore::DragController::maxDragImageSize):
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/haiku/EventHandlerHaiku.cpp: Added.
-        (WebCore::isKeyboardOptionTab):
-        (WebCore::EventHandler::invertSenseOfTabsToLinks):
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::focusDocumentView):
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        (WebCore::EventHandler::eventActivatedView):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::createDraggingClipboard):
-        (WebCore::EventHandler::passMousePressEventToSubframe):
-        (WebCore::EventHandler::passMouseMoveEventToSubframe):
-        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
-        (WebCore::EventHandler::accessKeyModifiers):
-        * page/haiku/FrameHaiku.cpp: Added.
-        (WebCore::Frame::dragImageForSelection):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added Haiku-specific files for WebCore/editing/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
-
-        Adding one new file, EditorHaiku.cpp
-
-        * editing/haiku/EditorHaiku.cpp: Added.
-        (WebCore::Editor::newGeneralClipboard):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added Haiku-specific files for WebCore/bindings/js/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
-
-        Adding a new file, ScriptControllerHaiku.cpp
-
-        * bindings/js/ScriptControllerHaiku.cpp: Added.
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added Haiku-specific files for WebCore/platform/text/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
-
-        Adding two new files, StringHaiku.cpp
-        and TextBreakIteratorInternalICUHaiku.cpp
-
-        * platform/text/haiku/StringHaiku.cpp: Added.
-        (WebCore::String::String):
-        (WebCore::String::operator BString):
-        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Added.
-        (WebCore::currentTextBreakLocaleID):
-
-2009-07-16  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Sends the basename of a selected file for non-multipart form submission.
-        <https://bugs.webkit.org/show_bug.cgi?id=26505>
-
-        Test: fast/forms/get-file-upload.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Centralize hidden property names
-        https://bugs.webkit.org/show_bug.cgi?id=27359
-
-        No behavior change.  Just moving these names to a central location.
-        I'll move the rest of our hidden property names as I sweep though the
-        bindings.
-
-        * WebCore.gypi:
-        * bindings/v8/V8HiddenPropertyName.cpp: Added.
-        (WebCore::V8HiddenPropertyName::objectPrototype):
-        (WebCore::V8HiddenPropertyName::isolatedWorld):
-        * bindings/v8/V8HiddenPropertyName.h: Added.
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::getEntered):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::getHiddenObjectPrototype):
-        (WebCore::V8Proxy::installHiddenObjectPrototype):
-
-2009-07-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        REGRESSION (r41238) Repainted portion of a scaled image does not line up with full image
-        https://bugs.webkit.org/show_bug.cgi?id=26747
-        rdar://problem/7009243
-
-        Test: fast/repaint/background-misaligned.html
-
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::drawTiled): Moved a variable definition closer to where
-        it is used.
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw): In the subimage code path, compute a
-        pixel-aligned source rect, because the subiamge is always pixel-aligned
-        in source space, and adjust the destination rect to preserve the
-        source -> destination mapping. Clip to the (original) destination rect
-        to prevent bleeding out.
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::toChromeClientChromium):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-2009-07-16  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Adam Barth.
 
-        Add a sessionStorageEnabled setting to the settings class.
-        https://bugs.webkit.org/show_bug.cgi?id=27318
-
-        Allow LocalStorage to be enabled without enabling SessionStorage at
-        runtime.  There is a settings class setting for localStorage, but not
-        for sessionStorage.  We want to be able to test one of these features
-        without necessarily enabling the other.
-
-        SessionStorage defaults to true so as to not change behavior and
-        because there really aren't any security concerns around SessionStorage
-        (unlike LocalsStorage).  The flag is needed in Chromium only because
-        we want to enable the compile time flag in the default build, but don't
-        want it on by default until it's been thoroughly tested.
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::sessionStorage):  Check the new flag
-        (WebCore::DOMWindow::localStorage):  A bit of cleanup
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):  Default the flag to true
-        (WebCore::Settings::setSessionStorageEnabled):  Add the new flag
-        * page/Settings.h:
-        (WebCore::Settings::sessionStorageEnabled):  Get the new flag
+        [BREWMP] Port PlatformMouseEvent
+        https://bugs.webkit.org/show_bug.cgi?id=34600
 
-2009-07-16  Adam Barth  <abarth@webkit.org>
+        Retrieve the event type, position, key modifiers, time stamp
+        and click count from AEEEvent.
 
-        Unreviewed.
-
-        Revert 45987.  Tests did not pass on Windows.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Added SHARED_WORKER flag to Windows build files, as well as associated .ccp/.h files.
-        Added missing V8 bindings to the AllInOne file
-
-        https://bugs.webkit.org/show_bug.cgi?id=27321
-
-        * WebCore.vcproj/WebCore.vcproj:
-        Added missing files to build.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added missing V8 bindings (V8AbstractWorker.cpp and V8SharedWorker.cpp)
-        * DerivedSources.cpp
-        Added missing JS bindings (JSAbstractWorker.cpp and JSSharedWorker.cpp)
-
-2009-07-16  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by David Levin.
+        * platform/PlatformMouseEvent.h:
+        * platform/brew/PlatformMouseEventBrew.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
 
-        Add a getter in MessagePortChannel for the PlatformMessagePortChannel.
+2010-02-09  Avi Drissman  <avi@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27337
+        Reviewed by Timothy Hatcher.
 
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::channel):
+        [Chromium] RenderTheme does not draw focus rings on SL for checkboxes, radio buttons
+        https://bugs.webkit.org/show_bug.cgi?id=34544
 
-2009-07-16  Xiaomei Ji  <xji@chromium.org>
+        Covered by layout tests when run on SL.
 
-        Reviewed by Darin Adler.
+        * platform/chromium/ThemeChromiumMac.mm:
+        (-[TCMVisibleView _focusRingVisibleRect]):
+        (-[TCMVisibleView _focusRingClipAncestor]):
+        (FocusIndicationFix::currentOSHasSetFocusRingStyleInBitmapBug):
+        (FocusIndicationFix::swizzleFocusView):
+        (FocusIndicationFix::ScopedFixer::ScopedFixer):
+        (FocusIndicationFix::ScopedFixer::~ScopedFixer):
+        (+[NSView TCMInterposing_focusView]):
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        (WebCore::paintButton):
 
-        Fix tooltip does not get its directionality from its element's directionality.
-        https://bugs.webkit.org/show_bug.cgi?id=24187
+2010-02-09  Anton Muhin  <antonm@chromium.org>
 
-        Per mitz's suggestion in comment #6, while getting the plain-text 
-        title, we also get the directionality of the title. How to handle 
-        the directionality is up to clients. Clients could ignore it, 
-        or use attribute or unicode control characters to display the title
-        as what they want.
+        Reviewed by Nate Chapin.
 
-        WARNING: NO TEST CASES ADDED OR CHANGED
+        [v8] Check if returned wrapper is empty before operating on it.
+        https://bugs.webkit.org/show_bug.cgi?id=34746
 
-        * WebCore.base.exp: Replace 2 names due to signature change.
-        * loader/EmptyClients.h: 
-        (WebCore::EmptyChromeClient::setToolTip): Add direction as 2nd parameter.
-        * page/Chrome.cpp:
-        (WebCore::Chrome::setToolTip): Calculate tooltip direction as well and pass it to client to take care when display tooltip.
-        * page/ChromeClient.h: Add direction as 2nd parameter to pure virtual function setToolTip().
-        * page/chromium/ChromeClientChromium.h:
-        (WebCore::ChromeClientChromium::setToolTip): Add setToolTip() 
-        temprarily to make chromium compile after pick up this webkit patch.
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::spellingToolTip): Besides getting the 
-        spelling tooltip, get its directionality as well.
-        (WebCore::HitTestResult::title): Besides getting the title, 
-        get its directionality as well.
-        * rendering/HitTestResult.h: Add 2 more methods.
-
-2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
+        (WebCore::toV8):
 
-        Reviewed by Oliver Hunt.
+2010-02-09  Mikhail Naganov  <mnaganov@chromium.org>
 
-        [CAIRO] pattern of a canvas-element changes after modifications on canvas-element
-        https://bugs.webkit.org/show_bug.cgi?id=20578
+        Reviewed by Pavel Feldman.
 
-        Copy pixel image in ImageBuffer::image() just like CG and Skia glue.
+        Continuing debugger and profiler unforking: narrow scope of JSC-specific ifdefs.
+        Also, enable JAVASCRIPT_DEBUGGER explicitly in features, it appears to be required
+        for really enabling it in V8 bindings generation.
 
-        Test: fast/canvas/canvas-pattern-modify.html
+        https://bugs.webkit.org/show_bug.cgi?id=34706
 
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (copySurface):
-        (WebCore::ImageBuffer::image):
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * page/Console.idl:
 
-2009-07-16  David Hyatt  <hyatt@apple.com>
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Beth Dakin.
+        Rubber Stamped by Geoff Garen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27353
-        Images mispositioned because of bug in percentage-based relative positioning.
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
 
-        Added fast/css/nested-floating-relative-position-percentages.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator+=):
 
-2009-07-16  Kent Tamura  <tkent@chromium.org>
+2010-02-09  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Anders Carlsson.
 
-        Sends the basename of a selected file for non-multipart form submission.
-        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+        <rdar://problem/7400160> Netscape plug-ins are not instantiated on property access if there are pending stylesheets
+        https://bugs.webkit.org/show_bug.cgi?id=34776
 
-        Test: fast/forms/get-file-upload.html
+        Tests: plugins/instance-available-before-stylesheets-loaded-object.html
+               plugins/instance-available-before-stylesheets-loaded.html
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings): Call
+        updateLayoutIgnorePendingStylesheets() before checking for a renderer. 
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings): Ditto.
 
-2009-07-16  Simon Fraser  <simon.fraser@apple.com>
+2010-02-09  Alejandro G. Castro  <alex@igalia.com>
 
         Reviewed by Darin Adler.
 
-        Video size sometimes jumps just after the video starts loading
-        https://bugs.webkit.org/show_bug.cgi?id=27352
+        Problems navigating by caret in links whose text wraps onto
+        subsequent lines.
+        https://bugs.webkit.org/show_bug.cgi?id=25676
 
-        Ensure that the media player is at or after the 'HaveMetadata' state so that
-        the instrinsic size is known before we create the layer for video. This avoids
-        a flash caused by computing the video rect using the default intrinsic size, and then
-        re-computing it when that size changes.
-        
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::isReadyForRendering):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        We should not search ahead if we are not in the last element.
 
-2009-07-16  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Antti Koivisto.
-        Patch by Brady Eidson and Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496
-        <rdar://problem/7065391> Microsoft Outlook Web Access fails because XHR stream connection blocks script loading/revalidation
-
-        After refreshing a page and when all CachedResources on that page are in validation mode, they got an exemption
-        from the connection-per-host limit.  Removing that exemption makes the test case load smoothly after reloads.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests): Remove the resourceIsCacheValidator exemption to the connection-per-host limit.
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] V8IsolatedWorld::evaluate needs to call didCreateIsolatedScriptContext
-        https://bugs.webkit.org/show_bug.cgi?id=27335
+        * dom/Position.cpp:
 
-        evaluateInNewContext makes this delegate call.  evaluateInNewWorld
-        needs to make the same call.  This does not appear to be testable with
-        our current technology.
+2010-02-09  Dirk Schulze  <krit@webkit.org>
 
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
+        Reviewed by Nikolas Zimmermann.
 
-2009-07-15  Jakub Wieczorek  <faw217@gmail.com>
+        More optimization for AffineTransform with SVG
+        https://bugs.webkit.org/show_bug.cgi?id=34774
+
+        Some optimizations to safe unnecessary summations and multiplications.
+        Optimize AffineTransform to handle an identity or translation matrix
+        more efficient.
+        Added translationRight to avoid multiplications of matrices as much as
+        possible.
+
+        No tests added, no change of functionality.   
+
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::translateRight):
+        * platform/graphics/transforms/AffineTransform.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::applyTextLengthCorrectionToTextChunk):
 
-        Reviewed by Simon Hausmann.
+2010-02-09  Dirk Schulze  <krit@webkit.org>
 
-        Fix a typo: application/atom=xml -> application/atom+xml.
+        Reviewed by Nikolas Zimmermann.
 
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::checkStyleSheet):
+        SVG patterns with some scale patternTransform are not displayed correctly for small elements
+        https://bugs.webkit.org/show_bug.cgi?id=25484
 
-2009-07-16  Dean McNamee  <deanm@chromium.org>
+        SVG Pattern size was clipped to the size of the target, if the pattern is bigger than the target. This
+        causes problems, if the patternTransform scales the pattern. This patch deletes the clipping.
 
-        Reviewed by Oliver Hunt.
+        Tests: svg/custom/pattern-excessive-malloc.svg
+               svg/custom/pattern-size-bigger-than-target-size.svg
+               svg/custom/pattern-skew-transformed.svg
 
-        https://bugs.webkit.org/show_bug.cgi?id=27292
-        Improve handling of <canvas> path operations on an empty path.
-        Implement Skia's Path::hasCurrentPoint().
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::hasCurrentPoint):
+2010-02-09  Darin Adler  <darin@apple.com>
 
-2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange): Fixed typo in comment.
 
-        Reviewed by Eric Seidel.
+2010-02-09  MORITA Hajime  <morrita@gmail.com>
 
-        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
-        https://bugs.webkit.org/show_bug.cgi?id=26254
+        Reviewed by Nikolas Zimmermann.
 
-        Make it so that setting white-space and word-wrap via CSS
-        overrides the wrap attribute.
+        SVG selection text foreground colour does not respect user settings
+        https://bugs.webkit.org/show_bug.cgi?id=15997
 
-        This involves having the shadow div in the textarea inherit
-        the CSS from its parent instead of hard-coding it in
-        RenderTextControlMultiline.
+        Add two subphases SVGTextPaintSubphaseGlyphFillSelection and
+        SVGTextPaintSubphaseGlyphStrokeSelection for painting selected
+        text on SVG. Selected texts are painted with style from
+        getCachedPseudoStyle() instead of style().
         
-        Committer note: Earlier I reverted this change because I did it incorrectly
-        by leaving out css/html.css. In the patch, the filename was the old name
-        css/html4.css and that led to my error.
-
-        * css/html.css:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-07-15  James Hawkins  <jhawkins@google.com>
+        Tests: svg/text/selection-styles.xhtml
 
-        Reviewed by Adam Barth.
-
-        [V8] Remove a local variable that is shadowing a function parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=27309
-
-        No test required as this modification does not change the current behavior.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-
-2009-07-15  Adam Langley  <agl@google.com>
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        (WebCore::SVGTextChunkWalker::setupFillSelection):
+        (WebCore::SVGTextChunkWalker::setupStrokeSelection):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::mayHaveSelection):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillSelectionCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeSelectionCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::activePaintServer):
+        (WebCore::SVGRootInlineBox::paint):
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::):        
+        Add callback hooks and its implementation for handle new
+        subphases.
+        
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::chunkSelectionStartEnd):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        Split box text into selected part and non-selected part, and use
+        separate subphases to paint them.
+        
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+        Relax ASSERT() condition to accept a part of text.
+        
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::SVGPaintServer::setup):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+        * svg/graphics/SVGPaintServerSolid.h:
+        Change setup() signature to accept RenderStyle instead of always
+        using RenderObject::style().
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        No scroll bars are displayed for standalone SVG image
+        https://bugs.webkit.org/show_bug.cgi?id=11225
+
+        Height and width defined for svg element are not honored
+        https://bugs.webkit.org/show_bug.cgi?id=24033
+
+        SVG file does not pan and has no scroll bars
+        https://bugs.webkit.org/show_bug.cgi?id=24448
+
+        Adapt to SVG 1.1 errata to change the overflow handling:
+        Replace "svg { overflow: hidden }"  by "svg:not(:root) { overflow: hidden }" to allow standalone SVG documents to contain scrolllbars.
+        Agreed by SVG WG to make this the default behaviour, already implemented by Opera & FireFox (partial support).
+
+        Add new tests in svg/overflow covering all special SVG css overflow handling rules on inner/outer svg elements.
+
+        Tests: svg/overflow/overflow-on-inner-svg-element-defaults.svg
+               svg/overflow/overflow-on-inner-svg-element.svg
+               svg/overflow/overflow-on-outermost-svg-element-defaults.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-1.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-2.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-3.svg
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-auto.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-defaults.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-hidden.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-scroll.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-visible.xhtml
+
+        * css/svg.css: Change default <svg> overflow rule to only apply to inner <svg> elements.
+        * page/FrameView.cpp: 
+        (WebCore::FrameView::layout): Only apply overflow rules for non-standalone SVG documents.
+        * rendering/RenderSVGRoot.cpp: Remove all calls to isOverflowHidden - it's always the case for the outermost SVG element, see spec + errata.
+        (WebCore::RenderSVGRoot::paint): Always clip to initial viewport size.
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Ditto.
+        (WebCore::RenderSVGRoot::nodeAtPoint): Simplify.
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Use isOverflowHidden() instead of a manual oveflow query and clip in float precision.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::isOverflowHidden): Simplify implementation, assure the function is not called anymore for RenderSVGRoot objects.
 
-        No review: reverting previous change.
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
-        Revert r45959:
+        Reviewed by Eric Seidel.
 
-        2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
-        Reviewed by Dimitri Glazkov.
+        [BREWMP] Port KURL::fileSystemPath
+        https://bugs.webkit.org/show_bug.cgi?id=34516
 
-        Adding the Win SQLite VFS implementation for Chromium.
+        Convert a file URL to a file path by prefixing
+        AEEFS_HOME_DIR to access files relative to the current
+        module directory in a case-sensitive manner.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26940
+        As IWeb "file:" engine opens files in BREW's application-relative
+        file namespace, we follow the same policy here.
 
+        * platform/brew/KURLBrew.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
 
-        The Chromium side of this patch was landed in 20839, but broke the build. It
-        was reverted in r20840. Thus, I'm reverting this side of the patch too.
+2010-02-09  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Removed.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-07-15  David Levin  <levin@chromium.org>
+        [Qt] the above website does not render properly when in compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=34681
 
-        Layout test fix, reverting previous change.
+        http://media.24ways.org/2009/15/spinner-alt.html now renders correctly
 
-        Reverting r45962 as it caused several layout test failures.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::MaskEffectQt::MaskEffectQt): implement mask as
+        QGraphicsEffect
+        (WebCore::MaskEffectQt::draw): reimp
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl): init the effect
+        (WebCore::GraphicsLayerQtImpl::paint): no need for drawContents
+        (WebCore::GraphicsLayerQtImpl::flushChanges): make sure to update the
+        mask layer, not just the actual children
 
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-08  Shinichiro Hamaji  <hamaji@chromium.org>
+        Reviewed by Laszlo Gombos.
 
-        Reviewed by Eric Seidel.
+        [BREWMP] Fix macro redefinition error in BREWMP simulator build.
+        https://bugs.webkit.org/show_bug.cgi?id=34738
 
-        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
-        https://bugs.webkit.org/show_bug.cgi?id=26254
+        Remove warning: 'FAR' macro redefinition.
 
-        Make it so that setting white-space and word-wrap via CSS
-        overrides the wrap attribute.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
 
-        This involves having the shadow div in the textarea inherit
-        the CSS from its parent instead of hard-coding it in
-        RenderTextControlMultiline.
+2010-02-07  Yuzo Fujishima  <yuzo@google.com>
 
-        * css/html4.css:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        Reviewed by Dan Bernstein.
 
-2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+        Fix the following bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=18926 - dt:after generate a line break. Boost documentation page renders poorly
+        https://bugs.webkit.org/show_bug.cgi?id=7276 - Most W3C padding related tests fail
 
-        Reviewed by Dimitri Glazkov.
+        Tests: fast/css/inline-element-line-break.html
+               fast/css/pseudo-element-line-break.html
 
-        Adding the Win SQLite VFS implementation for Chromium.
+        findNextLineBreak() unconditionally allowed lines to break between elements when no other line breaking opportunity had been found,
+        but that was unnecessary and led to incorrect layout. Disallow that kind of line breaks.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26940
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+2010-02-09  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-07-15  Jian Li  <jianli@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by David Levin.
+        Provide a way to get total number of pages to be printed
+        https://bugs.webkit.org/show_bug.cgi?id=34699
 
-        Bug 25151 - workers that fail to load scripts not firing error event.
-        https://bugs.webkit.org/show_bug.cgi?id=25151
+        Test: printing/numberOfPages.html
 
-        This fixes the problem that an error event is not fired when the worker
-        script fails to load. Some reasons this may occur are an invalid URL for
-        the worker script or a cross-origin redirect.
+        * WebCore.base.exp:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageNumberForElement):
+        (WebCore::PrintContext::numberOfPages):
+        * page/PrintContext.h:
+        (WebCore::PrintContext::pageRects):
 
-        We also moves the code to complete the URL and check its origin from
-        Worker constructor to WorkerScriptLoader loading functions in order to
-        move the exception throwing logic out of the scope of Worker constructor.
-        Due to this change, we also remove the output ExceptionCode parameter
-        in the worker constructor. Corresponding JS/V8 binding codes have been
-        updated to reflect this change.
+2010-02-08  Dominic Cooney  <dominicc@google.com>
 
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        (WebCore::Worker::create):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::toCrossOriginRedirectPolicy):
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::notifyLoadErrorTask):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        (WebCore::WorkerScriptLoader::didFail):
-        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
-        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
-        (WebCore::WorkerScriptLoader::notifyError):
-        * workers/WorkerScriptLoader.h:
-        (WebCore::):
-        (WebCore::WorkerScriptLoader::url):
+        Reviewed by Adam Barth.
 
-2009-07-15  Dan Bernstein  <mitz@apple.com>
+        [V8] Move Element custom methods into generic bindings
 
-        Reviewed by Dave Hyatt.
+        This patch moves the security checks in setAttribute,
+        setAttributeNode, setAttributeNS and setAttributeNodeNS from
+        V8ElementCustom into the generic bindings so that they can be
+        reused in other bindings. This is in a similar vein to
+        <https://bugs.webkit.org/attachment.cgi?id=45872>.
 
-        text-shadow is not drawn for text with transparent colour
-        https://bugs.webkit.org/show_bug.cgi?id=21374
+        https://bugs.webkit.org/show_bug.cgi?id=34554
 
-        Test: fast/text/shadow-translucent-fill.html
+        LayoutTests: None
 
-        * rendering/InlineTextBox.cpp:
-        (WebCore::paintTextWithShadows): If the text fill color is not opaque,
-        paint all shadows separately from the text, by casting them from
-        clipped-out opaque text.
+        * WebCore.gypi:
+        * bindings/generic/BindingElement.h: Added.
+        (WebCore::::setAttribute):
+        (WebCore::::setAttributeNode):
+        (WebCore::::setAttributeNS):
+        (WebCore::::setAttributeNodeNS):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::V8Element::setAttributeCallback):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNSCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
 
-2009-07-15  Adam Treat  <adam.treat@torchmobile.com>
+2010-02-08  Hayato Ito  <hayato@chromium.org>
 
-        Fix the Qt build.
+        Reviewed by Darin Adler.
 
-        * html/HTMLAreaElement.cpp:
+        Schedule a loading request when there are many in-flight requests beyond
+        the limit to avoid forever page loading.
 
-2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=31227
 
-        Reviewed by Darin Fisher.
+        Test: http/tests/loading/load-javascript-after-many-xhrs.html
 
-        Cleanup DOM Storage dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=27180
-
-        DOM Storage had several unnecessary (and probably unintended)
-        dependencies.  This patch replaces many includes of header files with
-        forward declaration of classes, making some destructors explicit, and
-        taking some factories out of the header files.
-
-        This will allow things like StorageAreaSync to take a StorageAreaImpl*
-        (as it should) rather than a StorageArea* which previously weren't
-        possible because the dependencies were such a tangled mess.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::~LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        (WebCore::Storage::~Storage):
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageEvent.h:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        * storage/StorageSyncManager.h:
-
-2009-07-15  Chris Marrin  <cmarrin@apple.com>
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
 
-        Reviewed by Simon Fraser.
+2010-02-08  David Levin  <levin@chromium.org>
 
-        Incorrect animation when trying to duplicate effect of transform-origin
-        https://bugs.webkit.org/show_bug.cgi?id=27310
+        Reviewed by Gavin Barraclough.
 
-        The bug is that matrix animation is being used when animating
-        a list of transform functions that match in the from and to states.
-        This sometimes works. But because of the way CA does matrix animation
-        function lists like the one shown in the testcase animate incorrectly.
+        REGRESSION (before r54472): Various tests in fast/workers are crashing on the buildbot.
+        https://bugs.webkit.org/show_bug.cgi?id=34728
 
-        This fixes the bug by always doing component animation
-        as long as the function lists match. This allows CA
-        to animate the components and then recompose the result
-        into the correct matrix.
+        The core part of the fix is to change WebCoreJSClientData::m_normalWorld
+        from DOMWrapperWorld to RefPtr<DOMWrapperWorld> so that the DOMWrapperWorld
+        is really ref counted.
 
-        Test: animations/transform-origin-vs-functions.html
+        No new tests because current tests sufficiently cover this as evidenced as
+        the buildbot crashes.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld): Made this robust to m_globalData
+        being 0.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::create): Made this class follow the standard
+        create pattern for RefCounted classes.
+        (WebCore::DOMWrapperWorld::detachFromGlobalData): Since this class can
+        now outlive JSGlobalData, this method tells it to stop using its JSGlobalData.
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData): Adjusted due to
+        m_normalWorld being a RefPtr.
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData): Ditto (and added
+        asserts for the FIXME).
+        (WebCore::WebCoreJSClientData::normalWorld): Ditto.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::IsolatedWorld::create): Made the constructor protected.
+        (WebCore::IsolatedWorld::IsolatedWorld): Made the constructor protected, so
+        that code would have to use the create method.
 
-2009-07-15  Albert J. Wong  <ajwong@chromium.org>
+2010-02-08  Kinuko Yasuda  <kinuko@chromium.org>
 
         Reviewed by David Levin.
 
-        Upstream the V8NPObject and NPV8Object build changes for WebCore.gypi.
-
-        Add upstreamed V8 bindings files into WebCore.gypi so they can be seen
-        downstream
-        https://bugs.webkit.org/show_bug.cgi?id=27274
-
-        Changes the build file for chromium.  Test built the chromium tree
-        to verify.
-
-        * WebCore.gypi:
-
-2009-07-15  Mark Rowe  <mrowe@apple.com>
-
-        I like it when the code compiles.
-
-        * WebCore.base.exp:
-
-2009-07-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
+        Remove special utf-8 tag from Chromium cilpboard code because
+        we now have the corresponding code in generic clipboard framework
+        code in chromium (since it's needed by other places than in Web
+        page rendering) and no longer need the separate workaround code in
+        WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=34567
 
-        Renamed parseURL to deprecatedParseURL.
+        Test: (for regression) editing/pasteboard
 
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::setValue): Renamed.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::allowSettingSrcToJavascriptURL): Renamed.
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::allowSettingJavascriptURL): Renamed.
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc): Renamed.
-        * bindings/objc/DOM.mm:
-        (-[DOMElement _getURLAttribute:]): Renamed.
-        * bindings/objc/DOMHTML.mm:
-        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Renamed.
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::allowSettingFrameSrcToJavascriptUrl): Renamed.
-        * css/CSSHelper.cpp:
-        (WebCore::deprecatedParseURL): Renamed.
-        * css/CSSHelper.h: Renamed and updated comment.
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::defaultEventHandler): Renamed.
-        (WebCore::HTMLAnchorElement::parseMappedAttribute): Renamed.
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::parseMappedAttribute): Renamed.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute): Renamed.
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseMappedAttribute): Renamed.
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::parseMappedAttribute): Renamed.
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Renamed.
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute): Renamed.
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::sourceURI): Renamed.
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::parseMappedAttribute): Renamed.
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute): Renamed.
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::parseMappedAttribute): Renamed.
-        * html/HTMLTablePartElement.cpp:
-        (WebCore::HTMLTablePartElement::parseMappedAttribute): Renamed.
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseTag): Renamed.
-        * html/PreloadScanner.cpp:
-        (WebCore::PreloadScanner::processAttribute): Renamed.
-        (WebCore::PreloadScanner::emitCSSRule): Renamed.
         * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::declareAndWriteDragImage): Renamed.
+        (WebCore::ClipboardChromium::writeRange):
         * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage): Renamed.
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage): Renamed.
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::declareAndWriteDragImage): Renamed.
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteImageURL): Renamed.
-        (WebCore::HitTestResult::absoluteMediaURL): Renamed.
-        (WebCore::HitTestResult::absoluteLinkURL): Renamed.
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler): Renamed.
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::sourceURI): Renamed.
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::defaultEventHandler): Renamed.
-        * wml/WMLImageLoader.cpp:
-        (WebCore::WMLImageLoader::sourceURI): Renamed.
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::documentFragment):
 
-2009-07-15  Darin Adler  <darin@apple.com>
+2010-02-08  Darin Adler  <darin@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        CSSHelper.h's parseURL is a function that no one should ever call
-        Part 1: Eliminate callers in the CSS parser.
-        https://bugs.webkit.org/show_bug.cgi?id=26599
-
-        Test: fast/css/uri-token-parsing.html
+        Crash due to layout not done in case involving removal of absolute positioning
+        https://bugs.webkit.org/show_bug.cgi?id=34734
+        rdar://problem/7588280
 
-        * css/CSSHelper.h: Added a comment explaining why nobody should ever call this
-        function. A FIXME suggests a next step, which would be to rename it deprecatedParseURL.
+        Test: fast/dynamic/position-change-layout.html
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Removed unneeded call to parseURL;
-        CSSParser::text already takes care of parsing the URI token syntax, and the
-        parseURL function does no good.
-        (WebCore::CSSParser::parseContent): Ditto.
-        (WebCore::CSSParser::parseFillImage): Ditto.
-        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
-        (WebCore::CSSParser::parseBorderImage): Ditto.
-        (WebCore::isCSSWhitespace): Added. Helper function that makes the text function
-        easier to read.
-        (WebCore::CSSParser::text): Tweak logic so that leading and trailing whitespace
-        are both trimmed before removing the quote marks. Changed to use the
-        isCSSWhitespace, isASCIIHexDigit, and toASCIIHexValue functions for clarity.
-
-        * css/CSSParser.h: Removed stray "public:" in this header.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::substring): Optimized the case where the substring covers
-        the entire string, so we just share the StringImpl instead of making a new one.
-        This case came up in earlier versions of the CSS parser changes above.
-        (WebCore::StringImpl::substringCopy): Streamlined the logic here and made it
-        not call substring any more. Before, this was relying on the substring function
-        always making a copy of any non-empty substring.
-
-2009-07-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by John Sullivan.
-
-        After double-clicking a word, using Shift-arrow to select behaves unpredictably
-        https://bugs.webkit.org/show_bug.cgi?id=27177
-        rdar://problem/7034324
-
-        Test: editing/selection/extend-selection-after-double-click.html
-
-        The bug was due to the m_lastChangeWasHorizontalExtension flag, which was not
-        being cleared in many cases where it should have been.
-
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::setSelection): Set m_lastChangeWasHorizontalExtension
-        to false. This catches all sorts of cases that don't flow through the modify function.
-        Before, the flag would reflect the last call to the modify function, which was not
-        necessarily the last selection change.
-        (WebCore::SelectionController::willBeModified): Rearrange function for clarity.
-        Remove code that sets m_lastChangeWasHorizontalExtension; that is now handled elsewhere. 
-        (WebCore::SelectionController::modify): Call setLastChangeWasHorizontalExtension after
-        setSelection when setting up a trial selection controller, since setSelection now
-        clears that flag. Also changed both trial selection controller cases to set the flag,
-        although it's not strictly necessary in both cases. Added code to set
-        m_lastChangeWasHorizontalExtension when extending the selection, which used to be
-        handled in willBeModified. Now we need to do it after the selection change.
-
-2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Need to update DOM Storage files in GYPI file.
-        https://bugs.webkit.org/show_bug.cgi?id=27317
-
-        Need to update DOM Storage files in the GYPI file.  They're pretty out
-        of date and we're on the path towards enabling them for everyone!
-
-        * WebCore.gypi:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange): Call markContainingBlocksForLayout in
+        a case where the object already needs layout, but might have a new containing
+        block and so needs to mark the new containing block.
 
-2009-07-15  Kwang Yul Seo  <skyul@company100.net>
+2010-02-08  Charlie Reis  <creis@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26794
-        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        onbeforeunload not called at window close + frame or iframe focused
+        https://bugs.webkit.org/show_bug.cgi?id=27481
         
-        Define YYMALLOC and YYFREE to fastMalloc and fastFree
-        respectively.
+        Chromium and WebKit on Windows will now fire beforeunload handlers
+        even if an inner frame is focused.  
 
-        * css/CSSGrammar.y:
-        * xml/XPathGrammar.y:
-
-2009-07-15  David Hyatt  <hyatt@apple.com>
+        Layout tests aren't able to test this bug, since it requires closing
+        the actual browser window, not calling window.close().  Instead,
+        test with WebCore/manual-tests/onbeforeunload-focused-iframe.html.
 
-        Reviewed by Adam Roben.
+        * manual-tests/onbeforeunload-focused-iframe.html: Added.
+        * manual-tests/resources/focused-iframe.html: Added.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27193
-        Don't run in to anonymous blocks.  No other browsers do this, and our implementation of run-in
-        is effectively broken as a result.
+2010-02-08  Alexey Proskuryakov  <ap@apple.com>
 
-        No new tests. Changed fast/runin/001.html and fast/runin/generated.html to match new behavior.
+        Addressing review feedback.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::handleRunInChild):
+        * bridge/c/c_instance.h: Removed argument name.
 
-2009-07-15  Yuzo Fujishima  <yuzo@google.com>
+2010-02-08  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
 
-        Test: fast/js/instanceof-operator.html
-
-        Fix for: Bug 25205 -  XMLHttpRequest instance is not an instanceof XMLHttpRequest
-        https://bugs.webkit.org/show_bug.cgi?id=25205
+        https://bugs.webkit.org/show_bug.cgi?id=34727
+        Assertion crashes and freezes when plug-in property access results in an exception
 
-        In addition to for XMLHttpRequest, this also fixes for:
-        - Audio
-        - Image
-        - MessageChannel
-        - Option
-        - WebKitCSSMatrix
-        - WebKitPoint
-        - Worker
-        - XSLTProcessor
+        Test: plugins/netscape-plugin-property-access-exception.html
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMConstructorObject::createStructure):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
-        * bindings/js/JSWebKitCSSMatrixConstructor.h:
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
-        * bindings/js/JSWebKitPointConstructor.h:
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
-        * bindings/js/JSWorkerConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.h:
-
-2009-07-15  Kai Br�ning  <kai@granus.net>
+        * bridge/c/c_instance.h: Made moveGlobalExceptionToExecState public, since it also need to
+        be called from CField.
 
-        Reviewed by Dave Hyatt.
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance): Call moveGlobalExceptionToExecState(). Without
+        this, not only didn't we get exceptions, but we also got an assertion failure because of
+        dangling global exception on next call into plug-in.
+        (JSC::Bindings::CField::setValueToInstance): Ditto.
 
-        CSS21 attribute selectors not dynamic for xml.
-        https://bugs.webkit.org/show_bug.cgi?id=25072
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-        Moved the relevant test in StyledElement::attributeChanged()
-        to a new function Element::recalcStyleIfNeededAfterAttributeChanged()
-        so it can be called from both StyledElement::attributeChanged()
-        and Element::attributeChanged().
-        Refactored Element::attributeChanged() into
-        Element::updateAfterAttributeChanged() and
-        Element::recalcStyleIfNeededAfterAttributeChanged(), which are called
-        separately from StyledElement::attributeChanged().
+        Unreviewed build fix of ChromiumWin.
 
-        Test: fast/css/attribute-selector-dynamic.xml
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        * platform/graphics/chromium/TransparencyWin.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
 
-        * dom/Element.cpp:
-        (WebCore::Element::attributeChanged):
-        (WebCore::Element::updateAfterAttributeChanged):
-        (WebCore::Element::recalcStyleIfNeededAfterAttributeChanged):
-        * dom/Element.h:
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::attributeChanged):
+2010-02-05  Dumitru Daniliuc  <dumi@chromium.org>
 
-2009-07-15  Alpha Lam  <hclam@chromium.org>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by David Levin.
+        Adding a way to get the set of all open database handles pointing
+        to a given database.
+        https://bugs.webkit.org/show_bug.cgi?id=34619
 
-        [V8] Layout test failures for drawImage in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=27311
+        Sometimes we need to be able to close all handles to a database as
+        soon as possible (to delete the DB file, for example).
 
-        Fixing several canvas layout tests failures due to a
-        missing return statement in CanvasRenderingContext2DDrawImage() which
-        was accidentally removed in r45929.
-
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getOpenDatabases):
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::getOpenDatabases):
 
-2009-07-15  Robert Hogan  <robert@roberthogan.net>
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Unreviewed windows build-fix.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26969
+        * page/win/FrameCGWin.cpp:
+        (WebCore::drawRectIntoContext):
 
-        If the httpMethod() of the request passed to SubresourceLoader::create is not
-        supported by the client we must expect to call didFail() while m_loader is still null.
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-        * loader/DocumentThreadableLoader.cpp:
-        (DocumentThreadableLoader::didFail):Changed.
+        Reviewed by Nikolas Zimmermann.
 
-2009-07-15  Mark Rowe  <mrowe@apple.com>
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        Fix the Mac build.
+        This adds back AffineTransform. This saves additional 4% memory consumption
+        on the 50k rects stress test: https://bugs.webkit.org/attachment.cgi?id=46721
+        It also makes it possible to optimize the calculations internally of
+        AffineTransform to the needs of 2D transformations (the second benefit for SVG,
+        which uses transformations relative often at the moment.
+        Everything that is 2D related (like images, patterns, gradients, fonts), uses
+        AffineTransform now.
 
-        * WebCore.base.exp:
-        * css/MediaQueryEvaluator.cpp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::V8SVGMatrix::multiplyCallback):
+        (WebCore::V8SVGMatrix::inverseCallback):
+        (WebCore::V8SVGMatrix::rotateFromVectorCallback):
+        * html/HTMLCanvasElement.cpp: Changed to AffineTransform now
+        (WebCore::HTMLCanvasElement::baseTransform):
+        * html/HTMLCanvasElement.h:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::matrixTransform):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::gradientSpaceTransform):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::baseTransform):
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::setPatternSpaceTransform):
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::create):
+        (WebCore::Pattern::tileImage):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformPattern):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::makeIdentity): needed by some parts of WebCore
+        (WebCore::AffineTransform::scale): Didn't scale the complete matrix
+        (WebCore::AffineTransform::translate): Didn't respect other transformations
+        (WebCore::AffineTransform::shear): direct calculation, no extra multiply of matrices
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::isIdentityOrTranslation):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::toAffineTransform):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/wince/FontWince.cpp:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wince/PathWince.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wince/PlatformPathWince.cpp:
+        (WebCore::drawPolygons):
+        (WebCore::PathPolygon::transform):
+        (WebCore::PlatformPathElement::transform):
+        (WebCore::PlatformPath::strokePath):
+        (WebCore::PlatformPath::fillPath):
+        (WebCore::PlatformPath::transform):
+        * platform/graphics/wince/PlatformPathWince.h:
+        (WebCore::):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wx/PathWx.cpp:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozillaGtkWidget):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localTransform):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::transform):
+        (WebCore::RenderBoxModelScaleData::setTransform):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::localTransform):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localTransform):
+        (WebCore::RenderObject::localToParentTransform):
+        (WebCore::RenderObject::absoluteTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::localTransform):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::localTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        (WebCore::RenderSVGText::localTransform):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        (WebCore::RenderSVGTransformableContainer::localTransform):
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::markerBoundaries):
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation):
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        (WebCore::RenderSVGViewportContainer::absoluteTransform):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGChar::characterTransform):
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::operator()):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::calculateGlyphBoundaries):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxSelectionRectWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGMarkerLayoutInfo.h:
+        (WebCore::MarkerLayout::MarkerLayout):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::applyTransformToPaintInfo):
+        * rendering/SVGRenderSupport.h:
         * rendering/SVGRenderTreeAsText.cpp:
-        * rendering/style/SVGRenderStyle.cpp:
-        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::operator<<):
+        * rendering/SVGRenderTreeAsText.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::applyTextLengthCorrectionToTextChunk):
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::applyTransform):
+        * rendering/TransformState.h:
+        * svg/GradientAttributes.h:
+        (WebCore::GradientAttributes::gradientTransform):
+        (WebCore::GradientAttributes::setGradientTransform):
+        * svg/PatternAttributes.h:
+        (WebCore::PatternAttributes::patternTransform):
+        (WebCore::PatternAttributes::setPatternTransform):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::resetToBaseValue):
+        (WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateMotionElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::supplementalTransform):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::getCTM):
+        (WebCore::SVGLocatable::getScreenCTM):
+        (WebCore::SVGLocatable::getTransformToElement):
+        * svg/SVGLocatable.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMatrix.idl:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::viewport):
+        (WebCore::SVGSVGElement::createSVGMatrix):
+        (WebCore::SVGSVGElement::createSVGTransformFromMatrix):
+        (WebCore::SVGSVGElement::getCTM):
+        (WebCore::SVGSVGElement::getScreenCTM):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        (WebCore::SVGStyledLocatableElement::getCTM):
+        (WebCore::SVGStyledLocatableElement::getScreenCTM):
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::getCTM):
+        (WebCore::SVGStyledTransformableElement::getScreenCTM):
+        (WebCore::SVGStyledTransformableElement::animatedLocalTransform):
+        (WebCore::SVGStyledTransformableElement::supplementalTransform):
+        * svg/SVGStyledTransformableElement.h:
+        (WebCore::SVGStyledTransformableElement::isStyledTransformable):
+        (WebCore::SVGStyledTransformableElement::toPathData):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::getScreenCTM):
+        (WebCore::SVGTextElement::getCTM):
+        (WebCore::SVGTextElement::animatedLocalTransform):
+        (WebCore::SVGTextElement::supplementalTransform):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTransform.cpp:
+        (SVGTransform::SVGTransform):
+        (SVGTransform::matrix):
+        (SVGTransform::setMatrix):
+        * svg/SVGTransform.h:
+        * svg/SVGTransformDistance.cpp:
+        (WebCore::SVGTransformDistance::SVGTransformDistance):
+        (WebCore::SVGTransformDistance::scaledDistance):
+        (WebCore::SVGTransformDistance::isZero):
+        * svg/SVGTransformDistance.h:
+        * svg/SVGTransformList.cpp:
+        (SVGTransformList::createSVGTransformFromMatrix):
+        (SVGTransformList::concatenate):
+        (SVGTransformList::valueAsString):
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::SVGTransformable::getCTM):
+        (WebCore::SVGTransformable::getScreenCTM):
+        (WebCore::SVGTransformable::parseTransformValue):
+        * svg/SVGTransformable.h:
+        (WebCore::SVGTransformable::):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::gradientTransform):
+        (WebCore::SVGPaintServerGradient::setGradientTransform):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::patternTransform):
+        (WebCore::SVGPaintServerPattern::setPatternTransform):
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::applyClip):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::markerTransformation):
+        (WebCore::SVGResourceMarker::draw):
+        * svg/graphics/SVGResourceMarker.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
 
-2009-07-07  Alpha Lam  <hclam@chromium.org>
+2010-02-08  Stephen White  <senorblanco@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] drawImage method of HTMLCanvasElement to accept HTMLVideoElement as argument
-        https://bugs.webkit.org/show_bug.cgi?id=27170
+        Make an inline function containing a static var out-of-line.  This is
+        a workaround for Xcode 3.1 bug radar 7070016.  We tripped on this in
+        deviceRGBColorSpaceRef on the Chromium canaries.  This is a proactive
+        fix for the same problem in sRGBColorSpaceRef().
 
-        Changed CanvasRenderingContext2DDrawImage() to accept HTMLVideoElement
-        as a parameter of drawImage() for HTMLCanvasElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34663
 
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
 
-2009-07-15  Adam Barth  <abarth@webkit.org>
+2010-02-08  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] Fix isolated world constructors
-        https://bugs.webkit.org/show_bug.cgi?id=27287
+        [V8] Unify the WorkerContext V8 object wrapping code with
+        the standard V8 object wrapping code.
 
-        Don't enter V8Proxy::m_context before creating DOM constructors.
-        Instead, use getWrapperContext to get the right context.
-
-        After this patch, all my tests pass.  I'll enable the feature
-        downstream and land the tests.
+        https://bugs.webkit.org/show_bug.cgi?id=34658
 
         * bindings/scripts/CodeGeneratorV8.pm:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createWrapperFromCache):
-        (WebCore::V8Proxy::isContextInitialized):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::installDOMWindow):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::getHiddenObjectPrototype):
-        (WebCore::V8Proxy::installHiddenObjectPrototype):
-        * bindings/v8/V8Proxy.h:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::toV8):
 
-2009-07-15  Antonio Gomes   <antonio.gomes@openbossa.org>
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Darin Adler.
 
-        useless null-check statement in visible_units.cpp@logicalStartOfLine
-        https://bugs.webkit.org/show_bug.cgi?id=27154
+        Use fastStrDup instead of strdup
+        https://bugs.webkit.org/show_bug.cgi?id=33943
 
-        Simple fix.
+        Replace strdup/free with fastStrDup/fastFree.
 
-        * editing/visible_units.cpp:
-        (WebCore::logicalStartOfLine): Doubled honorEditableBoundaryAtOrAfter() call removed.
-
-2009-07-15  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27304
-        WebKit should provide usage and eligibility information about the page cache.
-
-        * WebCore.base.exp:
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::childFrameCount):
-        * history/CachedFrame.h:
-
-        * history/PageCache.cpp:
-        (WebCore::PageCache::frameCount):
-        (WebCore::PageCache::autoreleasedPageCount):
-        * history/PageCache.h:
-        (WebCore::PageCache::pageCount):
-
-2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Levin.
-
-        Chromium's canvas forgets its context after fillText again
-        https://bugs.webkit.org/show_bug.cgi?id=27293
-
-        No new tests because the test for this was already added in
-        https://bugs.webkit.org/show_bug.cgi?id=26436
-
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::compositeTextComposite):
-
-2009-07-14  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27283
-
-        Implement the new 'rem' unit from CSS3.
-
-        Added some rem-* tests in fast/css.
-
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
-        (WebCore::unitFromString):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::lex):
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserValue::createCSSValue):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::computeLengthInt):
-        (WebCore::CSSPrimitiveValue::computeLengthIntForLength):
-        (WebCore::CSSPrimitiveValue::computeLengthShort):
-        (WebCore::CSSPrimitiveValue::computeLengthFloat):
-        (WebCore::CSSPrimitiveValue::computeLengthDouble):
-        (WebCore::CSSPrimitiveValue::cssText):
-        (WebCore::CSSPrimitiveValue::parserValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::):
-        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::initForStyleResolve):
-        (WebCore::convertToLength):
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillSize):
-        (WebCore::CSSStyleSelector::mapFillXPosition):
-        (WebCore::CSSStyleSelector::mapFillYPosition):
-        (WebCore::CSSStyleSelector::createTransformOperations):
-        * css/CSSStyleSelector.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::device_heightMediaFeatureEval):
-        (WebCore::device_widthMediaFeatureEval):
-        (WebCore::heightMediaFeatureEval):
-        (WebCore::widthMediaFeatureEval):
-        * css/WebKitCSSMatrix.cpp:
-        (WebCore::WebKitCSSMatrix::setMatrixValue):
-        * css/tokenizer.flex:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        (WebCore::Document::usesRemUnits):
-        (WebCore::Document::setUsesRemUnits):
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle):
-        * rendering/SVGRenderTreeAsText.cpp:
-        (WebCore::writeStyle):
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::applyStrokeStyleToContext):
-        (WebCore::dashArrayFromRenderingStyle):
-        * svg/graphics/SVGPaintServer.h:
-
-2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Remove extraneous qualifier, accidentally added in http://trac.webkit.org/changeset/45884.
-
-        * bindings/v8/V8DOMWrapper.h: Removed extraneous qualifier.
-
-2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Update bindings for ValiditeState patch.
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::IdentifierRep):
+        * bridge/jni/JNIBridge.cpp:
+        (JavaMethod::~JavaMethod):
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::~ResourceHandleManager):
+        (WebCore::ResourceHandleManager::setCookieJarFileName):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::~PluginStream):
+        (WebCore::PluginStream::startStream):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xsltParamArrayFromParameterMap):
+        (WebCore::freeXsltParamArray):
 
-2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Cleanup - Remove obsolete code from the make system
-        https://bugs.webkit.org/show_bug.cgi?id=27299
-
-        * WebCore.pro:
-
-2009-07-15  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix the build without media elements.
+        Fix Qt build on Windows.
 
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteMediaURL): Add #if ENABLE(VIDEO)
-        markers around the body of the method.
+        nmake fails to pick the right cpp file, so we have to
+        rename the file to to a unique name.
 
-2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Move storeLastActivePanel out of the
-        ifdef ENABLE_JAVASCRIPT_DEBUGGER section in IDL;
-        Add default panel for the first opening of the
-        WebInspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27263
-
-        * inspector/InspectorController.cpp:
-        (InspectorController::setWindowVisible):
-        * inspector/InspectorController.idl:
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Try to fix Windows build.
-
-        * bindings/scripts/CodeGeneratorCOM.pm: Add Reflect and ReflectURL support.
-
-2009-07-14  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        HTMLMediaElement::supportsFullscreen() should return false
-        https://bugs.webkit.org/show_bug.cgi?id=27284
-
-        (Reverting a part of 45875)
+        * WebCore.pro:
+        * platform/graphics/qt/FontCustomPlatformDataQt.cpp: Renamed from WebCore/platform/graphics/qt/FontCustomPlatformData.cpp.
 
-        HTMLVideoElement::supportsFullscreen() will properly do the
-        job, and check if the backend supports fullscreen.
+2010-02-08  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        HTMLVideoElement is the only subclass to support fullscreen
-        (conditionnaly). HTMLAudioElement fullscreen is not supported
-        and is a different kind of fullscreen, if it comes to be wanted.
+        Reviewed by Dirk Schulze.
 
-        No test can be done currently given that none of the media
-        backends support fullscreen.
+        All SVG *-expected.txt files contain wrong results
+        https://bugs.webkit.org/show_bug.cgi?id=34703
 
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::supportsFullscreen):
+        Finally dump meaningful information for SVG layout tests.
+        Use 'absoluteClippedOverflowRect' which goes through the same code paths used
+        to actually calculate repaint rects etc - instead of the legacy CSS-unaware
+        code path that mapped 'repaintRectInLocalCoordinates' through 'absoluteTransform'.
+        Remove absoluteTransform() - a long standing TODO, finally not needed anymore.
 
-2009-07-14  Darin Adler  <darin@apple.com>
+        Despite SVGRenderTreeAsText, SVGPaintServerGradient was also using absoluteTransform().
+        Rewrite the code in question, fixing svg/W3C-SVG-1.1/pserver-grad-08-b.svg alignment issues
+        when scaling/panning text using gradient on stroke/fill. Affects some other gradient tests as well.
 
-        Reviewed by Dimitri Glazkov.
+        As we're now dumping clipped overflow rects any problems with repaint rects will become
+        immediate visible - it turns out we're not supporting the overflow rules on the outermost <svg>
+        element properly (repaint rects and bounding boxes need to take special SVG overflow rules into account).
+        Fixing that magically gives pixel-perfect clipped overflow rects for all types of shapes/text/containers.
 
-        Next step in making DOM attribute getter/setters consistently use AtomicString
-        https://bugs.webkit.org/show_bug.cgi?id=25425
+        Note: This will break any overriden platform-specific SVG results, need to wait for build bots in order to update them.
 
-        This covers eight DOM classes, and for each one of the classes:
-
-        - Changes the IDL to use the Reflect syntax for all simple cases.
-        - Removes unused functions in the classes, mainly newly unused ones that were
-          used for reflection before.
-        - Removes unneeded explicitly defined destructors.
-        - Explicitly declares destructors as virtual.
-        - Removes unneeded includes.
-        - Makes members protected or private rather than public where possible.
-        - Renames "doc" to "document".
-        - Tweaks formatting to match our latest style in a few places.
-        - Improves some FIXME comments.
-
-        Over time we'll want to do this for all HTML DOM classes.
+        * rendering/RenderObject.cpp: Remove absoluteTransform() method, centralize overflow query code in SVGRenderSupport::isOverflowHidden().
+        * rendering/RenderObject.h: Remove absoluteTransform() method.
+        * rendering/RenderSVGHiddenContainer.h: Ditto.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Respect SVG overflow rules here: clip repaintRect against overflow rect _before_ passing
+                                                         along to RenderBox. This is the key issue behind wrong absoluteClippedOverflowRect() values.
+        (WebCore::RenderSVGRoot::nodeAtPoint): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        * rendering/RenderSVGRoot.h: Remove absoluteTransform(). Don't expose viewportSize() anymore.
+        * rendering/RenderSVGText.cpp: 
+        (WebCore::RenderSVGText::strokeBoundingBox): Fix default stroke width to 1. This was the only wrong place -> fixes repaint rects for stroked text.
+        * rendering/RenderSVGViewportContainer.cpp: Remove absoluteTransform() method.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        * rendering/RenderSVGViewportContainer.h: Remove absoluteTransform() method.
+        * rendering/SVGRenderSupport.cpp: Refactored overflow queries in one place, centralizing SVG specific assumptions about overflowX/Y.
+        (WebCore::SVGRenderBase::isOverflowHidden):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp: Dump absoluteClippedOverflowRect() instead of absoluteTransform().mapRect(repaintRectInLocalCoordinates()).
+        (WebCore::writePositionAndStyle): Affects all layout tests dumping render trees.
+        * svg/graphics/SVGPaintServerGradient.cpp: Rewrite Gradient on text fill/stroke support on Cg, to avoid using absoluteTransform().
+        (WebCore::absoluteTransformForRenderer):
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
 
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
-        * html/HTMLAnchorElement.h:
-        (WebCore::HTMLAnchorElement::endTagRequirement):
-        (WebCore::HTMLAnchorElement::tagPriority):
-        * html/HTMLAnchorElement.idl:
-        * html/HTMLAppletElement.cpp:
-        * html/HTMLAppletElement.h:
-        * html/HTMLAppletElement.idl:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::parseMappedAttribute):
-        * html/HTMLAreaElement.h:
-        (WebCore::HTMLAreaElement::endTagRequirement):
-        (WebCore::HTMLAreaElement::tagPriority):
-        * html/HTMLAreaElement.idl:
-        * html/HTMLBRElement.cpp:
-        (WebCore::HTMLBRElement::parseMappedAttribute):
-        * html/HTMLBRElement.h:
-        * html/HTMLBRElement.idl:
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::HTMLBaseElement):
-        (WebCore::HTMLBaseElement::removedFromDocument):
-        (WebCore::HTMLBaseElement::process):
-        * html/HTMLBaseElement.h:
-        * html/HTMLBaseElement.idl:
-        * html/HTMLBaseFontElement.cpp:
-        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
-        * html/HTMLBaseFontElement.h:
-        (WebCore::HTMLBaseFontElement::endTagRequirement):
-        (WebCore::HTMLBaseFontElement::tagPriority):
-        * html/HTMLBaseFontElement.idl:
-        * html/HTMLBlockquoteElement.cpp:
-        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
-        * html/HTMLBlockquoteElement.h:
-        (WebCore::HTMLBlockquoteElement::tagPriority):
-        * html/HTMLBlockquoteElement.idl:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::HTMLBodyElement):
-        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
-        * html/HTMLBodyElement.h:
-        (WebCore::HTMLBodyElement::endTagRequirement):
-        (WebCore::HTMLBodyElement::tagPriority):
-        * html/HTMLBodyElement.idl:
-        Made changes as described above.
-
-        * loader/FrameLoader.cpp: Removed unneeded include of HTMLAnchorElement.h.
-
-2009-07-14  Steve Falkenburg  <sfalken@apple.com>
-
-        Reorganize JavaScriptCore headers into:
-        API: include/JavaScriptCore/
-        Private: include/private/JavaScriptCore/
+2010-02-07  Daniel Bates  <dbates@webkit.org>
 
         Reviewed by Darin Adler.
 
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
+        https://bugs.webkit.org/show_bug.cgi?id=34402
 
-        Change all Noncopyable inheriting visibility to public.
-        https://bugs.webkit.org/show_bug.cgi?id=27225
+        Implements all of the numeric CSS3 list-style-types as per
+        section 4.3 of the CSS3 Lists module <http://www.w3.org/TR/css3-lists/#numeric>.
 
-        Change all Noncopyable inheriting visibility to public because
-        it is needed to the custom allocation framework (bug #20422).
+        Test: fast/lists/w3-css3-list-styles-numeric.html
 
-        * bindings/js/GCController.h:
-        * bindings/js/WorkerScriptController.h:
-        * bindings/v8/V8DOMMap.cpp:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSValueKeywords.in:
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * platform/text/CharacterNames.h: Added constant hyphenMinus.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::): Defined enum SequenceType.
+        (WebCore::toAlphabeticOrNumeric): Added.
+        (WebCore::toAlphabetic): Modified to call WebCore::toAlphabeticOrNumeric.
+        (WebCore::toNumeric): Added.
+        (WebCore::listMarkerSuffix):
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::calcPrefWidths):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h: Added numeric list style types
+        and fixed indent level for the enum values.
         (WebCore::):
-        * bridge/runtime.h:
-        * css/CSSSelector.h:
-        * css/CSSSelectorList.h:
-        * css/CSSStyleSelector.h:
-        * dom/ClassNames.h:
-        * dom/MessagePortChannel.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * dom/XMLTokenizerScope.h:
-        * editing/ReplaceSelectionCommand.cpp:
-        * editing/SelectionController.h:
-        * editing/TextIterator.cpp:
-        * history/PageCache.h:
-        * html/CanvasRenderingContext2D.h:
-        * html/HTMLParser.h:
-        * html/HTMLParserQuirks.h:
-        * html/PreloadScanner.h:
-        * loader/Cache.h:
-        * loader/CrossOriginPreflightResultCache.h:
-        * loader/FrameLoader.h:
-        * loader/ProgressTracker.h:
-        * loader/ThreadableLoader.h:
-        * loader/appcache/ApplicationCacheGroup.h:
-        * loader/archive/ArchiveResourceCollection.h:
-        * loader/icon/IconDatabase.h:
-        * loader/icon/IconLoader.h:
-        * loader/icon/PageURLRecord.h:
-        * loader/loader.h:
-        * page/ContextMenuController.h:
-        * page/EventHandler.h:
-        * page/FrameTree.h:
-        * page/Page.h:
-        * page/PageGroup.h:
-        * page/PageGroupLoadDeferrer.h:
-        * page/mac/EventHandlerMac.mm:
-        * platform/AutodrainedPool.h:
-        * platform/ContextMenu.h:
-        * platform/EventLoop.h:
-        * platform/HostWindow.h:
-        * platform/Pasteboard.h:
-        * platform/PurgeableBuffer.h:
-        * platform/RunLoopTimer.h:
-        * platform/ThreadGlobalData.h:
-        * platform/ThreadTimers.h:
-        * platform/Timer.h:
-        * platform/TreeShared.h:
-        * platform/graphics/FontData.h:
-        * platform/graphics/GlyphWidthMap.h:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/ImageBuffer.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/skia/GraphicsContextPlatformPrivate.h:
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        * platform/mac/LocalCurrentGraphicsContext.h:
-        * platform/network/FormDataBuilder.h:
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        * platform/text/StringBuffer.h:
-        * platform/text/TextCodec.h:
-        * platform/win/WindowMessageBroadcaster.h:
-        * rendering/CounterNode.h:
-        * rendering/LayoutState.h:
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderView.h:
-        * rendering/TransformState.h:
-        * svg/SVGAnimatedProperty.h:
-        * svg/SynchronizableTypeWrapper.h:
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        * xml/XPathExpressionNode.h:
-        * xml/XPathParser.h:
-        * xml/XPathPredicate.h:
-        * xml/XPathStep.h:
 
-2009-07-14  Darin Fisher  <darin@chromium.org>
+2010-02-07  Ismail Donmez  <ismail@namtrac.org>
 
         Reviewed by Darin Adler.
 
-        Fails to save document state when navigating away from a page with a
-        reference fragment.
-        https://bugs.webkit.org/show_bug.cgi?id=27281
-
-        Test: fast/history/saves-state-after-fragment-nav.html
+        Include wtf/StringExtras.h for strdup definition, which
+        is needed for WinCE.
 
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::isCurrentDocument): Use equalIgnoringRef
-        to compare URLs.
+        * bridge/IdentifierRep.h:
 
-2009-07-14  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-07  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Timothy Hatcher.
 
-        Inspector: Remove Unintended Global Variables
-        https://bugs.webkit.org/show_bug.cgi?id=27203
+        Web Inspector: Fragment-held Elements Not Shown in Inspector.
 
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/inspector.js:
-        (WebInspector.animateStyle):
+        https://bugs.webkit.org/show_bug.cgi?id=34680
 
-2009-07-14  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
 
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Added build stuff and stub for the ValidityState class, part of HTML5
-        section Forms:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+2010-02-07  Jian Li  <jianli@chromium.org>
 
-        Test: fast/forms/ValidityState-001.html
+        Reviewed by Darin Fisher.
 
-        * DerivedSources.cpp: Inclusion of ValidityState files
-        * DerivedSources.make: ditto
-        * GNUmakefile.am: ditto
-        * WebCore.gypi: ditto
-        * WebCore.pro: ditto
-        * WebCore.vcproj/WebCore.vcproj: ditto
-        * WebCore.xcodeproj/project.pbxproj: ditto
-        * WebCoreSources.bkl: ditto
-        * html/HTMLButtonElement.idl: validity attribute
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::validity): ValidityState getter
-        * html/HTMLFormControlElement.h: ditto
-        * html/HTMLInputElement.idl: validity attribute
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl: ditto
-        * html/ValidityState.cpp: Added.
-        (WebCore::ValidityState::ValidityState):
-        (WebCore::ValidityState::valid): validation flag
-        * html/ValidityState.h: Added.
-        (WebCore::ValidityState::create): validation flag
-        (WebCore::ValidityState::control): ditto
-        (WebCore::ValidityState::valueMissing): ditto
-        (WebCore::ValidityState::typeMismatch): ditto
-        (WebCore::ValidityState::patternMismatch): ditto
-        (WebCore::ValidityState::tooLong): ditto
-        (WebCore::ValidityState::rangeUnderflow): ditto
-        (WebCore::ValidityState::rangeOverflow): ditto
-        (WebCore::ValidityState::stepMismatch): ditto
-        (WebCore::ValidityState::customError): ditto
-        * html/ValidityState.idl: Added.
-
-2009-07-14  Ryosuke Niwa  <rniwa@google.com>
+        [chromium] Change chromium interface to handle DownloadURL format.
+        https://bugs.webkit.org/show_bug.cgi?id=34655
 
-        Reviewed by Eric Seidel.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
 
-        Outdenting a line inside a blockquote tag does nothing
-        https://bugs.webkit.org/show_bug.cgi?id=25316
+2010-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        The bug was caused by the code checking whether the blockquote is created by WebKit or not.
-        We simply remove this code to be consistent with Firefox and Internet Explorer.
-        Also, enclosingBlockFlow == enclosingNode in outdentParagraph isn't a sufficient condition to insert
-        the placeholder before the enclosingNode because there could be contents before the current paragraph.
-        Instead, we should split the enclosingNode (which is a blockquote) at the starting position of outdentation.
-        It turned out that this solves the bug 25315 also: https://bugs.webkit.org/show_bug.cgi?id=25315
+        No review, rolling out r54364.
+        http://trac.webkit.org/changeset/54364
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-        Test: editing/execCommand/outdent-regular-blockquote.html
+        Introduced asserts in layout tests, needs more testing
+        locally.
 
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::isIndentBlockquote): no longer checks whether a blockquote is created by WebKit or not.
-        (WebCore::IndentOutdentCommand::outdentParagraph): takes care of the case enclosingBlockFlow == enclosingNode
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-2009-07-14  Adam Barth  <abarth@webkit.org>
+2010-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        [V8] Fix isolated world wrappers for Node prototypes
-        https://bugs.webkit.org/show_bug.cgi?id=27277
+        Using inlines and function-level statics don't mix, according to gcc.
+        https://bugs.webkit.org/show_bug.cgi?id=34663
 
-        This change does two things:
+        De-inline deviceRGBColorSpaceRef to avoid gcc-bug landmines.
 
-        1) We bypass the wrapper cache in the isolated world.  This is because
-           the wrapper template cache has prototypes that lead to the main
-           world.  We can add a template cache for the isolated world if
-           performance warrants.
+        It appears that the initialization check, generated by gcc doesn't account
+        for a possibility that the function may be inlined, resulting in lazy
+        initialization failure for more than one inlined instance of the function.
 
-        2) We introduce a smarter way to grab the wrapper context for a frame
-           that is aware that proxy <-> context do not stand in one-to-one
-           correspondence.  This generalizes our solution for the node wrapper
-           case to prototypes.
+        No behavior change, so no new tests.
 
-        The net result is that Node wrappers get the right prototypes.  As
-        before, tests to follow.
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        (WebCore::V8DOMWrapper::getWrapperContext):
-        * bindings/v8/V8DOMWrapper.h:
+2010-02-05  Geoffrey Garen  <ggaren@apple.com>
 
-2009-07-14  Adam Barth  <abarth@webkit.org>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Dimitri Glazkov.
+        Added an ASSERT to catch an implausible but theoretically possible leak.
+        
+        In theory, if malloc allocated a UChar buffer directly after a StringImpl,
+        the StringImpl might incorrecly assume that the UChar buffer was inline,
+        and fail to delete it.
+        
+        This ASSERT is somewhat academic, since we don't use the same allocator
+        in debug builds, but oh well.
 
-        [V8] Fix isolated world wrappers for Nodes
-        https://bugs.webkit.org/show_bug.cgi?id=27271
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h: Separated the inline buffer StringImpl
+        constructor from the out-of-line buffer StringImpl constructor. Made
+        the former ASSERT that its buffer was indeed inline, and the latter ASSERT
+        that its buffer was indeed not inline.
 
-        Previously, we keepy a pointer to the DOMMap on V8Proxy, but this
-        caused us to miss the branch in V8DOMMap.cpp for isolated worlds.
+2010-02-05  Chris Marrin  <cmarrin@apple.com>
 
-        I have tests, but I can't land them until I get this feature under
-        control.
+        Reviewed by Simon Fraser.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::V8Proxy):
+        Fixed changed virtual function in GraphicsLayerCACF and call order issues
+        https://bugs.webkit.org/show_bug.cgi?id=34348
+        
+        The correct virtual function in GraphicsLayerCACF is now being
+        called. We also fixed an issue in QTMovieWin where the size
+        of the movie was not being set correctly because the call order
+        was changed.
+        
+        I also changed the order of a couple of calls in QTMovieWin to account
+        for changed calling order from the logic above.
 
-2009-07-14  Adam Barth  <abarth@webkit.org>
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Update to new virtual function API
+        (WebCore::GraphicsLayerCACF::setContentsToMedia):
+        (WebCore::GraphicsLayerCACF::updateContentsMedia):
+        * platform/graphics/win/GraphicsLayerCACF.h:Update to new virtual function API
+        (WebCore::GraphicsLayerCACF::):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::cacheMovieScale):Fix a bug where ratio was computed wrong because it was using integer math
+        (QTMovieWinPrivate::task):Compute movie scale before computing movie size so values are correct
+        (QTMovieWinPrivate::setSize):Move movie size update to updateMovieSize()
+        (QTMovieWinPrivate::updateMovieSize):Wrap size update in a new call so it can be used from multiple places
 
-        Reviewed by Dimitri Glazkov.
+2010-02-05  Enrica Casucci  <enrica@apple.com>
 
-        [V8] Fix isolated world crash on getting window.location
-        https://bugs.webkit.org/show_bug.cgi?id=27268
+        Reviewed by Simon Fraser.
 
-        I have a test for this locally, but it requires a compile-time hack to
-        run.  Once I get the feature's stability under control, we can turn the
-        feature on and add the tests.
+        Horizontal scrollbar works in reverse at milliondollarcu.be
+        <rdar://problem/7556121>
+        https://bugs.webkit.org/show_bug.cgi?id=33848
+        
+        Added a manual test.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::context):
+        * manual-tests/win: Added.
+        * manual-tests/win/horizontal-scroll-composited.html: Added.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
 
-2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-05  Ryan Leavengood  <leavengood@gmail.com>
 
-        Correct failing tests after r45875.  The original patch did not
-        test the m_player member for null, causing crashes.  This will
-        happen fairly frequently in real use.  Was this original patch
-        ever tested?
-        https://bugs.webkit.org/show_bug.cgi?id=27246
+        Reviewed by David Levin.
 
-        Test via existing media tests.
+        Implementation of GlyphPage::fill() for Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::supportsFullscreen): Check for null pointer.
-        (WebCore::HTMLMediaElement::supportsSave): Check for null pointer.
+        Covered by existing tests.
 
-2009-07-14  Avi Drissman  <avi@chromium.org>
+        * platform/graphics/haiku/GlyphPageTreeNodeHaiku.cpp
 
-        Reviewed by Darin Fisher.
+2010-01-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Explicitly mark the HTML generated for the Mac as being UTF-8 encoded.
-        The Windows clipboard format is explicitly documented as being UTF-8,
-        and all Linux apps assume UTF-8. On the Mac, though, unless otherwise
-        indicated, Windows-1252 is assumed, which is wrong.
+        Reviewed by Dave Hyatt.
 
-        Bug: https://bugs.webkit.org/show_bug.cgi?id=27262
+        Implement flattening of framesets
+        https://bugs.webkit.org/show_bug.cgi?id=32717
 
-        No new tests.
+        The following patch, builds ontop of Antti Koivisto's frameset
+        flattening code from the iPhone source, which itself is based on
+        the old Nokia Series 60 source.
 
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::writeRange):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeSelection):
+        Layout tests have been added to test the functionality and the original
+        code which has then been fixed to make these pass, as well as support
+        frameset grids.
 
-2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+        Tests: fast/frames/flattening/frameset-flattening-advanced.html
+               fast/frames/flattening/frameset-flattening-grid.html
+               fast/frames/flattening/frameset-flattening-simple.html
+               fast/frames/flattening/frameset-flattening-subframe-resize.html
+               fast/frames/flattening/frameset-flattening-subframesets.html
 
-        Reviewed by Dimitri Glazkov.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setFrameSetFlatteningEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::frameSetFlatteningEnabled):
+        * rendering/RenderFrame.cpp:
+        (WebCore::RenderFrame::layoutWithFlattening):
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::layout):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        (WebCore::RenderFrameSet::flattenFrameSet):
+        (WebCore::RenderFrameSet::userResize):
+        * rendering/RenderFrameSet.h:
 
-        Upstream V8NPObject.h and V8NPObject.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=27103
+2010-02-05  Simon Fraser  <simon.fraser@apple.com>
 
-        This just upstreams the files from the chromium code base. Only
-        minor changes to formatting and similar were done, so no testing
-        is required because nothing really changed.  Code verified to compile.
+        Reviewed by Dan Bernstein.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/v8/V8NPObject.cpp: Added.
-        (npObjectInvokeImpl):
-        (npObjectMethodHandler):
-        (npObjectInvokeDefaultHandler):
-        (weakTemplateCallback):
-        (npObjectGetProperty):
-        (npObjectNamedPropertyGetter):
-        (npObjectIndexedPropertyGetter):
-        (npObjectGetNamedProperty):
-        (npObjectGetIndexedProperty):
-        (npObjectSetProperty):
-        (npObjectNamedPropertySetter):
-        (npObjectIndexedPropertySetter):
-        (npObjectSetNamedProperty):
-        (npObjectSetIndexedProperty):
-        (weakNPObjectCallback):
-        (createV8ObjectForNPObject):
-        (forgetV8ObjectForNPObject):
-        * bindings/v8/V8NPObject.h: Added.
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        Changing display type of parent of input on focus causes input field to not receive key events
+        https://bugs.webkit.org/show_bug.cgi?id=34620
+        <rdar://problem/7584572>
+        
+        When layout affects a text input, the RenderTextControl gets destroyed and
+        recreated, which in turn makes a new innerTextElement. However, if the text field was
+        focused, the VisibleSelection is left pointing to the old innerTextElement, so text
+        input no longer works.
+        
+        The fix is to call updateFocusAppearanceSoon() when attaching the input element,
+        which will update the selection if necessary.
 
+        Test: fast/forms/restore-selection-after-layout.html
 
-2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+        * dom/Document.h: Add a paramter to updateFocusAppearanceSoon() and a member variable,
+        m_updateFocusAppearanceRestoresSelection, to store its value until the timer fires.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_updateFocusAppearanceRestoresSelection
+        (WebCore::Document::updateFocusAppearanceSoon): New restorePreviousSelection parameter.
+        (WebCore::Document::updateFocusAppearanceTimerFired): Pass m_updateFocusAppearanceRestoresSelection down.
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Call updateFocusAppearanceSoon() with false.
+        * dom/Element.h: The updateFocusAppearanceSoonAfterAttach() was undefined.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach): Call document()->updateFocusAppearanceSoon() with true.
 
-        Reviewed by Darin Adler.
+2010-02-05  Pavel Feldman  <pfeldman@chromium.org>
 
-        Add HTMLMediaElement::supportSave() and a
-        HitTestResult::absoluteMediaURL() functions
-        https://bugs.webkit.org/show_bug.cgi?id=27246
+        Reviewed by Timothy Hatcher.
 
-        Added an implementation of supportsSave() into HTMLMediaElement
-        that delegates to MediaPlayerPrivateImpl so that the media engine
-        is able to signal whether or not a media source supports saving.
+        Web Inspector: simplify cookies view, introduce DataGrid::autoSizeColumns.
 
-        Also added a function to HitTestResult that allows for retrieval
-        of the currentSrc associated with the "hit" media element. 
-        
-        These functions are just pipeing with no visible UI change so there
-        are no related layout test changes.
+        https://bugs.webkit.org/show_bug.cgi?id=34646
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::supportsFullscreen): 
-        (WebCore::HTMLMediaElement::supportsSave):
-        * html/HTMLMediaElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::supportsSave):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen):
-        (WebCore::MediaPlayerPrivateInterface::supportsSave):
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString):
-        (WebCore::HitTestResult::absoluteMediaURL):
-        * rendering/HitTestResult.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype._update):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.CookieItemsView.prototype._filterCookiesForDomain):
+        (WebInspector.CookieItemsView.prototype._createDataGrid):
+        (WebInspector.CookieItemsView.prototype._populateDataGrid.expiresCompare):
+        (WebInspector.CookieItemsView.prototype._populateDataGrid):
+        (WebInspector.CookieItemsView.prototype._createSimpleDataGrid):
+        (WebInspector.CookieItemsView.prototype._populateSimpleDataGrid):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.autoSizeColumns):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
 
-2009-07-14  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Timothy Hatcher.
 
-        [V8] Implement Reflect and ReflectURL attribute support.
-        https://bugs.webkit.org/show_bug.cgi?id=27273
+        Web Inspector: group cookies by frame, show total
+        cookies size, allow sorting cookie table.
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added support for Reflect and ReflectURL attributes.
+        https://bugs.webkit.org/show_bug.cgi?id=34617
 
-2009-07-14  Dmitry Titov  <dimich@chromium.org>
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._createNodes):
+        (WebInspector.CookieItemsView.prototype._sortData.localeCompare):
+        (WebInspector.CookieItemsView.prototype._sortData.numberCompare):
+        (WebInspector.CookieItemsView.prototype._sortData.expiresCompare):
+        (WebInspector.CookieItemsView.prototype._sortData):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-        Reviewed by Darin Adler.
+2010-02-05  Maxime Simone  <simon.maxime@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27266
-        Add hasCurrentPoint() to WebCore::Path.
-        This fixes Skia-based Chromium regression caused by the fix for
-        https://bugs.webkit.org/show_bug.cgi?id=27187.
-        For Skia, the new method always returns 'true', pending actual implementation.
-        This means Chromium still will differ from Gecko behavior, but at least its Canvas
-        will not be completely broken.
+        Reviewed by David Levin.
 
-        Existing Canvas Layout Tests should pass in Chromium after this change.
+        More robust conversion from BString to String for Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo): insteand of Path::isEmpty() test for hasCurrentPoint().
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo): ditto.
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo): ditto.
+        Covered by existing tests.
 
-        * platform/graphics/Path.h:
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::Path::isEmpty):
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/wx/PathWx.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        All these files add a Path::hasCurrentPoint() for various platforms.
+        * platform/text/haiku/StringHaiku.cpp: Fixed include order, Improved coversion from BString.
 
-2009-07-14  Nate Chapin  <japhet@chromium.org>
+2010-02-05  Steve Falkenburg  <sfalken@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Adam Roben.
 
-        Upstream RGBColor from src.chromium.org.
+        Windows build fix.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27133
+        * WebCore.vcproj/WebCore.make:
 
-        * WebCore.gypi: Add RGBColor
-        * css/RGBColor.cpp: Added.
-        (WebCore::RGBColor::create):
-        (WebCore::RGBColor::red):
-        (WebCore::RGBColor::green):
-        (WebCore::RGBColor::blue):
-        * css/RGBColor.h: Added.
-        (WebCore::RGBColor::RGBColor):
+2010-02-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-07-10  Matt Perry  <mpcomplete@chromium.org>
+        Reviewed by Dirk Schulze.
+        Rubber-stamped by Kenneth Rohde Christiansen.
 
-        Reviewed by Darin Fisher.
+        [Qt] Modifying SVG path dumping to equal to other ports
+        https://bugs.webkit.org/show_bug.cgi?id=33784
 
-        [V8] Rename the didCreate/DestroyScriptContext calls to make it
-        clear that that those refer to the frame's contxt.  Add another
-        similar call for when creating contexts via evaluateInNewContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27104
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::debugString): Path dumping style is aproached to Mac.
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didCreateScriptContextForFrame):
-        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContextForFrame):
-        (WebCore::EmptyFrameLoaderClient::didCreateIsolatedScriptContext):
-        * loader/FrameLoaderClient.h:
+2010-02-05  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
 
-2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+        Reviewed by Gustavo Noronha.
 
-        Revert http://trac.webkit.org/changeset/45864 after
-        breaking of Windows build.
+        Add a GStreamer HTTP/HTTPS source, using WebKit infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=34317
 
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        * storage/StorageEvent.h:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        * storage/StorageSyncManager.h:
-
-2009-07-11  Jeremy Orlow  <jorlow@chromium.org>
+        * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::doGstInit):
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.cpp:
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.h:
+        Add a GStreamer HTTP/HTTPS source, using the WebKit infrastructure.
+        This makes sure that referer, cookies, authentication information
+        and all kinds of other context are passed to GStreamer for websites
+        like Vimeo or YouTube.
 
-        Reviewed by Darin Adler.
+2010-02-05  Nate Chapin  <japhet@chromium.org>
 
-        Cleanup DOM Storage dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=27180
-
-        DOM Storage had several unnecessary (and probably unintended)
-        dependencies.  This patch replaces many includes of header files with
-        forward declaration of classes, making some destructors explicit, and
-        taking some factories out of the header files.
-
-        This will allow things like StorageAreaSync to take a StorageAreaImpl*
-        (as it should) rather than a StorageArea* which previously weren't
-        possible because the dependencies were such a tangled mess.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::~LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        (WebCore::Storage::~Storage):
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageEvent.h:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        * storage/StorageSyncManager.h:
+        Reviewed by Dimitri Glazkov.
 
+        [V8] Clean up code for getting a v8::FunctionTemplate.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34606
 
-2009-07-14  Adam Treat  <adam.treat@torchmobile.com>
+        * bindings/scripts/CodeGeneratorV8.pm: Making GetTemplate() public
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):
+        * bindings/v8/V8DOMWrapper.cpp: Remove getTemplate(), use V8ClassIndex::getTemplate() instead.
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        * bindings/v8/V8Index.cpp: Remove duplicate caching of FunctionTemplates.
+        (WebCore::V8ClassIndex::getTemplate):
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        (WebCore::V8HTMLAudioElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScriptHostV8Wrapper):
 
-        Reviewed by David Hyatt.
+2010-02-05  Siddharth Mathur  <siddharth.mathur@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26983
+        Reviewed by Ariya Hidayat.
 
-        Check to make sure the view is attached to a frame() in the visibleContentsResized()
-        method as it can be triggered before the view is attached by Frame::createView(...)
-        setting various values such as setScrollBarModes(...) for example.  An ASSERT is
-        triggered when a view is layout before being attached to a frame().
+        [Qt] Build break in QtWebkit on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=34597
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::visibleContentsResized):
-        * page/FrameView.h:
+        * plugins/PluginView.h:
 
-2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-05  Yury Semikhatsky  <yurys@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        WebInspector: show last opened panel when invoking inspector.
+        - Use SerializedScriptValue for passing data between injected script and
+        inspector frontend.
+        - Remove custom JSON implementation from the instpector utility script.
+        - Make sure that only objects created in the same ScriptState can be values
+        of ScriptObject/Array properties and arguments to ScriptFunctionCall. We don't
+        want ScriptObjects to leak between contexts.
+        - Use ScriptState of the 'this' object in ScriptFunctionCall instead of passing
+        it as additional parameter.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27263
+        https://bugs.webkit.org/show_bug.cgi?id=33592
 
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::reportDidDispatchOnInjectedScript):
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::set):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::ScriptValue::deserialize):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptArray.cpp:
+        (WebCore::ScriptArray::set):
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::deserialize):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::reportDidDispatchOnInjectedScriptCallback):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapForConsole):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::setWindowVisible):
-        (WebCore::InspectorController::storeLastActivePanel):
-        (WebCore::InspectorController::specialPanelForJSName):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::Setting::Setting):
-        * inspector/InspectorController.idl:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::newScriptArray):
+        (WebCore::InspectorFrontend::newScriptObject):
+        (WebCore::InspectorFrontend::populateFrontendSettings):
+        (WebCore::InspectorFrontend::updateConsoleMessageExpiredCount):
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::didGetResourceContent):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        (WebCore::InspectorFrontend::callSimpleFunction):
+        * inspector/InspectorFrontend.h:
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName.myCallback):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
         * inspector/front-end/inspector.js:
-        (WebInspector.set currentPanel):
-        (WebInspector.loaded):
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Speed up access to NodeList length.
-        https://bugs.webkit.org/show_bug.cgi?id=27264
-
-        That's a minimal alternation of the code.
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
 
-        * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER): 1) use AtomicString for comparison, 2) use
-        v8::Integer::New instead of v8::Number::New.
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-2009-07-14  Anton Muhin  <antonm@chromium.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Dimitri Glazkov.
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
 
-        Do not do unnecessary conversions from v8::Handle<v8::Value> to
-        v8::Handle<v8::Object> and accompanying changes.
-        https://bugs.webkit.org/show_bug.cgi?id=26953
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
 
-        Three things:
+        These extra headers are installed alongside the normal headers.
 
-        1) do not cast from v8::Value to v8::Object if unnecessary---casts are cheap,
-        but are not free (they check for emptiness of handle);
-        2) inline conversion from wrapper to node;
-        3) simplify case to an ASSERT.
+        * WebCore.pro: Use headers.pri based on DerivedSources instead
+        of the one previously checked in in the source tree.
 
-        This is just a refactoring, so no new tests are needed.
+2010-02-05  Mikhail Naganov  <mnaganov@chromium.org>
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::convertToSVGPODTypeImpl):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::convertDOMWrapperToNative):
-        (WebCore::V8Proxy::convertToNativeObject):
-        (WebCore::V8Proxy::convertToNativeEvent):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toCanvasStyle):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::V8Custom::GetTargetFrame):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Straight quotes should match fancy quotes in in-page search
-        https://bugs.webkit.org/show_bug.cgi?id=27217
+        Reviewed by Pavel Feldman.
 
-        Tests: fast/text/find-quotes.html
+        Enable JAVASCRIPT_DEBUGGER in chromium port.
 
-        * editing/TextIterator.cpp:
-        (WebCore::foldQuoteMark): Added.
-        (WebCore::foldQuoteMarks): Added.
-        (WebCore::SearchBuffer::SearchBuffer): Call foldQuoteMarks on the target string.
-        (WebCore::SearchBuffer::append): Call foldQuoteMarks on characters as they are
-        added to the search buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=34638
 
-        * platform/text/CharacterNames.h: Added more quotation mark character names.
-        Sorted character names with the sort tool.
+        * page/Console.cpp:
+        * page/Console.h:
+        * page/Console.idl:
 
-2009-07-13  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-05  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: handle debugger shortcuts while on source frame or on
-        script file selector.
+        Web Inspector: Tab width for javascript source is 8, should be 4
 
-        https://bugs.webkit.org/show_bug.cgi?id=27224
+        https://bugs.webkit.org/show_bug.cgi?id=31248
 
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
         * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-
-2009-07-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Use standard HashCountedSet instead of a hand rolled one
-        in HTMLDocument.
+        (WebInspector.SourceFrame):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.set replaceTabsWithSpaces):
+        (WebInspector.TextEditorModel.prototype._innerSetText):
+        (WebInspector.TextEditorModel.prototype._replaceTabsIfNeeded):
 
-        * html/HTMLDocument.cpp:
-        (WebCore::addItemToMap):
-        (WebCore::removeItemFromMap):
-        * html/HTMLDocument.h:
+2010-02-05  Tony Chang  <tony@chromium.org>
 
-2009-07-13  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Darin Adler and Maciej Stachowiak.
+        Reviewed by Eric Seidel.
 
-        Implement HTML5 draggable
-        https://bugs.webkit.org/show_bug.cgi?id=26262
+        https://bugs.webkit.org/show_bug.cgi?id=24872
+        When pasting a list into another list should not indent another level.
+        If the cursor is at the beginning of the line, it should insert the
+        list items before the current list item.  If the cursor is at the end
+        of the line, it should insert the list items after the current list item.
 
-        This adds support for the HTML5 draggable attribute and its DOM binding. It maps the draggable property
-        to the CSS properties -webkit-user-drag and -webkit-user-select respectively.
+        This matches Firefox and IE and makes the common activity of reordering a list
+        work as expected.
 
-        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/editing.html#the-draggable-attribute
+        This also adds a small helper method (isListItem) to htmlediting.h.
 
-        Test: fast/html/draggable.html
+        Test: editing/pasteboard/paste-list-002.html
 
-        * css/html.css:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::draggable):
-        * html/HTMLAnchorElement.h:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::draggable):
-        (WebCore::HTMLElement::setDraggable):
-        * html/HTMLElement.h:
-        * html/HTMLElement.idl:
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::draggable):
-        * html/HTMLImageElement.h:
-
-2009-07-13  Simon Fraser  <simon.fraser@apple.com>
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::isListItem):
+        (WebCore::appendedSublist):
+        * editing/htmlediting.h:
 
-        Reviewed by Dan Bernstein.
+2010-02-04  Mark Rowe  <mrowe@apple.com>
 
-        Image rendered as layer contents looks different from image rendered via CG.
-        <rdar://problem/7048830> 
-        
-        Fix a visible color profile difference between between images rendered via Core Graphics
-        and those rendered via a compositing layer, by assigning the GenericRGB profile to
-        untagged images (which come through as having the DeviceRGB profile) when they are set
-        as layer contents.
+        Reviewed by Timothy Hatcher.
 
-        Test: compositing/color-matching/image-color-matching.html
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
+        * WebCore.base.exp: Remove symbol.
+        * WebCore.xcodeproj/project.pbxproj: Accommodate rename of script.
 
-2009-07-13  Darin Adler  <darin@apple.com>
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27220
-        Assertion failure in createSearcher() (usearch_open() status is U_USING_DEFAULT_WARNING)
+        Updated to use new WeakGCPtr::clear interface.
 
-        * editing/TextIterator.cpp:
-        (WebCore::createSearcher): Add U_USING_DEFAULT_WARNING as a possible status code
-        in the assertion. Affects only the assertion.
-
-2009-07-13  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26925
-        <rdar://problem/7027850> URL Fragment Breaks Application Cache Loads
-
-        Test: http/tests/appcache/main-resource-hash.html
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        (WebCore::ApplicationCache::resourceForRequest):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        (WebCore::ApplicationCacheGroup::didFail):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        Remove URL fragment at appcache code borders.
-
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::create):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        Assert that there is no URL fragment in URL at key points in appcache code.
-
-2009-07-13  Darin Adler  <darin@apple.com>
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::invalidateJSFunction):
 
-        Reviewed by Dan Bernstein.
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27166
-        rdar://problem/7015857
-        Find for strings composed entirely of spaces doesn't work
+        Build fix: Added a forwarding header.
 
-        Test: fast/text/find-spaces.html
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Added.
 
-        * editing/TextIterator.cpp:
-        (WebCore::findPlainText): Removed unneeded special case.
-        The empty string case already works correctly.
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
-2009-07-13  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Alexey Proskuryakov and Darin Adler.
 
-        Reviewed by Kevin Decker.
-
-        Remove NPPVpluginPrivateModeBool, it was removed from the spec.
+        REGRESSION (r52082): Missing event handlers on JQuery demo page (33383)
+        https://bugs.webkit.org/show_bug.cgi?id=33383
+        <rdar://problem/7559449>
         
-        * bridge/npapi.h:
-
-2009-07-13  Feng Qian  <feng@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27237
-
-        Make V8DOMMap.h compiling with gcc option -Werror=non=virtual-dtor.  
-
-        * bindings/v8/V8DOMMap.h:
-        (WebCore::WeakReferenceMap::WeakReferenceMap):
-        (WebCore::WeakReferenceMap::~WeakReferenceMap):
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Remove an accidental add of bidi.(cpp|h) to WebCore.gypi.
-
-        * WebCore.gypi: Removed bidi.cpp and bidi.h
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
+        There were two bugs here:
+        
+        1. A stale wrapper would invalidate a node's event listeners, even if
+        the node had a fresh wrapper keeping it alive.
+        
+        The fix for this is for an event listener to keep a WeakGCPtr back-pointer
+        to the wrapper it expects to mark it. The wrapper destructor checks this
+        back-pointer, and only invalidates the event listener in the case of a match.
 
-        Update WebCore.gyp in preparation to hooking it up.
+        2. Conversely, a stale wrapper would not invalidate a node's event
+        listeners soon enough, if its destructor didn't have a chance to run
+        before an event fired on the node. (This can only happen in cases where
+        we've made some other error and failed to mark a wrapper that was circuitously
+        observable in the DOM. But we know we have edge case bugs like this, and
+        we don't want them to be crashes.)
+        
+        The fix for this is to check the wrapper back-pointer before firing the
+        event listener. As long as the the wrapper back-pointer is not null,
+        it's safe to fire the listener. 
 
-        * WebCore.gypi: Added files that were mid-stream while switching over.
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Added. Appease build gods.
 
-2009-07-13  Dmitry Titov  <dimich@chromium.org>
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
 
-        Not reviewed, another small fix for Chromium build.
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::initializeJSFunction):
+        (WebCore::JSEventListener::invalidateJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        (WebCore::JSEventListener::isolatedWorld):
+        (WebCore::JSEventListener::wrapper):
+        (WebCore::JSEventListener::setWrapper):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::createJSAttributeEventListener): Implemented the back-pointer
+        described above. Refactored the jsFunction() accessor to return 0 if
+        the wrapper back-pointer is 0.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
 
-2009-07-13  Dmitry Titov  <dimich@chromium.org>
 
-        Not reviewed, fix Chromium build bustage.
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
+        (WebCore::getEventListenerHandlerBody): Updated for the fact that jsFunction()
+        is no longer a virtual accessor on the EventHandler base class.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::JavaScriptConsoleMessage::addToPage):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
+        * bindings/scripts/CodeGeneratorJS.pm: Updated for the fact that jsFunction()
+        is no longer a virtual accessor on the EventHandler base class. Added a "JS"
+        to invalidateEventListeners and markEventListeners to clarify that these
+        actions are for JS event listeners only. Added a wrapper parameter to
+        invalidateEventListeners for the back-pointer check explained above.
 
-2009-07-13  Sam Weinig  <sam@webkit.org>
+        * dom/EventListener.h:
+        (WebCore::EventListener::invalidateJSFunction): ditto
 
-        Reviewed by Darin Adler.
+        * dom/EventTarget.h:
+        (WebCore::EventTarget::markJSEventListeners):
+        (WebCore::EventTarget::invalidateJSEventListeners): ditto
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27234
-        <rdar://problem/7054356>
+2010-02-04  Tony Chang  <tony@chromium.org>
 
-        Add null page check in HTMLDocument::hasFocus.
+        Reviewed by Eric Seidel.
 
-        Test: fast/dom/HTMLDocument/hasFocus-frameless-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=25002
+        When inserting a new paragraph, avoid nesting empty divs.  When
+        pasting near the end of a paragraph, this prevents each paste
+        command for getting nested one level deeper.
 
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::hasFocus): Add page null check.
-        (WebCore::HTMLDocument::createTokenizer): Cleanup page null check.
+        Test: editing/inserting/paragraph-outside-nested-divs.html
 
-2009-07-13  Dan Bernstein  <mitz@apple.com>
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::highestVisuallyEquivalentDiv):
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
 
-        Reviewed by Darin Adler.
+2010-02-04  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Disable continuous spell checking in the inspector
-        https://bugs.webkit.org/show_bug.cgi?id=27131
+        Reviewed by Eric Seidel.
 
-        * inspector/front-end/inspector.html: Added spellcheck="false" to the
-            main-panels and console-prompt containers.
+        1. Fix a bug in SQLiteTransaction: do not assume that COMMIT always
+        succeeds.
+        2. Jump straight to the transaction error callback when a
+        statement fails in a way that makes sqlite automatically rollback
+        the transaction.
+        3. Fix the code that handles the "quota reached" failure, as it is
+        one of the failures that lead to an automatic transaction
+        rollback.
 
-2009-07-13  Adam Langley  <agl@google.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34280
 
-        Reviewed by Eric Seidel.
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::isAutoCommitOn):
+        * platform/sql/SQLiteDatabase.h:
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+        (WebCore::SQLiteTransaction::commit):
+        (WebCore::SQLiteTransaction::rollback):
+        (WebCore::SQLiteTransaction::transactionWasRolledBackBySqlite):
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::runStatements):
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::handleCurrentStatementError):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
 
-        Chromium Linux: fix assertion when rendering google.com.kh
+2010-02-04  Peter Kasting  <pkasting@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26924
+        Not reviewed, rollback.
 
-        Some shapers (i.e. Khmer) will produce cluster logs which report that
-        /no/ code points contributed to certain glyphs. Because of this, we
-        take any code point which contributed to the glyph in question, or any
-        subsequent glyph.  If we run off the end, then we take the last code
-        point.
+        Rollback r54387, it doesn't fix builds and Chromium doesn't want this behavior.
 
-        Added LayoutTests/fast/text/international/khmar-selection.html
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::offsetForPositionForComplexText):
+2010-02-04  Stephen White  <senorblanco@chromium.org>
 
-2009-07-13  Dan Bernstein  <mitz@apple.com>
+        Unreviewed, build fix.
 
-        Reviewed by Darin Adler.
+        Fix for Chromium/Mac after palindromic scrollbar change (54345).
 
-        spellcheck="false" is ignored
-        <rdar://problem/7054177>
+        Covered by many layout tests.
 
-        * editing/Editor.cpp:
-        (WebCore::markMisspellingsOrBadGrammar): Moved code to check the
-            spellcheck attribute from here...
-        (WebCore::Editor::spellCheckingEnabledInFocusedNode): ...to here.
-        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Bail out
-            if spell chcking is disabled by the spellcheck attribute.
-        * editing/Editor.h:
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (WebCore::ScrollbarThemeChromiumMac::maxOverlapBetweenPages):
 
-2009-07-13  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-04  Clemmitt Sigler  <cmsigler@gmail.com>
 
-        Reviewed by Adam Roben.
+        Reviewed by David Levin.
 
-        Add new configuration flag for redistributable Windows build.
-        https://bugs.webkit.org/show_bug.cgi=27087
+        WebKitGTK doesn't build GtkLauncher when --enable-mathml is specified.
+        Updated WebCore/GNUmakefile.am to include needed files in build.
         
-        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo.vsprops to
-          Debug_Cairo and Release_Cairo builds.
-        * config.h: Check for presence of WIN_CAIRO and select appropriate
-          configuration.  Defaults to standard Apple build.
-
-2009-07-13  Peter Kasting  <pkasting@google.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34387
 
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Back out previous patch for this bug (too many problems).
+        No new tests.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLButtonElement.idl:
-        * html/HTMLFieldSetElement.idl:
-        * html/HTMLFormControlElement.cpp:
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::form):
-        * html/HTMLInputElement.idl:
-        * html/HTMLSelectElement.idl:
-        * html/HTMLTextAreaElement.idl:
-        * html/ValidityState.cpp: Removed.
-        * html/ValidityState.h: Removed.
-        * html/ValidityState.idl: Removed.
 
-2009-07-13  Nate Chapin  <japhet@chromium.org>
+2010-02-04  Stephan Aßmus  <superstippi@gmx.de>
 
-        Reviewed by Dimitri Glazkov.
-
-        Add HTMLAllCollection to WebCore.gypi.
+        Reviewed by David Levin.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27223
+        Misc coding style fixes in Haiku port code.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        * WebCore.gypi: Add HTMLAllCollection.
+        No tests needed.
 
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/haiku/ContextMenuItemHaiku.cpp: Trailing white space, NULL -> 0
+        * platform/haiku/DragImageHaiku.cpp: Trailing white space.
+        * platform/haiku/FileChooserHaiku.cpp: Sorted headers.
+        * platform/haiku/LocalizedStringsHaiku.cpp: Needed to include NotImplemented.h
 
-        Reviewed by Darin Fisher.
+2010-02-04  Enrica Casucci  <enrica@apple.com>
 
-        [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor.
-        https://bugs.webkit.org/show_bug.cgi?id=27218
+        Reviewed by Csaba Osztrogonac.
 
-        Test: fast/css/matrix-as-function-crash.html
-
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call.
+        Fixed crash on QT introduced with the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34609
 
-2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        The test has been added with the original patch.
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writePlainText): Added missing allocation of m_writeData.
 
-        Unreviewed make dist build fix.
+2010-02-04  Christian Dywan  <christian@twotoasts.de>
 
-        * GNUmakefile.am:
+        Reviewed by Xan Lopez.
 
-2009-07-13  Cédric Luthi  <cedric.luthi@gmail.com>
+        Conditionalize third party cookie policy for libsoup 2.29.90.
 
-        Reviewed by Tor Arne Vestbø.
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
 
-        Fix NPWindow clip rect in PluginViewMac
+2010-02-04  Christian Dywan  <christian@twotoasts.de>
 
-        The rect should be in window-coordinates. This bug can be observed
-        with Flash 10 here: http://www.permadi.com/tutorial/cursorTracker/
+        Rubber-stamped by Gustavo Noronha Silva.
 
-        * plugins/mac/PluginViewMac.cpp:
+        Add ENABLE(VIDEO) guards around freeOwnedGPtr<GstElement> implementation.
 
-2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+        * platform/gtk/GOwnPtrGtk.cpp:
 
-        Reviewed by Ariya Hidayat.
+2010-02-04  Alexey Proskuryakov  <ap@apple.com>
 
-        Fix Qt implementation of WebCore::directoryName to return the absolute
-        directory name instead of the base file name.
+        Reviewed by Darin Adler.
 
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::directoryName):
+        Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+        https://bugs.webkit.org/show_bug.cgi?id=34520
 
-2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+        Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
 
-        Reviewed by Ariya Hidayat.
+        * dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
+        properties before attributes. Otherwise, copying "checked" attribute would make the cloned
+        node checked, unchecking original (they share a name, and are thus in the same radio group).
+        We do want the original to be unchecked, but we also want to know its original state in
+        HTMLInputElement::copyNonAttributeProperties().
 
-        Fix WebCore::Path::isEmpty() for the Qt port to return true
-        if there is no element in the path.
+        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
+        Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
+        checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
+        won't be overridden when copying attributes.
 
-        QPainterPath::isEmpty() returns also true if there is one single
-        MoveTo element inside, which makes sense but doesn't patch Webcore's
-        is-empty definition.
+2010-02-04  Kevin Ollivier  <kevino@theolliviers.com>
 
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::isEmpty): Use elementCount() == 0.
+        [wx] Build fix after addition of Clipboard::writePlainText method.
 
-2009-07-13  Albert J. Wong  <ajwong@chromium.org>
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::writePlainText):
+        * platform/wx/ClipboardWx.h:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-04  Enrica Casucci  <enrica@apple.com>
 
-        Upstream fixes to NPV8Object.cpp that make ~30 layout tests pass.
-        https://bugs.webkit.org/show_bug.cgi?id=27127
+        Reviewed by Oliver Hunt.
 
-        There were a number of bugs introduced during the last upstreaming
-        effort that broke around 30 layout tests.  This fixes those bugs.
-        It also has compile fixes to match the recent cutting apart of
-        V8Proxy.
+        REGRESSION: Dragging plain text into a styled text region does not acquire the correct style info.
+        <rdar://problem/7595685>
+        https://bugs.webkit.org/show_bug.cgi?id=34609
 
-        * bindings/v8/NPV8Object.cpp:
-        (freeV8NPObject):
-        (npCreateV8ScriptObject):
-        (NPN_Invoke):
-        (NPN_InvokeDefault):
-        (NPN_EvaluateHelper):
-        (NPN_SetException):
-        (NPN_Construct):
+        Test: editing/pasteboard/drop-inputtext-acquires-style.html
 
-2009-07-13  Mads Ager  <ager@chromium.org>
+        The dragging code did not distinguish the case of dragging the content of an input control
+        as a special case. The markup placed in the pasteboard included the style information.
+        I've modified the Clipboard class interface adding a new method writePlainText to match the
+        behavior of the copy and cut commands and modified the drag code to detect the special case.
+        I've modified all the platform specific implementations of the Clipboard class.
+        
+        * dom/Clipboard.h: Added writePlainText pure virtual function.
+        * editing/Editor.cpp:
+        (WebCore::Editor::cut): Renamed nodeIsTextFormControl to isNodeInTextFormControl.
+        (WebCore::Editor::copy): Renamed nodeIsTextFormControl to isNodeInTextFormControl.
+        * editing/htmlediting.cpp:
+        (WebCore::isNodeInTextFormControl): Added, after removing the implementation with the old name
+        in Editor.cpp
+        * editing/htmlediting.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag):
+        * platform/Pasteboard.h:
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::writePlainText): Added.
+        * platform/android/ClipboardAndroid.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writePlainText): Added.
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::writePlainText): Added.
+        * platform/gtk/ClipboardGtk.h:
+        * platform/haiku/ClipboardHaiku.cpp:
+        (WebCore::ClipboardHaiku::writePlainText): Added.
+        * platform/haiku/ClipboardHaiku.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::writePlainText): Added.
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText): Added helper function.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writePlainText): Added.
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::writePlainText): Added.
+        * platform/win/ClipboardWin.h:
 
-        Reviewed by Adam Barth.
+2010-02-04  Steve Block  <steveblock@google.com>
 
-        Fix memory leak in the V8 binding layer. 
-        https://bugs.webkit.org/show_bug.cgi?id=27163
+        Reviewed by Nate Chapin.
 
-        Reinitializing the context is not necessary when clearing the proxy for navigation
-        and it will lead us to hold on to an empty context for each frame.
+        Fix bug in V8 convertNPVariantToJValue when converting float and double types
+        https://bugs.webkit.org/show_bug.cgi?id=34593
 
-        Test for empty context instead of empty global object handle when
-        updating the document for a context.
+        No new tests, build fix only.
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::updateDocument):
+        * bridge/jni/v8/JNIUtilityPrivate.cpp: Modified.
+        (JSC::Bindings::convertNPVariantToJValue): Modified. Use correct members of 'result' enum.
 
-2009-07-13  John Gregg  <johnnyg@google.com>
+2010-02-04  Chris Guillory  <chris.guillory@google.com>
 
-        Reviewed by David Levin.
+        Reviewed by Darin Fisher.
 
-        Correct the logic to determine if a V8 callback returns a value.
-        https://bugs.webkit.org/show_bug.cgi?id=27155
+        [Chromium] Notify ChromeClientChromium of AccessibilityObject state
+        change notifications.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::invokeCallback):
-        - Don't crash if result.IsEmpty().
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::toChromeClientChromium):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-2009-07-13  Drew Wilson  <atwilson@google.com>
+2010-02-04  Stephen White  <senorblanco@chromium.org>
 
-        Reviewed by David Levin.
+        Unreviewed, build fix for Chromium.
 
-        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
-        https://bugs.webkit.org/show_bug.cgi?id=26932
+        Revert r54341 ("[v8] Remove clear method from DOM object maps"),
+        since it causes the worker tests to fail on Chromium.
 
-        Initial IDL definition and bindings for SharedWorkers.
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::ChunkedTable::clear):
+        (WebCore::ChunkedTable::clearEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::ChunkedTableTraits::clear):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::removeAllDOMObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::clear):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
 
-        * Configurations/FeatureDefines.xcconfig:
-        Added new files for SharedWorker support.
-        * DerivedSources.make:
-        Added new files for SharedWorker support.
-        * GNUmakefile.am:
-        Added new files for SharedWorker support.
-        * WebCore.gypi:
-        Added new files for SharedWorker support.
-        * WebCore.pro:
-        Added new files for SharedWorker support.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added new files for SharedWorker support.
-        * bindings/js/JSAbstractWorkerCustom.cpp: Added.
-        (WebCore::JSAbstractWorker::mark):
-        Custom mark handler that marks the event listeners.
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        (WebCore::JSAbstractWorker::toJS):
-        Custom toJS handler which differentiates between various subclasses.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::sharedWorker):
-        SharedWorker constructor (only enabled when SHARED_WORKERS is
-        enabled).
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        Added support for converting to/from SharedWorkers.
-        * bindings/js/JSSharedWorkerConstructor.cpp: Added.
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        (WebCore::constructSharedWorker):
-        (WebCore::JSSharedWorkerConstructor::getConstructData):
-        * bindings/js/JSSharedWorkerConstructor.h: Added.
-        (WebCore::JSSharedWorkerConstructor::classInfo):
-        * bindings/js/JSSharedWorkerCustom.cpp: Added.
-        (WebCore::JSSharedWorker::mark):
-        Custom mark function that marks the internal MessagePort.
-        * bindings/v8/DOMObjectsInclude.h:
-        Updated to include new header files.
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Added.
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        V8 handlers for add/removeEventListener().
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        Custom constructor for SharedWorker.
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toSharedWorker):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * workers/AbstractWorker.cpp: Added.
-        (WebCore::AbstractWorker::AbstractWorker):
-        Common base class for SharedWorker and (soon) Worker. The functions below were copied from Worker.cpp.
-        This is the first step in refactoring Worker to derive from AbstractWorker to enable code sharing.
-        (WebCore::AbstractWorker::~AbstractWorker):
-        (WebCore::AbstractWorker::addEventListener):
-        (WebCore::AbstractWorker::removeEventListener):
-        (WebCore::AbstractWorker::dispatchEvent):
-        (WebCore::AbstractWorker::dispatchLoadErrorEvent):
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-        * workers/AbstractWorker.h: Added.
-        Definitions of functionality shared by Worker.h and SharedWorker.h. In a future patch, Worker will derive from AbstractWorker.
-        (WebCore::AbstractWorker::scriptExecutionContext):
-        (WebCore::AbstractWorker::setOnerror):
-        (WebCore::AbstractWorker::onerror):
-        (WebCore::AbstractWorker::eventListeners):
-        (WebCore::AbstractWorker::refEventTarget):
-        (WebCore::AbstractWorker::derefEventTarget):
-        * workers/AbstractWorker.idl: Added.
-        * workers/SharedWorker.cpp: Added.
-        (WebCore::SharedWorker::SharedWorker):
-        (WebCore::SharedWorker::~SharedWorker):
-        * workers/SharedWorker.h: Added.
-        (WebCore::SharedWorker::create):
-        (WebCore::SharedWorker::port):
-        (WebCore::SharedWorker::toSharedWorker):
-        * workers/SharedWorker.idl: Added.
+2010-02-04  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-07-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Xan Lopez.
 
-        Reviewed by Simon Hausmann.
+        [GTK] Crashes when an invalid hostname is pre-fetched
+        https://bugs.webkit.org/show_bug.cgi?id=34602
 
-        [Qt] Cleanup - Remove prf install target
-        https://bugs.webkit.org/show_bug.cgi?id=27191
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): NULL-check the SoupURI that is created
+        from the hostname; that will happen for invalid hostnames.
 
-        qtwebkit.prf has been removed; this cleans up the related
-        install target as well.
+2010-02-04  José Millán Soto  <jmillan@igalia.com>
 
-        * WebCore.pro: Remove prf install target
+        Reviewed by Xan Lopez.
 
-2009-07-12  Adam Barth  <abarth@webkit.org>
+        [Gtk] webkitgtk crashed when Orca open
+        https://bugs.webkit.org/show_bug.cgi?id=34463
 
-        Reviewed by Oliver Hunt.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
+        Checking if render objects are texts before calling toRenderText
 
-        Facebook Chat is broken due to XSS auditor
-        https://bugs.webkit.org/show_bug.cgi?id=27179
+2010-02-04  Xan Lopez  <xlopez@igalia.com>
 
-        Instead of just using the script's URL as to detect an XSS attack, we
-        now use a bit of context before the URL.  In particular, we use the
-        bytes from the beginning of the attribute name to the end of the
-        attribute value.  In virtually all injection attacks, the attacker
-        would need to supply the attribute name as well as the attribute value.
-        However, in the Facebook false positive, the attribute name is not
-        present in the URL.
+        Reviewed by Gustavo Noronha.
 
-        Tests: http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
-               http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
-               http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
+        Set first party URI in all SoupMessages. This allows libsoup to
+        implement a "no third party cookies" policy in case it wants
+        to. Also start a non-JSC-specific, gtk-specific GOwnPtr module and
+        use it for SoupURI.
 
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseTag):
-        * html/HTMLTokenizer.h:
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        * page/XSSAuditor.h:
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
 
-2009-07-12  Keishi Hattori  <casey.hattori@gmail.com>
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Refactor ConsoleMessage to add MessageType attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=20625
+        Web Inspector: group cookies by domains, not frame's domains.
 
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::printErrorMessage):
-        * dom/Document.cpp:
-        (WebCore::Document::reportException):
-        (WebCore::Document::addMessage):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::reportErrorToConsole):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::addToConsole):
-        (WebCore::ConsoleMessage::isEqual):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::endGroup):
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        (WebCore::InspectorController::count):
-        * inspector/InspectorController.h:
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addMessage):
-        (WebInspector.ConsoleMessage): Added type property.
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleMessage.prototype.toString):
-        (WebInspector.ConsoleMessage.prototype.isEqual):
-        (WebInspector.ConsoleCommandResult):
-        (WebInspector.ConsoleGroup.prototype.addMessage):
-        (WebInspector.ConsoleGroup.prototype._titleClicked):
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype._addTip):
-        (WebInspector.Resource.prototype._checkWarning):
-        * inspector/front-end/inspector.css: Changed ".console-group-title-level" to ".console-group-title"
+        https://bugs.webkit.org/show_bug.cgi?id=34599
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
         * inspector/front-end/inspector.js:
-        (WebInspector.addMessageToConsole):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::printAccessDeniedMessage):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::addMessageToConsole):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::reportLocalLoadFailed):
-        (WebCore::FrameLoader::shouldAllowNavigation):
-        * page/ChromeClient.h:
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        (WebCore::Console::addMessage):
-        (WebCore::Console::error):
-        (WebCore::Console::log):
-        (WebCore::Console::dir):
-        (WebCore::Console::trace):
-        (WebCore::Console::assertCondition):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::warn):
-        * page/Console.h: Added MessageType enum.
-        (WebCore::):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessageTimerFired):
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        * svg/SVGDocumentExtensions.cpp:
-        (WebCore::SVGDocumentExtensions::reportWarning):
-        (WebCore::SVGDocumentExtensions::reportError):
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::reportWMLError):
-        * workers/GenericWorkerTask.h: Added GenericWorkerTask8 for the extra argument.
-        (WebCore::GenericWorkerTask8::create):
-        (WebCore::GenericWorkerTask8::GenericWorkerTask8):
-        (WebCore::GenericWorkerTask8::performTask):
-        (WebCore::createCallbackTask):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::addMessage):
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::postConsoleMessageTask):
-        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::reportUnsafeUsage):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        * xml/XSLTProcessor.cpp:
-        (WebCore::XSLTProcessor::parseErrorFunc):
+        (WebInspector.updateResource):
+        (WebInspector._addCookieDomain):
 
-2009-07-12  Nate Chapin  <japhet@chromium.org>
+2010-02-04  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Upstream UndetectableHTMLCollection.idl as HTMLAllCollection.idl.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27132
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * dom/HTMLAllCollection.idl: Added.
-
-2009-07-12  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Inspector: Duplicate Computation in Autocompletion
-        https://bugs.webkit.org/show_bug.cgi?id=26778
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype._completionsReady):
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27196
-        Rename bidi.cpp to RenderBlockLineLayout.cpp and remove bidi.h
-
-        * GNUmakefile.am: Updated.
-        * WebCore.gypi: Updated.
-        * WebCore.pro: Updated.
-        * WebCore.vcproj/WebCore.vcproj: Updated.
-        * WebCore.xcodeproj/project.pbxproj: Updated.
-        * WebCoreSources.bkl: Updated.
-        * rendering/RenderBlock.h: Removed unnecessary forward declaration and
-            updated comments.
-        * rendering/RenderBlockLineLayout.cpp: Copied from WebCore/rendering/bidi.cpp.
-            Removed unnecessary #include statements.
-        (WebCore::BidiRun::BidiRun): Moved here from bidi.h.
-        (WebCore::RenderBlock::layoutInlineChildren): Removed outdated comment.
-        * rendering/bidi.cpp: Removed.
-        * rendering/bidi.h: Removed.
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged):
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Image cleanup
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::destroyDecodedData): Use the data() accessor
-        instead of the m_data member.
-        (WebCore::BitmapImage::dataChanged): Ditto.
-        * platform/graphics/Image.h: Re-ordered #includes and class
-        declarations. Removed the drawPatternCallback() declaration. Made member
-        variables private.
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::drawPatternCallback): Changed this from a member function to a
-        static function.
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged): Use the data() accessor
-        instead of the m_data member.
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged): Ditto.
-
-2009-07-12  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27189
-        
-        Fixes insufficient check in XSSAuditor::canSetBaseElementURL that caused 
-        XSSAuditor to incorrectly block HTML Base elements whose base path coincided 
-        with the URL of the page.
-
-        Test: http/tests/security/xssAuditor/base-href-safe3.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canSetBaseElementURL): Changed conditional to only call 
-        XSSAuditor::findInRequest() if the host in the page URL disagrees with the host 
-        in the base element URL.
-
-2009-07-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
+        [V8] Delete V8CustomBinding.h and all references to V8Custom
 
-        Text searching with ICU should take the user's default locale into account
-        https://bugs.webkit.org/show_bug.cgi?id=27184
-        rdar://problem/6812121
+        https://bugs.webkit.org/show_bug.cgi?id=32638
 
-        No simple way to test this since it's dependent on user locale.
-        After this, the user's default locale is used only on Mac.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Utilities.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h: Removed.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        * bindings/v8/custom/V8EventSourceCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        (WebCore::V8HTMLAudioElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeFilterCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
 
-        * editing/TextIterator.cpp:
-        (WebCore::createSearcher): Pass result of the currentSearchLocaleID
-        function as the locale.
-
-        * platform/text/TextBreakIteratorInternalICU.h: Added declaration of
-        currentSearchLocaleID function.
-
-        * platform/text/android/TextBreakIteratorInternalICU.cpp:
-        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
-        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-
-        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
-        (WebCore::textBreakLocalePreference): Added. Returns the value of
-        the AppleTextBreakLocale preference.
-        (WebCore::topLanguagePreference): Added. Returns the value of the
-        first item in the AppleLanguages preference.
-        (WebCore::canonicalLanguageIdentifier): Added. Cover for the
-        CFLocaleCreateCanonicalLanguageIdentifierFromString function.
-        (WebCore::getLocale): Added. Transfers the locale from a CFStringRef
-        into a buffer.
-        (WebCore::getSearchLocale): Added. Calls topLanguagePreference,
-        canonicalLanguageIdentifier, and getLocale.
-        (WebCore::currentSearchLocaleID): Added. Calls getSearchLocale once.
-        (WebCore::getTextBreakLocale): Changed to call
-        textBreakLocalePreference, topLanguagePreference,
-        canonicalLanguageIdentifier, and getLocale.
-
-        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
-        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-
-2009-07-12  Xan Lopez  <xlopez@igalia.com>
+2010-02-04  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
+        [Qt] Unnecessary QBrush construction for doing a solid fill
+        https://bugs.webkit.org/show_bug.cgi?id=34559
 
-        Create a PangoLayout that properly represents the visual
-        appearance of the text in the web page so that the line boundary
-        modes of getText{At,Before,After}Offset work correctly.
+        Use the similar trick like r37421, i.e. use the special brush for
+        solid color to avoid creating QBrush again and again.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (UTF16ToUTF8):
-        (g_substr):
-        (convertUniCharToUTF8):
-        (getPangoLayoutForAtk):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformFillColor):
 
-2009-07-11  Oliver Hunt  <oliver@apple.com>
+2010-02-04  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Bug 27187 - Match Gecko behaviour for canvas path mutation APIs on an empty path
-        <https://bugs.webkit.org/show_bug.cgi?id=27187>
-
-        Simple API change, check for the empty path and add appropriate point if necessary.
-
-        Test: fast/canvas/canvas-modify-emptyPath.html
-
-        * Info.plist:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-
-2009-07-11  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        HTMLMediaElement.canPlayType "maybe" and "probably" reversed
-        https://bugs.webkit.org/show_bug.cgi?id=27186
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Return "probably" if type has codecs parameter.
+        REGRESSION (r53718): When scrolling a tall window by page, the overlap between pages is too big
+        https://bugs.webkit.org/show_bug.cgi?id=34371
 
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Ditto.
+        Allow ScrollbarTheme to cap the overlap between pages, and set a cap of
+        40 in ScrollbarThemeMac.
 
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Ditto.
+        * WebCore.base.exp: Export Scrollbar::maxOverlapBetweenPages().
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance): Use Scrollbar methods instead of
+        constants, and cap the scroll distance if needed.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Ditto.
+        (WebCore::ScrollView::wheelEvent): Ditto.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::maxOverlapBetweenPages): Added. Returns the
+        value from the native scrollbar theme.
+        * platform/Scrollbar.h: Replaced scroll amount constants with static methods.
+        (WebCore::Scrollbar::pixelsPerLineStep): Replaces cScrollbarPixelsPerLineStep.
+        (WebCore::Scrollbar::minFractionToStepWhenPaging): Replaces cFractionToStepWhenPaging.
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::maxOverlapBetweenPages): A base implementation
+        that returns the largest int.
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/haiku/PlatformWheelEventHaiku.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/mac/ScrollbarThemeMac.h:
+        (WebCore::ScrollbarThemeMac::maxOverlapBetweenPages): An override
+        that returns 40.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use
+        Scrollbar::pixelsPerLineStep() instead of cScrollbarPixelsPerLineStep.
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents): Use Scrollbar
+        methods instead of constants, and cap the scroll distance if needed.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout): Ditto.
 
-2009-07-11  Brady Eidson  <beidson@apple.com>
+2010-02-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Ariya Hidayat.
 
-        A worker-thread inspired follow-up for:
-        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
-        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+        [Qt] Tuning and optimizations to GraphicsLayerQt. Reduce unnecessary
+        recaching, remove QTimer::singleShot and QPixmap::scaled, more
+        accurate strategy of handling transform operation blends. Rotating a
+        bordered-table, for example, now runs at 50FPS instead of 40FPS on Maemo5.
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Don't perform the XHR compensation when the XHR
-          is running on a worker thread. Accessing the global Cache data structures from a non-main thread is
-          not currently supported.
+        https://bugs.webkit.org/show_bug.cgi?id=34062
 
-2009-07-11  Simon Fraser  <simon.fraser@apple.com>
+        This is tested by https://bugs.webkit.org/show_bug.cgi?id=34450, fps measurements.
 
-        Enable support for accelerated compositing and 3d transforms on Leopard.
-        <https://bugs.webkit.org/show_bug.cgi?id=20166>
-        <rdar://problem/6120614>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges): Fine-tune caching
+        (WebCore::TransformAnimationQt::TransformAnimationQt): transform bugs
+        (WebCore::OpacityAnimationQt::updateState): style change
 
-        Reviewed by Oliver Hunt.
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
-        * Configurations/FeatureDefines.xcconfig:
+        Reviewed by Timothy Hatcher.
 
-2009-07-11  Simon Hausmann  <hausmann@webkit.org>
+        Web Inspector: Cookies for resources are not shown in storage panel.
 
-        Fix the Qt build after r45724.
+        https://bugs.webkit.org/show_bug.cgi?id=34594
 
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::cachedResource):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestURL):
 
-2009-07-10  Daniel Bates  <dbates@intudata.com>
+2010-02-04  Anton Muhin  <antonm@chromium.org>
 
         Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26921
-
-        Implements support for HTML entities, so XSSAuditor can protect against attacks
-        encoded with HTML entities.
-
-        Tests: http/tests/security/xssAuditor/inline-event-HTML-entities.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities.html
-               http/tests/security/xssAuditor/link-onclick-entities.html
-               http/tests/security/xssAuditor/script-tag-entities.html
-               http/tests/security/xssAuditor/script-tag-with-source-entities.html
+        [v8] Remove clear method from DOM object maps
+        https://bugs.webkit.org/show_bug.cgi?id=34530
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::decodeURL): Modified to call WebCore::XSSAuditor::decodeHTMLEntities
-        to decode HTML entities.
-        (WebCore::XSSAuditor::decodeHTMLEntities): Added method to decode HTML entities.
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-07-10  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27007: Build fixes when ICONDATABASE is disabled
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27007>
-
-        Reviewed by Sam Weinig.
+        No new tests. Should be covered by existent testing infrastructure.
 
-        * WebCore.xcodeproj/project.pbxproj: Added IconDatabaseNone.cpp
-        to the project.
-        * loader/icon/IconDatabase.cpp: Added
-        #if ENABLE(ICONDATABASE)/#endif macro guard.
-        * loader/icon/IconDatabase.h: Removed three public methods from
-        #if ENABLE(ICONDATABASE)/#endif macro so that they may be
-        stubbed out in IconDatabaseNone.cpp.
-        * loader/icon/IconDatabaseNone.cpp: Added
-        #if !ENABLE(ICONDATABASE)/#endif macro guard.
-        (WebCore::IconDatabase::importIconURLForPageURL): Added.
-        (WebCore::IconDatabase::importIconDataForIconURL): Added.
-        (WebCore::IconDatabase::shouldStopThreadActivity): Added.
-
-2009-07-10  Daniel Bates  <dbates@intudata.com>
+        * bindings/v8/DOMData.h:
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
 
-        Reviewed by Adam Barth.
+2010-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27151
+        Reviewed by Xan Lopez.
 
-        Fixes issue where JavaScript URLs that contain null- and non-null control characters can
-        bypass XSSAuditor.
+        [Gtk] Check if the renderer() exists in textForObject.
 
-        Tests: http/tests/security/xssAuditor/javascript-link-control-char.html
-               http/tests/security/xssAuditor/javascript-link-null-char.html
-               http/tests/security/xssAuditor/javascript-link.html
+        This is fixing a crash in the textForObject method. It can
+        happen when inspecting AtkObjects in the accerciser, then
+        navigating to a new page and still inspecting the old tree.
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Separated out logic for JavaScript URLs from 
-        inline scripts. For JavaScript URLs, calls XSSAuditor::canEvaluateJavaScriptURL.
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Made similar changes to evaluate() as in
-        bindings/js/ScriptController.cpp.
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Separated out logic for JavaScript URLs
-        into its own method.
-        * page/XSSAuditor.h:
+        In this case the AccessibilityObjectWrapperAtk was still
+        valid but the included renderer() was returning 0. Add a
+        check for the accObject->renderer() before trying to use
+        the result.
 
-2009-07-10  Shinichiro Hamaji  <hamaji@chromium.org>
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
 
-        Reviewed by David Kilzer.
+2010-02-04  Yury Semikhatsky  <yurys@chromium.org>
 
-        WebKit needs a style linting tool
-        https://bugs.webkit.org/show_bug.cgi?id=25884
+        Reviewed by Pavel Feldman.
 
-        Fix bunch of style issues by autofix of cpplint.
-        This patch is created to demonstrate the autofix of cpplint.py.
+        Provide strongly typed C++ interface for inspector's injected script.
 
-        No new testcases because it's a style fix
+        https://bugs.webkit.org/show_bug.cgi?id=33616
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseMediaQuery):
-        (WebCore::CSSParser::validUnit):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::skipCommaInDashboardRegion):
-        (WebCore::CSSParser::parseDashboardRegions):
-        (WebCore::ShadowParseContext::commitValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::ShadowParseContext::commitColor):
-        (WebCore::BorderImageParseContext::commitNumber):
-        (WebCore::BorderImageParseContext::commitWidth):
-        (WebCore::BorderImageParseContext::commitRule):
-        (WebCore::BorderImageParseContext::commitBorderImage):
-        (WebCore::CSSParser::lex):
-        (WebCore::CSSParser::text):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/MediaList.cpp:
-        (WebCore::MediaList::deleteMedium):
-        * css/MediaQuery.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::parseAspectRatio):
-        * css/MediaQueryEvaluator.h:
-        * css/MediaQueryExp.h:
-        (WebCore::MediaQueryExp::operator==):
-        * css/WebKitCSSMatrix.h:
-        * dom/Comment.h:
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        * dom/Document.h:
-        (WebCore::Document::setHasDashboardRegions):
-        * dom/DocumentFragment.cpp:
-        (WebCore::DocumentFragment::nodeName):
-        * dom/DocumentFragment.h:
-        * dom/DynamicNodeList.h:
-        * dom/EditingText.h:
-        * dom/Element.cpp:
-        (WebCore::Element::dispatchAttrAdditionEvent):
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::item):
-        * dom/Node.cpp:
-        (WebCore::Node::nodeValue):
-        (WebCore::Node::nodeIndex):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::create):
-        * dom/Notation.h:
-        * dom/ProcessingInstruction.h:
-        * dom/Range.cpp:
-        (WebCore::Range::processContents):
-        * dom/StyledElement.cpp:
-        (WebCore::toHex):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::PendingCallbacks::PendingStartElementNSCallback::~PendingStartElementNSCallback):
-        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call):
-        (WebCore::PendingCallbacks::):
-        (WebCore::OffsetBuffer::readOutBytes):
-        (WebCore::handleElementNamespaces):
-        (WebCore::handleElementAttributes):
-        (WebCore::attributesStartElementNsHandler):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::attributesStartElementNsHandler):
-        (WebCore::XMLTokenizer::parseStartElement):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyle):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode):
-        * editing/Editor.cpp:
-        (WebCore::Editor::pasteAsPlainText):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::directionOfEnclosingBlock):
-        * editing/SmartReplaceICU.cpp:
-        (WebCore::addAllCodePoints):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::icon):
-        (WebCore::HistoryItem::adoptVisitCounts):
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyFillColor):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::setActive):
-        (WebCore::HTMLAnchorElement::isLiveLink):
-        * html/HTMLAppletElement.h:
-        * html/HTMLAudioElement.h:
-        * html/HTMLBRElement.h:
-        * html/HTMLBaseElement.h:
-        * html/HTMLBaseFontElement.h:
-        * html/HTMLDListElement.h:
-        * html/HTMLDirectoryElement.h:
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::reset):
-        * html/HTMLHRElement.cpp:
-        (WebCore::HTMLHRElement::parseMappedAttribute):
-        * html/HTMLHeadElement.h:
-        * html/HTMLHtmlElement.h:
-        * html/HTMLImageElement.h:
-        (WebCore::HTMLImageElement::setLoadManually):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::selection):
-        * html/HTMLIsIndexElement.h:
-        * html/HTMLMarqueeElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::):
-        * html/HTMLMenuElement.h:
-        * html/HTMLMetaElement.h:
-        * html/HTMLModElement.h:
-        * html/HTMLOListElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::childrenChanged):
-        * html/HTMLParamElement.h:
-        * html/HTMLQuoteElement.h:
-        * html/HTMLStyleElement.h:
-        * html/HTMLTableCaptionElement.h:
-        * html/HTMLTableCellElement.h:
-        * html/HTMLTableColElement.h:
-        * html/HTMLTableSectionElement.cpp:
-        (WebCore::HTMLTableSectionElement::deleteRow):
-        * html/HTMLTitleElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseNonHTMLText):
-        (WebCore::HTMLTokenizer::parseEntity):
-        (WebCore::HTMLTokenizer::parseTag):
-        (WebCore::HTMLTokenizer::write):
-        * html/HTMLUListElement.h:
-        * html/HTMLVideoElement.h:
-        * html/TimeRanges.h:
-        (WebCore::TimeRanges::Range::Range):
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScript.cpp: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapAndStringifyForConsole):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::~InjectedScript):
+        (WebCore::InjectedScript::hasNoValue):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::enableResourceTracking):
-        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::newInspectorJSONObject):
-        * page/Console.cpp:
-        (WebCore::Console::addMessage):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::defaultKeyboardEventHandler):
-        * page/Frame.cpp:
-        (WebCore::Frame::jsDefaultStatusBarText):
-        * page/android/DragControllerAndroid.cpp:
-        (WebCore::DragController::dragOperation):
-        * page/android/EventHandlerAndroid.cpp:
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::eventActivatedView):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/gtk/DragControllerGtk.cpp:
-        (WebCore::DragController::dragOperation):
-        * page/qt/DragControllerQt.cpp:
-        * page/win/DragControllerWin.cpp:
-        (WebCore::DragController::isCopyKeyDown):
-        * page/win/FrameWin.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::mouseEventOffsetToThumb):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::setVerticalAlignLength):
-        (WebCore::InheritedFlags::setUnicodeBidi):
-        (WebCore::InheritedFlags::setCursor):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-        * rendering/style/SVGRenderStyleDefs.h:
-        * rendering/style/StyleInheritedData.h:
-        (WebCore::StyleInheritedData::operator!=):
-        * storage/DatabaseTask.h:
-        * svg/GradientAttributes.h:
-        * svg/LinearGradientAttributes.h:
-        * svg/PatternAttributes.h:
-        * svg/RadialGradientAttributes.h:
-        * svg/SVGAnimatedPathData.h:
-        * svg/SVGAnimatedPoints.h:
-        * svg/SVGAnimationElement.h:
-        * svg/SVGClipPathElement.h:
-        * svg/SVGElementInstance.h:
-        * svg/SVGFEBlendElement.cpp:
-        (WebCore::SVGFEBlendElement::build):
-        * svg/SVGFEBlendElement.h:
-        * svg/SVGFEColorMatrixElement.cpp:
-        (WebCore::SVGFEColorMatrixElement::build):
-        * svg/SVGFEComponentTransferElement.cpp:
-        (WebCore::SVGFEComponentTransferElement::build):
-        * svg/SVGFECompositeElement.cpp:
-        (WebCore::SVGFECompositeElement::build):
-        * svg/SVGFEDiffuseLightingElement.cpp:
-        (WebCore::SVGFEDiffuseLightingElement::build):
-        * svg/SVGFEDisplacementMapElement.cpp:
-        (WebCore::SVGFEDisplacementMapElement::build):
-        * svg/SVGFEDistantLightElement.h:
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFEFloodElement.h:
-        * svg/SVGFEFuncAElement.h:
-        * svg/SVGFEFuncBElement.h:
-        * svg/SVGFEFuncGElement.h:
-        * svg/SVGFEFuncRElement.h:
-        * svg/SVGFEGaussianBlurElement.cpp:
-        (WebCore::SVGFEGaussianBlurElement::build):
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::build):
-        * svg/SVGFEMergeElement.cpp:
-        (WebCore::SVGFEMergeElement::build):
-        * svg/SVGFEOffsetElement.cpp:
-        (WebCore::SVGFEOffsetElement::build):
-        * svg/SVGFEPointLightElement.h:
-        * svg/SVGFESpecularLightingElement.cpp:
-        (WebCore::SVGFESpecularLightingElement::build):
-        * svg/SVGFESpotLightElement.h:
-        * svg/SVGFETileElement.cpp:
-        (WebCore::SVGFETileElement::build):
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::parseMappedAttribute):
-        * svg/SVGList.h:
-        * svg/SVGListTraits.h:
-        (WebCore::):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMetadataElement.h:
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::SVGPathParser::parseSVG):
-        (WebCore::SVGPathParser::calculateArc):
-        * svg/SVGPathElement.h:
-        * svg/SVGPathSegClosePath.h:
-        * svg/SVGSVGElement.h:
-        * svg/SVGSetElement.h:
-        * svg/SVGSwitchElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::parseMappedAttribute):
-        * svg/SVGTextPathElement.h:
-        * svg/SVGTitleElement.h:
-        * svg/SVGTransformable.cpp:
-        (WebCore::):
-        * svg/SVGViewSpec.cpp:
-        (WebCore::):
-        * svg/animation/SMILTime.cpp:
-        (WebCore::operator+):
-        (WebCore::operator-):
-        (WebCore::operator*):
-        * svg/animation/SVGSMILElement.h:
-        * svg/graphics/SVGResource.cpp:
-        (WebCore::clientMap):
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::value):
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::value):
-        * workers/WorkerRunLoop.cpp:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dropProtection):
-        * xml/XPathPath.h:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-2009-07-10  Eric Carlson  <eric.carlson@apple.com>
+2010-02-04  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Simon Fraser.
+        Rubber stamped by Xan Lopez.
 
-        <rdar://problem/7049066>.
-        Update SnowLeopard media controller layout.
+        Missing include, build fix after landing of patch from the bug 34435.
 
-        * css/mediaControlsQT.css:
-            Update for new layout.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::movieLoadType):
-            Added to replace isStreaming.
-        * html/HTMLMediaElement.h:
-            Declare movieLoadType, remove isStreaming.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlStatusDisplayElement::update):
-            Use movieLoadType instead of isStreaming.
-        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
-            MediaControlElement is the base class, not HTMLInputElement.
-        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded):
-            Ditto.
-        (WebCore::MediaControlRewindButtonElement::rendererIsNeeded):
-            Don't display rewind button for live streams.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded):
-            MediaControlInputElement is the base class, not HTMLInputElement.
-        * rendering/MediaControlElements.h:
+2010-02-02  Philippe Normand  <pnormand@igalia.com>
 
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::getMediaUIPartStateFlags):
-            New, return wkDrawMediaUIPart flags.
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-        (WebCore::RenderThemeMac::paintMediaPlayButton):
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeMac::paintMediaRewindButton):
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-            Use getMediaUIPartStateFlags.
-
-2009-07-10  Michelangelo De Simone  <micdesim@gmail.com>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Adele Peterson.
+        [Gtk] libsoup critical warning in media player http cookies injection code
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Added build stuff and stub for the ValidityState class, part of HTML5
-        section Forms:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+        Fixed the critical warning and refactored the
+        User-Agent/Referer/cookies injection code, in that order. Previous
+        order (cookies first) was wrong because if cookies injection could
+        not be done neither the User-Agent nor Referer were injected. Also
+        started a non-JSC-specific, gtk-specific GOwnPtr module.
 
-        Test: fast/forms/ValidityState-001.html
+        * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Added.
+        (WTF::SoupURI):
+        (WTF::GstElement):
+        * platform/gtk/GOwnPtrGtk.h: Added.
 
-        * DerivedSources.cpp: Fix aimed to include ValidityState files
-        * DerivedSources.make: ditto
-        * GNUmakefile.am: ditto
-        * WebCore.gypi: ditto
-        * WebCore.pro: ditto
-        * WebCore.vcproj/WebCore.vcproj: ditto
-        * WebCore.xcodeproj/project.pbxproj: ditto
-        * WebCoreSources.bkl: ditto
-        * html/HTMLButtonElement.idl: "validity" attribute
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp: object getter
-        (WebCore::HTMLFormControlElement::validity):
-        * html/HTMLFormControlElement.h: ditto
-        * html/HTMLInputElement.idl: "validity" attribute
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl: ditto
-        * html/ValidityState.cpp: Added.
-        (WebCore::ValidityState::ValidityState):
-        (WebCore::ValidityState::valid): validation flag
-        * html/ValidityState.h: Added.
-        (WebCore::ValidityState::create): creation routine
-        (WebCore::ValidityState::control): ValidityState's parent getter
-        (WebCore::ValidityState::valueMissing): validation flag
-        (WebCore::ValidityState::typeMismatch): ditto
-        (WebCore::ValidityState::patternMismatch): ditto
-        (WebCore::ValidityState::tooLong): ditto
-        (WebCore::ValidityState::rangeUnderflow): ditto
-        (WebCore::ValidityState::rangeOverflow): ditto
-        (WebCore::ValidityState::stepMismatch): ditto
-        (WebCore::ValidityState::customError): ditto
-        * html/ValidityState.idl: Added.
-
-2009-07-10  Brady Eidson  <beidson@apple.com>
-
-        Style cleanup over my last patch.
+2010-02-04  Mikhail Naganov  <mnaganov@chromium.org>
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+        Reviewed by Timothy Hatcher.
 
-2009-07-10  Kevin McCullough  <kmccullough@apple.com>
+        Put JSC-specific debugger & profiler code under "USE(JSC)" defines.
+        The plan is to enable "JAVASCRIPT_DEBUGGER" in Chromium and then
+        make this code engine-agnostic.
 
-        Reviewed by Geoffrey Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=34531
 
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
         * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::dynamicGlobalObject):
-        * inspector/JavaScriptCallFrame.h: New helper method, used below.
-
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptDebugListener.h:
         * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::detach): In the special case
-        where we detach from a window currently executing JavaScript,
-        manually tear down our representation of the JavaScript
-        call stack, since we won't get any more callbacks from JavaScriptCore
-        to automatically tear it down. It's too bad that WebCore is
-        responsible for this kind of tracking -- in the future, it would
-        be nice if more of the breakpoint handling was inside of JavaScriptCore.
-
-2009-07-10  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
-        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
-
-        With this test we ended up going over the maximum-connections-per-host limit that CFNetwork expected.
-        When that happened, the first request that was over the limit ended up in a bizarre state where it 
-        wasn't fully serviced until after the long running XHR was complete.
-
-        Loader and Loader::Host work together to try to not exceed the max-connection limit but non-cache
-        resources - such as XHR - could still end up causing this limit to be exceeded.
-
-        This fix adds a workaround specifically for XHR while we hash out a more thorough solution that will
-        handle this at the resource handle level.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::nonCacheRequestInFlight):
-        (WebCore::Loader::nonCacheRequestComplete):
-        (WebCore::Loader::Host::Host):
-        (WebCore::Loader::Host::nonCacheRequestInFlight):
-        (WebCore::Loader::Host::nonCacheRequestComplete):
-        (WebCore::Loader::Host::servePendingRequests): Take nonCacheRequestsInFlight into account.
-        * loader/loader.h:
-        (WebCore::Loader::Host::processingResource): Take nonCacheRequestsInFlight into account.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest): 
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Bump the nonCacheRequestInFlight count.
-        (WebCore::XMLHttpRequest::didFail): Decrement that count if the Loader was notified.
-        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
-
-2009-07-10  Antti Koivisto  <antti@apple.com>
-
-        Try to unbreak non-Mac build.
-
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::formDidFocus):
-        (WebCore::ChromeClient::formDidBlur):
-
-2009-07-10  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        The rest of the fix for <rdar://problem/7038831> REGRESSION (TOT): 
-        In Mail, a crash occurs at WebCore::Widget::afterMouseDown() after 
-        clicking To Do's close box
-
-        Make the Widget* in passMouseDownEventToWidget() a RefPtr.
-
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-
-2009-07-10  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        rename getDOMStructure calls w/o JSGlobalObject* to deprecatedGetDOMStructure
-        https://bugs.webkit.org/show_bug.cgi?id=27157
-
-        This is the first step to fixing
-        https://bugs.webkit.org/show_bug.cgi?id=27088
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::deprecatedGetDOMStructure):
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSRGBColor.cpp:
-        (WebCore::JSRGBColor::JSRGBColor):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::RuntimeArray):
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::RuntimeMethod):
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-
-2009-07-10  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        Add delegate methods about focus and blur and state change
-        https://bugs.webkit.org/show_bug.cgi?id=27153
-
-        Call the appropriate new ChromeClient methods for focus and blur.
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
-        * html/HTMLFormControlElement.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::formDidFocus):
-        (WebCore::EmptyChromeClient::formDidBlur):
-        * page/ChromeClient.h:
-
-2009-07-10  Steve Falkenburg  <sfalken@apple.com>
-
-        <rdar://problem/7048741> REGRESSION: Error about missing SwMenuX.dll opening pages with Shockwave
-        
-        Use altered search path while loading plug-ins. This modifies the DLL search order
-        to look in the directory containing the plug-in even if a call to SetDllDirectory
-        was previously made. Use of SetDllDirectory removes the current directory from the search path,
-        breaking the previous strategy for locating any dependent DLLs of the plug-in.
-        
-        Reviewed by Jon Honeycutt.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load): Use LoadLibraryEx with LOAD_WITH_ALTERED_SEARCH_PATH
-
-2009-07-10  Adam Roben  <aroben@apple.com>
-
-        Sort all our Xcode projects
-
-        Accomplished using sort-Xcode-project-file.
-
-        Requested by Dave Kilzer.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-07-10  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Chromium Linux: use disabled images for disabled widgets.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27106
-
-        Previously, checkboxes and radio controls rendered the same even if disabled.
-        The Chromium side of this change is r20224.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-
-2009-07-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix crash when changing the zoom level in http://iphone.akamai.com/
-        <rdar://problem/7029077>
-
-        RenderLayerBacking's paintIntoLayer() method called updateLayerListsIfNeeded(),
-        which could potentially destroy that compositing layer, causing a crash.
-        Prevent this from happening by not doing a compositing update from paintIntoLayer().
-
-        The existing updateLayerListsIfNeeded() was renamed to updateCompositingAndLayerListsIfNeeded(),
-        and still does the compositing update. The new updateLayerListsIfNeeded() does not touch
-        compositing layers, and is still called from paintIntoLayer().
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::updateLayerListsIfNeeded):
-        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
-        * rendering/RenderLayer.h:
-
-2009-07-10  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Darin Adler.
-
-        Need to remove UsesManualToJSImplementation() in favor of CustomToJS.
-        https://bugs.webkit.org/show_bug.cgi?id=27010
-
-        Added support for CustomToJS IDL attribute to replace the hard-coded class list in UsesManualToJSImplementation().
-
-        This is just a cleanup of existing functionality, so existing LayoutTests adequately cover this patch.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Removed UsesManualToJSImplementation(), added support for CustomToJS attribute.
-        * css/CSSRule.idl:
-        * css/CSSValue.idl:
-        * css/StyleSheet.idl:
-        * dom/Document.idl:
-        * dom/Event.idl:
-        * dom/Node.idl:
-        * html/ImageData.idl:
-        * svg/SVGElementInstance.idl:
-        * svg/SVGPathSeg.idl:
-        Added CustomToJS attribute to all the above IDL files.
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        - fix the build by reverting the ill-advised r45711
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor):
-
-2009-07-09  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Updated WebCore.base.exp to add some needed functions.
-
-        * WebCore.base.exp:
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        - address a review comment from Simon Fraser which I forgot to include
-          in the last check-in
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor): Pass true to getRect() for
-        maximum transform friendliness!
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=27137
-          <rdar://problem/7043124> REGRESSION (r44311): Reproducible crash due
-          to infinite recursion into FrameLoader::gotoAnchor() ->
-          FrameView::layout()
-
-        Test: fast/loader/goto-anchor-infinite-layout.html
-
+        * inspector/JavaScriptDebugServer.h:
+        * inspector/JavaScriptProfile.cpp:
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        * inspector/JavaScriptProfileNode.h:
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::gotoAnchor): Moved the code to update layout,
-        find the renderer to scroll to, and scroll from here to methods on
-        FrameView, and replaced it with a call to
-        FrameView::maintainScrollPositionAtAnchor().
-        (WebCore::FrameLoader::completed): Call maintainScrollPositionAtAnchor()
-        instead of setLockedToAnchor().
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView): Removed initialization of
-        m_lockedToAnchor.
-        (WebCore::FrameView::reset): Reset m_maintainScrollPositionAnchor instead
-        of m_lockedToAnchor.
-        (WebCore::FrameView::layout): Removed the code related to scrolling to
-        the anchor from here, because scrolling can trigger events which
-        invalidate the layout, and as such, belongs with the post-layout tasks.
-        (WebCore::FrameView::maintainScrollPositionAtAnchor): Added. When called
-        with a node scrolls the view to the top of that node and maintains it
-        scrolled to the top of the node during subsequent layouts, until
-        this function is called with 0 or other things trigger scrolling.
-        (WebCore::FrameView::scrollRectIntoViewRecursively): Reset
-        m_maintainScrollPositionAnchor.
-        (WebCore::FrameView::setScrollPosition): Ditto.
-        (WebCore::FrameView::scrollToAnchor): Added. Scrolls to the top of
-        m_maintainScrollPositionAnchor, if it is set.
-        (WebCore::FrameView::performPostLayoutTasks): Call scrollToAnchor().
-        (WebCore::FrameView::setWasScrolledByUser): Reset
-        m_maintainScrollPositionAnchor.
-
-        * page/FrameView.h: Removed lockedToAnchor(), setLockedToAnchor(),
-        and m_lockedToAnchor. Added maintainScrollPositionAtAnchor() and
-        m_maintainScrollPositionAnchor.
-
-2009-07-04  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26439
-
-        QtWebKit fails in loading www.nytimes.com in Windows/Linux
-
-        QNetworkReplyHandler is ignoring content associated with 401 error.
-        This causes the XHR response handling to fail.
-
-        Simon: Added also ProxyAuthenticationRequiredError, to handle the same
-        case when going through proxies, as suggested by Prasanth.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Enable HTML 5 Messaging to fix message channel Qt DRT failures in
-        fast/events.
-
-        * WebCore.pro:
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        added InlineBox::isLeaf()
-        firstLeafChild()/lastLeafChild() not virtual and not callable on InlineBox anymore.
-        firstLeafChild()/lastLeafChild() will no longer return a node outside of the given subtree.   
-        Removed firstLeafChildAfterBox()/lastLeafChildBeforeBox()
-        Removed potentially quadratic behavior if all nodes before/after a given box are empty InlineFlowBoxes
-
-        Currently, these methods are called on RootInlineBox objects only, so above changes should not have
-        any observable effect (only the removal of the square performance behavior could apply, 
-        but the conditions for that are probably of a rather theoretical nature).
-
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::nextLeafChild):
-        (WebCore::InlineBox::prevLeafChild):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::isLeaf):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::firstLeafChild):
-        (WebCore::InlineFlowBox::lastLeafChild):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::firstChild):
-        (WebCore::InlineFlowBox::lastChild):
-        (WebCore::InlineFlowBox::isLeaf):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::closestLeafChildForXPos):
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Added InlineBox::baselinePosition() and lineHeight() methods
-        (adapted remaining code accordingly to use those methods)
-
-        No change in functionality.
-
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::baselinePosition):
-        (WebCore::InlineBox::lineHeight):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
-        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
-        (WebCore::InlineFlowBox::placeBoxesVertically):
-
-2009-07-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 27142 - canPlayType() should return empty string for unsupported content
-        <https://bugs.webkit.org/show_bug.cgi?id=27142>
-
-        Return "" instead of "no" for unsupport media types. 
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::canPlayType):
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Implement the part of HTML5 spec that deals with parsing of <rp> and <rt> tags
-        in that their end tags are optional if followed by <rp>/<rt>.
-
-        Also specify a new accessibility role "annotation" for <rp> and <rt>.
-
-        Affected code parts are not enclosed in #IF ENABLE(RUBY), since the parsing
-        is not affected by whether ruby is rendered properly or not (in fact, it may 
-        be more profound without ruby layouting, since the contents of <rp> are not hidden).
-
-        Test: fast/ruby/parse-rp.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::roleValue):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::endTagRequirement):
-        (WebCore::HTMLElement::tagPriority):
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::rpCreateErrorCheck):
-        (WebCore::HTMLParser::rtCreateErrorCheck):
-        (WebCore::HTMLParser::getNode):
-        * html/HTMLParser.h:
-        * html/HTMLTagNames.in:
-
-2009-07-09  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, fix for previous commit.
-
-        The change http://trac.webkit.org/changeset/45695 did not correctly
-        enabled GTL and QT build flags. This caused layout tests failure.
-        This is speculative fix for those failures.
-
-        * GNUmakefile.am: added ENABLE_CHANNEL_MESSAGING flag.
-        * WebCore.pro: ditto.
-        * page/DOMWindow.idl: touched to cause recompile.
-        * workers/WorkerContext.idl: ditto.
-
-2009-07-09  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26903
-
-        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
-        is now implemented for Web Workers and is reasonably stable.
-
-        Tests: fast/events/message-channel-gc-2.html
-               fast/events/message-channel-gc-3.html
-               fast/events/message-channel-gc-4.html
-               fast/events/message-channel-gc.html
-               fast/events/message-channel-listener-circular-ownership.html
-               fast/events/message-port-clone.html
-               fast/events/message-port-constructor-for-deleted-document.html
-               fast/events/message-port-deleted-document.html
-               fast/events/message-port-deleted-frame.html
-               fast/events/message-port-inactive-document.html
-               fast/events/message-port-no-wrapper.html
-               fast/events/message-port.html
-               fast/workers/worker-cloneport.html
-               fast/workers/worker-messageport-gc.html
-               fast/workers/worker-messageport.html
-
-        * Configurations/FeatureDefines.xcconfig: Turned on ENABLE_CHANNEL_MESSAGING.
-        * WebCore/WebCore.vcproj/WebCoreCommon.vsprops: ditto.
-        * WebCore/WebCore.vcproj/build-generated-files.sh: ditto.
-        * WebCore/page/DOMWindow.idl: touch the file to cause re-generation of headers.
-        * WebCore/workers/WorkerContext.idl: ditto.
-
-
-2009-07-09  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Full page zoom breaks remaining and elapsed time display in the <video> controller.
-        https://bugs.webkit.org/show_bug.cgi?id=27123
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
 
-        We are changing the size of the time remaining and time elapsed field, to
-        automatically hide them, when the controller is too short.
+2010-02-03  Nicholas Young  <nicholas.young@nokia.com>
 
-        Because we toggle the size between 0 and the previous value of the
-        controller, we miss any width change that may occur during full page zoom,
-        and we fail to restore a correct width.
+        Reviewed by Eric Carlson.
 
-        This change fixes that problem by using a cloned style on which we
-        set the width to 0, and restoring the previous style when going back to
-        the normal width.
+        Defer formatting of times displayed on media controls to the current theme.
+        https://bugs.webkit.org/show_bug.cgi?id=34405
 
-        We take care about properly using the cloned style or the pseudo style,
-        by overriding styleForElement().
+        No new tests needed. Refactoring Only.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::styleForElement):
-        (WebCore::MediaControlElement::attach):
-        (WebCore::MediaControlElement::updateStyle):
-        (WebCore::MediaControlInputElement::styleForElement):
-        (WebCore::MediaControlInputElement::attach):
-        (WebCore::MediaControlInputElement::updateStyle):
-        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
-        (WebCore::MediaControlTimeDisplayElement::styleForElement):
-        (WebCore::MediaControlTimeDisplayElement::setVisible):
+        * rendering/MediaControlElements.cpp: Removed formatTime()
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue): No longer sets inner text
         * rendering/MediaControlElements.h:
         * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::shouldShowTimeDisplayControls): Make sure
-        we take in account the zoom level when deciding if we should hide the 
-        ellapsed and remaining time.
-
-2009-07-09  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Adler.
-
-        Fix chromium build bustage due to Widget being a RefCounted class.
-        https://bugs.webkit.org/show_bug.cgi?id=27139
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        * platform/chromium/PopupMenuChromium.h:
-
-2009-07-09  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27130 - Need to implement ARIA role="toolbar"
-        https://bugs.webkit.org/show_bug.cgi?id=27130
-
-        Test: platform/mac/accessibility/aria-toolbar.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [Chromium] Upstream WebCore.gypi, the project file for Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=27135
-
-        * WebCore.gypi: Added.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        A more robust fix for <rdar://problem/6930280> Reproducible crash at
-        USA Today photo gallery
-
-        Reviewed by Steve Falkenburg.
-
-        * plugins/win/PluginMessageThrottlerWin.cpp:
-        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
-        Protect the PluginView from destruction before calling its window proc.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/6978804> WER #16: Repro Access Violation in
-        WebCore::PluginView::bindingInstance (1310178023)
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::bindingInstance):
-        Protect the PluginView from destruction before calling NPN_GetValue. If
-        the renderer for the PluginView was destroyed during the call, and the
-        PluginView's ref count is now 1, return null.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Speculative fix for <rdar://problem/6991251> WER #13: Crash in
-        WebKit!WebCore::PluginView::performRequest+203 (1311461169)
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
-        Protect the PluginView from destruction before performing a load.
-        Removed some trailing whitespace.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Build fix.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
-
-2009-07-09  Beth Dakin and Jon Honeycutt <bdakin@apple.com>
+        (WebCore::RenderMedia::updateTimeDisplay): Asks the theme to format the time display elements
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::formatMediaControlsTime): new virtual method
+        (WebCore::RenderTheme::formatMediaControlsCurrentTime): new virtual method
+        (WebCore::RenderTheme::formatMediaControlsRemainingTime): new virtual method
+        * rendering/RenderTheme.h:
 
-        Reviewed by Dave Hyatt.
+2010-02-03  Steve Falkenburg  <sfalken@apple.com>
 
-        Make Widget RefCounted to fix or make fixable:
+        Windows Debug_All build fix.
 
-        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs 
-        at WebCore::Widget::afterMouseDown() after clicking To Do's close 
-        box
-        <rdar://problem/6978804> WER #16: Repro Access Violation in 
-        WebCore::PluginView::bindingInstance (1310178023)
-        -and-
-        <rdar://problem/6991251> WER #13: Crash in WebKit!
-        WebCore::PluginView::performRequest+203 (1311461169) 
+        * platform/graphics/win/WKCACFLayer.cpp:
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::createPlugin):
-        Changed to return PassRefPtr
-        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
-        Ditto.
+2010-02-03  Brady Eidson  <beidson@apple.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        (WebCore::FrameLoader::loadPlugin):
-        Make the widget variable a RefPtr. Use .get() when passing it to
-        RenderPart::setWidget().
-        (WebCore::FrameLoader::createJavaAppletWidget):
-        Make the widget variable a RefPtr.
+        Reviewed by Alexey Proskuryakov.
 
-        * loader/FrameLoader.h:
-        Changed the return type of createJavaAppletWidget().
+        REGRESSION (r51644): WebCore/manual-tests/linkjump-1.html fails
+        <rdar://problem/7595694> and https://bugs.webkit.org/show_bug.cgi?id=34550
 
-        * loader/FrameLoaderClient.h:
-        Change the return types of createPlugin() and 
-        createJavaAppletWidget().
+        Tests: fast/loader/document-with-fragment-url-1.html
+               fast/loader/document-with-fragment-url-2.html
+               fast/loader/document-with-fragment-url-3.html
+               fast/loader/document-with-fragment-url-4.html
 
-        * page/Frame.cpp:
-        (WebCore::Frame::createView):
-        No need to call .get() since setWidget() takes a RefPtr.
+        * platform/KURL.cpp:
+        (WebCore::KURL::init): When resolving new URL from an empty reference relative to an absolute URL,
+          any fragment identifier from the absolute URL should be removed from the resulting resolution.
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        children() now returns a HashSet of RefPtrs.
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
-        * page/FrameView.h:
-        Remove inheritance from RefCounted; we pick this up from ScrollView
-        through Widget.
+        Reviewed by Eric Seidel.
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::addChild):
-        addChild() now takes a PassRefPtr and m_children now keeps a 
-        HashSet of RefPtrs.
+        [BREWMP] Port TextBreakIteratorInternalICU
+        https://bugs.webkit.org/show_bug.cgi?id=34515
 
-        * platform/ScrollView.h:
-        ScrollView constructor is now protected.
-        (WebCore::ScrollView::children):
-        m_children is now a HashSet of RefPtrs.
+        Port TextBreakIteratorInternalICU.
 
-        * platform/Scrollbar.h:
-        Remove inheritance from RefCounted; we pick this up from ScrollView
-        through Widget.
+        * platform/text/brew/TextBreakIteratorInternalICUBrew.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
 
-        * platform/Widget.h:
-        Inherit from RefCounted. Cleaned up some whitespace. Make m_widget 
-        a RefPtr.
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::create):
-        Adopt the PluginView when returning it.
+        Reviewed by Simon Fraser.
 
-        * plugins/PluginView.h:
-        Changed create() to return a PassRefPtr.
+        Fix for <rdar://problem/7594212> 
+        https://bugs.webkit.org/show_bug.cgi?id=34549 - CSS counters crash at http://www.w3.org/TR/css3-content/
+        CrashTracer: [USER] 20 crashes in Safari at com.apple.WebCore: WebCore::CounterNode::insertAfter + 319
 
-        * rendering/RenderApplet.cpp:
-        Receive result in a RefPtr when calling createJavaAppletWidget().
+        Test: fast/css/counters/counter-before-selector-crash.html
 
-        * rendering/RenderPart.cpp:
-        (WebCore::RenderPart::setWidget): 
-        setWidget() now takes a PassRefPtr. Also removed the manual ref of 
-        FrameViews. This is handled by having m_widget be a RefPtr. Removed 
-        deleteWidget().
+        * rendering/RenderCounter.cpp: (WebCore::updateCounters): nil check.
 
-        * rendering/RenderPart.h:
-        Removed override of deleteWidget().
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy):
-        (WebCore::RenderWidget::setWidget):
-        (WebCore::RenderWidget::paint):
-        (WebCore::RenderWidget::setOverlapTestResult):
-        (WebCore::RenderWidget::updateWidgetPosition):
-        Use .get().
-        (WebCore::RenderWidget::clearWidget):
-        Don't call deleteWidget(). It was removed. 
-
-        * rendering/RenderWidget.h:
-        Removed deleteWidget(). Made m_widget a RefPtr.
-        (WebCore::RenderWidget::widget):
-        Use .get().
+        Reviewed by Brady Eidson.
 
-2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+        Initialize the variable in the last checkin to false.  I didn't realize DRT relies on this being false.  
+        So ports that want visited link tracking need to set that flag.
 
-        Reviewed by Darin Adler.
+        * page/PageGroup.cpp:
 
-        Bug 27129 - AX: possible assertion for a non-native image in accessibility
-        https://bugs.webkit.org/show_bug.cgi?id=27129 
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        It's possible for an image that is not really an image to assert, because its renderer
-        is turned into a RenderImage.
+        Reviewed by Brady Eidson.
 
-        Test: accessibility/non-native-image-crash.html
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34547
+        static shouldTrackVisitedLinks is not initialized
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::RoleEntry::):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
+        For ports that don't call into WebKit to initialize this, 
+        we should initialize to true so they get the visited link behavior by default.
 
-2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+        * page/PageGroup.cpp:
 
-        Build fix for SnowLeopard.
-        
-        Avoid using the contentsTransform methods if not on Leopard, because
-        we don't need to call them.
+2010-02-03  Dan Bernstein  <mitz@apple.com>
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::updateContentsTransform):
-        * platform/graphics/mac/WebLayer.mm:
-        (-[WebLayer setNeedsDisplayInRect:]):
-        * platform/graphics/mac/WebTiledLayer.mm:
-        (-[WebTiledLayer setNeedsDisplayInRect:]):
+        Reviewed by Simon Fraser.
 
-2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+        <rdar://problem/7577604> Drag and Drop: background elements are bleeding through
+        https://bugs.webkit.org/show_bug.cgi?id=34546
 
-        Reviewed by Dave Hyatt
+        * manual-tests/drag-image-table-part-decorations.html: Added.
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Bail out if this object shouldn’t
+        paint within the current painting root.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell): Ditto.
+        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
 
-        Improve the appearance of text in compositing layers when -[CALayer geometryFlipped]
-        is not available.
-        <rdar://problem/6120614>
+2010-02-03  Nate Chapin  <japhet@chromium.org>
 
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsOrientation):
-        (WebCore::GraphicsLayer::contentsOrientation):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        Add a m_contentsOrientation member and getter/setter to control whether
-        the contents of this layer have a transform applied to them before display.
+        Unreviewed, Chromium mac build fix.
 
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        New method to return the default contents orientation.
+        [V8] Remove unused V8Proxy* variable from generated wrapping code.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::flipTransform):
-        Convenience method to return a transform with a Y flip.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::setSize):
-        After the size changes we have to update the contentsTransform.
+2010-02-03  Nate Chapin  <japhet@chromium.org>
 
-        (WebCore::GraphicsLayerCA::setGeometryOrientation):
-        (WebCore::GraphicsLayerCA::geometryOrientation):
-        If -setGeometryFlipped: is not available, use a children transform.
-        
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        Tiled layers have issues with flipped contentsTransform, so just use
-        top-down drawing for them. Call updateContentsTransform() to set the
-        new contents transform after swapping layers.
-        
-        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
-        Use bottom-up when -geometryFlipped is not available, otherwise top-down.
-        
-        (WebCore::GraphicsLayerCA::updateContentsTransform):
-        Set the layer contents transform based on contentsOrientation().
+        Reviewed by Dimitri Glazkov.
 
-        (WebCore::GraphicsLayerCA::setContentsLayer):
-        We have to manually flip contents layers if we're not using -geometryFlipped.
-        
-        * platform/graphics/mac/WebLayer.h:
-        * platform/graphics/mac/WebLayer.mm:
-        Do early return if layerContents is nil. Flip the CTM if the layer has
-        bottom-up coordinates, so that CG sees a CTM with no flip.
-        Do the CGContextRestoreGState() after drawing the debug indicator.
+        [V8] Use toV8() to wrap in the custom bindings, and remove
+        the old wrapping code from V8DOMWrapper.
         
-        (-[WebLayer setNeedsDisplayInRect:]):
-        * platform/graphics/mac/WebTiledLayer.mm:
-        (-[WebTiledLayer setNeedsDisplayInRect:]):
-        Need to map the dirty rect through the contentsTransform.
-
-2009-07-09  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        <rdar://problem/6921671> Visit counter shouldn't be incremented by redirects.
-
-        Can't test this functionality with layout tests.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
 
-        * WebCore.base.exp:
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::recordVisitAtTime):
-        (WebCore::HistoryItem::visited):
-        * history/HistoryItem.h:
-        Only increase visit count if explicitly told to. Now, some visits change last access time,
-        but do not increase visit count.
+2010-02-03  Sam Weinig  <sam@webkit.org>
 
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+        Reviewed by Anders Carlsson.
 
-        Reviewed by Simon Fraser.
+        Fix drawing buttons in viewless WebKit.
 
-        <rdar://problem/7046098> MediaControllerThemeQT requires QuickTime 7.6.3
+        * platform/mac/ThemeMac.mm:
+        (WebCore::paintButton): If there is no view, make sure to flip the
+        context so that the button is drawn correctly.
 
-        Require QuickTime 7.6.3 or higher to enable the new media controller UI.
+2010-02-03  Yael Aharon  <yael.aharon@nokia.com>
 
-        * rendering/RenderThemeMac.mm:
-        (WebCore::mediaControllerTheme):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-07-09  Sam Weinig  <sam@webkit.org>
+        [Qt] WebSockets : Buffer the data in WebKit instead of QtNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=34425
 
-        Reviewed by Beth Dakin.
+        Reverting r54279, it was a misunderstanding.
 
-        Remove incorrect comment.
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
 
-        * page/MouseEventWithHitTestResults.h:
+2010-02-03  Drew Wilson  <atwilson@chromium.org>
 
-2009-07-09  Mads Ager  <ager@chromium.org>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Dimitri Glazkov.
+        SharedWorkerScriptLoader should not be an ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=34513
 
-        Update the V8 bindings codegenerator to use the RGBColor::create
-        method to handle refcounts for RGBColor objects correctly.
-        
-       * bindings/scripts/CodeGeneratorV8.pm: Use RGBColor::create to create RGBColor objects.
+        Test: Existing tests suffice (fixes test downstream in Chrome).
 
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Changed to no longer derive from ActiveDOMObject (handles its own refcounting).
+        (WebCore::SharedWorkerScriptLoader::load):
+        Now increments own refcount when a load is pending.
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        Changed to decrement refcount when load is complete.
+        * workers/WorkerScriptLoaderClient.h:
+        Documentation change about reliability of notifyFinished() when used from worker context.
 
-        Reviewed by Adele Peterson.
+2010-02-03  Pavel Feldman  <pfeldman@chromium.org>
 
-        Crash in RenderMedia::styleDidChange.
-        <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
-        media element (RenderMedia::styleDidChange 115)
+        Reviewed by Timothy Hatcher.
 
-        Speculative fix for crash in styleDidChange. Null check controller elements before tell
-        them to update style.
+        Web Inspector: Inspector renders blank scripts on reloading the webpage.
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::styleDidChange):
+        https://bugs.webkit.org/show_bug.cgi?id=34537
 
-2009-07-09  Adam Barth  <abarth@webkit.org>
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-03  Yury Semikhatsky  <yurys@chromium.org>
 
-        [V8] Move V8DOMWrapper to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=27121
+        Reviewed by Pavel Feldman.
 
-        * bindings/v8/V8DOMWrapper.cpp: Added.
-        (WebCore::GetToStringName):
-        (WebCore::ConstructorToString):
-        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
-        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
-        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::domWrapperType):
-        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
-        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        (WebCore::V8DOMWrapper::maybeDOMWrapper):
-        (WebCore::V8DOMWrapper::isDOMEventWrapper):
-        (WebCore::V8DOMWrapper::isWrapperOfType):
-        (WebCore::V8DOMWrapper::htmlElementType):
-        (WebCore::V8DOMWrapper::svgElementType):
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        (WebCore::):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
-        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
-        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
-        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
-        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        * bindings/v8/V8DOMWrapper.h: Added.
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::wrapCPointer):
-        (WebCore::V8DOMWrapper::extractCPointer):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        (WebCore::V8DOMWrapper::extractCPointerImpl):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
+        Provide strongly typed C++ interface for inspector's injected script.
 
-2009-07-09  David Hyatt  <hyatt@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=33616
 
-        Reviewed by Adele Peterson.
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScript.cpp: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapAndStringify):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::~InjectedScript):
+        (WebCore::InjectedScript::hasNoValue):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
 
-        Crash in setFocusedFrame.
-        <rdar://7032869> Crashing in setFocusedFrame on blogger.com.
+2010-02-03  Andras Becsi  <abecsi@webkit.org>
 
-        Speculative fix for crasher in setFocusedFrame.  Make sure to ref both frames and fire
-        the events only after the local member has been updated.
+        Unreviewed build fix.
 
-        * page/FocusController.cpp:
-        (WebCore::FocusController::setFocusedFrame):
+        [Qt] Roll-out r54281 because it broke the build on the Qt Release bot.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::State::State):
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform):
+        (WebCore::GraphicsLayerQtImpl::drawContents):
+        (WebCore::GraphicsLayerQtImpl::notifyChange):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setNeedsDisplayInRect):
+        (WebCore::applyTimingFunction):
+        (WebCore::webkitAnimationToQtAnimationValue):
+        (WebCore::AnimationQtBase::updateState):
+        (WebCore::AnimationQt::updateCurrentTime):
+        (WebCore::TransformAnimationQt::TransformAnimationQt):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
+        (WebCore::TransformAnimationQt::applyFrame):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
+
+2010-02-02  Bryan Yeung  <bryeung@google.com>
 
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Adele Peterson.
+        Avoid using an invalidated KURL object in baseURI.
 
-        Possible crashes when mouse clicks not dispatched because range input destroyed while 
-        thumb is being dragged (e.g. scrub to end of movie)
-        <rdar://problem/7037494> 
-        https://bugs.webkit.org/show_bug.cgi?id=27101
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-        Some shadow nodes "capture" all mouse events from mouseDown to mouseUp so they continue to 
-        get mouse events even when the mouse is moved outside of the node. This is done by putting
-        EventHandler into a mode where it sends all mouse events to the node regardless of the
-        actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the
-        node is deleted while in this mode, the mouseUp is never sent and EventHandler continues
-        to try to send events to the deleted node. This sometimes results in a crash, and sometimes
-        in a page that doesn't respond to click events.
+        This change fixes baseURI for Chromium (where the KURL implementation
+        does not allow invalid KURLs to carry relative paths).  This is
+        regression tested by
+        LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
 
-        Tests: fast/forms/search-delete-while-cancel-button-clicked.html
-               fast/forms/slider-delete-while-dragging-thumb.html
-               media/audio-delete-while-slider-thumb-clicked.html
-               media/audio-delete-while-step-button-clicked.html
+        This is a re-application of this patch since it was mistakenly identified as
+        the cause of a big chromium test regression and rolled out in r54264.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlSeekButtonElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
-        * rendering/MediaControlElements.h:
-            Declare detach().
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
+2010-02-02  Joel Stanley  <joel@jms.id.au>
 
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::SearchFieldCancelButtonElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
-        * rendering/TextControlInnerElements.h:
-            Declare detach().
+        Reviewed by David Levin.
 
-2009-07-09  Yury Semikhatsky  <yurys@chromium.org>
+        [Chromium] Make setCaretBlinkInterval static.
+        https://bugs.webkit.org/show_bug.cgi?id=31704
 
-        Reviewed by Dimitri Glazkov.
+        This is so it can be called from the newly exposed Chromium API setter
+        method.
 
-        Enter the Frame's context before creating new objects in setContextDebugId.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=27112
+2010-02-02  Yael Aharon  <yael.aharon@nokia.com>
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setContextDebugId):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-07-09  Simon Hausmann  <hausmann@webkit.org>
+        [Qt] WebSockets : Buffer the data in WebKit instead of QtNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=34425
 
-        Fix the Qt build.
+        Buffer the sent data in SocketStreamHandlePrivate instead of relying on
+        the network layer to do it. This is more robust and more consistent with how 
+        Qt's HTTP stack works.
+        Close the socket in SocketStreamHandlePrivate::close() regardless of its state.
 
-        * WebCore.pro: Add new storage impl files to the build.
+        No new tests, since no new functionality is introduced.
 
-2009-07-08  Adam Barth  <abarth@webkit.org>
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
+        (WebCore::SocketStreamHandlePrivate::socketBytesWritten):
 
-        Rubber stamped by Eric Seidel.
+2010-02-03  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        [V8] Move DOM wrapper functions in V8Proxy to V8DOMWrapper
-        https://bugs.webkit.org/show_bug.cgi?id=27107
+        Unreviewed revert of r54259 as it seems to break chromium's unit tests.
+        The tests pass with r54257 but fail with r54260.
+        As r54258 and r54260 don't touch code, I'm reverting this change.
 
-        This patch is just renaming.  Code motion will occur next.
+        [V8] Generate toV8 conversion helpers, a la JSC bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        * bindings/scripts/CodeGeneratorV8.pm:
         * bindings/v8/ScriptController.cpp:
         (WebCore::ScriptController::processingUserGesture):
         (WebCore::createScriptObject):
         (WebCore::ScriptController::createScriptObjectForPluginElement):
         * bindings/v8/ScriptObject.cpp:
         (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
         * bindings/v8/V8AbstractEventListener.cpp:
         (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8Collection.cpp:
-        (WebCore::toOptionsCollectionSetter):
         * bindings/v8/V8Collection.h:
         (WebCore::getV8Object):
+        (WebCore::toNativeCollection):
         (WebCore::getNamedPropertyOfCollection):
-        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::collectionNamedPropertyGetter):
         (WebCore::getIndexedPropertyOfCollection):
-        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::collectionIndexedPropertyGetter):
         (WebCore::nodeCollectionIndexedPropertyEnumerator):
         (WebCore::collectionIndexedPropertyEnumerator):
         (WebCore::collectionStringOrNullIndexedPropertyGetter):
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::enumerateDOMObjectMap):
-        (WebCore::DOMObjectVisitor::visitDOMWrapper):
-        (WebCore::GCPrologueVisitor::visitDOMWrapper):
-        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::wrapNPObject):
-        * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::acceptNode):
-        * bindings/v8/V8Proxy.cpp:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionIndexedGetter):
+        (WebCore::setCollectionNamedGetter):
+        (WebCore::setCollectionStringOrNullIndexedGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::downcastSVGPathSeg):
         (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
         (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
-        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::getConstructor):
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8Proxy::retrieveWindow):
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::installDOMWindow):
-        (WebCore::setDOMExceptionHelper):
         (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::domWrapperType):
-        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
-        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
         (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        (WebCore::V8DOMWrapper::maybeDOMWrapper):
         (WebCore::V8DOMWrapper::isDOMEventWrapper):
-        (WebCore::V8DOMWrapper::isWrapperOfType):
         (WebCore::V8DOMWrapper::htmlElementType):
         (WebCore::V8DOMWrapper::svgElementType):
         (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
         (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
         (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
         (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
         (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
         (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
         (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
         (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        (WebCore::V8Proxy::bindJsObjectToWindow):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::wrapCPointer):
-        (WebCore::V8DOMWrapper::extractCPointer):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
         (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
         (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8Proxy::constructDOMObject):
-        (WebCore::toV8):
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGPODTypeUtil::toSVGPODType):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::GetConstructor):
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        * bindings/v8/custom/V8AttrCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::toCanvasStyle):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::V8Custom::GetTargetFrame):
+        (WebCore::toV8Object):
+        (WebCore::V8CanvasRenderingContext2D::createPatternCallback):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        (WebCore::V8CustomPositionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
+        (WebCore::V8CustomPositionErrorCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
         (WebCore::V8CustomSQLStatementCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
@@ -50983,9354 +25463,2149 @@ form controls that have different validity states.
         * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
         (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::V8DOMWindow::openCallback):
+        (WebCore::V8DOMWindow::indexedPropertyGetter):
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Document::evaluateCallback):
+        (WebCore::V8Document::getCSSCanvasContextCallback):
+        (WebCore::V8Document::implementationAccessorGetter):
         * bindings/v8/custom/V8DocumentLocationCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8Document::locationAccessorGetter):
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
         * bindings/v8/custom/V8EventCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8Event::dataTransferAccessorGetter):
+        (WebCore::V8Event::clipboardDataAccessorGetter):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::V8HTMLAllCollection::callAsFunctionCallback):
         * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::v8HTMLAudioElementConstructorCallback):
         * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
         * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
         (WebCore::getNamedItems):
         (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8HTMLCollection::callAsFunctionCallback):
         * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8HTMLDocument::namedPropertyGetter):
+        (WebCore::V8HTMLDocument::allAccessorGetter):
         * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8HTMLFormElement::indexedPropertyGetter):
+        (WebCore::V8HTMLFormElement::namedPropertyGetter):
         * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
         * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::v8HTMLImageElementConstructorCallback):
         * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        (WebCore::V8HTMLOptionsCollection::indexedPropertyGetter):
         * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8HTMLSelectElement::namedPropertyGetter):
+        (WebCore::V8HTMLSelectElement::indexedPropertyGetter):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScript):
+        (WebCore::V8InjectedScriptHost::nodeForIdCallback):
+        (WebCore::V8InjectedScriptHost::databaseForIdCallback):
         * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::portsAccessorGetter):
         * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NavigatorCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8NamedNodeMap::indexedPropertyGetter):
+        (WebCore::V8NamedNodeMap::namedPropertyGetter):
         * bindings/v8/custom/V8NodeIteratorCustom.cpp:
         (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGLengthCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8NodeList::namedPropertyGetter):
+        (WebCore::V8NodeList::callAsFunctionCallback):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
         * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        (WebCore::storageGetter):
-        (WebCore::storageSetter):
-        (WebCore::storageDeleter):
+        (WebCore::V8SVGMatrix::multiplyCallback):
+        (WebCore::V8SVGMatrix::inverseCallback):
+        (WebCore::V8SVGMatrix::rotateFromVectorCallback):
         * bindings/v8/custom/V8StyleSheetListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8StyleSheetList::namedPropertyGetter):
         * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::SetTimeoutOrInterval):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::toV8Object):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
         * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make sure we can click outside the slider thumb and start dragging.
-        https://bugs.webkit.org/show_bug.cgi?id=26229
-
-        Previously we were assuming that if the thumb hasn't been clicked, we
-        wouldn't issue any value change upon dragging.
-
-        We need to handle the two different cases:
-        - Clicked in the thumb, we need to make sure the cursor is always pointing
-        the same slider thumb point.
-        - Clicked outside, the cursor should always be pointing to the center of
-        the thumb.
-
-        For simplicity, we don't remember the original point of the mouse down,
-        but a vector between that point and the thumb.
-
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::SliderThumbElement):
-        (WebCore::SliderThumbElement::defaultEventHandler):
-        (WebCore::RenderSlider::mouseEventVectorToThumb): Utility function.
-        * rendering/RenderSlider.h:
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+        (WebCore::V8XSLTProcessor::transformToFragmentCallback):
+        (WebCore::V8XSLTProcessor::transformToDocumentCallback):
 
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27100
-        <rdar://problem/7042621>
-
-        Don't display "loading" in the <video> controller when
-        there is no src specified.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlStatusDisplayElement::update): The only
-        way to find out if we have an element is currentSrc(). networkState()
-        will always report LOADING according to the spec.
-
-2009-07-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Move V8GCController functions to their own file
-        https://bugs.webkit.org/show_bug.cgi?id=27102
-
-        * bindings/v8/V8GCController.cpp: Added.
-        * bindings/v8/V8GCController.h: Added.
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
+2010-02-03  Mikhail Naganov  <mnaganov@chromium.org>
 
-2009-07-08  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Split StorageArea and StorageNamespace into an interface and implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=27072
+        Reviewed by Pavel Feldman.
 
-        I need to split StorageNamespace and StorageArea into an interface and
-        implementation.  In a later patch, I'll implement a proxy interface
-        that'll run inside the Chromium renderer process.
+        Start unforking debugger and profiler code.
 
-        Additionally, fix the alphabetical ordering of files I recently added
-        in the project files.
+        Remove custom implementation of Console.
+        Add 'ScriptProfiler' and 'ScriptProfile' types.
+        Start migration to engine-neutral types in InspectorController.
 
-        This is a continuation of other refactoring work:
-        https://bugs.webkit.org/show_bug.cgi?id=25376
+        https://bugs.webkit.org/show_bug.cgi?id=34481
 
         * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::create):
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::~StorageArea):
-        * storage/StorageAreaImpl.cpp: Copied from WebCore/storage/StorageArea.cpp.
-        (WebCore::StorageAreaImpl::create):
-        (WebCore::StorageAreaImpl::~StorageAreaImpl):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::copy):
-        (WebCore::StorageAreaImpl::length):
-        (WebCore::StorageAreaImpl::key):
-        (WebCore::StorageAreaImpl::getItem):
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::removeItem):
-        (WebCore::StorageAreaImpl::clear):
-        (WebCore::StorageAreaImpl::contains):
-        (WebCore::StorageAreaImpl::importItem):
-        (WebCore::StorageAreaImpl::securityOrigin):
-        (WebCore::StorageAreaImpl::close):
-        (WebCore::StorageAreaImpl::blockUntilImportComplete):
-        (WebCore::StorageAreaImpl::dispatchStorageEvent):
-        * storage/StorageAreaImpl.h: Copied from WebCore/storage/StorageArea.h.
-        * storage/StorageAreaSync.h:
-        * storage/StorageNamespace.cpp:
-        (WebCore::StorageNamespace::localStorageNamespace):
-        (WebCore::StorageNamespace::sessionStorageNamespace):
-        * storage/StorageNamespace.h:
-        (WebCore::StorageNamespace::~StorageNamespace):
-        * storage/StorageNamespaceImpl.cpp: Copied from WebCore/storage/StorageNamespace.cpp.
-        (WebCore::StorageNamespaceImpl::localStorageNamespace):
-        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        (WebCore::StorageNamespaceImpl::close):
-        * storage/StorageNamespaceImpl.h: Copied from WebCore/storage/StorageNamespace.h.
-
-2009-07-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Move garbage collector related functions from V8Proxy to V8GCController
-        https://bugs.webkit.org/show_bug.cgi?id=26967
-
-        This patch just moves the functions around in V8Proxy.  We'll actually
-        move them to a separate file in another patch.
-
-        * bindings/v8/NPV8Object.cpp:
-        (freeV8NPObject):
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::~ScheduledAction):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::gcProtectJSWrapper):
-        (WebCore::ScriptController::gcUnprotectJSWrapper):
-        * bindings/v8/ScriptInstance.cpp:
-        (WebCore::V8ScriptInstance::clear):
-        (WebCore::V8ScriptInstance::set):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::operator=):
-        (WebCore::ScriptValue::clear):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::~V8LazyEventListener):
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
-        * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8GCController::registerGlobalHandle):
-        (WebCore::V8GCController::unregisterGlobalHandle):
-        (WebCore::V8GCController::gcProtect):
-        (WebCore::V8GCController::gcUnprotect):
-        (WebCore::V8Proxy::destroyGlobal):
-        (WebCore::V8Proxy::updateDocumentWrapper):
-        (WebCore::V8Proxy::clearDocumentWrapper):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::):
-        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-
-2009-07-08  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26918
-        
-        Prevents injection of HTML Base tag.
-
-        Tests: http/tests/security/xssAuditor/base-href-control-char.html
-               http/tests/security/xssAuditor/base-href-null-char.html
-               http/tests/security/xssAuditor/base-href-safe.html
-               http/tests/security/xssAuditor/base-href-safe2.html
-               http/tests/security/xssAuditor/base-href-scheme-relative.html
-               http/tests/security/xssAuditor/base-href.html
-
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::parseMappedAttribute):
-        (WebCore::HTMLBaseElement::process): Modified to call XSSAuditor::canSetBaseElementURL
-        to determine if it is safe to use base element URL.
-        * html/HTMLBaseElement.h: Added field m_hrefAttrValue to store unparsed base element URL.
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        * page/XSSAuditor.h:
-
-2009-07-08  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8 npruntime bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27094
-
-        * bindings/v8/npruntime.cpp: Upstreamed from src.chromium.org.
-        (StringKey::operator==):
-        (StringKey::StringKeyHash::hash):
-        (StringKey::StringKeyHash::equal):
-        (StringKeyHashTraits::constructDeletedValue):
-        (StringKeyHashTraits::isDeletedValue):
-        (getStringIdentifierMap):
-        (getIntIdentifierMap):
-        * bindings/v8/npruntime_impl.h: Upstreamed from src.chromium.org.
-        * bindings/v8/npruntime_internal.h: Upstreamed from src.chromium.org.
-        * bindings/v8/npruntime_priv.h: Upstreamed from src.chromium.org.
-
-2009-07-08  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Extending the PlatformFileHandle definition from PLATFORM(WIN) to
-        PLATFORM(WIN_OS)
-
-        https://bugs.webkit.org/show_bug.cgi?id=27013
-
-        * platform/FileSystem.h:
-
-2009-07-08  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27071
-        
-        Resolves issue when HTTP parameters contain null- and  non-null-control- characters.
-
-        Tests: http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html
-               http/tests/security/xssAuditor/embed-tag-control-char.html
-               http/tests/security/xssAuditor/embed-tag-null-char.html
-               http/tests/security/xssAuditor/embed-tag.html
-               http/tests/security/xssAuditor/link-onclick-control-char.html
-               http/tests/security/xssAuditor/link-onclick-null-char.html
-               http/tests/security/xssAuditor/object-embed-tag-control-char.html
-               http/tests/security/xssAuditor/object-embed-tag-null-char.html
-               http/tests/security/xssAuditor/object-embed-tag.html
-               http/tests/security/xssAuditor/object-tag.html
-               http/tests/security/xssAuditor/script-tag-post-control-char.html
-               http/tests/security/xssAuditor/script-tag-post-null-char.html
-               http/tests/security/xssAuditor/script-tag-with-source-control-char.html
-               http/tests/security/xssAuditor/script-tag-with-source-null-char.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonNullControlCharacter): Called by XSSAuditor::decodeURL.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::decodeURL): Added parameters matchNullCharacters,
-        and matchNonNullControlCharacters.
-        (WebCore::XSSAuditor::findInRequest): Added parameters matchNullCharacters,
-        and matchNonNullControlCharacters.
-        * page/XSSAuditor.h:
-
-2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add DerivesSourcesAllInOne.cpp to help with release windows compilation.
-        https://bugs.webkit.org/show_bug.cgi?id=27093
-
-        This is specific for v8, no change in behavior.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Added.
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27086
-
-        Make sure the Media controller doesn't fade in for no reason.
-        This is happening because a update() call to the controller
-        panel may reset the opacity to 1.0, given that it reloads the
-        style.
-
-        We also add a different fade in and fade out time to soften
-        the fade out effect.
-
-        No test case because this depends on how the movie is loaded.
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-        (WebCore::RenderMedia::updateControls):
-        (WebCore::RenderMedia::updateControlVisibility): Simplify
-        , and make sure we stop the timer if there is no animation
-        to do.
-        (WebCore::RenderMedia::opacityAnimationTimerFired): 
-        * rendering/RenderMedia.h:
-
-2009-07-08  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27081: Wrap RunLoopTimerCF.cpp in PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27081>
-
-        Reviewed by Timothy Hatcher.
-
-        * platform/cf/RunLoopTimerCF.cpp: This code is only used on
-        Mac OS X when HAVE(RUNLOOP_TIMER) is enabled, so wrap the code
-        in that macro as well.
-
-2009-07-08  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add -[WebView _isProcessingUserGesture]
-        https://bugs.webkit.org/show_bug.cgi?id=27084
-
-        Rename FrameLoader::userGestureHint() to FrameLoader::isProcessingUserGesture()
-        for clarity.
-
-        * WebCore.base.exp: Add WebCore::FrameLoader::isProcessingUserGesture()
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::processingUserGesture):
-        * loader/FrameLoader.cpp: 
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::isProcessingUserGesture):
-        * loader/FrameLoader.h:
-
-2009-07-08  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed (an earlier version) by Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27090
-        Remove lockBackForwardList argument from HTMLFormElement::submit()
-
-        No change in behavior, so no tests.
-
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::submit):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::submit):
-        * html/HTMLFormElement.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::scheduleFormSubmission):
-        * loader/FrameLoader.h:
-        Don't pass lockBackForwardList around when it's known to be false.
-
-2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix V8 idl codegen to use unique constant names
-        <https://bugs.webkit.org/show_bug.cgi?id=27089>
-
-        Embed the interface name in the global constant names so coagulating all
-        the .cc files into one compile unit works with V8 bindings.
-
-        Nothing added; Still compiles and pass tests.
-
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/ScriptProfile.h: Added.
+        * bindings/js/ScriptProfiler.cpp: Added.
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/js/ScriptProfiler.h: Added.
         * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-07-08  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build fix: Add missing #includes for Windows (cURL) build.
-        The <winsock2.h> and <windows.h> headers were not being
-        included in Windows cURL builds.
-
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/curl/ResourceHandleManager.h:
-
-2009-07-08  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        WebKit needs a style linting tool
-        https://bugs.webkit.org/show_bug.cgi?id=25884
-
-        Fix bunch of style issues in WebCore/rendering.
-        This patch is created to demonstrate cpplint.py.
-
-        No testcase because it's just a style fixes.
-
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::layout):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeEllipsisBox):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        * rendering/MediaControlElements.h:
-        * rendering/RenderArena.cpp:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
-        (WebCore::RenderBlock::positionNewFloats):
-        (WebCore::RenderBlock::newLine):
-        (WebCore::RenderBlock::floatBottom):
-        (WebCore::RenderBlock::leftBottom):
-        (WebCore::RenderBlock::rightBottom):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcReplacedWidthUsing):
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::layoutLegend):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::FlexBoxIterator::FlexBoxIterator):
-        (WebCore::FlexBoxIterator::reset):
-        (WebCore::FlexBoxIterator::first):
-        (WebCore::FlexBoxIterator::next):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::borderStartEdgeColor):
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderImage.cpp:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateVisibilityStatus):
-        (WebCore::RenderLayer::calculateClipRects):
-        (WebCore::RenderLayer::calculateRects):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::panScroll):
-        * rendering/RenderMarquee.cpp:
-        (WebCore::RenderMarquee::updateMarqueeStyle):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::drawLineForBoxSide):
-        (WebCore::RenderObject::localCaretRect):
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
-        * rendering/RenderSlider.h:
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::outerBorderBottom):
-        * rendering/RenderTableCol.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::supportsFocusRing):
-        * rendering/SVGCharacterLayoutInfo.cpp:
-        (WebCore::SVGCharacterLayoutInfo::addStackContent):
-        * rendering/SVGCharacterLayoutInfo.h:
-        * rendering/TextControlInnerElements.h:
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
-
-2009-07-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Reduce complexity of lifetime management in DynamicNodeList caches
-        <https://bugs.webkit.org/show_bug.cgi?id=27068>
-
-        Switch the Cache object used by DynamicNodeList into a normal
-        refcounted object rather than having a weird flag controlled
-        refcounting system, where positive refcount did not automatically
-        imply the cache object would actually still be live.
-
-        * dom/DynamicNodeList.cpp:
-        (WebCore::DynamicNodeList::DynamicNodeList):
-        (WebCore::DynamicNodeList::~DynamicNodeList):
-        (WebCore::DynamicNodeList::Caches::Caches):
-        (WebCore::DynamicNodeList::Caches::create):
-        * dom/DynamicNodeList.h:
-        * dom/Node.cpp:
-        (WebCore::Node::childNodes):
-        (WebCore::Node::getElementsByTagNameNS):
-        (WebCore::Node::getElementsByName):
-        (WebCore::Node::getElementsByClassName):
-        (WebCore::NodeListsNodeData::invalidateCaches):
-        (WebCore::NodeListsNodeData::isEmpty):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::NodeListsNodeData):
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-        
-        -webkit-perspective should be a Length
-        https://bugs.webkit.org/show_bug.cgi?id=27066
-        
-        -webkit-perspective should not take a magic valueless number, but should
-        be a normal Length value which responds to zooming. Treat valueless numbers
-        as pixels for backward compatibility.
-        
-        Test: transforms/3d/general/perspective-units.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-
-2009-07-07  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27047
-
-        We need to make sure that when we reattach, we also reattach
-        the children in every MediaControlElement. Else we may end up
-        having no remaining or elapsed time.
-
-        We have to handle that, because we are using a special shadow
-        tree in the DOM, and that we are ourselves handling
-        attaching/detaching the renderer.
-
-        The strategy here is to try to implement ::attach(), and try
-        to reuse as much code as we can from the super class, including
-        children attachement.
-
-        Test: media/controls-after-reload.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::styleForElement): Code factoring.
-        (WebCore::MediaControlElement::rendererIsNeeded): Code factoring.
-        (WebCore::MediaControlElement::attach): Implement attach
-        and call super class so that children are also attached.
-        (WebCore::MediaControlElement::updateStyle): Use attach()
-        (WebCore::MediaControlInputElement::styleForElement): Code factoring.
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Code factoring.
-        (WebCore::MediaControlInputElement::attach): See above.
-        (WebCore::MediaControlInputElement::updateStyle): Use attach()
-        * rendering/MediaControlElements.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls): Directly run attach() on
-        the m_panel, which is a root node for our shadow tree.
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Repaint issue after layer drops out of composited mode.
-        <https://bugs.webkit.org/show_bug.cgi?id=27022>
-
-        RenderLayers cache repaint rects in the form of m_repaintRect and m_outlineBox,
-        and expect these to stay valid from one style change to the next. These rects
-        are relative to the repaint container, so if a layer stops being composited,
-        we need to recompute them.
-        
-        Test: compositing/repaint/layer-repaint-rects.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::computeRepaintRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-
-2009-07-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt and Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
-          <rdar://problem/7030998> Reproducible crash at
-          FontCache::getFontData() when a custom font is used in a pseudo-style
-
-        Test: fast/css/pseudo-cache-stale.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
-        style and the new style, goes over cached pseudo-styles in the old
-        style and re-resolves the same style types off the new style. If any of
-        the new pseudo-styles is different from the currently cached
-        corresponding style, returns true. Otherwise, returns false.
-        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
-        deciding to keep the existing style.
-        * dom/Element.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
-        returns an uncached first-line style based off the given style.
-        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
-        parameter.
-        * rendering/RenderObject.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
-        pseudo-styles in the passed-in vector.
-        * rendering/style/RenderStyle.h:
-
-2009-07-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=27042
-          <rdar://problem/7010981> Incomplete painting of newly created floats
-
-        Tests: fast/repaint/float-in-new-block-with-layout-delta.html
-               fast/repaint/float-new-in-block.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlockChildren): If the child has never been
-        laid out before, paint its overhanging floats in addition to itself.
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): Added and
-        initialized a boolean everHadLayout member.
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::layoutInlineChildren): Paint floats that have
-        never been laid out before and did not move from (0, 0).
-
-2009-07-07  Brady Eidson  <beidson@apple.com>
-
-        Contributions from both Darin Adler and Brady Eidson.
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7024039> REGRESSION (r42158): Back-forward navigation does not work correctly on nytimes.com
-
-        In r42158 we lost some exclusions to making back/forward items for subframe navigations when a main frame
-        navigation was still in progress.
-
-        This patch makes things even better than it used to be by:
-        - Locking back/forward history at the time the navigation is scheduled, not after the load has committed.
-        - Locking back/forward history if *any* ancestor frame is still loading instead of just the main frame.
-
-        Test: fast/loader/subframe-navigate-during-main-frame-load.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm): Move out the history locking logic into a standalone function so it can be
-          used from multiple sites.
-        (WebCore::mustLockBackForwardList): Returns true if any ancestor frame is still loading.
-        (WebCore::FrameLoader::scheduleLocationChange): Respect mustLockBackForwardList() in addition to the passed in
-          lockBackForwardList flag.
-        (WebCore::FrameLoader::scheduleFormSubmission): Ditto.
-
-2009-07-07  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Upstream DOMObjectsInclude.h from src.chromium.org.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27035
-
-        * bindings/v8/DOMObjectsInclude.h: Added.
-
-2009-07-07  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Relanding r45559, which was rolled back at r45574.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm: Updated a function name in auto-generated bindings.
-        * bindings/v8/V8Binding.cpp: Moved from src.chromium.org.
-        * bindings/v8/V8Binding.h: Contents moved from src.chromium.org.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-07  Gregory Hughes  <gfhughesVO+webkit@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        AX: Some webpages do not send AXLoadComplete
-        https://bugs.webkit.org/show_bug.cgi?id=26995
-
-        When sending the AXLayoutComplete notification it is possible
-        that the AXObjectCache was cleared, resulting in no valid
-        object to send the notification to. This fix ensures that an
-        AX object is created and cached if one does not already exist.
-
-        Not able to add a test because notifications get sent after the layout test is completed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-
-2009-07-06  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27015
-
-        Make sure that the CSS properties letter-spacing, word-spacing,
-        line-height, text-transform, text-indent, text-shadow,
-        text-decoration and color do not affect the media element controls,
-        that display text.
-
-        Controls that display text are only present in when the theme
-        MediaControllerThemeQT is being used.
-
-        Test: media/controls-styling.html
-
-        * css/mediaControlsQT.css:
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::updateStyle): Special case for
-        text-decoration. text-decoration can't be overriden from CSS, because
-        text-decoration is additive for historical reasons.
-
-2009-07-07  Albert Wong  <ajwong@chromium.org>
-
-        Not reviewed, Chromium build fix.
-
-        Add in missing header fix syntax issue that crept into last patch.
-        https://bugs.webkit.org/show_bug.cgi?id=27027
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Make use of geometry information to decide which layers become composited.
-
-        <rdar://problem/7011947>
-        <https://bugs.webkit.org/show_bug.cgi?id=27021>
-        
-        In addition to looking at painting order, also, optionally, take layer
-        overlap into account when deciding which RenderLayers need to be composited.
-
-        No testcase because DRT doesn't dump which layers are composited.
-        
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateCompositingLayers):
-        Removed the unused CompositingUpdate parameter, and just do an early return
-        when there is no view.
-        
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::rendererContentChanged):
-        (WebCore::RenderLayer::dirtyZOrderLists):
-        (WebCore::RenderLayer::dirtyNormalFlowList):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::mustOverlapCompositedLayers):
-        (WebCore::RenderLayer::setMustOverlapCompositedLayers):
-        Change "overlay" to "overlap" for consistency with the use of "overlap"
-        elsewhere.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        compositingLayersNeedUpdate() renamed to compositingLayersNeedRebuild().
-        
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-        Tell the compositor that we started an accelerated animation or transition.
-        
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::compositingLayersNeedRebuild):
-        Renamed, since it's explicitly about changes in hierarchy now.
-        
-        (WebCore::RenderLayerCompositor::setCompositingConsultsOverlap):
-        (WebCore::RenderLayerCompositor::compositingConsultsOverlap):
-        New getter and setter for whether compositing should take overlap into account.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        Add m_compositingConsultsOverlap, re-order some member variables.
-        
-        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
-        Whitespace cleanup and method rename.
-        
-        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
-        Method and variable renaming.
-        
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        Now we have to run through the layer hierarchy every time if looking
-        at overlap, because changes in layout can now alter compositing behavior.
-        We minimize work by tracking whether we actually need to change the layer
-        hierarchy via needLayerRebuild.
-        
-        (WebCore::RenderLayerCompositor::updateBacking):
-        3D transforms turn off overlap mode.
-        
-        (WebCore::RenderLayerCompositor::layerWasAdded):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        Method rename.
-        
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::overlapsCompositedLayers):
-        Utility methods to add a layer to the overlapMap (computing the absolute
-        bounding box only if we haven't already done so), and testing the map
-        entries.
-        
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        If a layer would composite only because it comes after other compositing
-        layers in the painting order, then consult the overlap map to determine whether
-        it overlaps, and thus actually needs to composite.
-        
-        Add layers to the map when they must be composited.
-        
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        Only do re-parenting work if the updateHierarchy flag is set.
-        
-        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation):
-        When we start an accelerated transition or animation, we stop looking at
-        overlap because we can no longer guarantee correct front-to-back ordering while the
-        accelerated animation is running.
-
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-        Method renames.
-        
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setMaximalOutlineSize):
-        Add comment indicating that this could be optimized.
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Speed up creation of V8 wrappers for DOM nodes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26882
-
-        This patch doesn't require new tests as it a set of refactorings
-        to speed up wrapper creation.  
-
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
-
-2009-07-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] textarea height property works only if other property are defined
-        https://bugs.webkit.org/show_bug.cgi?id=18984
-
-        Let WebCore handle textarea's metrics instead of readjusting it RenderthemeGtk.
-
-        Test: fast/forms/textarea-metrics.html
-
-        * platform/gtk/RenderThemeGtk.cpp:
-        * platform/gtk/RenderThemeGtk.h:
-
-2009-07-07  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Antti Koivisto.
-
-        HTML5 Database becomes locked if a transaction is in progress when the page is refreshed.
-        https://bugs.webkit.org/show_bug.cgi?id=25711
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=25711 where web
-        storage databases could become locked until the browser is shut
-        down if the page is refreshed whilst a transaction is in progress.
-
-        Test: storage/database-lock-after-reload.html
-
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-        (WebCore::Database::close): add code to inform the database thread we've closed the database.
-        (WebCore::Database::performOpenAndVerify): add code to inform the database thread we've opened a database.
-        * storage/Database.h:
-        (WebCore::Database::opened): return true iff the underlying sqlite database has been opened but not closed.
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::databaseThread): Before the database thread terminates, close any databases that ran transactions in this thread.
-        (WebCore::DatabaseThread::recordDatabaseOpen): Records a database that executed a transaction in this thread.
-        (WebCore::DatabaseThread::recordDatabaseClosed): Removes a database from the set of open databases.
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::getThreadID): return the thread id for the database thread.
-
-2009-07-07  Jiahua Huang  <jhuangjiahua@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Gtk] Paste of rich text from firefox results garbled markup
-        https://bugs.webkit.org/show_bug.cgi?id=26791
-
-        Fix problem with UTF-16 clipboard pasted.
-
-        * manual-tests/gtk/paste-richtext-from-firefox.html: Added.
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::documentFragment):
-
-2009-07-07  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Change 'Continue debug' shortcut from F5 to F8 for consistency with Firebug.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23849
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-
-2009-07-06  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Update RenderThemeChromiumMac for wkDrawMediaUIPart and wkDrawMediaSlider API
-        change.
-
-        Fix compile RenderThemeChromiumMac.mm due to API changes from r45572
-        https://bugs.webkit.org/show_bug.cgi?id=27018
-
-        This is mainly an API change update to fix the chromium compile.  It
-        also has a small fix of a typo in RenderThemeMac.mm.
-
-        Compilation against the head of chromium trunk passed.  Since this is
-        a compile fix, that should be sufficient.
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::):
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::):
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27002: Build fix when DASHBOARD_SUPPORT is disabled with -Wunused-parameter
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27002>
-
-        Reviewed by Geoff Garen.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
-        Mark gradient as an unused parameter when DASHBOARD_SUPPORT is
-        disabled.
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27001: Fix improper use of PassRefPtr<Node> to RefPtr<Node>
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27001>
-
-        Reviewed by Geoff Garen.
-
-        PassRefPtr<> should only be used for arguments to functions that
-        take ownership of the object, or as return values from functions
-        that relinquish ownership of the object.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::increaseSelectionListLevelOrdered): Changed
-        stack-allocated PassRefPtr<Node> to RefPtr<Node> and call
-        release() on returned object.
-        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
-
-2009-07-06  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7035474> Make new media controller UI default on SnowLeopard
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::mediaControllerTheme):
-            New media controller UI is enabled by default on SnowLeopard.
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, build fix.
-
-        Roll out r45559 to fix Chromium canary.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Binding.cpp: Removed.
-        * bindings/v8/V8Binding.h:
-        (WebCore::toInt32):
-        (WebCore::toWebCoreString):
-        (WebCore::fromWebCoreString):
-        (WebCore::toWebCoreStringWithNullCheck):
-        (WebCore::isUndefinedOrNull):
-        (WebCore::v8Boolean):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-06  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7008093> Media controller can’t be used to scrub when movie is 
-        narrow — track is too narrow
-
-        Do not show media controller time display elements when the a movie is too narrow.
-
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
-            Give current time and time remaining controls a common base class.
-        (WebCore::MediaControlTimeDisplayElement::setVisible):
-            New method, hide and show the element.
-        * rendering/MediaControlElements.h:
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-            Initialize m_previousVisible.
-        (WebCore::RenderMedia::layout):
-            Show/hide the time display elements as the movie width changes.
-        (WebCore::RenderMedia::createCurrentTimeDisplay):
-        (WebCore::RenderMedia::createTimeRemainingDisplay):
-            Base class is now MediaControlTimeDisplayElement, not MediaControlElement.
-        (WebCore::RenderMedia::shouldShowTimeDisplayControls):
-            New, decide if time display elements should be visible or not.
-        * rendering/RenderMedia.h:
-
-        * rendering/RenderThemeMac.mm:
+        * bindings/v8/ScriptProfile.h: Added.
+        (WebCore::ScriptProfile::create):
+        (WebCore::ScriptProfile::~ScriptProfile):
+        (WebCore::ScriptProfile::title):
+        (WebCore::ScriptProfile::uid):
+        (WebCore::ScriptProfile::ScriptProfile):
+        * bindings/v8/ScriptProfiler.cpp: Added.
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/v8/ScriptProfiler.h: Added.
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Removed.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::endGroup):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::createProfileHeader):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::searchingForNodeInPage):
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        * page/Console.h:
         (WebCore::):
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-        (WebCore::RenderThemeMac::paintMediaPlayButton):
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeMac::paintMediaRewindButton):
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27000: Minor clean up to runtime_root.{cpp|h}
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27000>
-
-        Reviewed by Geoff Garen.
-
-        * bridge/runtime_root.cpp: Added blank line between license and
-        the first #include statement.
-        * bridge/runtime_root.h: Added comment to #endif.
-
-2009-07-06  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        generalize the special height treatment for SVG (to be re-used for ruby):
-            renamed InlineBox::m_isSVG to m_hasVirtualHeight
-            renamed InlineBox::isSVG() to hasVirtualHeight()
-            renamed InlineBox::setIsSVG() to setHasVirtualHeight()
-
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::height):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::InlineBox):
-        (WebCore::InlineBox::isText):
-        (WebCore::InlineBox::setIsText):
-        (WebCore::InlineBox::isSVGRootInlineBox):
-        (WebCore::InlineBox::hasVirtualHeight):
-        (WebCore::InlineBox::setHasVirtualHeight):
-        (WebCore::InlineBox::virtualHeight):
-        * rendering/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::createFlowBox):
-        * rendering/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::createTextBox):
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::createRootBox):
-        * rendering/SVGInlineFlowBox.h:
-        (WebCore::SVGInlineFlowBox::virtualHeight):
-        * rendering/SVGInlineTextBox.h:
-        (WebCore::SVGInlineTextBox::virtualHeight):
-        * rendering/SVGRootInlineBox.h:
-        (WebCore::SVGRootInlineBox::virtualHeight):
+        (WebCore::Console::create):
+        (WebCore::Console::profiles):
+        * page/Console.idl:
 
-2009-07-06  Alice Liu  <alice.liu@apple.com>
+2010-02-02  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        REGRESSION(r45285): focus rings are black on windows safari
-        https://bugs.webkit.org/show_bug.cgi?id=26821
-        <rdar://problem/7018252>
-
-        Add a mechanism for setting a custom focus ring color, and relocate the 
-        determination of focus ring color to base class RenderTheme.
-
-        No new tests.  Already-existing tests run in pixel mode would have caught this regression
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue): Move the responsibility
-        of determining focus color to base class RenderTheme.
-        * rendering/RenderTheme.cpp:
-        (WebCore::customFocusRingColor): Added static local.
-        (WebCore::RenderTheme::setCustomFocusRingColor): Added
-        (WebCore::RenderTheme::focusRingColor): Use custom color over platform color.
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::platformFocusRingColor): default implementation, black color
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderTheme::themeForPage): Circumstances that lead to returning the RenderThemeWin
-        are the same under which we want to use the focus ring color from SafariTheme.
-        (WebCore::RenderThemeSafari::platformFocusRingColor): Renamed from focusRingColor
-        * rendering/RenderThemeSafari.h:
-
-        Renaming focusRingColor to platformFocusRingColor in these files:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::platformFocusRingColor):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::platformFocusRingColor):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::platformFocusRingColor):
-
-        Cleanup leftover from removal of WebCore::Color in r45285 in these files:
-        * WebCore.order:
-        * platform/graphics/Color.h:
-
-2009-07-06  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Bug 15135: REGRESSION (r19843-r19850): Changing a flexbox's
-        contents makes its container scroll to the top
-        https://bugs.webkit.org/show_bug.cgi?id=15135
-
-        Delay updateing scroll bar of descendants of flexbox until their
-        positions are determined.  In this way we can prevent descendants
-        of flexible boxes from changing positions of their scrollbars
-        using tentative positions.
-
-        Test: fast/flexbox/repaint-scrollbar.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
-        * rendering/RenderBlock.h:
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-
-2009-07-06  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make unconfirmed IME text affect textarea's value.
-        This matches input and contentEditable elements as well
-        IE and Firefox.
-
-        This fixes https://bugs.webkit.org/show_bug.cgi?id=25061.
-
-        Input elements would go down this code path because it
-        would always get a null compositionNode from frame->editor().
-        Special casing compositionNodes is wrong because we explicitly
-        want unconfirmed IME input in the textarea's value (assuming we
-        want to match IE and Firefox here).
-
-        This change is originally created by Ojan Vafai <ojan@chromium.org> and
-        I just changed its manual tests with an automated test on his behalf.
-
-        Test: platform/mac/editing/input/text-control-ime-input.html
-
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::text):
-        (WebCore::RenderTextControl::textWithHardLineBreaks):
-
-2009-07-06  Anders Carlsson  <andersca@apple.com>
+        Fix a bug that changes for some constraint attributes doesn't
+        update validation CSS selectors.
+        https://bugs.webkit.org/show_bug.cgi?id=31716
 
-        Reviewed by Adele Peterson.
-
-        Add the ability for wheel events to latch to a node.
-        
-        * WebCore.base.exp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/EventHandler.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::wheelEvent):
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a bunch of layout test crahses in Chromium caused by a bad usage of DEFINE_STATIC_LOCAL.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26997
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ValueToWebCoreString): Use a regular static declaration instead of DEFINE_STATIC_LOCAL.
-
-2009-07-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: suggest global properties based on async evaluation.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26976
-
-        Before this change, empty string was evaluated to the global object
-        (or scope chain object) synchronously. This is now fixed and global
-        object is evaluated using the same control flow.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.completions):
-        (WebInspector.Console.prototype._evalInInspectedWindow):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype._variablesInScope):
-
-2009-07-06  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix crash when indenting in an empty table cell.
-        https://bugs.webkit.org/show_bug.cgi?id=26872
-
-        The crash is that we would call splitTreeToNode where the node
-        and the nodeToSplitTo were the same node.
-
-        Test: editing/execCommand/indent-empty-table-cell.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::splitTreeToNode):
-        Added an assert in that node and nodeToSplitTo
-        are different nodes to make this assumption explicit.
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::isAtUnsplittableElement):
-        (WebCore::IndentOutdentCommand::indentRegion):
-        * editing/IndentOutdentCommand.h:
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8Binding and update some function names.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm: Update function names in auto-generated files.
-        * bindings/v8/V8Binding.cpp: Upstreamed from src.chromium.org.
-        * bindings/v8/V8Binding.h: Upstreamed from src.chromium.org.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Jan Alonzo.
-
-        Use soup's content sniffing
-        https://bugs.webkit.org/show_bug.cgi?id=26982
-
-        Drop our hackish content sniffing code, and use the new libsoup
-        feature to do that job for us.
-
-        Testing this is in a cross-platform way is not obvious or possible
-        while we are using platform-specific code for sniffing.
-
-        * platform/network/ResourceHandleInternal.h:
-        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::gotHeadersCallback):
-        (WebCore::contentSniffedCallback):
-        (WebCore::gotChunkCallback):
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-05  Antonio Gomes  <antonio.gomes@openbossa.org>
-
-        Reviewed by Darin Adler.
-
-        REGRESSION (r40499): fast/dom/cssTarget-crash.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=20342
-
-        Re-added code removed by commit r40499.
-        Without this, both Qt and Mac were crashing while running the test.
-
-        Note that this does not entirely fix the bug. It fixes the WebCore
-        crash, but the test no longer seems to work due to loader changes.
-        So this patch does not reenable the test. The test probably has to
-        be rewritten.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::removedFromDocument): Re-added code to
-        set the CSS target of the document to 0.
-
-2009-07-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26943
-
-        When one transition finishes slightly before another the longer
-        one will fire a second time. This is because the second
-        ImplicitAnmation object is culled too early, before its final
-        RenderStyle is in place. This is done by cleanupFinishedAnimations()
-        so I got rid of that method completely and now cleanup each
-        transition or animation at the point where I am setting the final
-        style, or when I detect that the transition or animation has been
-        terminated early (which happens when you remove it from the style).
-
-        Test: transitions/extra-transition.html
-
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        Avoid a divide by zero if m_animation->duration() is zero, which can happen
-        if the duration is changed to zero while the animation is running.
-
-2009-07-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Revert the previous commit because it broke the
-        animations/transition-and-animation-1.html
-        testcase.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
-        * page/animation/CompositeAnimation.h:
-
-2009-07-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26943
-
-        When one transition finishes slightly before another the longer
-        one will fire a second time. This is because the second 
-        ImplicitAnmation object is culled too early, before its final
-        RenderStyle is in place. This is done by cleanupFinishedAnimations()
-        so I got rid of that method completely and now cleanup each 
-        transition or animation at the point where I am setting the final
-        style, or when I detect that the transition or animation has been
-        terminated early (which happens when you remove it from the style).
-
-        Test: transitions/extra-transition.html
-
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
+        - Rename HTMLFormControlElement::updateValidity() to setNeedsValidityCheck()
+        - Introduce HTMLFormControlElement::setNeedsWillValidate()
+        - Introduce HTMLFormControlElement::m_hasName to make willValidate()
+          work in parseMappedAttribute().
+        - We need to call setNeedsValidityCheck() when HTMLInputElement::step or
+          HTMLTextAreaElement::maxLength is changed.
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        Avoid a divide by zero if m_animation->duration() is zero, which can happen
-        if the duration is changed to zero while the animation is running.
-
-2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26843
-
-        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
-
-        The Metrowerks compiler on the Symbian platform moves the globally
-        defined Hashtables into read-only memory, despite one of the members
-        being mutable. This causes crashes at run-time due to write access to
-        read-only memory.
-
-        Avoid the use of const with this compiler by introducing the
-        JSC_CONST_HASHTABLE macro.
-
-        Based on idea by Norbert Leser.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Use JSC_CONST_HASHTABLE for hash tables
-        define in the bindings.
-
-2009-07-05  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 26897 - Dynamic SVG images do not display correctly
-        https://bugs.webkit.org/show_bug.cgi?id=26897
-
-        Use repaint() to fix a rendering problem with a SVG image embedded in xhtml.
-
-        Test: svg/custom/createImageElement2.xhtml
-
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::imageChanged):
-
-2009-07-05  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26960
-        [Gtk] caret offset not updated when selecting text
-
-        Report the caret offset from the end of the selection so it works
-        correctly for multi-char selections too (ie, anything that is not
-        the zero width caret).
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_text_get_caret_offset):
-
-2009-07-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Unreviewed link fix for Qt.
-
-        Fix Qt link error by adding two new localized strings
-
-        In r45474 two new strings got added to LocalizedStrings.h add
-        the definition of them to Qt.
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::insertedIntoTree):
+        (WebCore::HTMLFormControlElement::removedFromTree):
+        (WebCore::HTMLFormControlElement::formDestroyed):
+        (WebCore::HTMLFormControlElement::willValidate): Avoids function calls.
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::disabled): Move the code from .cpp.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
 
-2009-07-03  Darin Adler  <darin@apple.com>
+2010-02-02  Roland Steiner  <rolandsteiner@chromium.org>
 
         Reviewed by Adele Peterson.
 
-        REGRESSION (r44670-r44680): Typing is suprisingly slow in password field on reddit.com
-        https://bugs.webkit.org/show_bug.cgi?id=26959
-        rdar://problem/7029882
-
-        The code to handle iteration boundaries was malfunctioning when the boundary was
-        at the edge of a shadow tree. This happens all the time with <input> elements.
-
-        It's not immediately obvious how to make a regression test for this since the
-        symptom was a performance problem, not incorrect behavior. I'll add a test if I
-        figure out a way to make one.
-
-        * editing/TextIterator.cpp:
-        (WebCore::parentCrossingShadowBoundaries): Renamed from parentOrShadowParent.
-        (WebCore::depthCrossingShadowBoundaries): Updated for name change.
-        (WebCore::nextInPreOrderCrossingShadowBoundaries): Added.
-        (WebCore::previousInPostOrderCrossingShadowBoundaries): Added.
-        (WebCore::setUpFullyClippedStack): Updated for name change.
-        (WebCore::TextIterator::TextIterator): Updated for name change. Use
-        nextInPreOrderCrossingShadowBoundaries instead of Range::pastLastNode to fix the bug.
-        (WebCore::TextIterator::advance): Updated for name change.
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        Tweaked formatting.
-        (WebCore::SimplifiedBackwardsTextIterator::advance): Ditto. Changed code that
-        initializes m_pastStartNode to use previousInPostOrderCrossingShadowBoundaries.
-        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Tweaked formatting.
-        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
-
-2009-07-03  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Background audio stops playing when JS GC runs
-        https://bugs.webkit.org/show_bug.cgi?id=26956
-        
-        Ensure we keep the Audio object around while it is playing, so that it
-        doesn't get collected.
-        
-        Not testable because there's no way to know whether the audio keeps
-        playing without holding a reference to it.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM):
-
-2009-07-02  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26814
-        [Gtk] Caret-moved events are not issued for the correct offset
-        when text is selected forward
-
-        Report the caret offset from the end of the selection, otherwise
-        we'll report the same offset when moving the caret while
-        modififying the selection (eg, with Shift Right).
-
-        * editing/gtk/SelectionControllerGtk.cpp:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-
-2009-07-02  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26815
-        [Gtk] text-selection-changed events are not issued for the correct
-        object when the selection spans multiple objects
-
-        Get the focused node from the end of the selection, not the start,
-        so we can detect when we cross object boundaries.
-
-        * editing/gtk/SelectionControllerGtk.cpp:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26947
-
-        Fix the media controls hit tests. They may lose click events.
-
-        Test cases already covered in the video-controls-zoomed tests.
-
-        Don't trust wkHitTestMediaUIPart for the tests. We are accurate enough.
-
-        * rendering/RenderThemeMac.h: Remove hitTestMediaControlPart.
-        * rendering/RenderThemeMac.mm: Remove hitTestMediaControlPart.
-
-2009-07-02  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        RenderBlock and RenderInline have confusingly named object creation methods:
-        RenderBlock::createRootBox/createRootInlineBox
-        RenderInline::createFlowBox/createInlineFlowBox
-        where the 2nd method in both cases just calls the first and then appends the created object.
-        I therefore renamed those methods to something IMHO more informative:
-        
-        createRootBox()         -> createRootInlineBox()
-        createRootInlineBox()   -> createAndAppendRootInlineBox();
-        createFlowBox()         -> createInlineFlowBox();
-        createInlineFlowBox()   -> createAndAppendInlineFlowBox();
-
-        https://bugs.webkit.org/show_bug.cgi?id=26828
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::createRootInlineBox):
-        (WebCore::RenderBlock::createAndAppendRootInlineBox):
-        * rendering/RenderBlock.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::createInlineFlowBox):
-        (WebCore::RenderInline::createAndAppendInlineFlowBox):
-        * rendering/RenderInline.h:
-        * rendering/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::createInlineFlowBox):
-        * rendering/RenderSVGInline.h:
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::createRootInlineBox):
-        * rendering/RenderSVGText.h:
-        * rendering/bidi.cpp:
-        (WebCore::createInlineBoxForRenderer):
-
-2009-07-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix typo in the resource panel enabler caption.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26753
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-
-2009-07-02  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adam Roben.
-
-        [Win] HTML5 Drag and drop, dragend is not fired when pressing Esc
-        https://bugs.webkit.org/show_bug.cgi?id=26699
-
-        * manual-tests/drag-escape.html: Added.
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dragSourceEndedAt):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser. 
+        Bug 34198 -  Ruby text should not inherit line-height
+        (https://bugs.webkit.org/show_bug.cgi?id=34198)
         
-        https://bugs.webkit.org/show_bug.cgi?id=26944
-
-        Make sure we support full page zoom in video controls.
-
-        This is tracked by a the video-controls-zoom test case.
-
-        * css/mediaControlsQT.css: Make sure we don't have any inherited margin.
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::updateStyle): Propagate the style to the innertext.
-        * rendering/RenderThemeMac.mm: Adjust the painting rect.
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Fix the Gtk build after r45474. The localized strings should
-        have been added there.
-
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26939
-
-        Media controller is rendered badly at http://www.mozilla.com/en-US/firefox/video/firefox-3.5.html
-
-        We fix two things:
-        - We use px instead of em, because px is used everywhere else
-        and because 0.09em hit the font size limit.
-        - We use -webkit-box instead of inline-block because in strict mode
-        inline-block has a different behavior.
-
-        Test: media/controls-strict.html
-
-        * css/mediaControlsQT.css:
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        TextIterator should use hasOverflowClip when checking for overflow instead of looking at the style.
-        https://bugs.webkit.org/show_bug.cgi?id=26942
-
-        * editing/TextIterator.cpp:
-        (WebCore::fullyClipsContents):
-
-2009-07-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/5230700>
-        Remove local .xhtml file workaround
-
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): Work around is no longer necessary.
-
-2009-07-02  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Sort, add functions used by WebKit.
-        
-        * WebCore.base.exp:
-
-2009-07-02  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Sam Weinig.
-
-        More of <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
-
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (webNSURLResponseMIMEType): Give Tiger a chance to query the UTI machinery.
-
-2009-07-02  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: fix complex text rendering with line break characters.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26935
-
-        If the CSS white-space property is inhibiting line breaking, we might
-        find end-of-line characters rendered via the complex text path. Fonts
-        don't provide glyphs for these code points so, if we find one, we
-        simulate the space glyph being interposed in this case.  Because the
-        input is variable-length per code point, we walk the input in step
-        with the output.
-
-        Covered by:
-            LayoutTests/fast/text/international/bidi-linebreak-002.html
-            LayoutTests/fast/text/international/bidi-linebreak-003.html
-            LayoutTests/fast/text/international/hindi-whitespace.html
-
-        * platform/graphics/chromium/HarfbuzzSkia.cpp:
-        (WebCore::stringToGlyphs):
-
-2009-07-02  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26521
-        Expose file size to chromium.
-
-        Implement getFileSize() for Chromium.
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::getFileSize):
-
-2009-07-02  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, build fix.
-
-        * bindings/v8/V8SVGPODTypeWrapper.h: Lost a space in nested template argument list.
-
-2009-07-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix: add missing #include.
-
-        * platform/mac/ThemeMac.mm:
-
-2009-07-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        <rdar://problem/7028682> ThemeMac::paintRadio() throws Obj-C exceptions when zoomed
-
-        Add BEGIN_BLOCK_OBJC_EXCEPTIONS/END_BLOCK_OBJC_EXCEPTIONS guards around code
-        that can possibly throw Objective-C exceptions when drawing Mac form controls.
-
-        * platform/mac/ThemeMac.mm:
-        (WebCore::paintCheckbox):
-        (WebCore::paintRadio):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::inflateControlPaintRect):
-
-2009-07-02  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8SVGPODTypeWrapper.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26907
-
-        * bindings/scripts/CodeGeneratorV8.pm: Update function being renamed in V8SVGPODTypeWrapper.h.
-        * bindings/v8/V8SVGPODTypeWrapper.h: Upstreamed from src.chromium.org.
-
-2009-07-02  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adds an abstraction layer between the DB classes and the file
-        system, which allows us to add our own logic for storing, opening,
-        deleting, etc. databases.
+        Resetting line-height to 'normal' in the default UA style sheet.
+        Adding layout-test to check for this.
 
-        The patch was tested using the tests in WebCore/storage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26054
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/sql/SQLiteDatabase.cpp:
-        (WebCore::SQLiteDatabase::open): Delegating the job of opening DB files to SQLiteFileSystem to allow use of custom VFSs.
-        * platform/sql/SQLiteFileSystem.cpp: Added.
-        * platform/sql/SQLiteFileSystem.h: Added.
-        * platform/win/FileSystemWin.cpp:
-        (WebCore::directoryName): Implemented.
-        * storage/Database.cpp:
-        (WebCore::Database::databaseSize): The code that returns the size of a DB file moved to SQLiteFileSystem.
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::DatabaseTracker): Added the ability to register a custom SQLite VFS.
-        (WebCore::DatabaseTracker::trackerDatabasePath): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::openTrackerDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::originPath): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::fullPathForDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::usageForDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::deleteOrigin): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::deleteDatabaseFile): DB file-related operations moved to SQLiteFileSystem.
-        * storage/OriginUsageRecord.cpp:
-        (WebCore::OriginUsageRecord::diskUsage): DB file-related operations moved to SQLiteFileSystem.
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Always clip replaced elements to border radii.
-        https://bugs.webkit.org/show_bug.cgi?id=26933
-
-        Make sure to always clip replaced elements to border radii, even when overflow is visible.
-        Stop defaulting those elements to overflow:hidden in the UA sheet, since it is now no longer
-        necessary.
-
-        Covered by existing tests (since the UA default changing keeps the behavior exactly the same).
+        Test: fast/ruby/ruby-line-height.html
 
         * css/html.css:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
-
-2009-07-02  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Simon Fraser.
-
-        convertFromScrollbarToContainingView and friends should be in ScrollView
-        https://bugs.webkit.org/show_bug.cgi?id=26929
-
-        This is breaking Chromium's build because PopupMenuChromium inherits
-        from ScrollView, but these functions are pure virtual in it.  I could
-        put it directly in PopupMenuChromium, but that seems a bit silly since
-        the functions are fairly generic.
-
-        Passes existing layout tests.
-
-        * page/FrameView.cpp:  Remove the 4 functions Hyatt just added
-        (IntRect WebCore::FrameView::convertFromScrollbarToContainingView):
-        (IntRect WebCore::FrameView::convertFromContainingViewToScrollBar):
-        (IntPoint WebCore::FrameView::convertFromScrollbarToContainingView):
-        (IntPoint WebCore::FrameView::convertFromContainingViewToScrollBar):
-        * page/FrameView.h: ditto
-        * platform/ScrollView.cpp:  Move the 4 functions from FrameView here
-        (IntRect WebCore::ScrollView::convertFromScrollbarToContainingView):
-        (IntRect WebCore::ScrollView::convertFromContainingViewToScrollBar):
-        (IntPoint WebCore::ScrollView::convertFromScrollbarToContainingView):
-        (IntPoint WebCore::ScrollView::convertFromContainingViewToScrollBar):
-        * platform/ScrollView.h: ditto
-
-2009-07-02  Dirk Pranke  <dpranke@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=26088 - TransparencyWin 
-        doesn't handle errors well at all; revise it to fail silently 
-        (drawing nothing), and bulletproof FontChromiumWin to handle the
-        failure accordingly.
-
-        Tests: fast/text/text-large-negative-letter-spacing-with-opacity.html
-               fast/text/text-letter-spacing.html
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::TransparencyWin):
-        (WebCore::TransparencyWin::setupLayerForNoLayer):
-        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
-        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
-        (WebCore::TransparencyWin::setupTransformForKeepTransform):
-        (WebCore::TransparencyWin::setupTransformForScaleTransform):
-        (WebCore::TransparencyWin::initializeNewContext):
-        (WebCore::TransparencyWin::compositeOpaqueComposite):
-        (WebCore::TransparencyWin::compositeTextComposite):
-        (WebCore::TransparencyWin::makeLayerOpaque):
-        * platform/graphics/chromium/TransparencyWin.h:
-        (WebCore::TransparencyWin::platformContext):
-
-2009-07-02  Eric Carlson  <eric.carlson@apple.com>
-
-        Change #import to #include to fix non-ObjC builds.
-
-        * rendering/MediaControlElements.cpp:
-
-2009-07-02  Anders Carlsson  <andersca@apple.com>
-
-        Build fix.
-        
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (mimeTypeFromUTITree):
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Simon Fraser.
-
-        Fix for bug 22119, clicks in the scrollbars of transformed content don't work.  Add new
-        conversion methods for going across parent/child widget boundaries that can be implemented
-        by the FrameView and ScrollbarClient to be transform-aware.
-
-        Test cases added in platform/mac/fast/forms and platform/mac/fast/overflow.
-
-        * WebCore.base.exp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::convertFromScrollbarToContainingView):
-        (WebCore::FrameView::convertFromContainingViewToScrollbar):
-        (WebCore::FrameView::convertFromRenderer):
-        (WebCore::FrameView::convertToRenderer):
-        (WebCore::FrameView::convertToContainingView):
-        (WebCore::FrameView::convertFromContainingView):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::convertToContainingView):
-        (WebCore::Scrollbar::convertFromContainingView):
-        * platform/Scrollbar.h:
-        * platform/ScrollbarClient.h:
-        (WebCore::ScrollbarClient::convertFromScrollbarToContainingView):
-        (WebCore::ScrollbarClient::convertFromContainingViewToScrollbar):
-        * platform/Widget.cpp:
-        (WebCore::Widget::convertFromContainingWindow):
-        (WebCore::Widget::convertToContainingWindow):
-        (WebCore::Widget::convertFromRootToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindowToRoot):
-        (WebCore::Widget::convertToContainingView):
-        (WebCore::Widget::convertFromContainingView):
-        * platform/Widget.h:
-        * platform/graphics/IntPoint.h:
-        (WebCore::IntPoint::move):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromRootToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindowToRoot):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::isPointInOverflowControl):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::convertFromScrollbarToContainingView):
-        (WebCore::RenderDataGrid::convertFromContainingViewToScrollbar):
-        * rendering/RenderDataGrid.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
-        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
-        (WebCore::RenderLayer::scrollbarOffset):
-        (WebCore::RenderLayer::hitTestOverflowControls):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::isPointInOverflowControl):
-        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
-        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
-        * rendering/RenderListBox.h:
-
-2009-07-02  Dan Bernstein  <mitz@apple.com>
+2010-02-02  James Robinson  <jamesr@chromium.org>
 
-        Reviewed by Dave Hyatt and Simon Fraser.
+        Reviewed by Dmitry Titov.
 
-        - fix <rdar://problem/6933052> SPOD playing video in a div with a box
-          shadow
+        Add a null check for image, which might be NULL if tileSize is empty
+        https://bugs.webkit.org/show_bug.cgi?id=34510
 
-        Test: fast/box-shadow/transform-fringing.html
+        Test: fast/gradients/crash-on-1px-border.html
 
         * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Clip out the
-        box even if it has an opaque background, but in that case, inset the
-        clip path by 1 pixel, to avoid antialiasing artifacts.
-        Do not inset the clip rect by 1 pixel if the CTM is purely a
-        translation.
-        Move the shadow-casting path away in the non-rounded-rect case (it
-        was already being done in the rounded-rect case), to avoid a black
-        fringe when the CTM is not purely a translation.
-
-2009-07-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
-
-        Walk the CoreTypes UTI tree for extensions with unknown MIME types, using the first MIME type found.
-
-        For many types of text files (such as source code files) this ends up being text/plain.
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Tweak the logging output.
-
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (mimeTypeFromUTITree): 
-        (webNSURLResponseMIMEType): Use mimeTypeFromUTITree() to find a UTI-based MIME type for this file's extension.
-        (-[NSURLResponse _webcore_reportedMIMEType]): Return the actual MIME type that CFNetwork gave us.
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/6518119>
-
-        Add a rewind button and hide the timeline for live broadcasts when
-        in MediaUI mode.
-
-        * css/CSSPrimitiveValueMappings.h: 
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add the new pseudo element.
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): Ditto.
-        * css/CSSSelector.h: 
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
-
-        * css/CSSValueKeywords.in: Ditto.
-        * css/mediaControls.css: Ditto.
-        * css/mediaControlsQT.css: Ditto.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::rewind): New.
-        (WebCore::HTMLMediaElement::returnToRealTime): New.
-        (WebCore::HTMLMediaElement::isStreaming): New.
-        * html/HTMLMediaElement.h:
-
-        * page/mac/WebCoreViewFactory.h: Declare mediaElementLoadingStateText and mediaElementLiveBroadcastStateText.
-
-        * platform/LocalizedStrings.h: Add localized media state messages.
-
-        * platform/ThemeTypes.h: Add the new pseudo element.
-
-        * platform/mac/LocalizedStringsMac.mm: 
-        (WebCore::mediaElementLoadingStateText): Add localized media state.
-        (WebCore::mediaElementLiveBroadcastStateText): Ditto.
-
-        * platform/mac/WebCoreSystemInterface.h: Change BOOL param wkDrawMediaUIPart to an int to support
-           multiple states.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-
-        * rendering/MediaControlElements.cpp: 
-        (WebCore::MediaControlElement::MediaControlElement): Deal with new elements.
-        (WebCore::MediaControlElement::attachToParent): Ditto.
-        (WebCore::MediaControlElement::update): Ditto.
-        (WebCore::MediaControlElement::updateStyle): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::update): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlInputElement::MediaControlInputElement): Ditto.
-        (WebCore::MediaControlInputElement::attachToParent): Ditto.
-        (WebCore::MediaControlInputElement::updateStyle): Ditto.
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
-        (WebCore::MediaControlRewindButtonElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlTimelineElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlTimelineElement::update): Ditto.
-        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): Ditto.
-        * rendering/MediaControlElements.h: Ditto.
-
-        * rendering/RenderMedia.cpp: 
-        (WebCore::RenderMedia::styleDidChange): Deal with the new elements.
-        (WebCore::RenderMedia::createPanel): Ditto.
-        (WebCore::RenderMedia::createRewindButton): Ditto.
-        (WebCore::RenderMedia::createReturnToRealtimeButton): Ditto.
-        (WebCore::RenderMedia::createStatusDisplay): Ditto.
-        (WebCore::RenderMedia::createTimelineContainer): Ditto.
-        (WebCore::RenderMedia::createCurrentTimeDisplay): Ditto.
-        (WebCore::RenderMedia::createTimeRemainingDisplay): Ditto.
-        (WebCore::RenderMedia::updateControls): Ditto.
-        (WebCore::RenderMedia::forwardEvent): Ditto.
-        * rendering/RenderMedia.h:
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint): Deal with the new elements.
-
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMediaRewindButton): Deal with the new elements.
-        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton): Ditto.
-        (WebCore::RenderTheme::paintMediaControlsBackground): Ditto.
-
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaRewindButton): Deal with the new elements.
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton): Ditto.
-        (WebCore::RenderThemeMac::paintMediaControlsBackground): Ditto.
-
-        * rendering/style/RenderStyleConstants.h: Add constants for the new elements.
-
-2009-07-01  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Small refactoring of MessagePortChannel so that PlatformMessagePortChannel
-        may be defined at the WebKit layer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26905
-
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-        * dom/MessagePortChannel.cpp:
-        * dom/MessagePortChannel.h:
-        * dom/default/PlatformMessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::createChannel):
-        (WebCore::MessagePortChannel::create):
-        (WebCore::MessagePortChannel::MessagePortChannel):
-        (WebCore::MessagePortChannel::~MessagePortChannel):
-
-2009-07-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <video> fails to show on http://camendesign.com/code/video_for_everybody
-        <rdar://problem/7026010>
-        https://bugs.webkit.org/show_bug.cgi?id=26919
-
-        Fix an issue introduced in r44961. In that revision we changed to only update
-        compositing layer geometry when all siblings had been laid out (i.e. we pushed
-        the updates one level down). However, that left out the root layer, so this
-        fix ensures that the root layer geometry gets updated at the end.
-
-        Test: compositing/geometry/root-layer-update.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-
-2009-07-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-        
-        <rdar://problem/7026010> <video> fails to show on http://camendesign.com/code/video_for_everybody
-
-        First part of fix: when outline width changes, don't to a synchronous
-        layer update right away, but just set the flag to say that compositing
-        layers need updating. The synchronous layer update left the layer geometries
-        out of whack when it happened in the middle of layout (e.g. when inside ::first-letter).
-        
-        Test: compositing/geometry/outline-change.html
-
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setMaximalOutlineSize):
-
-2009-07-01  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26842
-        Build fix when ENABLE_DATABASE is off
-
-        Move Database.h into ENABLE(DATABASE) guard so toggling ENABLE_DATABASE
-        off does not break builds.
-
-        * bindings/js/ScriptObjectQuarantine.cpp:
-
-2009-07-01  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26899
-        
-        Modified XSSAuditor::decodeURL to only remove null characters so that 
-        it is consistent with the behavior of HTMLTokenizer and prevents 
-        injected scripts that contain control characters. 
-
-        Tests: http/tests/security/xssAuditor/script-tag-control-char.html
-               http/tests/security/xssAuditor/script-tag-null-char.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeURL): Modified to only remove null characters. 
-        * page/XSSAuditor.h: Reverted naming of third argument of method XSSAuditor::decodeURL
-        from allowControlCharacters back to allowNullCharacters.
-        * platform/network/ResourceResponseBase.cpp: Reverted back to rev #45003.
-        (WebCore::isControlCharacter):
-        * platform/network/ResourceResponseBase.h: Reverted back to rev #45003.  
-
-2009-07-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        - supported keyboard shortcuts compatible with Firebug in Scripts Debugger:
-        F5, Ctrl+/ (win,lin), Command+/ (mac) - continue
-        F10, Ctrl+' (win, lin), Command+' (mac) - step over
-        F11, Ctrl+; (win, lin), Command+; (mac) - step into
-        Shift+F11, Ctrl+Shift+; (win, lin), Command+Shift+; (mac) - step out
-
-        - added call stack navigation shortcuts:
-        Ctrl+. - next call frame
-        Ctrl+, - previouse call frame
-
-        https://bugs.webkit.org/show_bug.cgi?id=23849
-
-        * inspector/front-end/CallStackSidebarPane.js:
-        (WebInspector.CallStackSidebarPane):
-        (WebInspector.CallStackSidebarPane.prototype.handleKeyEvent):
-        (WebInspector.CallStackSidebarPane.prototype._selectNextCallFrameOnStack):
-        (WebInspector.CallStackSidebarPane.prototype._selectPreviousCallFrameOnStack):
-        (WebInspector.CallStackSidebarPane.prototype._selectedPlacardByIndex):
-        (WebInspector.CallStackSidebarPane.prototype._selectedCallFrameIndex):
-        * inspector/front-end/KeyboardShortcut.js: Added.
-        (WebInspector.KeyboardShortcut):
-        (WebInspector.KeyboardShortcut.makeKey):
-        (WebInspector.KeyboardShortcut.makeKeyFromEvent):
-        (WebInspector.KeyboardShortcut.makeKeyFromCodeAndModifiers_):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.handleKeyEvent):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-07-01  Daniel Erat  <derat@google.com>
-
-        Reviewed by David Levin.
-
-        Chromium Linux: Move the scrollbar thumb on middle-click.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26910
-        http://code.google.com/p/chromium/issues/detail?id=11976
-
-        Tested by building Chrome and checking that the scrollbar moves as expected.
-
-        * platform/chromium/ScrollbarThemeChromium.cpp:
-        * platform/chromium/ScrollbarThemeChromium.h:
-        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
-        * platform/chromium/ScrollbarThemeChromiumLinux.h:
-        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
-        * platform/chromium/ScrollbarThemeChromiumWin.h:
-
-2009-07-01  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add a preference/setting to toggle whether content sniffing is enabled for file URLs.
-
-        * WebCore.base.exp:
-
-        * page/Settings.cpp:
-        (WebCore::Settings::setLocalFileContentSniffingEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::localFileContentSniffingEnabled):
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-
-2009-07-01  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26909: aria-label needs to be supported
-        https://bugs.webkit.org/show_bug.cgi?id=26909
-
-        Test: accessibility/aria-label.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-        * html/HTMLAttributeNames.in:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        More datagrid columns work.  Make sure columns cache both a style for the column header as well
-        as a style for the column background (behind the cells).
-
-        Hook up to CSSStyleSelector methods for obtaining the pseudo styles for columns (stubbed out and
-        unimplemented).
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumn):
-        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumnHeader):
-        * css/CSSStyleSelector.h:
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::columnStyle):
-        (WebCore::DataGridColumn::setColumnStyle):
-        (WebCore::DataGridColumn::headerStyle):
-        (WebCore::DataGridColumn::setHeaderStyle):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::recalcStyleForColumn):
-        (WebCore::RenderDataGrid::columnStyle):
-        (WebCore::RenderDataGrid::headerStyle):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        * rendering/RenderDataGrid.h:
-
-2009-07-01  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        <rdar://problem/7009870> After <audio> movie finishes playing, Pause button fails to change 
-        back to Play button
-
-        Grab onto the current time when QTKit "ended" notification fires and use it as 
-        duration from that point on as QuickTime sometimes refuses to play all the way to
-        the time it reports for duration and buffered. HTMLMediaElement assumes that there
-        more to play in this situation and tries to restart playback, endlessly.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-            Rename m_duration to m_reportedDuration. Declare m_cachedDuration.
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-            Rename m_duration to m_reportedDuration. Initialize m_cachedDuration.
-        (WebCore::MediaPlayerPrivate::duration):
-            Return m_cachedDuration once it has been set.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Rename m_duration to m_reportedDuration.
-        (WebCore::MediaPlayerPrivate::didEnd):
-            Set m_cachedDuration to currentTime().
-
-2009-07-01  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 26900: AX: Manual spell check with Command-; does not bring up suggestions
-        https://bugs.webkit.org/show_bug.cgi?id=26900
-
-        Editable web areas should have a clickpoint that uses where the selection is.
-
-        Test: accessibility/editable-webarea-context-menu-point.html
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::clickPoint):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-07-01  David Levin  <levin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove unused code in SVGTransformList and SVGTransformDistance
-        <https://bugs.webkit.org/show_bug.cgi?id=26891>
-
-        * svg/SVGTransformDistance.cpp:
-        (WebCore::SVGTransformDistance::SVGTransformDistance):
-        * svg/SVGTransformList.cpp:
-        * svg/SVGTransformList.h:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Begin stubbing out functions for layout, painting and style/geometry caching on columns.  Not enough
-        is implemented for this to do much of anything yet, but it should help keep patch sizes down. :)
-
-        * html/DataGridColumn.cpp:
-        (WebCore::DataGridColumn::columnChanged):
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::setId):
-        (WebCore::DataGridColumn::setLabel):
-        (WebCore::DataGridColumn::setType):
-        (WebCore::DataGridColumn::setSortable):
-        (WebCore::DataGridColumn::setSortDirection):
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::style):
-        (WebCore::DataGridColumn::setStyle):
-        (WebCore::DataGridColumn::rect):
-        (WebCore::DataGridColumn::setRect):
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::DataGridColumnList):
-        (WebCore::DataGridColumnList::setDataGridNeedsLayout):
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
-        (WebCore::DataGridColumnList::clear):
-        (WebCore::DataGridColumnList::primaryColumnChanged):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::create):
-        (WebCore::DataGridColumnList::dataGrid):
-        (WebCore::DataGridColumnList::clearDataGrid):
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::findDataGridAncestor):
-        (WebCore::HTMLDataGridColElement::insertedIntoTree):
-        (WebCore::HTMLDataGridColElement::removedFromTree):
-        * html/HTMLDataGridColElement.h:
-        (WebCore::HTMLDataGridColElement::dataGrid):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::~HTMLDataGridElement):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::styleDidChange):
-        (WebCore::RenderDataGrid::recalcStyleForColumns):
-        (WebCore::RenderDataGrid::recalcStyleForColumn):
-        (WebCore::RenderDataGrid::styleForColumn):
-        (WebCore::RenderDataGrid::layout):
-        (WebCore::RenderDataGrid::layoutColumns):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        (WebCore::RenderDataGrid::paintColumnHeader):
-        * rendering/RenderDataGrid.h:
-        (WebCore::RenderDataGrid::renderName):
-        (WebCore::RenderDataGrid::canHaveChildren):
-
-2009-07-01  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26807
-        
-        Fixes this address by checking whether frame->document()->decoder() is null. 
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::findInRequest):
-
-2009-07-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26885
-
-        Correctly reset history length to '0', not '1'. Old relict from early WML days.
-        Add some new WML testcases covering the use of history length (by onenterforward event handling)
-
-        Tests: wml/onenterforward-event.html
-               wml/onenterforward-inline-event.html
-               wml/ontimer-event.html
- 
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::reset):
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make sure setting attributes on dcol elements properly updates the corresponding DataGridColumn object.
-
-        Added new test in fast/dom/HTMLDataGridElement.
-
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::parseMappedAttribute):
-        * html/HTMLDataGridColElement.h:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        <rdar://problem/6998524> REGRESSION (r44474): Form text field has focus ring, looks focused,
-        even though the field is not actually focused for keyboard input
-        
-        Add the concept of whether or not the Page is focused by adding a boolean to the focusController.  This allows the
-        focused frame and focused node to both be cached and changed programmatically even when the Page itself doesn't
-        actually happen to have focus at that time.
-
-        * WebCore.base.exp:
-        * page/FocusController.cpp:
-        (WebCore::FocusController::FocusController):
-        (WebCore::FocusController::setFocusedFrame):
-        (WebCore::FocusController::setFocused):
-        (WebCore::FocusController::setActive):
-        * page/FocusController.h:
-        (WebCore::FocusController::isFocused):
-
-2009-07-01  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
-        get installed when running make install from the build directory.
-
-        * WebCore.pro:
-
-2009-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Ariya Hidayat.
-
-        Ran WebKitTools/Scripts/generate-qt-inspector-resource to update the
-        qrc file with new png files from the web inspector.
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-06-30  Mark Rowe  <mrowe@apple.com>
-
-        Land some code that has a hope of compiling.
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::imageSourceOptions):
-
-2009-06-30  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Flip back on block caching. Throwing away block data, while 
-        a perceived memory win, is a performance hit in cases where we 
-        are repainting large images (i.e. backgrounds) frequently 
-        (i.e. a flash video playing on top).  
-        <rdar://problem/6933515> REGRESSION(L-SL): Large JPEG images are 
-        decoded on drawing, slowing down painting of sites that frequently 
-        repaint e.g. because of Flash (pandora.com, Starcraft 2)
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::imageSourceOptions):
-
-2009-06-30  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Rename html4.css to html.css, since we target HTML5 now
-        https://bugs.webkit.org/show_bug.cgi?id=26873
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        * css/html.css: Copied from css/html4.css.
-        * css/html4.css: Removed.
-        * css/themeWin.css:
-        * platform/Theme.h:
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-        * rendering/RenderTheme.h:
-
-2009-06-30  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Drag and drop support
-        https://bugs.webkit.org/show_bug.cgi?id=23642
-
-        Define DragImageRef as GdkPixbuf and implement essential
-        functions which manipulate drag images.
-
-        * platform/DragImage.h:
-        * platform/gtk/DragImageGtk.cpp:
-        (WebCore::dragImageSize):
-        (WebCore::deleteDragImage):
-        (WebCore::scaleDragImage):
-        (WebCore::createDragImageFromImage):
-
-2009-06-30  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        StorageNamespace.cpp build issue
-        https://bugs.webkit.org/show_bug.cgi?id=26859
-
-        Moved #endif //ENABLE(DOM_STORAGE) position
-        so that the build doesn't fail.
-        The namespace WebCore was started after the #if ENABLE(DOM_STORAGE)
-        but closed after the #endif.
-
-        * storage/StorageNamespace.cpp:
-
-2009-06-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/7020825> HTMLMediaElement should not assume seeking is only possible in 
-        buffered time ranges
-
-        * html/HTMLMediaElement.cpp:
-            Don't ASSERT if the network state goes to Idle when when the ready state is 
-            HaveEnoughData or higher, it is perfectly legal.
-        (WebCore::HTMLMediaElement::setReadyState): 
-            Don't clear m_seeking after posting a 'seeking' event.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::seek):
-            Do nothing when asked to seek to the same time we are already seeking to. Check requested
-            seek time against maxTimeSeekable, not maxTimeLoaded.
-        (WebCore::MediaPlayerPrivate::doSeek):
-            Don't bother stopping a movie that isn't playing. Minor cleanup to make the code more readable.
-        (WebCore::MediaPlayerPrivate::seekTimerFired):
-            Check requested seek time against maxTimeSeekable, not maxTimeLoaded.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            A streaming movie has as much data as it needs once it reaches "playable", so 
-            set the ready state to HaveFutureData. A movie with metadata doesn't drop back 
-            to "have nothing" when seeking. A streaming movie doesn't use the network when paused.
-        (WebCore::MediaPlayerPrivate::timeChanged):
-            It may not be possible to seek to a specific time in a streamed movie but when seeking 
-            in a streaming movie QuickTime sets the time to closest time possible and posts a  
-            timechanged notification, so update m_seekTo so we can detect when the seek completes.
-
-2009-06-30  Steve Falkenburg  <sfalken@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=26860
-
-        Reviewed by Sam Weinig.
-
-        Blacklist Yahoo Application State plug-in for versions prior to 1.0.0.6.
-        Earlier versions cause corruption crashes.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2009-06-30  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7005207> <video> in canvas broken with ACCEL_COMPOSITING
-        
-        Fix drawImage of video in CanvasRenderingContext2D when
-        accelerated compositing is enabled. This is done by
-        adding a new paint method to HTMLVideoElement that
-        is only called from canvas, which will create the software
-        renderer if necessary, but otherwise calls the regular
-        paint method. Meanwhile, add logic to the software video
-        renderer so that it can be created without calling repaint
-        every time it sees a new frame.
-        
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::paintCurrentFrameInContext):
-        * html/HTMLVideoElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::paintCurrentFrameInContext):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::paintCurrentFrameInContext):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-        (WebCore::MediaPlayerPrivate::createQTVideoRenderer):
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
-
-2009-06-30  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26858
-
-        Get <dcol> elements reflected into the datagrid's column list.  Make sure columns get added/removed
-        properly.  (Attribute changes are still not caught.  That is coming in a separate patch.)
-
-        Added fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
-
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::create):
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::DataGridColumn):
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::clear):
-        * html/DataGridColumnList.h:
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::findDatagridAncestor):
-        (WebCore::HTMLDataGridColElement::ensureColumn):
-        (WebCore::HTMLDataGridColElement::insertedIntoTree):
-        (WebCore::HTMLDataGridColElement::removedFromTree):
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        * html/HTMLDataGridColElement.h:
-        (WebCore::HTMLDataGridColElement::column):
-        (WebCore::HTMLDataGridColElement::setColumn):
-        (WebCore::HTMLDataGridColElement::datagrid):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::dataSource):
-
-2009-06-30  Jeremy Orlow (jorlow@chromium.org)
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26852
-
-        Fix some minor build issues in the v8 bindings.
-
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        (WebCore::storageGetter):
-        (WebCore::storageSetter):
-        (WebCore::storageDeleter):
-        * storage/StorageArea.cpp:
-
-2009-06-30  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: use different fonts for each script run.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26853
-
-        Previously, when rendering complex text, we picked a single font which
-        could render all the glyphs needed for the run. However, this meant
-        that sometimes lines were rendered with, for example, [LATIN, THAI,
-        LATIN] and we could end up with a different font for the Latin parts
-        than for lines without Thai in them.
-
-        With this patch, we pick a font for each script run.
-
-        This change is covered by existing layout tests.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::drawGlyphs):
-        (WebCore::TextRunWalker::TextRunWalker):
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::nextScriptRun):
-        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
-        (WebCore::TextRunWalker::setupFontForScriptRun):
-        (WebCore::TextRunWalker::allocHarfbuzzFont):
-        (WebCore::setupForTextPainting):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::setupPaint):
-
-2009-06-30  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt, Dan Bernstein.
-        
-        <rdar://problem/6191676> Redraw issues scrolling overflow:scroll div with compositing
-
-        There are two parts to this fix. First, if a compositing layer has overflow clipping
-        or a mask, then the compositing layer does not need to be sized to encompass all
-        non-composited children.
-        
-        Second, when scrolling, we have to back up to the compositing ancestor and have
-        it reposition descendant compositing layers, because overflow doesn't follow
-        the z-order tree.
-        
-        Test: compositing/overflow/overflow-scroll.html
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        Pass the UpdateCompositingLayers flag when updating layers after layout, so that
-        we can reposition compositing layers if we're not about to do a layer rebuild.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        Only update compositing layers if the flag is set.
-        
-        (WebCore::RenderLayer::scrollToOffset):
-        Do compositing layer updates from the compositing ancestor in one fell swoop.
-
-        * rendering/RenderLayer.h:
-        Replace the unused FullUpdate flag with one that allows us to specify whether
-        compositing layers should be updated.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        * rendering/RenderLayerBacking.h:
-        New param that we can pass to updateCompositingDescendantGeometry to control
-        whether the update goes deep.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        We can return earlier if this is not a self-painting layer.
-        If the layer has overflow clip or a mask, then the composited bounds are just the
-        local bounds, excluding descendants.
-        
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
-        * rendering/RenderLayerCompositor.h:
-        Renamed from updateCompositingChildrenGeometry, and added a flag that allows
-        us to do a deep update.
-
-2009-06-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26764
-        Uncaught NOT_FOUND_ERR: DOMException 8 loading empty text file
-
-        Test: fast/parser/empty-text-resource.html
-
-        * loader/TextDocument.cpp: (WebCore::TextTokenizer::finish): Create document tree if it
-        hasn't been created yet.
-
-2009-06-30  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Renamed scrollbarUnderPoint to scrollbarAtPoint.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarAtPoint):
-        * platform/ScrollView.h:
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleMouseDownEvent):
-        (WebCore::PopupListBox::handleMouseMoveEvent):
-
-2009-06-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
-
-        <select> elements and other elements the produce popups can keep their popups
-        live across a page load.  If this occurs and the <select> element has an
-        onchange handler it is possible to get into a state where we try to execute
-        JS on a page that no longer has an execution context. 
-
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode):
-          Be paranoid and add a null check, but assert as well because we shouldn't
-          actually get to this point.
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::valueChanged):
-
-2009-06-30  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=25435>
-
-        Added support for sending MessagePorts to/from Workers via postMessage().
-
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::messageChannel):
-        Exposes MessageChannel constructor WorkerContext.
-        * bindings/js/JSWorkerCustom.cpp:
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Now correctly handles being instantiated from within a Worker.
-       * platform/CrossThreadCopier.h:
-        (WebCore::GenericWorkerTaskTraits<PassOwnPtr>):
-        Added support for passing PassOwnPtr as argument to GenericWorkerTask
-       * workers/GenericWorkerTask.h:
-        (WebCore::):
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
-        (WebCore::Worker::dispatchMessage):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        Added an optional MessagePort argument to postMessage()
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::hasPendingActivity):
-        Workers now report pending activity whenever there are remotely entangled ports.
-        (WebCore::WorkerContext::postMessage):
-        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
-        (WebCore::WorkerContext::dispatchMessage):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        Added an optional MessagePort argument to postMessage()
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        Updated messaging infrastructure to transport an optional MessagePort/MessagePortChannel.
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        Added additional postMessage() API that accepts a MessagePort
-        * workers/WorkerObjectProxy.h:
-        Added additional postMessage() API that accepts a MessagePort
-
-2009-06-30  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium: Add complex text support on Linux.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25068
-
-        This patch adds complex text support on Linux using Harfbuzz. It's not
-        the fastest code possible: some caching of font tables will certainly
-        be required. However, it's probably the simplest code that works.
-
-        This will require checking in new baselines in the Chromium tree for
-        those layout tests which now pass.
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::drawGlyphs):
-        (WebCore::truncateFixedPointToInteger):
-        (WebCore::TextRunWalker::TextRunWalker):
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::reset):
-        (WebCore::TextRunWalker::setXOffsetToZero):
-        (WebCore::TextRunWalker::rtl):
-        (WebCore::TextRunWalker::setBackwardsIteration):
-        (WebCore::TextRunWalker::nextScriptRun):
-        (WebCore::TextRunWalker::glyphs):
-        (WebCore::TextRunWalker::length):
-        (WebCore::TextRunWalker::xPositions):
-        (WebCore::TextRunWalker::advances):
-        (WebCore::TextRunWalker::width):
-        (WebCore::TextRunWalker::logClusters):
-        (WebCore::TextRunWalker::numCodePoints):
-        (WebCore::TextRunWalker::widthOfFullRun):
-        (WebCore::TextRunWalker::allocHarfbuzzFont):
-        (WebCore::TextRunWalker::deleteGlyphArrays):
-        (WebCore::TextRunWalker::createGlyphArrays):
-        (WebCore::TextRunWalker::expandGlyphArrays):
-        (WebCore::TextRunWalker::shapeGlyphs):
-        (WebCore::TextRunWalker::setGlyphXPositions):
-        (WebCore::setupForTextPainting):
-        (WebCore::fontPlatformDataForTextRun):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::glyphIndexForXPositionInScriptRun):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/chromium/HarfbuzzSkia.cpp: Added.
-        (WebCore::SkiaScalarToHarfbuzzFixed):
-        (WebCore::stringToGlyphs):
-        (WebCore::glyphsToAdvances):
-        (WebCore::canRender):
-        (WebCore::getOutlinePoint):
-        (WebCore::getGlyphMetrics):
-        (WebCore::getFontMetric):
-        (WebCore::harfbuzzSkiaGetTable):
-
-2009-06-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7019799> Slow loading MediaDocument can fall back to plug-in unnecessarily
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Always fall back to a plug-in if m_hasUnsupportedTracks is set.
-        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
-            Set m_hasUnsupportedTracks if we disable a track.
+2010-02-02  Kent Tamura  <tkent@chromium.org>
 
-2009-06-30  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix inverted if/else that's causing a layout test in src.chromium.org to fail.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26820
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::GCPrologueVisitor::visitDOMWrapper): if (port2), not if (!port2).
+        Reviewed by Darin Adler.
 
-2009-06-30  Dan Bernstein  <mitz@apple.com>
+        rangeOverflow/rangeUnderflow support for type=datetime, datetime-local,
+        month, time and week
+        https://bugs.webkit.org/show_bug.cgi?id=34483
 
-        Reviewed by Dave Hyatt.
+        Tests: fast/forms/ValidityState-rangeOverflow.html
+               fast/forms/ValidityState-rangeUnderflow.html
 
-        - fix <rdar://problem/6946611> REGRESSION (r30673): Shade10:" D_Snap
-          to Grid" window is clipping
+        * html/HTMLInputElement.cpp:
+          Defines the hard limits for the types as double values.
+        (WebCore::HTMLInputElement::rangeUnderflow): Supports the types.
+        (WebCore::HTMLInputElement::rangeOverflow): Supports the types.
+        (WebCore::HTMLInputElement::minimum): Supports the types.
+        (WebCore::HTMLInputElement::maximum): Supports the types.
 
-        Added an app-specific quirk to revert the behavior of <link> elements
-        to the way it was before r30673, namely that if the rel attribute
-        is not "stylesheet" but the type attribute contains "text/css", the
-        link behaves as a stylesheet link.
+2010-02-02  Fumitoshi Ukai  <ukai@chromium.org>
 
-        * WebCore.base.exp: Exported setTreatsAnyTextCSSLinkAsStylesheet().
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::process): Check
-            Settings::treatsAnyTextCSSLinkAsStylesheet() and if true, allow a
-            style sheet link if the type contains "text/css".
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-            Initialize m_treatsAnyTextCSSLinkAsStylesheet.
-        (WebCore::Settings::setTreatsAnyTextCSSLinkAsStylesheet): Added.
-        * page/Settings.h:
-        (WebCore::Settings::treatsAnyTextCSSLinkAsStylesheet): Added.
-
-2009-06-30  Adrien Nader  <camaradetux@gmail.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Xan Lopez.
+        WebSocket set pending activity to avoid unexpected GC.
+        https://bugs.webkit.org/show_bug.cgi?id=34014
 
-        Fix typo in GNUMakefile.am: it reads WebCOre instead of WebCore.
+        Test: websocket/tests/websocket-pending-activity.html
 
-        * GNUmakefile.am:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect): set pending activity until it receives didClose. 
+        (WebCore::WebSocket::contextDestroyed): check socket is already closed.
+        (WebCore::WebSocket::stop): close the connection and unset pending activity when it stops.
+        (WebCore::WebSocket::didClose): unset pending activity.
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData): protect this while it processes received data.
 
-2009-06-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-02-02  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Reviewed by Xan Lopez.
+        No review, rolling out r54261.
+        http://trac.webkit.org/changeset/54261
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        [Gtk] Turn on ENABLE_DATAGRID so we can run the layout tests.
+        Causes crashes on release builds
 
         * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Removed.
+        * platform/gtk/GOwnPtrGtk.h: Removed.
 
-2009-06-30  Raju Kunnath  <raju.kunnath@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=26752>
-
-        [Qt] Windows release build issue with Qt4.5 due to -GL flag on msvc2005 and msvc2008. 
-
-        * WebCore.pro: Removed -GL compiler option for win32-msvc2005|win32-msvc2008.
-
-2009-06-30  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Initialize member variables in the right order. Fixes compiler
-        warning.
-
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::BMPImageReader):
-
-2009-06-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26831
-        Fix compiler warning in WorkerLoaderProxy.h
-
-        Forward declaration of a class within a class is not allowed,
-        since the compiler can't know if the declaration is legal at that
-        point. This gives the following compiler warning:
-
-        ../../WebCore/workers/WorkerLoaderProxy.h:40: warning: declaration
-        "class WebCore::ScriptExecutionContext::Task" does not declare
-        anything
-
-        Include the full ScriptExecutionHeader header instead.
-
-        * workers/WorkerLoaderProxy.h:
-
-2009-06-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Remove unused function.
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-
-2009-06-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Change RenderLayer::updateLayerPositions() to use a bitmask instead of two
-        boolean arguments. FullUpdate is unused at present, but will be used soon.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-
-2009-06-29  Nate Chapin  <japhet@chromium.org>
+2010-02-02  David Levin  <levin@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        No review, rolling out r54245.
+        http://trac.webkit.org/changeset/54245
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-        Fix one more bad merge in V8Proxy.
+        This patch seems to have broken thousands of chromium tests on
+        Windows (and since it was for chromium, I'm rolling it out).
 
-        https://bugs.webkit.org/show_bug.cgi?id=26819
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException): setDOMExceptionHelper() instead of convertToV8Object().
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Mark Rowe.
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
 
-        Remove more unused scons support.
+        * WebCore.vcproj/QTMovieWin.rc:
 
-        * SConstruct: Removed.
+2010-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        No review, rolling out r54257.
+        http://trac.webkit.org/changeset/54257
+        https://bugs.webkit.org/show_bug.cgi?id=34491
 
-        Reviewed by Dave Hyatt.
+        [Chromium] broke thousands of Win tests and a few of Linux tests.
 
-        Fix some incorrect create functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
 
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::create):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::create):
+2010-02-02  Philippe Normand  <pnormand@igalia.com>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Dave Hyatt.
+        [Gtk] libsoup critical warning in media player http cookies injection code
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        Remove initialize method from DataGridDataSource and add
-        DOMDataGridDataSource.
+        Fixed the critical warning and refactored the
+        User-Agent/Referer/cookies injection code, in that order. Previous
+        order (cookies first) was wrong because if cookies injection could
+        not be done neither the User-Agent not Referer were injected. Also
+        started a non-JSC-specific, gtk-specific GOwnPtr module.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDataGridDataSource.cpp:
-        * bindings/js/JSDataGridDataSource.h:
-        * bindings/js/JSHTMLDataGridElementCustom.cpp:
-        (WebCore::JSHTMLDataGridElement::setDataSource):
-        * html/DOMDataGridDataSource.cpp: Added.
-        (WebCore::DOMDataGridDataSource::DOMDataGridDataSource):
-        (WebCore::DOMDataGridDataSource::~DOMDataGridDataSource):
-        * html/DOMDataGridDataSource.h: Added.
-        (WebCore::DOMDataGridDataSource::create):
-        (WebCore::DOMDataGridDataSource::isDOMDataGridDataSource):
-        (WebCore::asDOMDataGridDataSource):
-        * html/DataGridDataSource.h:
-        (WebCore::DataGridDataSource::isDOMDataGridDataSource):
-        (WebCore::DataGridDataSource::isJSDataGridDataSource):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::dataSource):
-        * html/HTMLDataGridElement.h:
-
-2009-06-29  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a couple of bad merge items from my previous V8Proxy patch.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26813
-
-        * bindings/v8/V8Collection.h:
-        (WebCore::nodeCollectionNamedPropertyGetter):  Fix a bad function name that slipped through.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException):  Fix a bad merge that caused a couple of lines of extraneous, breaking code to get in.
-
-2009-06-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26706
-
-        Fixed crash due to dereference of m_toStyle
-
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
-
-2009-06-29  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7014813> Ask media engine if a movie is streamed or downloaded.
-
-        * WebCore.base.exp: 
-            Export _wkQTMovieGetType
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
-            Move to keep with other non-callback functions.
-        (WebCore::MediaPlayer::movieLoadType):
-            New, returns the movie type.
-        * platform/graphics/MediaPlayer.h:
-            Declare MovieLoadType enum and movieLoadType method.
-
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::movieLoadType):
-            Default implementation of movieLoadType
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-            Don't base m_isStreaming on protocol, there are other types of streaming movies.
-        (WebCore::MediaPlayerPrivate::maxTimeBuffered):
-            Don't assume all streams are unbuffered.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Update m_isStreaming once we have metadata.
-        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
-            Tracks that are disabled to begin with shouldn't be included in m_enabledTrackCount.
-        (WebCore::MediaPlayerPrivate::movieLoadType):
-            New, return movie type.
-
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-            Add wkQTMovieGetType.
-
-2009-06-29  Alice Liu  <alice.liu@apple.com>
-
-        Fixed <rdar://problem/6930280> Reproducible crash at USA Today photo gallery
-
-        Reviewed by Anders Carlsson.
-
-        No test added because the crash requires a flash plugin
-
-        * plugins/win/PluginMessageThrottlerWin.cpp:
-        Rely on the hWnd of the plugin to tell us whether the PluginView has 
-        been deleted during execution of its wndProc.
-        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
-
-2009-06-29  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26811
-         [Chromium] Remove a flag and functions used to enable workers in runtime.
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        * bindings/v8/WorkerContextExecutionProxy.h:
-
-2009-06-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        <rdar://problem/6976712> Text antialiasing problems when rendering into compositing layers.
-        
-        Improve the appearance of text in compositing layers by making use of
-        CA's layer geometry flipping, rather that doing it ourselves with a flip
-        transform. This allows CG to use font autohinting in the layer text.
-
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setGeometryOrientation):
-        (WebCore::GraphicsLayer::geometryOrientation):
-        New methods to set whether this layer uses flipped geometry.
-        
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setGeometryOrientation):
-        (WebCore::GraphicsLayerCA::geometryOrientation):
-        Subclass in order to call into CA
-        
-        (WebCore::GraphicsLayerCA::setContentsLayer):
-        Now that CA is doing the geometry flipping, we no longer need to flip the content
-        layers for image and video manually
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        Turn on flipping on the root layer.
-
-2009-06-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26246
-
-        Implement most WML specific <select> element features.
-        Add 'iname' / 'ivalue' support and support variable references.
-
-        Add two tests covering most select/variable related functionality.
-        Needs more tests when adding full 'iname' / 'ivalue' support (used in conjuction with onpick).
-
-        Tests: http/tests/wml/post-data-to-server.html
-               wml/select-element-variables.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::optionCount): Refactored from HTMLSelectElement::length() for use within HTML & WML.
-        * dom/SelectElement.h:
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::length): Use new SelectElement::optionCount() function. (no functional changes for HTML).
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): Activated commented code taking care of WMLSelectElement initialization.
-        * wml/WMLSelectElement.cpp: Add a bunch of new code handling WML specific feature processing.
-        (WebCore::WMLSelectElement::title):
-        (WebCore::WMLSelectElement::formControlName):
-        (WebCore::WMLSelectElement::defaultEventHandler):
-        (WebCore::WMLSelectElement::selectInitialOptions):
-        (WebCore::WMLSelectElement::calculateDefaultOptionIndices):
-        (WebCore::WMLSelectElement::selectDefaultOptions):
-        (WebCore::WMLSelectElement::initializeVariables):
-        (WebCore::WMLSelectElement::updateVariables):
-        (WebCore::WMLSelectElement::parseIndexValueString):
-        (WebCore::WMLSelectElement::valueStringToOptionIndices):
-        (WebCore::WMLSelectElement::optionIndicesToValueString):
-        (WebCore::WMLSelectElement::optionIndicesToString):
-        (WebCore::WMLSelectElement::name):
-        (WebCore::WMLSelectElement::value):
-        (WebCore::WMLSelectElement::iname):
-        (WebCore::WMLSelectElement::ivalue):
-        * wml/WMLSelectElement.h:
-
-2009-06-29  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Put <datagrid> behind an ifdef.
-
-        * Configurations/FeatureDefines.xcconfig:
-        * bindings/js/JSDataGridColumnListCustom.cpp:
-        * bindings/js/JSDataGridDataSource.cpp:
-        * bindings/js/JSDataGridDataSource.h:
-        * bindings/js/JSHTMLDataGridElementCustom.cpp:
-        * html/DataGridColumn.cpp:
-        * html/DataGridColumn.h:
-        * html/DataGridColumn.idl:
-        * html/DataGridColumnList.cpp:
-        * html/DataGridColumnList.h:
-        * html/DataGridColumnList.idl:
-        * html/DataGridDataSource.h:
-        * html/HTMLDataGridCellElement.cpp:
-        * html/HTMLDataGridCellElement.h:
-        * html/HTMLDataGridCellElement.idl:
-        * html/HTMLDataGridColElement.cpp:
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-        * html/HTMLTagNames.in:
-        * page/DOMWindow.idl:
-        * rendering/RenderDataGrid.cpp:
-        * rendering/RenderDataGrid.h:
-
-2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Ariya Hidayat and Adam Roben.
-
-        Fix compilation with MINGW. Ported MSVC inline assembly to
-        GNU inline assembly. Also fixed casting errors where gcc
-        refused to cast a pointer-to-function to a pointer-to-object,
-        without an intermediate cast to a non-pointer type.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-        (WebCore::hook):
-        (WebCore::setUpOffscreenPaintingHooks):
-
-2009-06-26  John Sullivan  <sullivan@apple.com>
-
-        Added Speech submenu to context menu on Mac when there's a non-editable selection
-        (it was already present when there's an editable selection). 
-        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
-
-        Reviewed by Tim Hatcher.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyContextMenuClient::isSpeaking):
-        implemented this new virtual function to return false
-        
-        * page/ContextMenuClient.h:
-        declared this new pure virtual function
-        
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::populate):
-        insert Speech item (after a separator) on Mac when there's selected non-editable text
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
-
-2009-06-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
-          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
-          in MobileMe iDisk Web App
-
-        Test: added a case to fast/dom/Element/scrollWidth.html
-
-        Ensure that scroll{Width, Height} is greater or equal to
-        client{Width, Height}.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrollWidth):
-        (WebCore::RenderBox::scrollHeight):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        Do not make compositing layers for non-self-painting RenderLayers,
-        since these exist only to push a clip onto the clipping stack. If such
-        a layer gets compositied for some other reason, it should not paint.
-        
-        Also ensure that we update composited layer positions correctly
-        inside overflow:scroll layers. We can't assume that the contents
-        are child layers, so we have to go up to the compositing ancestor,
-        and tell it to update all its child layer positions as we do 
-        after layout.
-
-        Tests: compositing/layers-inside-overflow-scroll.html
-               compositing/self-painting-layers.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-
-2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by Eric Seidel.
-
-        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
-        https://bugs.webkit.org/show_bug.cgi?id=23057
-
-        Define these functions for Gtk as well.
-
-        * platform/PurgeableBuffer.h:
-
-2009-06-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26765
-
-        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Added.
+        (WTF::SoupURI):
+        (WTF::GstElement):
+        * platform/gtk/GOwnPtrGtk.h: Added.
 
-2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+2010-02-02  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        If loading a font fails because of the sandbox, we ask the browser process to 
-        try to load it by calling ensureFontLoaded. If it still fails after 
-        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
-
-        This case happens once in a while during browser shutdown. The browser will 
-        queue a message to the renderer to shutdown, and will then stop answering sync 
-        messages from the renderer. If the renderer is still loading a page during this 
-        time, it might try to call the browser process to ask to load a font. The 
-        browser process will ignore the request, and the font will fail to load, even 
-        after the second try. 
-
-        This is unfortunate, but there is no real risk here, since the renderer will be 
-        going away as soon as it processes another message. 
-
-        This can't be layout tested as it depends on the sandbox. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=26743 
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
-        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
-        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
-
-2009-06-28  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=15457
-
-        Test: plugins/netscape-plugin-map-data-to-src.html
-
-        Fix problems with Real or WMP plugins not displaying because "data" was set
-        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
-        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::mapDataParamToSrc):
-        (WebCore::RenderPartObject::updateWidget):
-
-2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Qt] Build fix after r45290
-        https://bugs.webkit.org/show_bug.cgi?id=26769
-
-        * WebCore.pro:
-
-2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [GTK] Don't use deprecated GTKsymbols.
-        https://bugs.webkit.org/show_bug.cgi?id=26583
-
-        * plugins/gtk/gtk2xtbin.c:
-        (gtk_xtbin_class_init):
-        (gtk_xtbin_new):
-        (gtk_xtbin_destroy):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        Fix up previous change. When computeCompositingRequirements() determines
-        that the current layer is composited, it needs to inform its parent
-        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
-        always happen after the previous patch. Clarified the logic here.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
+        [V8] Use toV8() to wrap in the custom bindings, and remove
+        the old wrapping code from V8DOMWrapper.
         
-        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
-        correctly.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
-        that can clobber the value from an earlier sibling. Add some more comments.
-        
-        Remove a final use of Vector iterators.
-        
-        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
-        Move the normalFlowList() processing outside the test for isStackingContext().
-
-2009-06-27  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser and Antti Koivisto.
-
-        - make paintFillLayerExtended() non-virtual and remove its clipY and
-          clipH parameters
-
-        These parameters were computed and passed along to
-        paintFillLayerExtended in order to vertically constrain the rect fill to
-        the damage rect, because Qt cannot paint tall rectangles (see
-        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
-        is passed along in the PaintInfo, the extra parameters are redundant,
-        and the intersection can just take place in paintFillLayerExtended().
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintFillLayers):
-        (WebCore::InlineFlowBox::paintFillLayer):
-        (WebCore::InlineFlowBox::paintBoxDecorations):
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/InlineFlowBox.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintRootBoxDecorations):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::paintMask):
-        (WebCore::RenderBox::paintMaskImages):
-        (WebCore::RenderBox::paintFillLayers):
-        (WebCore::RenderBox::paintFillLayer):
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations):
-        (WebCore::RenderFieldset::paintMask):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations):
-        (WebCore::RenderTable::paintMask):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
-        (WebCore::RenderTableCell::paintMask):
-
-2009-06-27  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26762
-
-        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
-        https://bugs.webkit.org/show_bug.cgi?id=21712
-
-        Added few utility functions to htmlediting.h/cpp
-
-        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
-        i.e. there is no visible node between the first and second positions
-
-        canMergeLists checks whether two lists can be merged.
-        It checks the type of list, the editing boundary, and adjacency of the lists.
-
-        Tests: editing/execCommand/indent-nested-lists-1.html
-               editing/execCommand/indent-nested-lists-2.html
-               editing/execCommand/indent-nested-lists-3.html
-               editing/execCommand/indent-nested-lists-4.html
-               editing/execCommand/indent-nested-lists-5.html
-               editing/execCommand/indent-nested-lists-6.html
-               editing/execCommand/indent-nested-lists-7.html
-               editing/execCommand/outdent-nested-lists-1.html
-               editing/execCommand/outdent-nested-lists-2.html
-               editing/execCommand/outdent-nested-lists-3.html
-               editing/execCommand/outdent-nested-lists-4.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
-        (WebCore::IndentOutdentCommand::indentRegion):
-        * editing/IndentOutdentCommand.h:
-        * editing/htmlediting.cpp:
-        (WebCore::enclosingListChild):
-        (WebCore::canMergeLists):
-        (WebCore::isVisibilyAdjacent):
-        * editing/htmlediting.h:
-
-2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix completion when iterating options using Tab.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26722
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype._completionsReady):
-
-2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25889
-        [GTK] scrollbar policy for main frame is not implementable
-
-        Override visibleContentRect to handle GTK+'s case, in which
-        scrollbars or equivalent decoration are painted by the parent
-        widget.
-
-        * platform/ScrollView.cpp:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::visibleContentRect):
-
-2009-06-27  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26708
-        
-        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
-        and UTF-7 encoded payloads.   
-
-        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
-               http/tests/security/xssAuditor/iframe-javascript-url.html
-               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
-               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
-
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
-        (WebCore::HTMLTokenizer::parseTag):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
-        as to compare against iFrame javascript URL.
-        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
-        isControlCharacter in ResourceResponseBase.cpp.
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
-        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
-        of iFrame javascript URL.
-        * page/XSSAuditor.h: Added field m_parentFrame.
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::isControlCharacter):
-        * platform/network/ResourceResponseBase.h:
-
-2009-06-27  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
-
-        The drawImage(<video>) logic naively assumes that it just needs
-        to check the src attribute of the video element when in fact it
-        needs to look at the url that is being played instead.  Failure
-        to do this means that video provided through source elements 
-        taints the canvas.
-
-        Test: media/video-canvas-source.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::checkOrigin):
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        * html/CanvasRenderingContext2D.h:
-
-2009-06-26  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26695
-        
-        Added the ability to do scrollbar hit testing in EventHandler, changed the
-        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
-        to scrollbarUnderPoint, and updated all calls to that function.        
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h:
-        (WebCore::):
-        * platform/PlatformWheelEvent.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarUnderPoint):
-        * platform/ScrollView.h:
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleMouseDownEvent):
-        (WebCore::PopupListBox::handleMouseMoveEvent):
-        * platform/win/WheelEventWin.cpp:
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
-        
-        Don't go into compositing mode just for opacity transitions, but they will be
-        hardware acclerated if we're already compositing.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
-        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
-        * rendering/RenderLayerCompositor.h:
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Rubber-stamped by Dave Levin
-
-        Rename ioCompState to compositingState to better match WebCore coding style.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-
-2009-06-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - revert unintentional project changes from r45277
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-06-26  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Windows build.
-
-        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
-        the file was deleted from SVN.
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26766
-
-        Change to use array indexing rather than Vector enumerators; the former
-        are preferred style.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::hasNonCompositingContent):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
-        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
-        (WebCore::RenderLayerCompositor::layerHas3DContent):
-
-2009-06-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
-          as 1 px
-
-        Test: fast/dom/Element/scrollWidth.html
-
-        Changed scrollWidth and scrollHeight to use the same logic for
-        visible overflow boxes that is used for clipped overflow boxes. In
-        particular, borders are not included and
-        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrollWidth):
-        (WebCore::RenderBox::scrollHeight):
-
-2009-06-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=26725
-
-        Tests: accessibility/aria-disabled.html
-               accessibility/aria-hidden.html
-               accessibility/aria-readonly.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaIsHidden):
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::AccessibilityRenderObject::isEnabled):
-        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
-        * accessibility/AccessibilityRenderObject.h:
-        * html/HTMLAttributeNames.in:
-
-2009-06-26  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26759
-
-        GIFImageDecoder is broken.
-
-        Make the GIFImageDecoder.repetitionCount function const to match the
-        base class. The mismatched definitions were causing the function to not
-        get called.
-
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::repetitionCount):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-
-2009-06-26  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
-
-        The flag should always default to true to avoid it getting set
-        to false in a build with accelerated compositing turned off
-        and then disabling accelerated compositing when subsequently
-        running a build with it turned on.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-
-2009-06-26  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
-
-        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreURLResponse.h:
-
-2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26732
-
-        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
-        combine LocalStorage and SessionStorage into StorageNamespace. The
-        synching code (for LocalStorage) has already been removed, so these
-        classes are now very similar.  All they do is essentially contain a
-        logical grouping of origins that are attached to specific contexts
-        (be it PageGroups for LocalStorage and Page for SessionStorage).
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::createWindow):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::localStorage):
-        * page/DOMWindow.h:
-        * page/Page.cpp:
-        (WebCore::Page::sessionStorage):
-        (WebCore::Page::setSessionStorage):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::localStorage):
-        * page/PageGroup.h:
-        * storage/LocalStorage.cpp: Removed.
-        * storage/LocalStorage.h: Removed.
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageThread.cpp:
-        * storage/SessionStorage.cpp: Removed.
-        * storage/SessionStorage.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::create):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::length):
-        (WebCore::StorageArea::key):
-        (WebCore::StorageArea::getItem):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::contains):
-        (WebCore::StorageArea::importItem):
-        (WebCore::StorageArea::close):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        (WebCore::):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
-        (WebCore::localStorageNamespaceMap):
-        (WebCore::StorageNamespace::localStorageNamespace):
-        (WebCore::StorageNamespace::sessionStorageNamespace):
-        (WebCore::StorageNamespace::StorageNamespace):
-        (WebCore::StorageNamespace::~StorageNamespace):
-        (WebCore::StorageNamespace::copy):
-        (WebCore::StorageNamespace::storageArea):
-        (WebCore::StorageNamespace::close):
-        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
-
-2009-06-26  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26623
-
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::~ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::isSafeScript):
-        (WebCore::ScriptController::gcProtectJSWrapper):
-        (WebCore::ScriptController::gcUnprotectJSWrapper):
-        (WebCore::ScriptController::processingUserGesture):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::setEventHandlerLineNumber):
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::collectGarbage):
-        (WebCore::ScriptController::haveInterpreter):
-        (WebCore::createScriptObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/v8/ScriptInstance.cpp:
-        (WebCore::V8ScriptInstance::clear):
-        (WebCore::V8ScriptInstance::set):
         * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptScope.cpp:
-        (WebCore::ScriptScope::ScriptScope):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::operator=):
-        (WebCore::ScriptValue::clear):
         * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8Collection.cpp:
-        (WebCore::toOptionsCollectionSetter):
         * bindings/v8/V8Collection.h:
-        (WebCore::getV8Object):
-        (WebCore::getNamedPropertyOfCollection):
-        (WebCore::nodeCollectionNamedPropertyGetter):
-        (WebCore::getIndexedPropertyOfCollection):
-        (WebCore::nodeCollectionIndexedPropertyGetter):
-        (WebCore::nodeCollectionIndexedPropertyEnumerator):
-        (WebCore::collectionIndexedPropertyEnumerator):
-        (WebCore::collectionStringOrNullIndexedPropertyGetter):
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::weakDOMObjectCallback):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::wrapNPObject):
-        (WebCore::toV8Context):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::~V8LazyEventListener):
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
         * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::acceptNode):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
-        * bindings/v8/V8Proxy.cpp: Added.
-        * bindings/v8/V8Proxy.h:
-        (WebCore::):
-        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
-        (WebCore::V8Proxy::):
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::frame):
-        (WebCore::V8Proxy::inlineCode):
-        (WebCore::V8Proxy::setInlineCode):
-        (WebCore::V8Proxy::timerCallback):
-        (WebCore::V8Proxy::setTimerCallback):
-        (WebCore::V8Proxy::setEventHandlerLineNumber):
-        (WebCore::V8Proxy::finishedWithEvent):
-        (WebCore::V8Proxy::wrapCPointer):
-        (WebCore::V8Proxy::extractCPointer):
-        (WebCore::V8Proxy::convertDOMWrapperToNative):
-        (WebCore::V8Proxy::convertDOMWrapperToNode):
-        (WebCore::V8Proxy::convertToV8Object):
-        (WebCore::V8Proxy::convertToNativeObject):
-        (WebCore::V8Proxy::convertToNativeEvent):
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::extractCPointerImpl):
-        (WebCore::V8Proxy::utilityContext):
-        (WebCore::V8Proxy::constructDOMObject):
-        (WebCore::throwError):
-        (WebCore::toV8):
-        * bindings/v8/V8Utilities.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::GetConstructor):
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
-        (WebCore::WorkerContextExecutionProxy::evaluate):
-        (WebCore::WorkerContextExecutionProxy::runScript):
-        * bindings/v8/custom/V8AttrCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/V8Proxy.cpp:
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::toCanvasStyle):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::allowSettingFrameSrcToJavascriptUrl):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::V8Custom::GetTargetFrame):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        (WebCore::V8EventListener::~V8EventListener):
-        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
         * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
-        (WebCore::V8CustomSQLStatementCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
-        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
-        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
-        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::V8CustomVoidCallback::handleEvent):
-        (WebCore::invokeCallback):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMParserConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::convertBase64):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::createWindow):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DocumentLocationCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
         * bindings/v8/custom/V8EventCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
         * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
         * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
         * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
         * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
         * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NavigatorCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeIteratorCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGLengthCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
         * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8StyleSheetListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
         * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::SetTimeoutOrInterval):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
         * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
 
-2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+2010-02-02  Garret Kelly  <gdk@chromium.org>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by David Levin.
 
-        <rdar://problem/7011047> Profiler shows the record button 'on' even
-        though it's finished
+        When using the Skia graphics context, the beginTransparencyLayer call
+        currently creates a new layer, but does not keep the current
+        compositing mode for use when merging the created layer back onto the
+        rest of the context. This patch fixes that.
+        https://bugs.webkit.org/show_bug.cgi?id=34491
 
-        I consolidated the creation of the user initiated profile name into
-        its own function and then called it from console::profile instead of
-        calling startUserInitiatedProfiling().  This way we don't call
-        toggleRecordButton() which turns on the record button.
+        fast/backgrounds/svg-as-mask.html is affected by this change in Chromium,
+        but not fixed. This is the first of a series of patches to fix it.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/InspectorController.h:
-        * page/Console.cpp:
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.h:
 
-2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26691
-
-        Cleanup: Move focusRingColor to RenderTheme.
-
-        Most of this CL involves deleting files and removing dead code.
+        Use WTF::getLocalTime instead of localtime_r in FTPDirectoryDocument
+        https://bugs.webkit.org/show_bug.cgi?id=34409
 
-        focusRingColor() is now defined in RenderTheme rather than in
-        misc. places on each port.  The default color is specified as
-        black in renderTheme and ports can override it in their own
-        custom renderThemes.
+        Platform guards for localtime_r are not needed because we already have
+        WTF::getLocalTime which does the same thing.
 
-        Behavior should be identical except for the following cases,
-        this lists platform and what the focus ring color used to be
-        before this cl and the file where it used to be defined:
-
-        Android - red
-        WebCore/platform/android/TemporaryLinkStubs.cpp
-
-        Cairo - aqua focus ring color - 0xFF7DADD9
-        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
-
-        wx - red
-        WebCore/platform/wx/TemporaryLinkStubs.cpp
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::gmtimeQt):
 
-        QT - black
-        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+        Copy WebCore's bindings generation scripts to the PrivateHeaders
+        directory on Mac
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
-        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
-        * platform/android/TemporaryLinkStubs.cpp:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        * platform/graphics/chromium/ColorChromium.cpp: Removed.
-        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
-        * platform/graphics/mac/ColorMac.h:
-        * platform/graphics/mac/ColorMac.mm:
-        (WebCore::oldAquaFocusRingColor):
-        (WebCore::setUsesTestModeFocusRingColor):
-        (WebCore::usesTestModeFocusRingColor):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/win/ColorSafari.cpp: Removed.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::focusRingColor):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::focusRingColor):
-        (WebCore::RenderThemeChromiumMac::systemColor):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::focusRingColor):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::focusRingColor):
-        (WebCore::RenderThemeMac::systemColor):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::makeRGBAFromCGColor):
-        (WebCore::RenderThemeSafari::focusRingColor):
-        * rendering/RenderThemeSafari.h:
+        This will allow other projects to use these scripts.
 
-2009-06-26  Dmitry Titov  <dimich@chromium.org>
+        Fixes <http://webkit.org/b/34498>.
 
-        Reviewed by David Levin.
+        Reviewed by Mark Rowe.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26761
-        [Chromium] Enable Dedicated Workers in Chromium.
+        * WebCore.xcodeproj/project.pbxproj: Added the bindings generation
+        scripst to the Copy Headers phase, and marked them as Private.
 
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Remove the check that prevented workers from being created w/o a command-line switch.
-        The flag itself and methods will be removed in a subsequent patch, after
-        corresponding change in Chromium.
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-2009-06-26  Jessie Berlin  <jberlin@apple.com>
+        Copy WebCore's bindings generation scripts to a more sensible location
 
-        Reviewed by Mark Rowe.
-        
-        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
-        Where the m_mouseDown event was never being set on windows, so the
-        client X and Y coordinates were always being reported as zero in a
-        dragstart handler.
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-        Test: editing/selection/drag-start-event-client-x-y.html
+        Reviewed by Steve Falkenburg.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        Set the m_mouseDown event when the mouse press is handled.
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::mouseDown):
-        Removed now redundant setting of m_mouseDown.
+        * WebCore.vcproj/WebCore.make:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        Instead of copying to obj/WebKit/DOMInterfaces, copy to obj/WebCore/scripts.
 
-2009-06-26  Brady Eidson  <beidson@apple.com>
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        Tiger build fix
+        Rename the scripts used to copy WebCore's bindings generation scripts
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (swizzleMIMETypeMethodIfNecessary):
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Steve Falkenburg.
 
-        Reviewed by Sam Weinig.
+        * WebCore.vcproj/MigrateScripts: Renamed from WebCore/WebCore.vcproj/MigrateIDLAndScripts.
+        * WebCore.vcproj/migrate-scripts.sh: Renamed from WebCore/WebCore.vcproj/migrate-idls.sh.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26681
-        Problem updating applicationCache when server returns 304
-        
-        Improve the fix, make the test pass on Tiger.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Updated for renames.
 
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
-        current item from list.
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
-        conditional requests that cannot be cached by network layer cause errors with default cache
-        policy.
+        Stop copying IDL files into $(WebKitOutputDir)
 
-2009-06-26  Brady Eidson  <beidson@apple.com>
+        No one uses these anymore (as of r52921).
 
-        Reviewed by Sam Weinig
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+        Reviewed by Steve Falkenburg.
 
-        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
-        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
-        knew about.
+        * WebCore.vcproj/MigrateIDLAndScripts: Don't copy the IDL files
+        anymore. Keep copying the scripts, though, since other projects
+        (outside of the WebKit repository) do use those.
 
-        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
-        type mappings that are missing in CoreType's database.
+2010-02-02  Bryan Yeung  <bryeung@google.com>
 
-        Test: platform/mac/fast/loader/file-url-mimetypes.html
+        Reviewed by Darin Adler.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
-          WebCoreURLResponse.
-
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
-          where we do all MIMEType correction.
-
-        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
-          implementation of MIMEType.
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (createBinaryExtensionsSet):
-        (createExtensionToMIMETypeMap):
-        (swizzleMIMETypeMethodIfNecessary):
-        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
-          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
-          implemented in _webcore_MIMEType.
+        Avoid using an invalidated KURL object in baseURI.
 
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        This change fixes baseURI for Chromium (where the KURL implementation
+        does not allow invalid KURLs to carry relative paths).  This is
+        regression tested by
+        LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
 
-        Reviewed by Simon Fraser.
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        Show the fullscreen button only if the backend has support for it.
+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26661
+        Reviewed by Darin Adler.
 
-        No test since this is not reachable via the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
 
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::supportsFullscreen): new
-        * html/HTMLVideoElement.h:
-        (WebCore::HTMLVideoElement::supportsFullscreen): new
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
-        (WebCore::MediaPlayer::supportsFullscreen): new
-        * platform/graphics/MediaPlayer.h: new
-        * platform/graphics/MediaPlayerPrivate.h: new
-        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
-        * rendering/MediaControlElements.h:
+        Test: fast/forms/misplaced-img-form-registration.html
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
+        to vector again.
+        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
+        that's actually registered.
 
-        Reviewed by Simon Fraser.
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
+        to insert the image element, then there will be no removed from tree notification either,
+        need to unregister right away.
 
-        <rdar://problem/7007776> Controller doesn't automatically update counters when file
-        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+2010-02-02  Alexander Pavlov  <apavlov@chromium.org>
 
-        Update the time display when the movie time changes.
+        Reviewed by Pavel Feldman.
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
+        Web Inspector: Eliminate some of the platform flavor-specific stylesheet selectors
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        Extract OS version into WebInspector.platformFlavor
+        https://bugs.webkit.org/show_bug.cgi?id=34469
 
-        Reviewed by Simon Fraser.
+        * inspector/front-end/InspectorBackendStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.URLRegExp.i.get platform):
+        (WebInspector.get platformFlavor):
+        (WebInspector._detectPlatformFlavor):
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+        (WebInspector.isMac):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26659
+2010-02-02  Steve Block  <steveblock@google.com>
 
-        Support hidding a control bar element from the Media element controller.
+        Reviewed by Ariya Hidayat.
 
-        Update layout tests since the fullscreen button no longer has a renderer.
+        Adds utility functions for converting between JavaInstance and NPAPI types
+        https://bugs.webkit.org/show_bug.cgi?id=34468
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
-        is updated properly.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-        (WebCore::MediaControlInputElement::update): call updateStyle()
-        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
-        or not depending on what rendererIsNeeded() return.
-        * rendering/MediaControlElements.h:
+        This is required by Android for injecting objects into V8 JavaScript.
 
-2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+        No new tests, added utility functions only.
 
-        Reviewed by Oliver Hunt.
+        * Android.v8bindings.mk: Modified. Added JavaNPObjectV8.cpp
+        * bridge/jni/v8/JavaNPObjectV8.cpp: Added.
+        (JSC::Bindings::AllocJavaNPObject):
+        (JSC::Bindings::FreeJavaNPObject):
+        (JSC::Bindings::):
+        (JSC::Bindings::JavaInstanceToNPObject):
+        (JSC::Bindings::ExtractJavaInstance):
+        (JSC::Bindings::JavaNPObjectHasMethod):
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectHasProperty):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaNPObjectV8.h: Added.
 
-        <rdar://problem/6968137> Profiler title numbers increment even after a
-        reload.
+2010-02-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        - Now the numbers are reset when the profiles are.
+        Reviewed by Ariya Hidayat.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
+        [Qt] Symbian plugins include a wrong header file for QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34475
 
-2009-06-26  Adele Peterson  <adele@apple.com>
+        * plugins/symbian/PluginViewSymbian.cpp:
 
-        Reviewed by Darin Adler.
+2010-02-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix for <rdar://problem/7000796>
-        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+        Reviewed by Timothy Hatcher.
 
-        Test: editing/inserting/break-blockquote-after-delete.html
+        Web Inspector: URLs are not syntax-higlighted as links in source view.
 
-        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
-        typing command, keep that flag up to date.
+        This change enables linkifier in the NativeTextViewer. It adds
+        "linkify" and "a_node" parse states into the highlighter in order
+        to detect links and distinguish between resource and external ones.
+        Contains drive-by fix for the webkit-html-* styles and moves them to the
+        common location.
 
-        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
-        was following an open Delete command, which does preserve the typing style.  So we were applying the original
-        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+        https://bugs.webkit.org/show_bug.cgi?id=34364
 
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::TypingCommand):
-        (WebCore::TypingCommand::typingAddedToOpenCommand):
-        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
-        (WebCore::TypingCommand::insertLineBreak):
-        (WebCore::TypingCommand::insertParagraphSeparator):
-        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
-        (WebCore::TypingCommand::deleteKeyPressed):
-        (WebCore::TypingCommand::forwardDeleteKeyPressed):
-        (WebCore::TypingCommand::deleteSelection):
-        (WebCore::TypingCommand::updatePreservesTypingStyle):
-        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer):
+        (WebInspector.NativeTextViewer.prototype._createSpan):
+        (WebInspector.NativeTextViewer.prototype._createLink):
+        (WebInspector.NativeTextViewer.prototype._rewriteHref):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype._attrValueTokenType):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspectorSyntaxHighlight.css:
 
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2010-02-02  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Ariya Hidayat.
 
-        Add support for saving and loading of QWebHistory to and from a QByteArray.
+        [Qt] Install libraries and headers in package builds
+        https://bugs.webkit.org/show_bug.cgi?id=34325
 
-        This includes streaming operators for QWebHistory. for convenience.
+        Add the QtWebKit libraries to the installable items, except on
+        Symbian where the libraries are always linked in their final
+        destination.
 
-        New autotests that test QWebHistory and QWebHistoryItem serialization.
+        Also include the headers generated by syncqt in the installation.
 
         * WebCore.pro:
-        * history/HistoryItem.h:
-        (WebCore::HistoryItem::dailyVisitCounts):
-        (WebCore::HistoryItem::weeklyVisitCounts):
-        * history/qt/HistoryItemQt.cpp: Added.
-        (WebCore::HistoryItem::restoreState):
-        (WebCore::HistoryItem::saveState):
 
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2010-02-02  Kavita Kanetkar  <kkanetkar@chromium.org>
 
-        Reviewed by Simon Hausmann.
-
-        Add support for QDataStream operators to String and IntPoint.
-
-        * platform/graphics/IntPoint.h:
-        (WebCore::operator<<):
-        (WebCore::operator>>):
-        * platform/text/PlatformString.h:
-        * platform/text/qt/StringQt.cpp:
-        (WebCore::operator<<):
-        (WebCore::operator>>):
-
-2009-06-26  Ben Murdoch  <benm@google.com>
+        Reviewed by Dmitry Titov.
 
-        Reviewed by Darin Fisher.
+        [V8] Raising an exception while setting timeout/interval from a detached frame
+        https://bugs.webkit.org/show_bug.cgi?id=34453
+        This fixes the issue/failing test mentioned in Chromium bug:
+        http://code.google.com/p/chromium/issues/detail?id=32671
 
-        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
-        https://bugs.webkit.org/show_bug.cgi?id=26757
 
-        * bindings/v8/custom/V8StorageCustom.cpp
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
 
-2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Test: platform/qt/fast/events/event-sender-keydown-frame.html
-
-        Bug 20303: [Qt] Key events are not working in frames.
+        [BREWMP] Port Screen
+        https://bugs.webkit.org/show_bug.cgi?id=34299
 
-        Merge scrolling handling code in qt and win port, move it to
-        EventHandler.
+        Get the screen size and depth from the main display bitmap.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::scrollRecursively):
-        * page/EventHandler.h:
+        * platform/brew/ScreenBrew.cpp: Added.
+        (WebCore::getDisplayInfo):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
 
-2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26682
-        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
-
-        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
-
-        Test: svg/custom/createImageElement.svg
-
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::synchronizeProperty):
-
-2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
-        https://bugs.webkit.org/show_bug.cgi?id=26156
-
-        When in view-source mode, render the contents using HTMLViewSourceDocument
-        regardless it's applicable for any plugin or not.
-
-        Chromium tells WebCore to render the contents of specified URL when
-        view-source: prefix is added to the URL. But currently, DOMImplementation
-        ignores inViewSourceMode() when the MIME type is indicating that the contents
-        are neither texts nor HTML family documents.
-
-        For example, we can check the contents of asf file without launching media
-        player. Rendering contents for view-source:-specified input is not what user
-        expects.
+        [BREWMP] Port LocalizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=34257
 
-        http://code.google.com/p/chromium/issues/detail?id=10545
+        Port LocalizedStrings to BREWMP.
 
-        I want to fix this issue by this patch. IMHO, regardless of this Chromium
-        specific issue, I think we should force use of HTMLViewSourceDocument when
-        inViewSourceMode() is specified.
-
-        Test: fast/frames/viewsource-on-image-file.html
-
-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument):
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::createTokenizer):
-        * html/HTMLViewSourceDocument.h:
-
-2009-06-26  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25529
-        [Gtk] Expected states not exposed to assistive technologies
-
-        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+        * platform/brew/LocalizedStringsBrew.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXMenuListPopupActionVerb):
+        (WebCore::AXMenuListActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkStateSetFromCoreObject):
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Adler.
+        [BREWMP] Port systemBeep
+        https://bugs.webkit.org/show_bug.cgi?id=33601
 
-        "Pointer to incomplete class type is not allowed" error with RVCT
-        https://bugs.webkit.org/show_bug.cgi?id=26721
+        Implement systemBeep with IShell_Beep.
 
-        Based on Norbert Leser's work.
+        * platform/brew/SoundBrew.cpp: Added.
+        (WebCore::systemBeep):
 
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchMouseEvent):
-        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
-        to eliminate dependency on the Event class definition
+2010-02-02  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Maciej Stachowiak.
+        [Win] Utilize PrintContext to share the printing code with other ports
+        https://bugs.webkit.org/show_bug.cgi?id=34312
 
-        [Qt] Build fix after r45183
-        https://bugs.webkit.org/show_bug.cgi?id=26748
+        No new tests as this is just a small refactoring.
 
-        * WebCore.pro:
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Adler.
+        [BREWMP] Add conversions between IntPoint and AEEPoint
+        https://bugs.webkit.org/show_bug.cgi?id=34194
 
-        https://bugs.webkit.org/show_bug.cgi?id=26681
-        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+        Make it easy to convert between IntPoint and AEEPoint.
 
-        Test: http/tests/appcache/update-cache.html
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/brew/IntPointBrew.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator AEEPoint):
 
-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        We're already done with the resource, don't try to load it again.
+2010-02-02  Steve Block  <steveblock@google.com>
 
-2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Oliver Hunt.
-        
-        <rdar://problem/6990481>
-        
-        Handle perspective computation on non-layer objects.
+        Adds virtual destructors for AbstractWeakReferenceMap and AbstractWeakReferenceMap::Visitor
+        https://bugs.webkit.org/show_bug.cgi?id=34434
 
-        Test: transforms/3d/general/perspective-non-layer.html
+        No new tests, build fix only.
 
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::getTransformFromContainer):
+        * bindings/v8/V8DOMMap.h: Modified.
+        (WebCore::AbstractWeakReferenceMap::~AbstractWeakReferenceMap): Added.
+        (WebCore::AbstractWeakReferenceMap::Visitor::~Visitor): Added.
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+2010-02-02  Avi Drissman  <avi@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26653
-
-        Use flex box in the mediaControls.css style, to nicely scale if a button gets
-        dynamically added or removed.
-
-        Media tests results are affected by this changes.
+        Sync up Chromium Mac render theme to Mac render theme
+        https://bugs.webkit.org/show_bug.cgi?id=34340
 
-        * css/mediaControls.css:
-        * css/mediaControlsQT.css:
+        Covered by existing layout tests.
 
-2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+        * platform/chromium/ThemeChromiumMac.mm:
+        (WebCore::updateStates):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::listButtonSizes):
+        (WebCore::setupButtonCell):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::paint):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver initWithTheme:WebCore::]):
+        (WebCore::convertNSColorToColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchFieldSize):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::popupButton):
+        (WebCore::RenderThemeChromiumMac::sliderThumbHorizontal):
+        (WebCore::RenderThemeChromiumMac::sliderThumbVertical):
 
-        Reviewed by Darin Fisher.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26724
+        Reviewed by Eric Seidel.
 
-        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
-        up into RenderThemeChromiumSkia.
+        [BREWMP] Port Logging
+        https://bugs.webkit.org/show_bug.cgi?id=34300
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
-        * rendering/RenderThemeChromiumWin.h:
+        Log calls to notImplemented() by default.
 
-2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+        * platform/brew/LoggingBrew.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
 
-        Reviewed by Darin Fisher.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26733
+        Reviewed by Eric Seidel.
 
-        Add V8-only methods to FrameLoaderClient that V8 can use to send
-        out notifications when it creates/destroys a script context.
+        [BREWMP] Port FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=34261
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
-        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::didCreateScriptContext):
-        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+        Port FileChooser to BREWMP.
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/brew/FileChooserBrew.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
 
-        Reviewed by David Levin.
+2010-02-01  Zoltan Horvath  <zoltan@webkit.org>
 
-        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
-        to match WebKit style.
+        Reviewed by Darin Adler.
 
-        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+        Allow custom memory allocation control for IconDatabaseClient class
+        https://bugs.webkit.org/show_bug.cgi?id=33252
 
-2009-06-25  Adam Langley  <agl@google.com>
+        Inherits the following struct from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
 
-        TBRed: fix for Chromium tree.
+        class name               - instantiated at: WebCore/'location'
+        class IconDatabaseClient - loader/icon/IconDatabase.cpp:89
 
-        Add missing include for r45199.
+        * loader/icon/IconDatabaseClient.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=26736
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        r45199 added a reference to throwError without including V8Proxy.h
+        Reviewed by Eric Seidel.
 
-        * bindings/v8/WorkerScriptController.cpp:
+        [BREWMP] Port MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=34220
 
-2009-06-25  Adam Langley  <agl@google.com>
+        Port MIMETypeRegistry with an extension map as other ports do.
 
-        TBRed: fix for Chromium tree.
+        * platform/brew: Added.
+        * platform/brew/MIMETypeRegistryBrew.cpp: Added.
+        (WebCore::):
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26735
+2010-02-01  Dmitry Titov  <dimich@chromium.org>
 
-        Fix V8IsolatedWorld to point to the correct include file.
+        Not reviewed, revert r54194 that fails new test on Qt and Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        The deprecated v8_index.h was removed from the Chromium tree in r19291
-        and upstreamed into WebKit with r45193. However V8IsolatedWorld
-        slipped in between the cracks and broke the build.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument):
+        * html/HTMLFrameElementBase.h:
+        * page/Frame.cpp:
+        * page/Frame.h:
 
-        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+2010-02-01  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-25  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+        Provide a way to get page number with layoutTestController
+        https://bugs.webkit.org/show_bug.cgi?id=33840
 
-        https://bugs.webkit.org/show_bug.cgi?id=26651
-        
-        Preference is named "WebKitAcceleratedCompositingEnabled"
-        and is a boolean value. When false, prevents compositing layers from
-        being created, which prevents hardware animation from running.
-        Also forces video to do software rendering. Added a cache for
-        the flag in RenderLayerCompositing and made it all work
-        on-the-fly when the flag is changed while a page is loaded.
+        Test: printing/page-break-always.html
 
         * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateCompositingLayers):
-        * page/Settings.cpp:
-        (WebCore::setNeedsReapplyStylesInAllFrames):
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setAcceleratedCompositingEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::acceleratedCompositingEnabled):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasAcceleratedCompositing):
-        (WebCore::RenderLayer::updateTransform):
-        (WebCore::RenderLayer::currentTransform):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateLayerTransform):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::enableCompositingMode):
-        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
-        * rendering/RenderObject.h:
-        (WebCore::makeMatrixRenderable):
-
-2009-06-25  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26701: Implement the missing code for "FIXME: Need to return an
-        exception" in WorkerScriptController::evaluate for v8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=26701
-
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-
-2009-06-25  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8Index.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26495
-
-        * bindings/v8/V8Index.cpp: Added.
-        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
-        * bindings/v8/V8Index.h:
-        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
-
-2009-06-25  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26529
-
-        This is hopefully the last step before our renderers can run
-        cleanly in a chroot.
-
-        WebKit needs to be able to ask for the correct font to use in
-        the case that the current font doesn't include glyphs for
-        certain code points. Currently we make a fontconfig call in our
-        WebKit port to handle this.
-
-        This patch changes this so that the call is sent our via
-        ChromiumBridge.
-
-        http://codereview.chromium.org/132007
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageRect): Added a getter function.
+        (WebCore::PrintContext::computePageRects): Move its logic into computePageRectsWithPageSize.
+        (WebCore::PrintContext::computePageRectsWithPageSize): Factored out from computePageRects for pageNumberForElement.
+        (WebCore::enclosingBoxModelObject): Added for pageNumberForElement.
+        (WebCore::PrintContext::pageNumberForElement): Added for testing.
+        * page/PrintContext.h:
 
-        This should not affect any layout tests.
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/graphics/chromium/FontCacheLinux.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
+        Reviewed by Eric Seidel.
 
-2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+        [BREWMP] Add conversions between IntSize and AEESize
+        https://bugs.webkit.org/show_bug.cgi?id=34197
 
-        Reviewed by David Levin.
+        Make it easy to convert between IntSize and AEESize.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26566
-        Upstream these files from the chromium v8 code.  No tests were
-        affected because this is essentially a code move.
+        * platform/graphics/IntSize.h:
+        * platform/graphics/brew/IntSizeBrew.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator AEESize):
+
+2010-02-01  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for Pattern transformations in Chromium/Skia.  This required 
+        reworking Pattern a bit to be more like the Gradient implementation.
+        In particular, it now holds an m_pattern reference to the
+        platform-specific implementation, and passes along changes to the
+        m_patternSpaceTransformation, in the same way that Gradient does for
+        m_gradientSpaceTransformation.  This is necessary since Skia creates the
+        platform-specific pattern (SkShader) once, rather than recreating it
+        on each draw.
+        For platforms other than Skia, m_pattern is unused, they will
+        continue to use the static createPlatformPattern(), and the new
+        notification functions are stubbed out.  Other platforms can switch to
+        the new implementation if they so choose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24534 
+
+        Covered by svg/custom/pattern-y-offset.svg,
+        svg/custom/pattern-cycle-detection.svg, and many more.
+
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::Pattern):
+        Initializer for m_pattern.
+        (WebCore::Pattern::~Pattern):
+        call platformDestroy().
+        (WebCore::Pattern::setPatternSpaceTransform):
+        Pass along the transform via setPlatformPatternSpaceTransform().
+        (WebCore::Pattern::platformDestroy):
+        (WebCore::Pattern::setPlatformPatternSpaceTransform):
+        Stub implementations for non-skia platforms.
+        * platform/graphics/Pattern.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        Call platformPattern() instead of static version.
+        Since Pattern now owns its SkShader, no need to unref here.
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformDestroy):
+        Unref the SkShader on destroy.
+        (WebCore::Pattern::platformPattern):
+        Create the platform pattern (SkShader) once, and cache it.
+        (WebCore::Pattern::setPlatformPatternSpaceTransform):
+        Set the shader's local matrix from the m_patternSpaceTransformation.
+
+2010-02-01  Daniel Bates  <dbates@webkit.org>
 
-        * bindings/v8/NPV8Object.cpp: Added.
-        (allocV8NPObject):
-        (freeV8NPObject):
-        (listFromVariantArgs):
-        (npIdentifierToV8Identifier):
-        (npCreateV8ScriptObject):
-        (NPN_Invoke):
-        (NPN_InvokeDefault):
-        (NPN_Evaluate):
-        (NPN_EvaluateHelper):
-        (NPN_GetProperty):
-        (NPN_SetProperty):
-        (NPN_RemoveProperty):
-        (NPN_HasProperty):
-        (NPN_HasMethod):
-        (NPN_SetException):
-        (NPN_Enumerate):
-        (NPN_Construct):
-        * bindings/v8/NPV8Object.h: Added.
-        (PrivateIdentifier::):
-        * bindings/v8/V8NPUtils.cpp: Added.
-        (convertV8ObjectToNPVariant):
-        (convertNPVariantToV8Object):
-        (getStringIdentifier):
-        * bindings/v8/V8NPUtils.h: Added.
-
-2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+        Reviewed by Adam Barth.
 
-        Reviewed by Dimitri Glazkov.
+        https://bugs.webkit.org/show_bug.cgi?id=27312
 
-        https://bugs.webkit.org/show_bug.cgi?id=26436
+        Implements support for full page blocking via the X-XSS-Protection header.
 
-        Windows Chromium bug fix: save context of destination canvas in
-        TransparencyWin::compositeTextComposite() before the function
-        modifies the context.
+        Tests: http/tests/security/xssAuditor/full-block-base-href.html
+               http/tests/security/xssAuditor/full-block-get-from-iframe.html
+               http/tests/security/xssAuditor/full-block-iframe-javascript-url.html
+               http/tests/security/xssAuditor/full-block-iframe-no-inherit.php
+               http/tests/security/xssAuditor/full-block-javascript-link.html
+               http/tests/security/xssAuditor/full-block-link-onclick.html
+               http/tests/security/xssAuditor/full-block-object-tag.html
+               http/tests/security/xssAuditor/full-block-post-from-iframe.html
+               http/tests/security/xssAuditor/full-block-script-tag-with-source.html
+               http/tests/security/xssAuditor/full-block-script-tag.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header.html
 
-        Test: fast/canvas/translate-text.html
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::shouldFullPageBlockForXSSProtectionHeader): Added.
+        (WebCore::XSSAuditor::findInRequest): Modified to call method
+        XSSAuditor::shouldFullPageBlockForXSSProtectionHeader.
+        * page/XSSAuditor.h: Defined method shouldFullPageBlockForXSSProtectionHeader
+        and fixed misspelled words in large comment block.
 
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::compositeTextComposite):
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Timothy Hatcher.
+        [BREWMP] Port SharedTimer with IShell_SetTimerEx.
+        https://bugs.webkit.org/show_bug.cgi?id=33599
 
-        Show the filename and first line for "(program)" in the Profiler/Debugger
-        https://bugs.webkit.org/show_bug.cgi?id=25475
+        As fireTime passed in setSharedTimerFireTime is the absolute time,
+        we must calcalute the interval by subtracting currentTime() from
+        fireTime and pass the result to ISHELL_SetTimerEx.
 
-        Add support to associate a sourceURL with an eval()'d string
-        via a @sourceURL comment.  Currently the sourceURL is only available
-        in the script debugger, not in the console or profiler, but it's
-        most needed in the script debugger.
+        * platform/brew/SharedTimerBrew.cpp: Added.
+        (WebCore::invokeCallback):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
 
-        * English.lproj/localizedStrings.js: added new "(program): %s" string
-        * inspector/front-end/Script.js:
-        (WebInspector.Script): if no sourceURL is available for the Script,
-        search for a comment of the form //@ sourceURL=(url) to use
-        as the sourceURL instead.
-        * manual-tests/inspector/named-evals.html: Added.
+2010-02-01  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-25  John Gregg  <johnnyg@google.com>
+        [Chromium] Unreviewed attempt to fix the chromium build.
 
-        Reviewed by Sam Weinig.
+        Corresponding change: http://trac.webkit.org/changeset/54182
 
-        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
-        https://bugs.webkit.org/show_bug.cgi?id=23721
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/ScriptController.h:
 
-        onchange events fire when a SELECT element has
-        focus and the selectedIndex is updated by script in some way--either
-        during another onchange, onkeypress, onfocus, or timer--and then
-        focus is lost. 
+2010-02-01  Dmitry Titov  <dimich@chromium.org>
 
-        Fixed by making a separate method for user-driven selectedIndex 
-        changes, leaving scripts to use one which doesn't cause onchange to
-        be queued.
-        
-        Test: fast/forms/select-script-onchange.html
-
-        * dom/SelectElement.cpp: check if the pending change is user driven
-        before calling onchange
-        (WebCore::SelectElement::menuListOnChange):
-        (WebCore::SelectElement::setSelectedIndex):
-        * dom/SelectElement.h: store whether the pending change is user driven
-        (WebCore::SelectElementData::userDrivenChange):
-        (WebCore::SelectElementData::setUserDrivenChange):
-        * html/HTMLSelectElement.cpp: split into two methods -- script version
-        [non-user-driven] corresponds to IDL defined property name
-        (WebCore::HTMLSelectElement::setSelectedIndex):
-        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
-        * html/HTMLSelectElement.h: 
-        * rendering/RenderMenuList.cpp: use ByUser method when coming through
-        the renderer
-        (WebCore::RenderMenuList::valueChanged):
+        Reviewed by David Levin.
 
-2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        Reviewed by Darin Fisher.
+        Test: fast/frames/iframe-reparenting-new-page.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=26698
-
-        Combined LocalStorageArea and SessionStorageArea into StorageArea since
-        (after my other refactorings) there are no longer substantial
-        differences between the two.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setName):
+        Move the code setting the frame name into a separate function.
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp: Removed.
-        * storage/LocalStorageArea.h: Removed.
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/SessionStorageArea.cpp: Removed.
-        * storage/SessionStorageArea.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::createLocalStorage):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::createSessionStorage):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::scheduleFinalSync):
-        (WebCore::StorageArea::blockUntilImportComplete):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::updateLiveFrame):
+        Update frame tree, reset page in the contentFrame and re-set the name.
 
-2009-06-25  Dan Bernstein  <mitz@apple.com>
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument): 
+        * html/HTMLFrameElementBase.h:
 
-        Reviewed by Darin Adler.
+        * page/Frame.cpp:
+        (WebCore::Frame::setPage):
+        * page/Frame.h: Add setPage method. It is only currently used when iframe is
+                        moved between pages (so the ASSERT(m_ownerElement).
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
-          <rdar://problem/7001880> Safari 4.0 crashes in
-          WebCore::DOMTimer::fired()
+2010-02-01  Brady Eidson  <beidson@apple.com>
 
-        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+        Reviewed by Tim Hatcher.
 
-        When a "style sheet candidate" element is removed from a document,
-        call Document::removeStyleSheetCandidateNode() regardless of whether
-        the document is rendered. Otherwise, the document's style sheet
-        candidate set can end up containing stale references.
+        Add common IRC ports to port blocking.
+        <rdar://problem/7593895> and https://bugs.webkit.org/show_bug.cgi?id=34451
 
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::removedFromDocument):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::removedFromDocument):
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::removedFromDocument):
+        * platform/KURL.cpp:
+        (WebCore::portAllowed):
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Nate Chapin.
 
-        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+        [V8] Add compile time guards for IndexedDB custom functions
+        https://bugs.webkit.org/show_bug.cgi?id=34368
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
-          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+        * bindings/v8/custom/V8IDBRequestCustom.cpp:
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp:
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-01-29  Gavin Barraclough  <barraclough@apple.com>
 
-        Unreviewed, build fix.
+        Reviewed by Sam Weinig + Oliver Hunt.
 
-        Add FileList.h include to fix Chromium build.
+        Bug 34346 - With JSC bindings, make processingUserGesture work with events in Isolated Worlds
 
-        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+        Change HTMLMediaElement methods that require checking whether the event is a user gesture to
+        be passed a boolean.  This may be passed from the JSC bindings (where we have an exec state),
+        or read from the event.  Add a Flag to the IDL to mark this information is required.
 
-2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+        * WebCore.Video.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::processingUserGesture):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::domWindowAllowPopUp):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::anyPageIsProcessingUserGesture):
+        * bindings/js/ScriptController.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Event.cpp:
+        (WebCore::Event::isUserEvent):
+        * dom/Event.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::play):
+        (WebCore::HTMLMediaElement::pause):
+        (WebCore::HTMLMediaElement::beginScrubbing):
+        (WebCore::HTMLMediaElement::documentDidBecomeActive):
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::allowPopUp):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlSeekButtonElement::defaultEventHandler):
 
-        Reviewed by Jan Alonzo.
+2010-02-01  Andreas Kling  <andreas.kling@nokia.com>
 
-        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
-        https://bugs.webkit.org/show_bug.cgi?id=26489
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fixed a Typo in a Web Inspector error message.
+        [Qt] Use the fallback style on Maemo 5
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._queryError):
+        https://bugs.webkit.org/show_bug.cgi?id=34376
 
-2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        * platform/qt/RenderThemeQt.h:
 
-        Fix the Qt build, add missing StorageAreaSync files to the build.
+2010-02-01  Kavita Kanetkar  <kkanetkar@chromium.org>
 
-        * WebCore.pro:
+        Reviewed by Nate Chapin.
 
-2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+        [V8] Making V8 generated classes' GetTemplate() function public
+        https://bugs.webkit.org/show_bug.cgi?id=34026
 
-        Reviewed by and done with Tor Arne Vestbø.
+        * bindings/scripts/CodeGeneratorV8.pm: Generated code need not depend on V8CustomBinding.h, made GetTemplate() signature public.
 
-        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
-        empty. If we're asked to disambiguate the event into a Char keyboard event,
-        we try to detect this situation and still set the text, to ensure that the
-        general event handling sends a key press event after this disambiguation.
+        Reviewed by Ariya Hidayat.
 
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        Adds V8-specific JNI bridge classes
+        https://bugs.webkit.org/show_bug.cgi?id=34166
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+        This is the V8 equivalent of bridge/jni/jsc/JNIBridgeJSC.
 
-        Build fix only, no review.
+        No new tests, build fix only.
 
-        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+        * Android.v8bindings.mk: Modified. Added JNIBridge.cpp and JNIBridgeV8.cpp
+        * bridge/Bridge.h: Modified. Added missing include for Noncopyable.h
+        * bridge/jni/v8/JNIBridgeV8.cpp: Added.
+        (JavaField::JavaField):
+        * bridge/jni/v8/JNIBridgeV8.h: Added.
+        (JSC::Bindings::JavaField::name):
+        (JSC::Bindings::JavaField::type):
+        (JSC::Bindings::JavaField::getJNIType):
 
-        * platform/gtk/ClipboardGtk.cpp:
-        * platform/qt/ClipboardQt.cpp:
-        * platform/win/ClipboardWin.cpp:
-        * platform/wx/ClipboardWx.cpp:
+2010-02-01  Steve Block  <steveblock@google.com>
 
-2009-05-21  Eric Seidel  <eric@webkit.org>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Maciej Stachowiak.
+        Adds V8-specific JNI utility functions.
+        https://bugs.webkit.org/show_bug.cgi?id=33901
 
-        Expose files in the clipboard in ondrop events
-        https://bugs.webkit.org/show_bug.cgi?id=25916
+        This is the V8 equivalent of bridge/jni/jsc/JNIUtilityPrivate.
 
-        Make it possible for applications like gmail to implement
-        drag and drop of attachments onto email messages.
+        No new tests, build fix only.
 
-        This patch exposes an event.dataTransfer.files accessor
-        on the drop event.  No information is exposed during dragover.
-        This follows the HTML 5 drag and drop security model:
-        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
-        The test http/tests/security/clipboard/clipboard-file-access.html
-        verifies this behavior.
+        * Android.v8bindings.mk: Modified. Add JNIUtilityPrivate.cpp
+        * bridge/jni/v8/JNIUtilityPrivate.cpp: Added.
+        (JSC::Bindings::convertNPVariantToJValue):
+        (JSC::Bindings::convertJValueToNPVariant):
+        * bridge/jni/v8/JNIUtilityPrivate.h: Added.
 
-        Internet Explorer shows historical documentation of supporting
-        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
-        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
-        has removed this reference (as far as I can tell IE never implemented it)
-        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
-        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        I choose not to use IE's getData('File') and instead added .files
-        so that the accessor could have a type, matching WebKit's existing
-        .files accessor on HTMLInputElement.
+        Reviewed by Ariya Hidayat.
 
-        Mozilla has equivalent file access:
-        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
-        which also does not return a typed value.
-        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+        Adds V8 version of JavaClass
+        https://bugs.webkit.org/show_bug.cgi?id=33898
 
-        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
-        have incomplete Clipboard implementations and will require experts from those platforms
-        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+        This is the V8 equivalent of bridge/jni/jsc/JavaClassJSC
 
-        Test: http/tests/security/clipboard/clipboard-file-access.html
+        No new tests, build fix only.
 
-        * dom/Clipboard.h:
-        * dom/Clipboard.idl:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::files):
-        * platform/chromium/ClipboardChromium.h:
-        * platform/gtk/ClipboardGtk.cpp:
-        (WebCore::ClipboardGtk::files):
-        * platform/gtk/ClipboardGtk.h:
-        * platform/mac/ClipboardMac.h:
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::absoluteURLsFromPasteboardFilenames):
-        (WebCore::absoluteURLsFromPasteboard):
-        (WebCore::ClipboardMac::files):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::files):
-        * platform/qt/ClipboardQt.h:
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::files):
-        * platform/win/ClipboardWin.h:
-        * platform/wx/ClipboardWx.cpp:
-        (WebCore::ClipboardWx::files):
-        * platform/wx/ClipboardWx.h:
+        * Android.v8bindings.mk: Modified. Added JavaClassV8.cpp
+        * bridge/jni/v8/JavaClassV8.cpp: Added.
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        (JavaClass::methodsNamed):
+        (JavaClass::fieldNamed):
+        * bridge/jni/v8/JavaClassV8.h: Added.
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        No review, only completing revert of r45144.
+        Reviewed by Ariya Hidayat.
 
-        Add back files deleted by r45144.
+        Adds V8 version of JavaInstance
+        https://bugs.webkit.org/show_bug.cgi?id=33951
 
-        * storage/LocalStorageArea.cpp: Added.
-        (WebCore::LocalStorageArea::create):
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::itemChanged):
-        (WebCore::LocalStorageArea::itemRemoved):
-        (WebCore::LocalStorageArea::areaCleared):
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        (WebCore::LocalStorageArea::dispatchStorageEvent):
-        * storage/LocalStorageArea.h: Added.
-        * storage/SessionStorageArea.cpp: Added.
-        (WebCore::SessionStorageArea::copy):
-        (WebCore::SessionStorageArea::SessionStorageArea):
-        (WebCore::SessionStorageArea::itemChanged):
-        (WebCore::SessionStorageArea::itemRemoved):
-        (WebCore::SessionStorageArea::areaCleared):
-        (WebCore::SessionStorageArea::blockUntilImportComplete):
-        (WebCore::SessionStorageArea::dispatchStorageEvent):
-        * storage/SessionStorageArea.h: Added.
-        (WebCore::SessionStorageArea::create):
+        This is the V8 equivalent of bridge/jni/jsc/JavaInstanceJSC.
+        Also fixes a typo in a comment in JavaInstanceJSC.cpp.
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+        No new tests, build fix only.
 
-        No review, reverting r45144 only.
+        * Android.v8bindings.mk: Modified. Added JavaInstanceV8.cpp
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified.
+        (JavaInstance::invokeMethod): Modified. Fixed comment
+        * bridge/jni/v8/JavaInstanceV8.cpp: Added.
+        (JavaInstance::JavaInstance):
+        (JavaInstance::~JavaInstance):
+        (JavaInstance::getClass):
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
+        * bridge/jni/v8/JavaInstanceV8.h: Added.
+        (JSC::Bindings::JObjectWrapper::instance):
+        (JSC::Bindings::JObjectWrapper::setInstance):
+        (JSC::Bindings::JObjectWrapper::ref):
+        (JSC::Bindings::JObjectWrapper::deref):
+        (JSC::Bindings::JavaInstance::javaInstance):
+        (JSC::Bindings::JavaInstance::begin):
+        (JSC::Bindings::JavaInstance::end):
+        (JSC::Bindings::JavaInstance::virtualBegin):
+        (JSC::Bindings::JavaInstance::virtualEnd):
 
-        Roll out r45144 after 18 test failures appeared on the bots.
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+2010-02-01  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::~StorageArea):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        Reviewed by Eric Seidel.
 
-2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+        Making sure that all in-progress transactions are rolled back on
+        the database thread before they're destroyed. Otherwise,
+        SQLiteTransaction's destructor will try to do a rollback and that
+        would cause an assertion failure, if the object is not destroyed
+        on the DB thread.
 
-        Reviewed by Darin Fisher.
+        https://bugs.webkit.org/show_bug.cgi?id=34152
 
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::stop):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::notifyDatabaseThreadIsShuttingDown):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::shutdown):
 
-        Combined LocalStorageArea and SessionStorageArea into StorageArea since
-        (after my other refactorings) there are no longer substantial
-        differences between the two.
+2010-02-01  Sam Weinig  <sam@webkit.org>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp: Removed.
-        * storage/LocalStorageArea.h: Removed.
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/SessionStorageArea.cpp: Removed.
-        * storage/SessionStorageArea.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::createLocalStorage):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::createSessionStorage):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::scheduleFinalSync):
-        (WebCore::StorageArea::blockUntilImportComplete):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        Reviewed by Beth Dakin.
 
-2009-06-24  Dan Bernstein  <mitz@apple.com>
+        Fix EXPERIMENTAL_SINGLE_VIEW_MODE build.
 
-        Reviewed by Simon Fraser.
+        * page/EventHandler.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::currentNSEvent):
+        (WebCore::EventHandler::currentKeyboardEvent):
+        (WebCore::EventHandler::mouseDown):
+        (WebCore::EventHandler::mouseDragged):
+        (WebCore::EventHandler::mouseUp):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
 
-        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
-          at UCSC Genome Browser doesn't work because image map prevents img
-          from hit-testing
+2010-02-01  Nate Chapin  <japhet@chromium.org>
 
-        Test: fast/replaced/image-map-2.html
+        Unreviewed, Chromium build fix.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
-        the image map failed the hit test.
+        Failed to properly add new files for http://trac.webkit.org/changeset/54150.
 
-2009-06-22  Adam Barth  <abarth@webkit.org>
+        * bindings/v8/custom/V8BarInfoCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSRuleCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSValueCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8DOMSelectionCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGPathSegCustom.cpp: Added.
+        * bindings/v8/custom/V8ScreenCustom.cpp: Added.
+        * bindings/v8/custom/V8StyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Added.
 
-        Reviewed by Dimitri Glazkov.
+2010-01-27  Matt Perry  <mpcomplete@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26366
+        Reviewed by Eric Seidel.
 
-        Refactor V8DOMMap to support isolated worlds.
+        Add support for addUserScript to chromium port.
 
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInWorld):
         * bindings/v8/ScriptController.h:
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
-        (WebCore::DOMDataStore::allStores):
-        (WebCore::DOMDataStore::allStoresMutex):
-        (WebCore::DOMDataStore::domData):
-        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
-        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
-        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
-        (WebCore::):
-        (WebCore::MainThreadDOMData::MainThreadDOMData):
-        (WebCore::MainThreadDOMData::getStore):
-        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
-        (WebCore::ChildThreadDOMData::getStore):
-        (WebCore::DOMDataStore::DOMDataStore):
-        (WebCore::DOMDataStore::~DOMDataStore):
-        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
-        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
-        (WebCore::forget):
-        (WebCore::getDOMNodeMap):
-        (WebCore::getDOMObjectMap):
-        (WebCore::getActiveDOMObjectMap):
-        (WebCore::getDOMSVGElementInstanceMap):
-        (WebCore::getDOMSVGObjectWithContextMap):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::ensureDeref):
-        (WebCore::weakDOMObjectCallback):
-        (WebCore::weakActiveDOMObjectCallback):
-        (WebCore::weakNodeCallback):
-        (WebCore::weakSVGElementInstanceCallback):
-        (WebCore::weakSVGObjectWithContextCallback):
-        (WebCore::DOMData::derefObject):
-        (WebCore::DOMData::derefDelayedObjects):
-        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
-        (WebCore::visitDOMNodesInCurrentThread):
-        (WebCore::visitDOMObjectsInCurrentThread):
-        (WebCore::visitActiveDOMObjectsInCurrentThread):
-        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
-        (WebCore::visitSVGObjectsInCurrentThread):
-        * bindings/v8/V8DOMMap.h:
-        (WebCore::DOMDataStoreHandle::getStore):
-        * bindings/v8/V8IsolatedWorld.cpp: Added.
-        (WebCore::getIsolatedWorldKey):
-        (WebCore::contextWeakReferenceCallback):
-        (WebCore::V8IsolatedWorld::evaluate):
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::getEntered):
-        * bindings/v8/V8IsolatedWorld.h: Added.
-        (WebCore::V8IsolatedWorld::getDOMDataStore):
-
-2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Bug 26604: Search doesn't work in Web Inspector Profiler
-        https://bugs.webkit.org/show_bug.cgi?id=26604
-
-        Seems like search was damaged in revision 42808.
-
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.prototype.refresh):
-        Here and in other functions: nodes we're searching in are profile data grid
-        nodes, so there is no more need for '_dataGridNode' references.
-        (WebInspector.ProfileView.prototype.searchCanceled):
-        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
-        Fixed accidental semicolon that caused 'matchesQuery' always return true.
-        (WebInspector.ProfileView.prototype.performSearch):
-        To perform search correctly in the case of bottom up tree, we need to populate
-        the tree, because there's no 1-to-1 correspondence between profile nodes and
-        data grid nodes in this case.
-        (WebInspector.ProfileView.prototype._jumpToSearchResult):
-
-2009-06-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        <rdar://problem/6450239&6574516>
-    
-        Fix flashing issues caused by compositing layers rendering content before
-        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
-        work for composited layers, we need to use scheduleViewUpdate() to queue
-        up a layout via the run loop observer in WebKit, whenever we know we
-        are going to be painting soon.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-
-2009-06-24  David Levin  <levin@chromium.org>
-
-        Fix all builds.
-
-        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
-
-2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26658
-
-        Split the syncing portions of LocalStorageArea into StorageAreaSync.
-        This name will make more sense in the next patch (in this set) when
-        LocalStorageArea and SessionStorageArea are merged to become simply
-        StorageArea.  (Thus the synching portion of StorageArea is in
-        StorageAreaSync.)
-
-        This looks like a big patch, but really all it's doing is splitting
-        code and patching split-related things up.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::create):
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::itemChanged):
-        (WebCore::LocalStorageArea::itemRemoved):
-        (WebCore::LocalStorageArea::areaCleared):
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        * storage/LocalStorageArea.h:
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::createImport):
-        (WebCore::LocalStorageTask::createSync):
-        * storage/LocalStorageThread.cpp:
-        (WebCore::LocalStorageThread::scheduleImport):
-        (WebCore::LocalStorageThread::scheduleSync):
-        * storage/LocalStorageThread.h:
-        * storage/SessionStorageArea.cpp:
-        (WebCore::SessionStorageArea::blockUntilImportComplete):
-        * storage/SessionStorageArea.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
-        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h:
-
-2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
-
-        Fix Qt build.
-
-        * WebCore.pro:
-
-2009-06-24  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
-        https://bugs.webkit.org/show_bug.cgi?id=26696
-
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::itemWithName):
-        (WebCore::DataGridColumnList::add):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::item):
-        (WebCore::DataGridColumnList::primaryColumn):
-        (WebCore::DataGridColumnList::sortColumn):
-
-2009-06-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dave "Messy" Hyatt.
-
-        Little bit of style cleanup.
-
-        * html/DataGridColumn.cpp:
-        * html/DataGridColumn.h:
-        * html/DataGridColumn.idl:
-        * html/DataGridColumnList.cpp:
-        * html/DataGridColumnList.h:
-        * html/DataGridColumnList.idl:
-        * html/HTMLDataGridCellElement.cpp:
-        * html/HTMLDataGridCellElement.h:
-        * html/HTMLDataGridCellElement.idl:
-        * html/HTMLDataGridColElement.cpp:
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-
-2009-06-24  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26668: AX: need a way to retrieve the language for an element
-        
-        Provides a way to retrieve the language associated with a specific accessibility element.
-
-        Test: accessibility/language-attribute.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::language):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::language):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-06-24  Brady Eidson  <beidson@apple.com>
+2010-02-01  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Dan Bernstein.
-        
-        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
-
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
-
-2009-06-24  Nicolas Weber  <thakis@chromium.org>
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=34448
+        <rdar://problem/7598130>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26685
-        Accomodate for backwards-incompatible skia api changes.
+        RenderVideo::intrinsicSizeChanged infinite recursion
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/skia/ImageSkia.cpp:
-        (WebCore::paintSkBitmap):
-        (WebCore::Image::drawPattern):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):
-        (PlatformContextSkia::setupPaintCommon):
-        (PlatformContextSkia::setXfermodeMode):
-        (PlatformContextSkia::applyClipFromImage):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::):
-        (WebCore::WebCoreCompositeToSkiaComposite):
-        * platform/graphics/skia/SkiaUtils.h:
-
-2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix. Add files that were added in r45093 and r45096
-
-        * GNUmakefile.am:
+        * rendering/RenderImage.h:
+        (WebCore::RenderImage::intrinsicSizeChanged): Make protected instead of private so it can
+            be called by RenderVideo.
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::intrinsicSizeChanged): Call RenderMedia::intrinsicSizeChanged, not
+            RenderVideo::intrinsicSizeChanged.
+        (WebCore::RenderVideo::imageChanged): Call RenderMedia::imageChanged instead of 
+            RenderImage::imageChanged.
 
-2009-06-24  Brady Eidson  <beidson@apple.com>
+2010-02-01  Nate Chapin  <japhet@chromium.org>
 
-        Fix 64-bit SnowLeopard build.
+        Reviewed by Dimitri Glazkov.
 
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
+        [V8] Generate toV8() converter for most WebCore->V8 conversions,
+        and defined custom converters in their respective V8<class>Custom.cpp.
 
-2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+        Old converters in V8DOMWrapper will be deleted in a later patch.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        https://bugs.webkit.org/show_bug.cgi?id=26392
-        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
-        https://bugs.webkit.org/show_bug.cgi?id=26328
-        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+        * Android.v8bindings.mk:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8BarInfoCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSRuleCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSValueCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8DOMSelectionCustom.cpp: Added.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGPathSegCustom.cpp: Added.
+        * bindings/v8/custom/V8ScreenCustom.cpp: Added.
+        * bindings/v8/custom/V8StyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * dom/make_names.pl: Add options to generate wrapper factory for V8 bindings.
+
+2010-02-01  Alexander Pavlov  <apavlov@chromium.org>
 
-        React to href updates even when there is no renderer, i.e. display=none.
+        Reviewed by Pavel Feldman.
 
-        Tests: svg/custom/js-update-image-and-display.svg
-               svg/custom/js-update-image-and-display2.svg
-               svg/custom/js-update-image-and-display3.svg
+        Web Inspector: lazy-load textual resources to avoid UI hangup
+        https://bugs.webkit.org/show_bug.cgi?id=34332
 
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::svgAttributeChanged):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.contentTabSelected):
 
-2009-06-24  David Hyatt  <hyatt@apple.com>
+2010-02-01  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Adele Peterson.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26687
+        Crash in Safari opening new tabs to "same page"
+        <rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444
 
-        Add basic back-end column support to datagrid.
+        Test: fast/loader/crash-copying-backforwardlist.html
 
-        Added fast/dom/HTMLDataGridElement/ column tests.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Null check currentItem().
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/DataGridColumn.cpp: Added.
-        (WebCore::DataGridColumn::setPrimary):
-        * html/DataGridColumn.h: Added.
-        (WebCore::DataGridColumn::create):
-        (WebCore::DataGridColumn::id):
-        (WebCore::DataGridColumn::setId):
-        (WebCore::DataGridColumn::label):
-        (WebCore::DataGridColumn::setLabel):
-        (WebCore::DataGridColumn::type):
-        (WebCore::DataGridColumn::setType):
-        (WebCore::DataGridColumn::sortable):
-        (WebCore::DataGridColumn::setSortable):
-        (WebCore::DataGridColumn::sortDirection):
-        (WebCore::DataGridColumn::setSortDirection):
-        (WebCore::DataGridColumn::primary):
-        (WebCore::DataGridColumn::detachFromColumnList):
-        (WebCore::DataGridColumn::DataGridColumn):
-        * html/DataGridColumn.idl: Added.
-        * html/DataGridColumnList.cpp: Added.
-        (WebCore::DataGridColumnList::~DataGridColumnList):
-        (WebCore::DataGridColumnList::itemWithName):
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
-        (WebCore::DataGridColumnList::clear):
-        (WebCore::DataGridColumnList::primaryColumnChanged):
-        * html/DataGridColumnList.h: Added.
-        (WebCore::DataGridColumnList::create):
-        (WebCore::DataGridColumnList::length):
-        (WebCore::DataGridColumnList::item):
-        (WebCore::DataGridColumnList::primaryColumn):
-        (WebCore::DataGridColumnList::sortColumn):
-        * html/DataGridColumnList.idl: Added.
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        (WebCore::HTMLDataGridColElement::sortDirection):
-        (WebCore::HTMLDataGridColElement::setSortDirection):
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        * html/HTMLDataGridElement.h:
-        (WebCore::HTMLDataGridElement::columns):
-        * html/HTMLDataGridElement.idl:
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::paintObject):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        (WebCore::RenderDataGrid::rebuildColumns):
-        * rendering/RenderDataGrid.h:
-        (WebCore::RenderDataGrid::gridElement):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Ditto.
 
-2009-06-24  Jessie Berlin  <jberlin@apple.com>
+2010-02-01  Kevin Watters  <kevinwatters@gmail.com>
 
-        Reviewed by Adam Roben.
+        Reviewed by Kevin Ollivier.
 
-        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
-        (<rdar://problem/5015942>)
-        Where on windows it was not possible to set an element as the drag
-        image using setDragImage on the dataTransfer object.
+        [wx] Remove unused file that doesn't seem to belong to the port.
         
-        Does not "fix" the case of dragging a link where the default link image
-        is still used, even when the -webkit-user-drag is set to "element". This
-        is the same behavior as is found on OS X.
-        
-        Added a manual test because it is not possible to check that what is
-        contained in the image snapshot is indeed the requested element.
-
-        * dom/Clipboard.h:
-        (WebCore::Clipboard::dragImageElement):
-        Made getting the raw pointer from the RefPtr a const operation.
-        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::createDragImage):
-        Get an image of the rendered element and its subtree.
-
-2009-06-24  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26683
-        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
-
-        This change just adds a stub implementation for now to help fix the build.
+        https://bugs.webkit.org/show_bug.cgi?id=34445
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+        * platform/wx/KeyEventWin.cpp: Removed.
 
-2009-06-24  David Kilzer  <ddkilzer@apple.com>
+2010-02-01  Eric Carlson  <eric.carlson@apple.com>
 
-        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        Reviewed by Adele Peterson.
 
-        Reviewed by Adam Roben.
+        Fullscreen API should be on HTMLVideoElement
+        https://bugs.webkit.org/show_bug.cgi?id=34438
+        
+        Move fullscreen DOM APIs from HTMLMediaElement to HTMLVideoElement.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::deliverNotification): Removed
-        ExceptionCode parameter from togglePlayState().
-        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
-        object to a String when assigning to a KURL variable.
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Save memory by not storing attribute values in member variables, if not absolutely needed.
-        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
-
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::parseMappedAttribute):
-        (WebCore::WMLDoElement::label):
-        * wml/WMLDoElement.h:
-        * wml/WMLFieldSetElement.cpp:
-        (WebCore::WMLFieldSetElement::insertedIntoDocument):
-        * wml/WMLFieldSetElement.h:
-        * wml/WMLOptGroupElement.cpp:
-        (WebCore::WMLOptGroupElement::title):
-        (WebCore::WMLOptGroupElement::parseMappedAttribute):
-        (WebCore::WMLOptGroupElement::groupLabelText):
-        * wml/WMLOptGroupElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::name):
-        (WebCore::WMLPostfieldElement::value):
-        (WebCore::WMLPostfieldElement::encodeData):
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
-        (WebCore::WMLSetvarElement::name):
-        (WebCore::WMLSetvarElement::value):
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::parseMappedAttribute):
-        (WebCore::WMLTimerElement::insertedIntoDocument):
-        (WebCore::WMLTimerElement::timerFired):
-        (WebCore::WMLTimerElement::start):
-        (WebCore::WMLTimerElement::value):
-        * wml/WMLTimerElement.h:
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Roben.
-
-        Forgot to initialize m_task member variable. Results in crashes sometimes.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::WMLAnchorElement):
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Forgot to include within last patch.
-
-        * manual-tests/wml/card-title-attr.wml: Added.
-
-2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
- 
-        Reviewed by Nikolas Zimmermann.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
-        Adding WML <card> title attribute handling.
-
-        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
-        * wml/WMLElement.cpp:
-        * wml/WMLCardElement.h: 
-        (WebCore::WMLCardElement::title):
-        * wml/WMLCardElement.cpp:
-        * wml/manual-test/card-title-attr.wml: Manual test  
- 
-2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the build without ENABLE_VIDEO.
-
-        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
-        * html/CanvasRenderingContext2D.h: Ditto.
-
-2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
-        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
-        to just replace the selection, and place the caret at the end of the selection it replaced.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
-        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
-
-2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Don't use an unsigned int for intervalInMS because we sometimes initialize
-        it with a negative value.
-
-        * platform/wx/SharedTimerWx.cpp:
-        (WebCore::setSharedTimerFireTime):
-
-2009-06-24  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        The previous checkin had an improper merge.  This fixes the build.
-
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-
-2009-06-05  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25922
-        JS setting dropEffect = "none" causes tryDHTMLDrag
-        to return DragOperationNone.  Which is also the value
-        tryDHTMLDrag previously used to indicate JS did not
-        want to handle the drag.
-
-        Make it possible for the DragController::try* methods
-        to return a bool to indicate if javascript accepted
-        or rejected the drag event, separate from the DragOperation.
-
-        Tests:
-        - fast/events/drag-to-navigate.html
-        - fast/events/prevent-drag-to-navigate.html
-
-        * page/DragController.cpp:
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::defaultOperationForDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        * page/DragController.h:
-
-2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Sam Weinig and Dave Hyatt.
-
-        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
-        <https://bugs.webkit.org/show_bug.cgi?id=25920>
-
-        Add support for drawing the contents of the video element to the canvas
-        in accordance with the current HTML5 draft.
-
-        Test: media/video-canvas.html
-
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-          Standard custom bindings stuff we need to do for all canvas methods.
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::size): Helper function for finding the size of a video element
-        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
-        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
-        * html/CanvasRenderingContext2D.h:
         * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
-          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
-          as we force QT to maintain a single origin.
+        * html/HTMLMediaElement.idl:
         * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::paint): 
-            Paint routine on video so we don't have to look at MediaPlayer directly
+        (WebCore::HTMLVideoElement::paint): Removed outdated FIXME.
+        (WebCore::HTMLVideoElement::paintCurrentFrameInContext): Ditto.
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen): Moved from HTMLMediaElement.
+        (WebCore::HTMLVideoElement::webkitExitFullScreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitSupportsFullscreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitDisplayingFullscreen): Ditto.
         * html/HTMLVideoElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
-        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
-            Default implementations of hasSingleSecurityOrigin
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-            A video may need a player now even if it is not visible.
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-            Always return true due to restrictions we've placed on QT.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::paint):
-            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
-            In the long term we'd like to cache the HDC, but this will do for now.
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-            As for Mac we force QT to only allow same origin loads.
+        * html/HTMLVideoElement.idl:
 
-2009-06-23  Adam Langley  <agl@google.com>
+2010-02-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Eric Seidel.
-
-        Chromium: Fix crash with inherited font-size in <option>
-
-        https://bugs.webkit.org/show_bug.cgi?id=26656
-        http://code.google.com/p/chromium/issues/detail?id=14853
-
-        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
-        the <select> handing for Chromium to fix a rendering bug. However,
-        although the font-size is correctly ignored, getRowHeight wasn't
-        updated and so was calculating the height of the rows in an
-        inconsistent manner. This can lead to a crash.
-
-        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::getRowHeight):
-
-2009-06-23  Brady Eidson  <beidson@apple.com>
-
-        Patch by Antti Koivisto.
-        Reviewed by Brady Eidson.
+        Reviewed by Timothy Hatcher.
 
-        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
+        Web Inspector: Syntax highlighting in source view of
+        Resources pane stops half-way.
 
-        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
-        it should always be revalidated upon reload.
+        There were two problems here: (1) styles for html highlighter were not
+        added into the css file (they used to be injected manually in the
+        SourceFrame before). (2) 'Tag' needed to be lexer's state, not parser's.
+        Otherwise unbalanced quotes in the text nodes were matching too match
+        into the string tokens.
 
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
+        https://bugs.webkit.org/show_bug.cgi?id=34359
 
-2009-06-23  Dan Bernstein  <mitz@apple.com>
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer.prototype._createLineDivs):
+        (WebInspector.NativeTextViewer.prototype._lineHeight):
+        (WebInspector.NativeTextViewer.prototype.initFontMetrics):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.initFontMetrics):
+        (WebInspector.TextEditor.prototype._registerShortcuts):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2010-02-01  Ben Murdoch  <benm@google.com>
 
         Reviewed by Darin Adler.
 
-        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
-          EventHandler::passMouseDownEventToWidget()
+        ScriptCallFrame's do not get line numbers/source id's if the caller is unkown.
+        https://bugs.webkit.org/show_bug.cgi?id=34335
 
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
-        -mouseDown: call with calls to Widget::beforeMouseDown() and
-        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
-        being removed from its parent view while the scroller is tracking the
-        mouse.
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack): If the caller is unknown, the line number and source information is still availble so pass it to the ScriptCallFrame being constructed.
 
-2009-06-23  Sam Weinig  <sam@webkit.org>
+2010-02-01  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Simon Fraser.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
-        Add initial implementation of DataGridDataSource
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        - Initial implementation only supports the initialize callback function.
+        These are the first steps on reimplementing AffineTransform. Unlike
+        the old affine code, this one is platform independent like TransformationMatrix.
+        AffineTransform has the benefit, that it stores just 6 doubles instead of
+        16 in TransformationMatrix. The calculations of transformations are not that
+        complex and can improve the memory usage and speed of SVG.
+        AffineTransform can be used by HTML Canvas3D or SVG, since they are 2D related (at
+        least for the moment).
+        HTML Canvas is the first that makes use of the new AffineTransform. Next patches
+        will introduce the affine code to SVG.
 
-        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
+        No new tests. The new AffineTransformation code is tested by fast/canvas.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * Android.mk:
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDataGridDataSource.cpp: Added.
-        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::initialize):
-        * bindings/js/JSDataGridDataSource.h: Added.
-        (WebCore::JSDataGridDataSource::create):
-        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::jsDataSource):
-        (WebCore::asJSDataGridDataSource):
-        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
-        (WebCore::JSHTMLDataGridElement::listener):
-        (WebCore::JSHTMLDataGridElement::setListener):
-        * html/DataGridDataSource.h: Added.
-        (WebCore::DataGridDataSource::~DataGridDataSource):
-        (WebCore::DataGridDataSource::isJSDataGridDataSource):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::initializationTimerFired):
-        * html/HTMLDataGridElement.h:
-        (WebCore::HTMLDataGridElement::dataSource):
-        * html/HTMLDataGridElement.idl:
-
-2009-06-23  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Justin Garcia.
-
-        Undo the changeset 21212 to fix the regression bug 14062.
-        The changeset 21212 attempted to fix rdar://problem/5002441.
-        The changeset 21212 modified InsertTextCommand::input so as to convert
-        all spaces in text to non-breaking spaces for rdar://problem/5002441.
-        However, the bug was originally caused by rebalanceWhitespaceAt
-        and this workaround introduced a regression bug 14062.
-        Because rebalanceWhitespaceAt appears to behave correctly now,
-        the workaround introduced in 21212 is no longer needed.
-
-        Test: editing/inserting/space-after-removeformat.html
-
-        * editing/InsertTextCommand.cpp:
-        (WebCore::InsertTextCommand::input):
-
-2009-06-23  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
-        elements width can't be changed with javascript
-
-        This patch both fixes setting the width attribute directly in 
-        JavaScript, and setting the width on the style attribute. 
-
-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
-        new width, call setNeedsLayoutAndPrefWidthsRecalc()
-
-        Call calcPrefWidths() on the table cols.
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray):
-        
-        Call layoutIfNeeded on the table cols.
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
-        table() convenience function.
-        (WebCore::RenderTableCol::calcPrefWidths): Just call 
-        setPrefWidthsDirty(false) on ourself and our children.
-        (WebCore::RenderTableCol::table):
-        * rendering/RenderTableCol.h:
-
-2009-06-23  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
-        keyword values. When diff is called on a CSSStyleDeclaration, we check
-        the keywordSize to see if font-size matches a keyword value.
-        
-        This ensures that when we diff a CSSMutableStyleDeclaration returned from
-        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
-        correctly identify matching font-sizes.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26279
-
-        Test: editing/inserting/font-size-clears-from-typing-style.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
-        * css/CSSComputedStyleDeclaration.h:
-        * css/CSSStyleDeclaration.cpp:
-        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
-        (WebCore::CSSStyleDeclaration::diff):
-        * css/CSSStyleDeclaration.h:
-
-2009-06-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
-        add a blank line to pasted Facebook content (under
-        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
-
-        - Just added null checks and I will create a new bug to prevent the
-        bad behavior.
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix.
-
-        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
-        ACCELERATED_COMPOSITING is not defined.
-
-        * rendering/RenderLayer.cpp:
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=24863
-        
-        Fix reflection painting on elements with compositing layers.
-
-        Test: compositing/reflections/reflection-on-composited.html
-
-        * rendering/RenderLayer.h:
-        Add a new PaintLayerPaintingReflection flag which is set while painting inside
-        reflections.
-        (WebCore::RenderLayer::setPaintingInsideReflection):
-        Add a setter so that RenderLayerBacking can call it.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::shouldDoSoftwarePaint):
-        Utility to clarify the logic of when a composited layer should do a software paint.
-        
-        (WebCore::RenderLayer::paintLayer):
-        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
-        Remove transform-related tests from the reflection-painting if test because they appear
-        to be unnecessary.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        Add the code to paint reflections to the composited layer painting method.
-        
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        Set the PaintLayerPaintingReflection flag.
-
-2009-06-23  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26643
-        Memory cache should respect Cache-Control: no-store
-        
-        Make resources with Cache-Control: no-store uncacheable in the memory cache.
-        They get evicted immediately when all clients are gone and are always
-        reloaded from the server.
-
-        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::removeClient):
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::ResourceResponseBase):
-        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
-        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
-        * platform/network/ResourceResponseBase.h:
-
-2009-06-23  Brady Eidson  <beidson@apple.com>
-
-        Windows build fix.
-
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::play):
-        (QTMovieWin::pause):
-        (QTMovieWin::setRate):
-        (QTMovieWin::setCurrentTime):
-
-2009-06-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
-        after manually quoting blank line then hitting return
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::AffineTransform::operator cairo_matrix_t):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::AffineTransform::operator CGAffineTransform):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::AffineTransform::operator QTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::AffineTransform::operator SkMatrix):
+        * platform/graphics/transforms/AffineTransform.cpp: Added.
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::reset):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::isIdentity):
+        (WebCore::AffineTransform::det):
+        (WebCore::AffineTransform::isInvertible):
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::multiply):
+        (WebCore::AffineTransform::multLeft):
+        (WebCore::AffineTransform::rotate):
+        (WebCore::AffineTransform::scale):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::scaleNonUniform):
+        (WebCore::AffineTransform::rotateFromVector):
+        (WebCore::AffineTransform::flipX):
+        (WebCore::AffineTransform::flipY):
+        (WebCore::AffineTransform::shear):
+        (WebCore::AffineTransform::skew):
+        (WebCore::AffineTransform::skewX):
+        (WebCore::AffineTransform::skewY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        (WebCore::AffineTransform::blend):
+        (WebCore::AffineTransform::toTransformationMatrix):
+        * platform/graphics/transforms/AffineTransform.h: Added.
+        (WebCore::AffineTransform::a):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::b):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::c):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::d):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::e):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::f):
+        (WebCore::AffineTransform::setF):
+        (WebCore::AffineTransform::operator== ):
+        (WebCore::AffineTransform::operator!=):
+        (WebCore::AffineTransform::operator*=):
+        (WebCore::AffineTransform::operator*):
+        (WebCore::AffineTransform::setMatrix):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::AffineTransform::operator wxGraphicsMatrix):
 
-        If the insertion point is both the begining and ending visible position
-        then we need to insert at the end instead of the begining, which is what
-        would normally happen if the insertion point was as the begining.
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
 
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
+        Reviewed by Eric Carlson.
 
-2009-06-23  Brady Eidson  <beidson@apple.com>
+        [GTK] set playbin mute property depending on volume value
+        https://bugs.webkit.org/show_bug.cgi?id=31586
 
-        Reviewed by Sam Weinig, and looked over by Eric Carlson.
+        New API in MediaPlayer for mute control. 3 new methods are
+        introduced:
 
-        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
+        - bool supportsMuting() const;
+        - bool muted() const;
+        - void setMuted(bool);
 
-        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
+        Platform MediaPlayer implementations can support it easily if the
+        underlying sound daemon/API supports muting (eg. not only setting
+        volume to 0) like PulseAudio for instance on Linux. At the moment
+        the only player supporting this new API is the
+        MediaPlayerPrivateGStreamer.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
-          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
-        (WebCore::HTMLMediaElement::loadResource):
-        (WebCore::HTMLMediaElement::webkitPreservesPitch):
-        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setMuted):
+        (WebCore::HTMLMediaElement::mediaPlayerVolumeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerMuteChanged):
         * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.idl:
-
         * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::NullMediaPlayerPrivate::supportsMuting):
+        (WebCore::NullMediaPlayerPrivate::setMuted):
         (WebCore::MediaPlayer::MediaPlayer):
-        (WebCore::MediaPlayer::preservesPitch):
-        (WebCore::MediaPlayer::setPreservesPitch):
+        (WebCore::MediaPlayer::muted):
+        (WebCore::MediaPlayer::supportsMuting):
+        (WebCore::MediaPlayer::setMuted):
+        (WebCore::MediaPlayer::volumeChanged):
+        (WebCore::MediaPlayer::muteChanged):
         * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerMuteChanged):
         * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateInterface::supportsMuting):
+        (WebCore::MediaPlayerPrivateInterface::setMuted):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::notifyMuteIdleCallback):
         (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
-          exact same attributes as before, with pitch preservation being the difference.
-        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
-        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
-        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
-          has been effectively overwritten.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::load):
-        (WebCore::MediaPlayerPrivate::setPreservesPitch):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWinPrivate::QTMovieWinPrivate):
-        (QTMovieWinPrivate::~QTMovieWinPrivate):
-        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
-        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
-        (QTMovieWin::pause): Ditto.
-        (QTMovieWin::setRate): Ditto.
-        (QTMovieWin::setCurrentTime): Ditto.
-        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
-        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
-          but changing the pitch preservation flag.
-        * platform/graphics/win/QTMovieWin.h:
-
-2009-06-23  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/6998286> Crash after leaving page with <video>
-        
-        Don't try to post events after going into the page cache.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
-        event timers so we won't try to post events after going into the cache.
-
-2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Brady Eidson.
-
-        Simplify the interaction between LocalStorageArea/SessionStorageArea
-        and StorageArea by creating a "blockUntilImportComplete()" function
-        rather than bouncing back and forth between the child and parent
-        classes in a somewhat unintuitive manner.
-
-        This patch also paves the way for LocalStorageArea and
-        SessionStorageArea being merged into one.  It's part of several in a
-        set which are separating syncing (to disk) code from the rest of the
-        implementation so that local storage and session storage's code can be
-        unified.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25376
-
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        * storage/LocalStorageArea.h:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::length):
-        (WebCore::StorageArea::key):
-        (WebCore::StorageArea::getItem):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::contains):
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::blockUntilImportComplete):
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        * rendering/RenderLayerBacking.h:
-        Remove the unused 'haveTransparency' param to paintIntoLayer().
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
-
-        The updatingControlTints() painting pass goes through compositing layer boundaries,
-        so we need to ensure we don't cache clip rects computed with the wrong root by
-        setting temporaryClipRects to true.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        Remove a printf that I left in by mistake.
-
-2009-06-23  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler.
-
-        WebCore side of <rdar://problem/6946094>.
-        
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::setExternalDataObject):
-        * platform/win/ClipboardWin.h:
-
-2009-06-23  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26650
-
-        Add setFormContentType and setFormData since it is awkward for Chromium
-        to use setFormInfoFromRequest to set the underlying members.  Also, add
-        a clearChildren method that Chromium needs.  These methods are used as
-        part of the Chromium code that serializes a HistoryItem for storing in
-        the browser's session history.
-
-        * history/HistoryItem.cpp:
-        * history/HistoryItem.h:
-
-2009-06-23  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
-
-        Test: media/event-attributes.html
-
-        * html/HTMLAttributeNames.in: Add media event attribute names.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
-
-2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix Qt build with Phonon.
-
-        The #include <phonon> header no longer exists. And the <Phonon> or
-        <Phonon/Phonon> headers have never existed (neither for us nor for the
-        Phonon sources). You have to select each and every header that you do
-        want now.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Remove duplicated code in Qt & GTK logging initialization
-
-        We now share the getChannelFromName() function in Logging.cpp
-
-        * platform/gtk/LoggingGtk.cpp:
-        * platform/qt/LoggingQt.cpp:
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Rename the plugin logging channel to plural form 'Plugins'
-
-        This matches both the other logging channel names, as well as the
-        WebKit logging channel used by Safari/Mac for plugins.
-
-        * platform/Logging.cpp:
-        * platform/Logging.h:
-        * platform/gtk/LoggingGtk.cpp:
-        * platform/mac/LoggingMac.mm:
-        * platform/qt/LoggingQt.cpp:
-        * platform/win/LoggingWin.cpp:
-        * plugins/PluginDebug.h:
-        * plugins/gtk/PluginPackageGtk.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedCallback):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::muteChangedCallback):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
 
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-01  Henry Haverinen  <henry.haverinen@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix NPAPI mouse translation issues on Mac
-
-        The WindowRef we pass to the plugin refers to the the top level window,
-        so the x and y positions have to be relative to this position, but we
-        have to manually compensate for title bar decorations and other parents
-        of the QWebView since contentsToWindow() only traverses to the QWebView.
-
-        Previously we did this compensation when passing on mouse coordinates to
-        the plugin, which caused various issues with translations such as not
-        being able to close the Flash settings dialog, or the hand cursor not
-        appearing over links.
-
-        We now do the compensation as part of the call to NPP_SetWindow, and
-        then pass mouse coordinates in global context without any compensation,
-        similar to how both Safari and Mozilla does it.
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::globalMousePosForPlugin):
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        [Qt] Resolve absolute path to library install_name manually
-
-        Since our target.path is set to the Qt directory (to be able
-        to do 'make install') the 'absolute_library_soname' option
-        to QMake did not do the right thing.
-
-        We now compute the absolute path manually using DESTDIR.
-
-        * WebCore.pro:
-
-2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+        [Qt] Build without SSL support is broken
 
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
-        inactive look in background windows
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        Don't short-circuit the "painting" pass that is used to udpate control tints.
+        Added missing #ifdefs for OpenSSL support and one null-pointer
+        check for the socket.
 
-2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34416
 
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26567
-        Upstream V8 bindings code generator. With this change, also added interface ancestor
-        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
-        to determine whether an interface is a Node to facilitate proper casting and storage
-        in V8DOMMap.
-
-        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
-            by V8 bindings.
-        * bindings/scripts/CodeGeneratorV8.pm: Added.
-        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
-            parent traversal cases.
-
-2009-06-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Add event handler attribute getter/setters to HTMLFrameSetElement
-        as specified in HTML 5.  These match the ones on HTMLBodyElement.
-
-        * dom/Node.h:
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        (WebCore::HTMLFrameSetElement::onblur):
-        (WebCore::HTMLFrameSetElement::setOnblur):
-        (WebCore::HTMLFrameSetElement::onerror):
-        (WebCore::HTMLFrameSetElement::setOnerror):
-        (WebCore::HTMLFrameSetElement::onfocus):
-        (WebCore::HTMLFrameSetElement::setOnfocus):
-        (WebCore::HTMLFrameSetElement::onload):
-        (WebCore::HTMLFrameSetElement::setOnload):
-        (WebCore::HTMLFrameSetElement::onbeforeunload):
-        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
-        (WebCore::HTMLFrameSetElement::onmessage):
-        (WebCore::HTMLFrameSetElement::setOnmessage):
-        (WebCore::HTMLFrameSetElement::onoffline):
-        (WebCore::HTMLFrameSetElement::setOnoffline):
-        (WebCore::HTMLFrameSetElement::ononline):
-        (WebCore::HTMLFrameSetElement::setOnonline):
-        (WebCore::HTMLFrameSetElement::onresize):
-        (WebCore::HTMLFrameSetElement::setOnresize):
-        (WebCore::HTMLFrameSetElement::onstorage):
-        (WebCore::HTMLFrameSetElement::setOnstorage):
-        (WebCore::HTMLFrameSetElement::onunload):
-        (WebCore::HTMLFrameSetElement::setOnunload):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLFrameSetElement.idl:
-
-2009-06-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-
-        * dom/Element.cpp:
-        (WebCore::Element::getURLAttribute): Added. For use implementing getters
-        for ReflectURL.
-        * dom/Element.h: Added getURLAttribute.
-
-        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
-
-2009-06-22  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
-        objects.
-        https://bugs.webkit.org/show_bug.cgi?id=26626
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-
-2009-06-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
-        of 300x150.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/html4.css:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::createRenderer):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * rendering/RenderDataGrid.cpp: Added.
-        (WebCore::RenderDataGrid::RenderDataGrid):
-        (WebCore::RenderDataGrid::~RenderDataGrid):
-        (WebCore::RenderDataGrid::calcPrefWidths):
-        (WebCore::RenderDataGrid::paintObject):
-        (WebCore::RenderDataGrid::valueChanged):
-        (WebCore::RenderDataGrid::invalidateScrollbarRect):
-        (WebCore::RenderDataGrid::isActive):
-        * rendering/RenderDataGrid.h: Added.
-        (WebCore::RenderDataGrid::renderName):
-        (WebCore::RenderDataGrid::canHaveChildren):
-        (WebCore::RenderDataGrid::scrollbarCornerPresent):
-
-2009-06-22  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26430
-        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
-        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
-            during window resize when using hardware layers
-        
-        Fix an ordering dependency which caused the compositing position of a layer
-        to be affected by some later sibling, which affected the compositing ancestor's
-        composited bounds.
-        
-        The fix is to only update the compositing positions of layers in some subtree
-        when updateAfterLayout() has been called on all the layers in that subtree,
-        from the ancestor down.
-        
-        Also cache the composited bounds of a RenderLayerBacking, now that we can
-        guarantee that those bounds are accurate.
-        
-        Test: compositing/sibling-positioning.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::hitTestLayer):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        (WebCore::RenderLayerBacking::compositedBounds):
-        (WebCore::RenderLayerBacking::setCompositedBounds):
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
-        * rendering/RenderLayerCompositor.h:
-
-2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
-
-        Add StorageSyncManager.cpp/h
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-
-        In preparation for combining SessionStorage and LocalStorage into a
-        single StorageManager, move the syncing bits out of LocalStorage and
-        into its own class.
-
-        The next step is to combine LocalStorageArea and SessionStorageArea
-        into one.  Then SessionStorage and LocalStorage can be combined.
-
-        Note that combining them will cut down on code paths that must be
-        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
-        write historical sessionStorage to disk when memory is getting tight.
-
-        Also remove a couple bits of cruft including code for quotas which is
-        unnecessary (since a meta-data db is unnecessary since you can just
-        count bytes as you read the local storage databases into memory).
-
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::LocalStorage):
-        (WebCore::LocalStorage::storageArea):
-        (WebCore::LocalStorage::close):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::syncTimerFired):
-        (WebCore::LocalStorageArea::performImport):
-        * storage/LocalStorageArea.h:
-        (WebCore::LocalStorageArea::create):
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::performTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::):
-        (WebCore::LocalStorageTask::createImport):
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        * storage/SessionStorage.h:
-        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
-        (WebCore::StorageSyncManager::create):
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        (WebCore::StorageSyncManager::fullDatabaseFilename):
-        (WebCore::StorageSyncManager::close):
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
-        (WebCore::):
-
-2009-06-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26622
-        Add ChromiumDataObject::copy()
-
-        * platform/chromium/ChromiumDataObject.cpp:
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-06-22  Timothy Hatcher  <timothy@apple.com>
-
-        Add a silhouette image for the enable view of the Resource panel.
-
-        Reviewed by Kevin McCullough.
-
-        * inspector/front-end/Images/resourcesSilhouette.png: Added.
-        * inspector/front-end/inspector.css:
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
 
-2009-06-22  Kyle Prete  <kylep@chromium.org>
+2010-02-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26552
-        Add V8 JS bindings for Audio Constructor.
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added a callback declaration for audio ctor to macro.
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        Added the whole file.
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26600
-        StringImpl::copy() no longer copies empty string correctly
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
-        static method.
-        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
+        Reviewed by Timothy Hatcher.
 
-2009-06-22  Xiaomei Ji  <xji@chromium.org>
+        Web Inspector: Fix rest of the NativeTextViewer (line numbers,
+        conditional breakpoints, selection).
+
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer):
+        (WebInspector.NativeTextViewer.prototype._updatePreferredSize):
+        (WebInspector.NativeTextViewer.prototype._registerMouseListeners):
+        (WebInspector.NativeTextViewer.prototype._mouseDown):
+        (WebInspector.NativeTextViewer.prototype._contextMenu):
+        (WebInspector.NativeTextViewer.prototype._lineForMouseEvent):
+        (WebInspector.NativeTextViewer.prototype._lineHeight):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._registerMouseListeners):
+        (WebInspector.TextEditor.prototype._offsetToLine):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._paint):
+        (WebInspector.TextEditor.prototype._updateDivDecorations):
+        (WebInspector.TextEditor.prototype._paintSelection):
+
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        Reviewed by Eric Seidel
+        Reviewed by Ariya Hidayat.
 
-        Not auto-testable since it involves sending a keyboard event to
-        the popup, which is not possible (eventSender sends the key
-        events through webview, we want to go through the webwidget).
+        Adds implementation of JavaString for V8.
+        https://bugs.webkit.org/show_bug.cgi?id=33953
 
-        This patch is one part of the fix for issue "keyboard selection in
-        Hebrew select element does not work in Windows". The other part of the
-        fix is in chromium's webkit/glue layer.
-        https://bugs.webkit.org/show_bug.cgi?id=25899
+        No new tests, build fix only.
 
-        * manual-tests/keyboard_select_non_english.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
-        character type event. "Char" in Windows or "KeyDown" in Mac is character
-        type event.
-        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
-        indicate whether user types multiple characters continuely as a search
-        prefix or not, it should be only assigned when the event is character 
-        type event. 
+        * bridge/jni/JNIBridge.h: Modified. Include JavaStringV8.h for V8
+        * bridge/jni/v8: Added.
+        * bridge/jni/v8/JavaStringV8.h: Added.
+        (JSC::Bindings::JavaStringImpl::init):
+        (JSC::Bindings::JavaStringImpl::UTF8String):
+        (JSC::Bindings::JavaStringImpl::uchars):
+        (JSC::Bindings::JavaStringImpl::length):
 
-2009-06-22  Kevin McCullough  <kmccullough@apple.com>
+2010-02-01  Alex Milowski  <alex@milowski.com>
 
         Reviewed by Darin Adler.
 
-        <rdar://problem/6115819> Notify of profile start in console
+        Added compile time debug support for mathml layout (block boundary & baseline)
 
-        Put a message in the console that announces that a profile has started,
-        similar to how a console message announces that a profile has finished.
+        * mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::stretchToHeight):
+        (WebCore::RenderMathMLBlock::paint):
+        * mathml/RenderMathMLBlock.h:
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile): Use renamed function.
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        Renamed.
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        New function that logs the message about the profile starting.
-        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
-        * inspector/InspectorController.h:
-        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
-        title if there are multiple profiles, and take into account the fact
-        that titles are displayed twice as much now.
-        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
-        * page/Console.cpp:
-        (WebCore::Console::profile): Call new function.
+2010-02-01  Philippe Normand  <pnormand@igalia.com>
 
-2009-06-22  David Hyatt  <hyatt@apple.com>
+        Rubber stamped by Xan Lopez.
 
-        Reviewed by Sam Weinig.
+        Fixed compilation warning about unsigned vs signed comparison.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26615
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
 
-        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
-        correspond to ones you find on <select> elements.
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
-        Add an expanded property to row elements.
+        Unreviewed. Revert r54112 and r54124 because of Windows build error.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
+        * Android.mk:
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridCellElement.cpp: Added.
-        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
-        (WebCore::HTMLDataGridCellElement::label):
-        (WebCore::HTMLDataGridCellElement::setLabel):
-        (WebCore::HTMLDataGridCellElement::focused):
-        (WebCore::HTMLDataGridCellElement::setFocused):
-        (WebCore::HTMLDataGridCellElement::checked):
-        (WebCore::HTMLDataGridCellElement::setChecked):
-        (WebCore::HTMLDataGridCellElement::indeterminate):
-        (WebCore::HTMLDataGridCellElement::setIndeterminate):
-        (WebCore::HTMLDataGridCellElement::progress):
-        (WebCore::HTMLDataGridCellElement::setProgress):
-        * html/HTMLDataGridCellElement.h: Added.
-        (WebCore::HTMLDataGridCellElement::endTagRequirement):
-        (WebCore::HTMLDataGridCellElement::tagPriority):
-        * html/HTMLDataGridCellElement.idl: Added.
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::autofocus):
-        (WebCore::HTMLDataGridElement::setAutofocus):
-        (WebCore::HTMLDataGridElement::disabled):
-        (WebCore::HTMLDataGridElement::setDisabled):
-        (WebCore::HTMLDataGridElement::size):
-        (WebCore::HTMLDataGridElement::setSize):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        (WebCore::HTMLDataGridRowElement::checkDTD):
-        (WebCore::HTMLDataGridRowElement::expanded):
-        (WebCore::HTMLDataGridRowElement::setExpanded):
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-        * html/HTMLElementsAllInOne.cpp:
-        * html/HTMLTagNames.in:
-
-2009-06-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Add event handler attribute getter/setters to HTMLBodyElement
-        as specified in HTML 5.
-
-        - Removes erroneous inclusion of the onresize and onunload event
-        handler attributes in Element and Document.
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        * platform/graphics/transforms/AffineTransform.cpp: Removed.
+        * platform/graphics/transforms/AffineTransform.h: Removed.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * platform/graphics/wx/PathWx.cpp:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
 
-        * dom/Document.cpp:
-        (WebCore::Document::getWindowAttributeEventListener):
-        * dom/Document.h:
-        * dom/Document.idl:
-        * dom/Element.idl:
-        * dom/Node.cpp:
-        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
-        virtual, since their behavior for HTMLBodyElement differs from the base
-        implementation.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::onblur):
-        (WebCore::HTMLBodyElement::setOnblur):
-        (WebCore::HTMLBodyElement::onerror):
-        (WebCore::HTMLBodyElement::setOnerror):
-        (WebCore::HTMLBodyElement::onfocus):
-        (WebCore::HTMLBodyElement::setOnfocus):
-        (WebCore::HTMLBodyElement::onload):
-        (WebCore::HTMLBodyElement::setOnload):
-        (WebCore::HTMLBodyElement::onbeforeunload):
-        (WebCore::HTMLBodyElement::setOnbeforeunload):
-        (WebCore::HTMLBodyElement::onmessage):
-        (WebCore::HTMLBodyElement::setOnmessage):
-        (WebCore::HTMLBodyElement::onoffline):
-        (WebCore::HTMLBodyElement::setOnoffline):
-        (WebCore::HTMLBodyElement::ononline):
-        (WebCore::HTMLBodyElement::setOnonline):
-        (WebCore::HTMLBodyElement::onresize):
-        (WebCore::HTMLBodyElement::setOnresize):
-        (WebCore::HTMLBodyElement::onstorage):
-        (WebCore::HTMLBodyElement::setOnstorage):
-        (WebCore::HTMLBodyElement::onunload):
-        (WebCore::HTMLBodyElement::setOnunload):
-        * html/HTMLBodyElement.h:
-        * html/HTMLBodyElement.idl:
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+2010-01-31  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26601
-        Remove disabled code for appcache dynamic entries
-
-        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDOMStringListCustom.cpp: Removed.
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
-        * dom/DOMStringList.cpp: Removed.
-        * dom/DOMStringList.h: Removed.
-        * dom/DOMStringList.idl: Removed.
-        * dom/StaticStringList.cpp: Removed.
-        * dom/StaticStringList.h: Removed.
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::addResource):
-        * loader/appcache/ApplicationCache.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        * loader/appcache/ApplicationCacheResource.cpp:
-        (WebCore::ApplicationCacheResource::dumpType):
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeUpdatedType):
-        * loader/appcache/DOMApplicationCache.cpp:
-        * loader/appcache/DOMApplicationCache.h:
-        * loader/appcache/DOMApplicationCache.idl:
-        * page/DOMWindow.idl:
-
-2009-06-22  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows build fix.
-
-        * DerivedSources.cpp:
-        * html/HTMLElementsAllInOne.cpp:
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by John Sullivan.
-
-        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
-        Japanese can't be input.
-
-        WebKit uses a per-frame input context for most editable fields, and application's global
-        context for password fields, manually controlling secure input state and the list of available
-        input sources.
-
-        We were setting TSMDocument property to disable non-Roman input methods after focus changed
-        to a password field, but before selection was updated. This resulted in the property being
-        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
-        context cached by +[NSApplication updateWindows], we change context based on selection,
-        not on focus.
-
-        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
-        context that we use for password fields - the global one - there is no need to get the active
-        one.
-
-2009-06-22  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt and Eric Seidel.
-
-        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-
-        Test: scrollbars/scrollbar-crash-on-refresh.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Gives the FrameView a change to do any necessary cleanup on
-        Document::detach() which is where the renderArena gets detroyed.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Gets rid of any custom scrollbars (if the docment supplied them).
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::isCustomScrollbar):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        Removed the check for document()->frame().  If frame() is 0 in this code,
-        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
-        * rendering/RenderScrollbar.h:
-        (WebCore::RenderScrollbar::isCustomScrollbar):
-
-2009-06-22  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
-          <rdar://problem/6537777> CSS gradient not repainted when image load
-          completes
-
-        Test: fast/repaint/background-generated.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers): Return true if the layer does not
-        specify a size and the image uses the container size.
+        Limit the scope of packing alignment to avoid MSVC C4103 warning.
+        https://bugs.webkit.org/show_bug.cgi?id=34390
 
-2009-06-22  David Hyatt  <hyatt@apple.com>
+        Use pack(push, 16) and pack(pop) to limit the scope of packing
+        alignment change.
 
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26607
-
-        Add IDL for HTMLDataGridRowElement.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::primary):
-        (WebCore::HTMLDataGridColElement::setPrimary):
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::checkDTD):
-        (WebCore::HTMLDataGridElement::multiple):
-        (WebCore::HTMLDataGridElement::setMultiple):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp: Added.
-        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
-        (WebCore::HTMLDataGridRowElement::selected):
-        (WebCore::HTMLDataGridRowElement::setSelected):
-        (WebCore::HTMLDataGridRowElement::focused):
-        (WebCore::HTMLDataGridRowElement::setFocused):
-        * html/HTMLDataGridRowElement.h: Added.
-        (WebCore::HTMLDataGridRowElement::tagPriority):
-        * html/HTMLDataGridRowElement.idl: Added.
-        * html/HTMLTagNames.in:
-
-2009-06-19  Yael Aharon <yael.aharon@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26556
-
-        Fix a crash in case that the QNetworkReply::readReady signal is
-        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
-        QNetworkreply::finished signal is received and processed before
-        QNetworkReply::readReady is processed.
-
-        * manual-tests/qt/unload-alert.html: Added.
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::setLoadMode):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::start):
-        (WebCore::QNetworkReplyHandler::sendQueuedItems):
-        * platform/network/qt/QNetworkReplyHandler.h:
-        (WebCore::QNetworkReplyHandler::):
-
-2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Fix the Qt build.
-
-        * WebCore.pro:
-
-2009-06-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
-        more consistent and to make SVGElement.h be included in the header rather than in
-        every implementation file that includes the header. Added code to use getAttribute
-        and setAttribute directly when the [Reflect] extended attribute is used.
-
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-
-        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
-        reflect content attributes. Restricting this to one class for now to keep the
-        patch small and start out slowly.
-
-2009-06-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
-        Only expose event handler attributes to elements and documents.
-
-        Test: fast/dom/event-attribute-availability.html
-
-        * dom/Document.idl:
-        * dom/Element.idl:
-        * dom/Node.cpp:
-        * dom/Node.h:
-        * dom/Node.idl:
-
-2009-06-21  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26580
-        
-        Fix to enable XSSAuditor on child windows.
-        
-        Test: http/tests/security/xssAuditor/link-opens-new-window.html
-        
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::isEnabled):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
-        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
-        to query Settings.
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY.
-
-        Speculative windows build fix (idea by Mark Rowe).
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (Speculative gtk build fix).
-
-        * GNUmakefile.am:
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY.
-
-        Speculative tiger build fix and a windows build fix.
-        More fixes may still be in order.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * dom/default/PlatformMessagePortChannel.h:
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (Speculative tiger build fix).
-
-        * dom/default/PlatformMessagePortChannel.h:
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
-
-2009-06-21  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=26448>
-        
-        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
-        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markActiveObjectsForContext):
-        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::disentangle):
-        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::locallyEntangledPort):
-        Added API for fetching the entangled port if it is run by the same thread
-        * dom/MessagePort.h:
-        * dom/MessagePortProxyWrapper.h:
-        * dom/default/MessagePortProxy.cpp:
-        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
-        Added API for fetching the entangled port if it is run by the same thread        
-        (WebCore::MessagePortProxy::hasPendingActivity):
-        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
-        (WebCore::MessagePortProxy::locallyEntangledPort):
-        * dom/default/MessagePortProxy.h:
-
-2009-06-21  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=25043>
-        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
-
-        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
-        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
-        entirely into the platform-dependent proxy.
-
-        Created a thread-safe default PlatformMessagePortChannel implementation.
-
-        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
-        cross-thread MessagePorts work.
-        
-        * GNUMakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-            Added MessagePortChannel/PlatformMessagePortChannel files.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-            Changed ports to not mark their entangled pair as reachable, per the spec.
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::MessagePort):
-        (WebCore::MessagePort::~MessagePort):
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::disentangle):
-        (WebCore::MessagePort::messageAvailable):
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::close):
-        (WebCore::MessagePort::entangle):
-        (WebCore::MessagePort::contextDestroyed):
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::hasPendingActivity):
-            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
-        * dom/MessagePort.h:
-            Renamed isQueueOpen() to started().
-        * dom/MessagePort.idl:
-            Removed startConversation and onclose.
-        * dom/MessagePortProxy.h: Removed.
-        * dom/MessagePortChannel.cpp: Added.
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        (WebCore::MessagePortChannel::~MessagePortChannel):
-        * dom/MessagePortChannel.h: Added.
-        (WebCore::MessagePortChannel::EventData::message):
-        (WebCore::MessagePortChannel::EventData::channel):
-            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
-        (WebCore::MessagePortChannel::MessagePortChannel):
-        (WebCore::MessagePortChannel::create):        
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
-            Renamed isQueueOpen() to started().
-        * dom/default/PlatformMessagePortChannel.cpp: Added.
-        (WebCore::MessagePortChannel::entangleIfOpen):
-        (WebCore::MessagePortChannel::disentangle):
-        (WebCore::MessagePortChannel::postMessageToRemote):
-        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
-        (WebCore::MessagePortChannel::close):
-        (WebCore::MessagePortChannel::isConnectedTo):
-        (WebCore::MessagePortChannel::hasPendingActivity):
-        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
-        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
-        (WebCore::PlatformMessagePortChannel::createChannel):
-        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
-        (WebCore::PlatformMessagePortChannel::disentangle):
-        (WebCore::PlatformMessagePortChannel::setRemotePort):
-        (WebCore::PlatformMessagePortChannel::remotePort):
-        (WebCore::PlatformMessagePortChannel::entangledChannel):
-        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
-        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
-        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
-        (WebCore::PlatformMessagePortChannel::isConnectedTo):
-        (WebCore::PlatformMessagePortChannel::close):
-        (WebCore::PlatformMessagePortChannel::closeInternal):
-        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
-        * dom/default/PlatformMessagePortChannel.h: Added.
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
-        (WebCore::PostMessageTimer::event):
-        (WebCore::DOMWindow::postMessage):
-        (WebCore::DOMWindow::postMessageTimerFired):
-
-2009-06-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
-          <rdar://problem/5682745> resize: vertical does not restrict to vertical
-          resize
-
-        Test: fast/css/resize-single-axis.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
-        axis.
+        * bindings/js/JSSVGPODTypeWrapper.h:
 
-2009-06-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Eric Seidel
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
-        event.currentTarget for listener registered on window should point to the window object like in Firefox
-
-        Test: fast/events/event-trace.html
-
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
-        to it. We previously used the document because DOMWindow was not yet an EventTarget.
-
-2009-06-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
-          resize value not compared
-
-        Test: fast/css/resize-value-compared.html
-
-        * rendering/style/StyleRareInheritedData.cpp:
-        (WebCore::StyleRareInheritedData::operator==): Compare the resize
-        member.
-
-2009-06-19  Alice Liu  <alice.liu@apple.com>
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
-        Repro crash animating GIF if previously used in a closed window's back/forward list
-        Also filed as <rdar://problem/6978362>
-
-        Reviewed by Maciej Stachowiak.
-
-        Can't test this bug with an automated layout test since it requires b/f caching 
-        * manual-tests/animated-gif-bfcache-crash.html: Added.
-        * manual-tests/resources/containsAnimatedGif.html: Added.
-
-        Adding checks for hostWindow() since there is no guarantee that the Page is alive
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        (WebCore::ScrollView::contentsToScreen):
-        (WebCore::ScrollView::screenToContents):
-        (WebCore::ScrollView::wheelEvent):
-
-2009-06-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
-        Shadowing of top and parent
-
-        * page/DOMWindow.idl:
-
-2009-06-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
-        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
-
-        We allow selections to begin within an element that has -webkit-user-select: none set,
-        unless the element is draggable as dragging should take priority over starting a selection.
-
-        Test: editing/selection/user-drag-element-and-user-select-none.html
-
-        * dom/Node.cpp:
-        (WebCore::Node::canStartSelection):
-
-2009-06-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
-        https://bugs.webkit.org/show_bug.cgi?id=26528
-        rdar://problem/6985329
-
-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
-        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
-        remove assumption that innerTextElement will never be 0 since RenderTextControl
-        doesn't really guarantee this.
-
-2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by NOBODY.
-
-        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
-
-        * WebCore.pro:
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26561
-
-        Remove a memcpy by retrieving the already existing copy of a string
-        instead of making a new one.
-
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::source):
-        * bindings/js/StringSourceProvider.h:
-        (WebCore::StringSourceProvider::source):
-
-2009-06-19  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Steve Falkenburg.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26488
-        No Support for Single Finger or Two Finger Panning in Windows 7
-        
-        The code in WebCore allows us to interpret a Pan gesture as
-        a mousewheel event, and we are able to reuse the scrolling code.
-        Another constructor was created in WheelEventWin which takes data
-        better suited to the pan guesture than what was currently there. 
-        
-        Unable to add tests to simulate touch behavior/gestures.
-
-        * platform/PlatformWheelEvent.h:
-        * platform/win/WheelEventWin.cpp:
-
-2009-06-19  Chris Marrin  <cmarrin@apple.com>
-
-        Fixed a build error, which only shows up in the i386 compile
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-06-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
-        video track becomes detached from its controller.
-        
-        When in the media document, the MediaPlayer should not report that it
-        is capable of hardware acceleration, because it renders via a QTMovieView
-        which is already accelerated.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-
-2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Adding XSSAuditor.cpp to the wx build.
-
-        * WebCoreSources.bkl:
-
-2009-06-19  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26544
-
-        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
-        This is not really testable, since we can't see what the hardware animation is doing.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-06-19  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        An additional fix for Bug 26532: Native functions do not correctly unlink
-        from optimised callsites when they're collected
-        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
-
-        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
-        accessors, so the type of object you get to wrap a function is the same,
-        regardless of whether the access to the function is cross-frame.
-        
-        This is faster and more idiomatic than what we had before. It also would
-        have avoided Bug 26532 because it would have prevented a conflicting
-        PrototypeFunction from being allocated to wrap postMessage, where a
-        NativeFunctionWrapper had been allocated previously.
-        
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::objectToStringFunctionGetter):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::nonCachingStaticFunctionGetter):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::nonCachingStaticBackFunctionGetter):
-        (WebCore::nonCachingStaticForwardFunctionGetter):
-        (WebCore::nonCachingStaticGoFunctionGetter):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::nonCachingStaticReplaceFunctionGetter):
-        (WebCore::nonCachingStaticReloadFunctionGetter):
-        (WebCore::nonCachingStaticAssignFunctionGetter):
-
-2009-06-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by John Sullivan
-
-        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
-        
-        Fix a crash that could occur in complex content due to timing issues
-        when doing a partial layer tree rebuild which is required when painting;
-        setCompositingParent() could be called with a parent which has not been made
-        compositing yet.
-
-2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Build fix. Adding missing HTMLDataGrid* files to the build.
-
-        * GNUmakefile.am:
-
-2009-06-19  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
-        Make BMPImageReader a standalone class that is used by ICOImageDecoder
-        and BMPImageDecoder to decode individual BMPs within a file.  These
-        decoders now inherit directly from ImageDecoder.
-        
-        This also makes these decoders decode on-demand in isSizeAvailable() and
-        frameBufferAtIndex(), like the other decoders, instead of when setData()
-        is called, like before.  This should provide a speedup on pages
-        containing BMPs that aren't immediately onscreen.
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::BMPImageDecoder):
-        (WebCore::BMPImageDecoder::setData):
-        (WebCore::BMPImageDecoder::isSizeAvailable):
-        (WebCore::BMPImageDecoder::frameBufferAtIndex):
-        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
-        (WebCore::BMPImageDecoder::decode):
-        (WebCore::BMPImageDecoder::processFileHeader):
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::readUint32):
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::BMPImageReader):
-        (WebCore::BMPImageReader::decodeBMP):
-        (WebCore::BMPImageReader::readInfoHeaderSize):
-        (WebCore::BMPImageReader::processInfoHeader):
-        (WebCore::BMPImageReader::readInfoHeader):
-        (WebCore::BMPImageReader::processBitmasks):
-        (WebCore::BMPImageReader::processColorTable):
-        (WebCore::BMPImageReader::processRLEData):
-        (WebCore::BMPImageReader::processNonRLEData):
-        (WebCore::BMPImageReader::setFailed):
-        * platform/image-decoders/bmp/BMPImageReader.h:
-        (WebCore::BMPImageReader::readUint16):
-        (WebCore::BMPImageReader::readUint32):
-        (WebCore::BMPImageReader::setBuffer):
-        (WebCore::BMPImageReader::setData):
-        (WebCore::BMPImageReader::):
-        (WebCore::BMPImageReader::pastEndOfImage):
-        (WebCore::BMPImageReader::readCurrentPixel):
-        (WebCore::BMPImageReader::setRGBA):
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::setData):
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        (WebCore::ICOImageDecoder::size):
-        (WebCore::ICOImageDecoder::frameBufferAtIndex):
-        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
-        (WebCore::ICOImageDecoder::decode):
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::processDirectoryEntries):
-        (WebCore::ICOImageDecoder::readDirectoryEntry):
-        (WebCore::ICOImageDecoder::processImageType):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::readUint16):
-        (WebCore::ICOImageDecoder::readUint32):
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26555
-
-        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
-        the same API in V8 and JSC.
-
-        * WebCore/bindings/js/ScriptController.cpp:
-        * WebCore/bindings/js/ScriptSourceCode.h:
-        * WebCore/bindings/v8/ScriptController.cpp:
-        * WebCore/page/XSSAuditor.cpp:
-        * WebCore/page/XSSAuditor.h:
-
-2009-06-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26547
-        
-        Implement the IDL interface for HTMLDataGridColElement.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridColElement.cpp: Added.
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::label):
-        (WebCore::HTMLDataGridColElement::setLabel):
-        (WebCore::HTMLDataGridColElement::type):
-        (WebCore::HTMLDataGridColElement::setType):
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        (WebCore::HTMLDataGridColElement::sortDirection):
-        (WebCore::HTMLDataGridColElement::setSortDirection):
-        (WebCore::HTMLDataGridColElement::selected):
-        (WebCore::HTMLDataGridColElement::setSelected):
-        * html/HTMLDataGridColElement.h: Added.
-        (WebCore::HTMLDataGridColElement::endTagRequirement):
-        (WebCore::HTMLDataGridColElement::tagPriority):
-        * html/HTMLDataGridColElement.idl: Added.
-        * html/HTMLDataGridElement.h:
-        * html/HTMLElementsAllInOne.cpp:
-        * html/HTMLTagNames.in:
-        * page/DOMWindow.idl:
-
-2009-06-19  Chris Evans  <scarybeasts@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        There is no new test because this cannot be tested deterministically.
-        I've not been able to cause a crash at all in the test framework, but
-        I have verified that this is happening in the wild and that the patch
-        fixes the likely cause in the debugger.
-
-        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
-          of our input buffer looking for the end of the comment.
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26536
-
-        Fix external-script-URL-location.html and
-        write-external-script-open.html LayoutTests.
-
-        implicitOpen is called from several places.  We need to setXSSAuditor
-        each time, so I moved the call inside implicitOpen.
-
-        * dom/Document.cpp:
-        (WebCore::Document::open):
-        (WebCore::Document::implicitOpen):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-
-2009-06-19  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by David Levin.
-
-        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
-        that Chromium shows only the first filename even if a user selects
-        multiple files for <input type=file multiple>.
-        <https://bugs.webkit.org/show_bug.cgi?id=26502>
-
-        * platform/chromium/FileChooserChromium.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-
-2009-06-19  Dan Bernstein  <mitz@apple.com>
+        Fix valueAsNumber calculation for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=34304
 
-        Reviewed by Dave Hyatt.
-
-        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
-          to look up a word in Dictionary using command-control-d
-
-        Test: editing/selection/move-by-line-005.html
-
-        The root cause of this bug was searchAheadForBetterMatch() continuing
-        past the first rendered text object after the given object. While we
-        want to skip non-rendered text and empty containers, when we encounter
-        rendered text object, we must return a text box for that object.
-
-        * dom/Position.cpp:
-        (WebCore::searchAheadForBetterMatch):
+        valueAsNumber calculation for type=month which was checked in as
+        r53893 was the number of milliseconds since UNIX epoch, and it was
+        wrong. The correct way is the number months since UNIX epoch.
 
-2009-06-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by David Levin
-
-        https://bugs.webkit.org/show_bug.cgi?id=25657
+        * html/DateComponents.cpp:
+        (WebCore::DateComponents::setMonthsSinceEpoch):
+        (WebCore::DateComponents::monthsSinceEpoch):
+        * html/DateComponents.h: Declare setMonthsSinceEpoch() and monthsSinceEpoch().
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseToDouble):
+          Switch to monthsSinceEpoch() for type=MONTH.
+        (WebCore::HTMLInputElement::valueAsDate):
+          Add code with millisecondsSinceEpoch() for MONTH because
+          parseToDouble() changed its behavior.
+        (WebCore::HTMLInputElement::setValueAsNumber):
+          Use setMonthsSinceEpoch() for MONTH.
 
-        Chromium Linux port does not handle non-BMP characters properly.
-        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
-        codepoints out of a UTF-16 input string.
+2010-01-31  Dan Bernstein  <mitz@apple.com>
 
-        A manual test is added for non-BMP character rendering,
-        which we can use until a small freely-distributable font
-        covering non-BMP is added to the Webkit source tree.
+        Reviewed by Timothy Hatcher.
 
+        Web Inspector: REGRESSION: Numbers in bubbles are vertically off-center
+        https://bugs.webkit.org/show_bug.cgi?id=34398
 
-        * platform/graphics/chromium/FontCacheLinux.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
-        * manual-tests/non-bmp.html: Added.
+        * inspector/front-end/inspector.css: Specify line-height: normal for
+        ".console-message .bubble" and ".sidebar-tree-item .status .bubble".
 
-2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
+2010-01-28  Ojan Vafai  <ojan@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Darin Adler.
 
-        V8 Bindings: return proper state from the script stack.
+        Implement CSSOM Range.getClientRects for collapsed selections
+        https://bugs.webkit.org/show_bug.cgi?id=34239
 
-        https://bugs.webkit.org/show_bug.cgi?id=26512
+        When getting the quads for a range on a text node, allow returning
+        zero width quads. This leaves the case of collapsed selections inside
+        elements still not fixed, but no worse.
 
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        * bindings/v8/ScriptCallStack.h:
-        (WebCore::ScriptCallStack::state):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteQuadsForRange):
 
-2009-06-19  Jessie Berlin  <jberlin@apple.com>
+2010-01-31  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Windows build fix.
-        
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
+        Animated scaling of background-image is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=33808
 
-        Reviewed by Simon Hausmann.
-        Build fix after 44825.
+        Implement a version of the RenderImage animated scaling optimisation
+        for background images. Due to the possibility of arbitrary transforms
+        being applied to containing elements we explicitly check the current
+        CTM of the context for scaling or rotation.
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
-        <https://bugs.webkit.org/show_bug.cgi?id=26426>
-
-        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
-        The original number cannot be represented by mantissa of float
-        (23bit) so that it caused some error.
-
-        Test: fast/canvas/image-object-in-canvas.html:
-
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed attempt to fix the Chromium build.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.h:
-        (WebCore::ScriptController::xssAuditor):
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::~RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::hiqhQualityRepaintTimer):
+        (WebCore::RenderBoxModelScaleData::size):
+        (WebCore::RenderBoxModelScaleData::setSize):
+        (WebCore::RenderBoxModelScaleData::lastPaintTime):
+        (WebCore::RenderBoxModelScaleData::setLastPaintTime):
+        (WebCore::RenderBoxModelScaleData::useLowQualityScale):
+        (WebCore::RenderBoxModelScaleData::transform):
+        (WebCore::RenderBoxModelScaleData::setTransform):
+        (WebCore::RenderBoxModelScaleData::setUseLowQualityScale):
+        (WebCore::RenderBoxModelScaleObserver::boxModelObjectDestroyed):
+        (WebCore::RenderBoxModelScaleObserver::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
 
-2009-06-18  Adam Barth  <abarth@webkit.org>
+2010-01-31  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26199
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        Added an experimental reflective XSS filter.  The filter is disabled by
-        default.
+        These are the first steps on reimplementing AffineTransform. Unlike
+        the old affine code, this one is platform independent like TransformationMatrix.
+        AffineTransform has the benefit, that it stores just 6 doubles instead of
+        16 in TransformationMatrix. The calculations of transformations are not that
+        complex and can improve the memory usage and speed of SVG.
+        AffineTransform can be used by HTML Canvas3D or SVG, since they are 2D related (at
+        least for the moment).
+        HTML Canvas is the first that makes use of the new AffineTransform. Next patches
+        will introduce the affine code to SVG.
 
-        Test: http/tests/security/xssAuditor/script-tag.html
+        No new tests. The new AffineTransformation code is tested by fast/canvas.
 
+        * Android.mk:
         * GNUmakefile.am:
-        * WebCore.base.exp:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        (WebCore::ScriptController::xssAuditor):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * dom/Tokenizer.h:
-        (WebCore::Tokenizer::xssAuditor):
-        (WebCore::Tokenizer::setXSSAuditor):
-        (WebCore::Tokenizer::Tokenizer):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::requestObject):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setXSSAuditorEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::xssAuditorEnabled):
-        * page/XSSAuditor.cpp: Added.
-        (WebCore::isControlCharacter):
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::~XSSAuditor):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h: Added.
-        (WebCore::XSSAuditor::isEnabled):
-        (WebCore::XSSAuditor::setXSSAuditorEnabled):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feOffset and objectBoundingBox
-        [https://bugs.webkit.org/show_bug.cgi?id=26441]
-
-        If we use objectBoundingBox for primitiveUnits, the fractions given
-        to dx or dy of feOffset must be multiplied with the referenced objects
-        objectBoundingBox size.
-
-        Test: svg/filters/feOffset.svg
-
-        * svg/graphics/filters/SVGFEOffset.cpp:
-        (WebCore::FEOffset::apply):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feTile implementation missing
-        [https://bugs.webkit.org/show_bug.cgi?id=26419]
-
-        Implementation of feTile, a pattern effect for SVG filters. It was
-        necessary to modify FilterEffect since source inputs need a secial
-        logic and we have to identify if an effect is a source input.
-
-        Tests: svg/batik/filters/feTile.svg
-               svg/filters/feTile.svg
-
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::isSourceInput):
-        * platform/graphics/filters/SourceAlpha.h:
-        (WebCore::SourceAlpha::isSourceInput):
-        * platform/graphics/filters/SourceGraphic.h:
-        (WebCore::SourceGraphic::isSourceInput):
-        * svg/graphics/filters/SVGFETile.cpp:
-        (WebCore::FETile::apply):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feMerge implementation
-        [https://bugs.webkit.org/show_bug.cgi?id=26480]
-
-        Added feMerge to the SVG Filter system.
-
-        Test: svg/filters/feMerge.svg
-
-        * svg/graphics/filters/SVGFEMerge.cpp:
-        (WebCore::FEMerge::uniteChildEffectSubregions):
-        (WebCore::FEMerge::apply):
-        * svg/graphics/filters/SVGFEMerge.h:
-
-2009-06-18  Mark Rowe  <mrowe@apple.com>
-
-        Speculative Windows build fix.
-
-        * page/win/FrameCGWin.cpp: Add missing #include.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Dave Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26425
-        Final refactorings, picking up a few places where BitmapInfo
-        could be used.
-
-        * page/win/FrameCGWin.cpp:
-        (WebCore::imageFromRect):
-        * platform/win/CursorWin.cpp:
-        (WebCore::Cursor::Cursor):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-
-2009-06-18  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
-        https://bugs.webkit.org/show_bug.cgi?id=26522
-
-        Test: accessibility/non-data-table-cell-title-ui-element.html
-
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::titleUIElement):
-
-2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix after recent RenderTheme changes.
-
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::~RenderThemeWx):
-        (WebCore::RenderTheme::themeForPage):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
-        Attempt to minimize diff of following functional change by first landing
-        non-functional change to:
-        * Make readUintX() public and static (since they will need to be once
-          BMPImageReader is included in *ImageDecoder via composition rather
-          than inheritance).  Add wrappers in each class so callers can be
-          simpler.  In the next patch, these wrappers will be beefed up slightly
-          and the callers will get even simpler.
-        * Change direct setting of m_failed to use setFailed(), since in the
-          next patch much of this code won't even have direct access to m_failed
-        * Add a helper function in ICOImageDecoder to determine the image type
-          instead of simply doing it inline
-        * Rewrap lines that used to be <=80 cols and slipped over it during the
-          original landing of these decoders
-        * Other misc. changes, e.g. adding constructor definitions, reordering
-          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
-          functional effect but minimize the subsequent diff for readability
-
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::BMPImageDecoder):
-        (WebCore::BMPImageDecoder::processFileHeader):
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::readUint32):
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::decodeBMP):
-        (WebCore::BMPImageReader::getInfoHeaderSize):
-        (WebCore::BMPImageReader::processInfoHeader):
-        (WebCore::BMPImageReader::readInfoHeader):
-        (WebCore::BMPImageReader::processBitmasks):
-        (WebCore::BMPImageReader::processColorTable):
-        (WebCore::BMPImageReader::processRLEData):
-        (WebCore::BMPImageReader::processNonRLEData):
-        * platform/image-decoders/bmp/BMPImageReader.h:
-        (WebCore::BMPImageReader::readUint16Helper):
-        (WebCore::BMPImageReader::readUint32Helper):
-        (WebCore::BMPImageReader::):
-        (WebCore::BMPImageReader::readUint16):
-        (WebCore::BMPImageReader::readUint32):
-        (WebCore::BMPImageReader::readCurrentPixel):
-        (WebCore::BMPImageReader::getComponent):
-        (WebCore::BMPImageReader::setI):
-        (WebCore::BMPImageReader::setRGBA):
-        (WebCore::BMPImageReader::fillRGBA):
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        (WebCore::ICOImageDecoder::size):
-        (WebCore::ICOImageDecoder::decodeImage):
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::processDirectoryEntries):
-        (WebCore::ICOImageDecoder::isBetterEntry):
-        (WebCore::ICOImageDecoder::processImageType):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::readUint16):
-        (WebCore::ICOImageDecoder::readUint32):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Fix build bustage.
-
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-
-2009-06-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
-
-        Convert intptr_t to Strings so that we don't loose bits in the
-        conversion to JS.  Previously they were being put into 32bit ints.
-
-        * inspector/InspectorController.cpp: Convert the String back to an
-        intptr_t.
-        (WebCore::InspectorController::addBreakpoint):
-        (WebCore::InspectorController::removeBreakpoint):
-        * inspector/InspectorController.h:
-        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
-        truncation.
-        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
-        (WebCore::InspectorFrontend::parsedScriptSource):
-        * platform/text/PlatformString.h: Implemented the necessary conversion
-        functions to be able to convert to and from an intptr_t.
-        * platform/text/String.cpp: Ditto.
-        (WebCore::String::toIntPtrStrict):
-        (WebCore::String::toIntPtr):
-        (WebCore::charactersToIntPtrStrict):
-        (WebCore::charactersToIntPtr):
-        * platform/text/StringImpl.cpp: Ditto.
-        (WebCore::StringImpl::toIntPtrStrict):
-        (WebCore::StringImpl::toIntPtr):
-        * platform/text/StringImpl.h: Ditto.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Final cleanups in this refactoring:
-        (1) Move WindowsBitmap implementation from CG-specific file to
-            the platform-common GraphicsContextWin.cpp, since it is
-            equally useful on both platforms.
-        (2) Revise the TransformationMatrix logic as suggested by
-            Adam Roben in his review comments to Part #2 of this
-            refactoring.
-
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
-        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
-        (WebCore::GraphicsContext::createWindowsBitmap):
-        (WebCore::GraphicsContext::getWindowsContext):
-        (WebCore::GraphicsContextPlatformPrivate::scale):
-        (WebCore::GraphicsContextPlatformPrivate::rotate):
-        (WebCore::GraphicsContextPlatformPrivate::translate):
-        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
-        Make isSizeAvailable non-const, since it's not logically const (it
-        triggers lazy decoding), and simplify all the implementations (without
-        changing behavior; just make less verbose).  Remove some other
-        inappropriate consts, which enables the removal of all the mutable
-        declarations in the decoders.
-
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::isSizeAvailable):
-        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::isSizeAvailable):
-        (WebCore::GIFImageDecoder::repetitionCount):
-        (WebCore::GIFImageDecoder::decode):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageDecoder::isSizeAvailable):
-        (WebCore::JPEGImageDecoder::decode):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::isSizeAvailable):
-        (WebCore::PNGImageDecoder::decode):
-        * platform/image-decoders/png/PNGImageDecoder.h:
-        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
-        (WebCore::XBMImageDecoder::isSizeAvailable):
-        (WebCore::XBMImageDecoder::frameBufferAtIndex):
-        (WebCore::XBMImageDecoder::decode):
-        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move some common functions out of platform files and into
-        the common implementation.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26425.
-        Add a new platform context method (flush) so that the
-        getWindowsContext method can be consolidated into the common
-        GraphicsContextWin.cpp file.
-         
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
         * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::AffineTransform::operator cairo_matrix_t):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
         * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
-        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
-          getWindowContext method.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
-          getWindowContext method and fillWithClearColor methods.
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
-        (WebCore::GraphicsContext::getWindowsContext): Moved
-          from *CairoWin.cpp
-
-2009-06-18  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Remove code that I accidentally committed in r44811.
-
-        * editing/markup.cpp:
-        (WebCore::createMarkup):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
-        starts sometimes (with hardware acceleration).
-        
-        When deciding which RenderLayers should be composited, when a layer goes into
-        compositing mode we repaint the old location. However, we did that before
-        we'd looked at all the factors that may force a layer to composite, so missed
-        some cases. Fix by doing the repaint once we really know whether it's going
-        to composite.
-
-        Test: compositing/repaint/become-overlay-composited-layer.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
-        the Tiger build where QTMovieLayer does not exist.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-
-2009-06-17  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=15189
-        Adds the HTML5 input event support for textarea.
-        
-        Also, moves the oninput attribute parse handling to HTMLElement so that
-        it can be set on any HTML element so that bubbling events can be handled
-        using HTML attribute handlers.
-
-        Test: fast/forms/textarea-input-event.html
-
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Share code between filterEffects
-        [https://bugs.webkit.org/show_bug.cgi?id=26479]
-
-        Share more code of filter effects. The imageBuffer creation can move to
-        FilterEffect ant every effect asks for the GraphicsContext. Move the
-        drawingRect calculation to FilterEffect.
-
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::calculateDrawingRect):
-        (WebCore::FilterEffect::getEffectContext):
-        * platform/graphics/filters/FilterEffect.h:
-        * platform/graphics/filters/SourceGraphic.cpp:
-        (WebCore::SourceGraphic::apply):
-        * svg/graphics/filters/SVGFEFlood.cpp:
-        (WebCore::FEFlood::apply):
-        * svg/graphics/filters/SVGFEOffset.cpp:
-        (WebCore::FEOffset::apply):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26499
-        
-        Support hardware-accelerationed rendering of video elements.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
-        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
-        Just move these methods to group the render-related methods together.
-        
-        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
-        Call out method to ask the RenderLayerCompositor if presentation of this video
-        can be acclerated. It might say no, if, for example, the video has a reflection.
-        
-        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
-        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
-        
-        * html/HTMLMediaElement.h:
-        Reordered the rendering-related methods, and added two methods related to video
-        acceleration.
-        
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
-        Called by the rendering system when it determines that the video must go into, or
-        fall off of the hardware-accelerated path.
-        
-        (WebCore::MediaPlayer::supportsAcceleratedRendering):
-        Method to say whether the media engine supports accelerated rendering.
-        
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
-        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
-        Moved.
-        
-        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
-        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
-        New methods to ask the client if the rendering system can support accelerated
-        rendering, and to get a GraphicsLayer to plug the movie layer into.
-        
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
-        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
-        Forwarding methods from MediaPlayer.
-        
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
-        Methods to create and destroy the QTMovieLayer.
-        
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
-        Methods to clarify the code that decides which of the 3 rendering modes to use.
-        
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        Changed to use the new rendering mode methods.
-        
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        Destroy the layer if we have one.
-        
-        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
-        Small utility method.
-        
-        (WebCore::MediaPlayerPrivate::updateStates):
-        Move the call to setUpVideoRendering() to before we send out the state notifications,
-        so that we will have created the rendering objects already.
-        
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-        Return true if we have QTMovieLayer.
-        
-        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
-        We've been told that we went into or out of accelerated mode; maybe reset
-        the renderer, and set the layer if we have to.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::rendererContentChanged):
-        We may need to udpate compositing layers if the video went into accelerated mode.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::canUseDirectCompositing):
-        Add smarts to deal with video, which allows us to avoid extra backing store.
-        
-        (WebCore::RenderLayerBacking::contentsBox):
-        Use the videoBox to use the content layer for video layers.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        Poke the RenderVideo if the state changed.
-        
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        Handle an edge case when the video element itself is a stacking context
-        because of opacity or transform.
-        
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
-        Allow video to throw us into compositing mode if the media engine supports it.
-        
-        * rendering/RenderLayerCompositor.h:
-        New methods related to video.
-        
-        * rendering/RenderVideo.h:
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::updatePlayer):
-        Call rendererContentChanged() to give the compositor a change to throw the video into
-        compositing mode.
-        
-        (WebCore::RenderVideo::supportsAcceleratedRendering):
-        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
-        (WebCore::RenderVideo::videoGraphicsLayer):
-        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
-
-2009-06-18  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Niko.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26385
-        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
-
-        Also do the isValid check for outer <svg>.
-
-        Test: svg/custom/outer-svg-unknown-feature.svg
-
-        * svg/SVGDocument.cpp:
-        (WebCore::SVGDocument::childShouldCreateRenderer):
-        * svg/SVGDocument.h:
-
-2009-06-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
-          apple.com cuts entered text
-
-        Test: fast/forms/search-vertical-alignment.html
-
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
-            the search field's inner block.
-
-2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix compilation with Symbian WINSCW compiler, which produced
-        multiple definitions of the CSSPrimitiveValue conversion operators.
-
-        It turns out that they are defined inline but not declared inline.
-
-        Adding the inline keyword to the declaration fixes the build.
-
-        * css/CSSPrimitiveValue.h:
-
-2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
-
-        Reviewed by Simon Hausman.
-
-        Clarify in docs how to compile with debug information.
-
-        * WebCore.pro:
-
-2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] When writing an URL to the clipboard, save the corresponding title
-        in the mime data as well.
-
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::writeURL):
-
-2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
-
-        [Qt] Fix build. Add HTMLDataGridElement.
-
-        * WebCore.pro:
-
-2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix.
-
-        Add HTMLDataGridElement header and IDL to the build script.
-
-        * GNUmakefile.am:
-
-2009-06-18  Chris Evans  <scarybeasts@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        Fix 8-digit long hex entities. Fixes bug 26454
-        https://bugs.webkit.org/show_bug.cgi?id=26454
-
-        Test: fast/parser/eightdigithexentity.html
-
-        * html/HTMLTokenizer.cpp: fix off-by-ones.
-
-2009-06-18  David Levin  <levin@chromium.org>
-
-        Fix chromium linux build.
-
-        Fixes a mistake that happened during the complicated merge for
-        landing r44775, r44776, r44777.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::create):
-
-2009-06-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26499
-        
-        First step to making video rendering be hardware-accelerated:
-        make <video> elements get self-painting RenderLayers, and add
-        an isVideo() virtual method to RenderObject.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
-        (WebCore::RenderLayer::isSelfPaintingLayer):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isVideo):
-        * rendering/RenderVideo.h:
-        (WebCore::RenderVideo::requiresLayer):
-        (WebCore::RenderVideo::isVideo):
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Refactor a few common routines in the various Windows ports
-        and reduce some duplicated code.
-
-        (1) Create TransformationMatrix XFORM casting operator, and
-            switch various XFORM structure uses to utilize it.
-        (2) Push concatCTM call to GraphicsContextWin now that the
-            TransformationMatrix can directly create XFORM (rather
-            than converting to CGAffineTransform/cairo_matrix_t first.)
-
-        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
-        * platform/graphics/transforms/TransformationMatrix.h:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::scale):
-        (WebCore::GraphicsContextPlatformPrivate::rotate):
-        (WebCore::GraphicsContextPlatformPrivate::translate):
         (WebCore::GraphicsContextPlatformPrivate::concatCTM):
-        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
-        (WebCore::TransformationMatrix::operator XFORM): New operator
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Non-CG Windows build fix after @r44758.
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderTheme::themeForPage):
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Refactor a few common routines in the various Windows ports
-        and reduce some duplicated code.
-        https://bugs.webkit.org/show_bug.cgi?id=26425.
-
-        Refactor use of BITMAPINFO for the new BitmapInfo structure.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/win/BitmapInfo.cpp: Added.
-        (WebCore::bitmapInfoForSize):
-        (WebCore::BitmapInfo::create):
-        (WebCore::BitmapInfo::createBottomUp):
-        * platform/win/BitmapInfo.h: Added.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
-        (WebCore::TransformationMatrix::operator XFORM): New operator
-        * platform/win/DragImageCGWin.cpp:
-        (WebCore::allocImage):
-        * platform/win/DragImageCairoWin.cpp:
-        (WebCore::allocImage):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
-
-        Reviewed by Mark Rowe.
-
-        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
-        an unnecessary parameter name.
-        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Make Settings::shouldPaintNativeControls default to true
-
-        This matches the default up in WebKit (that was changed in r43318).
-
-        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
-        form controls
-        <https://bugs.webkit.org/show_bug.cgi?id=26493>
-
-        Reviewed by Darin Adler and Dave Hyatt.
-
-        No test possible since DRT always uses Mac-style form controls.
-
-        * page/Settings.cpp: Changed the initial value of
-        gShouldPaintNativeControls to true.
-
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
-        flaw here involving querying Settings before it's been initialized.
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Fix chromium windows build.
-
-        A mistake that happened during the complicated merge for
-        landing r44775, r44776, r44777.
-
-        * rendering/RenderThemeChromiumWin.h:
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::AffineTransform::operator CGAffineTransform):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::AffineTransform::operator QTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::AffineTransform::operator SkMatrix):
+        * platform/graphics/transforms/AffineTransform.cpp: Added.
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::reset):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::isIdentity):
+        (WebCore::AffineTransform::det):
+        (WebCore::AffineTransform::isInvertible):
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::multiply):
+        (WebCore::AffineTransform::multLeft):
+        (WebCore::AffineTransform::rotate):
+        (WebCore::AffineTransform::scale):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::scaleNonUniform):
+        (WebCore::AffineTransform::rotateFromVector):
+        (WebCore::AffineTransform::flipX):
+        (WebCore::AffineTransform::flipY):
+        (WebCore::AffineTransform::shear):
+        (WebCore::AffineTransform::skew):
+        (WebCore::AffineTransform::skewX):
+        (WebCore::AffineTransform::skewY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        (WebCore::AffineTransform::blend):
+        * platform/graphics/transforms/AffineTransform.h: Added.
+        (WebCore::AffineTransform::a):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::b):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::c):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::d):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::e):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::f):
+        (WebCore::AffineTransform::setF):
+        (WebCore::AffineTransform::operator== ):
+        (WebCore::AffineTransform::operator!=):
+        (WebCore::AffineTransform::operator*=):
+        (WebCore::AffineTransform::operator*):
+        (WebCore::AffineTransform::setMatrix):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::AffineTransform::operator wxGraphicsMatrix):
 
-2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+2010-01-31  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Timothy Hatcher.
 
-        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
+        Web Inspector: [REGRESSION] Breakpoint source line is not displayed
+        in the breakpoint manager.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
-        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
 
-2009-06-17  David Hyatt  <hyatt@apple.com>
+2010-01-31  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
+        Reviewed by Timothy Hatcher.
 
-        * html/HTMLElementsAllInOne.cpp:
+        Web Inspector: Introduce NativeTextViewer.
 
-2009-06-17  David Hyatt  <hyatt@apple.com>
+        This change handles rendering highlighted text, using browser's
+        selection/drag/drop/click logic. Breakpoint decorations and
+        program counter is working.
 
-        Reviewed by Adam Roben and Anders Carlsson.
+        Todo: line numbers are painted 'under' the text when scrolling
+        horizontally, search is not yet implemented.
 
-        Stub out the HTMLDataGridElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34391
 
-        * DerivedSources.make:
+        * WebCore.gypi:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * editing/htmlediting.cpp:
-        (WebCore::canHaveChildrenForEditing):
-        * html/HTMLDataGridElement.h: Added.
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::tagPriority):
-        * html/HTMLDataGridElement.idl: Added.
-        * html/HTMLElement.cpp:
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLTagNames.in:
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (chromium build fix).
-
-        Fix typo in previous changes.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Remove common code from RenderThemeChromiumWin that is shared with
-        RenderThemeChromiumSkia.
-
-        Also move supportsControlTints to RenderThemeChromiumLinux since it
-        is linux specific.
-
-        There are no tests changed because this just removes functions with
-        duplicate implementations between the base and derived classes.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::):
-        (WebCore::getNonClientMetrics):
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::systemFont):
-        (WebCore::RenderThemeChromiumWin::paintCheckbox):
-        (WebCore::RenderThemeChromiumWin::paintRadio):
-        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
-        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
-        * rendering/RenderThemeChromiumWin.h:
-
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::):
-        (WebCore::setSizeIfAuto):
-        (WebCore::mediaElementParent):
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
-        (WebCore::RenderThemeChromiumSkia::systemFont):
-        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-        (WebCore::RenderThemeChromiumSkia::setRadioSize):
-        (WebCore::brightenColor):
-        (WebCore::paintButtonLike):
-        (WebCore::RenderThemeChromiumSkia::paintButton):
-        (WebCore::RenderThemeChromiumSkia::paintTextField):
-        (WebCore::RenderThemeChromiumSkia::paintTextArea):
-        (WebCore::RenderThemeChromiumSkia::paintSearchField):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuList):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
-        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
-        * rendering/RenderThemeChromiumSkia.h:
-        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+        * inspector/front-end/DivBasedTextViewer.js: Added.
+        (WebInspector.DivBasedTextViewer):
+        (WebInspector.DivBasedTextViewer.prototype._textChanged):
+        (WebInspector.DivBasedTextViewer.prototype._createLineDivs):
+        (WebInspector.DivBasedTextViewer.prototype._updatePreferredSize):
+        (WebInspector.DivBasedTextViewer.prototype._scroll):
+        (WebInspector.DivBasedTextViewer.prototype._registerMouseListeners):
+        (WebInspector.DivBasedTextViewer.prototype._registerKeyboardListeners):
+        (WebInspector.DivBasedTextViewer.prototype._registerClipboardListeners):
+        (WebInspector.DivBasedTextViewer.prototype._paintSelection):
+        (WebInspector.DivBasedTextViewer.prototype._positionDivDecoration):
+        (WebInspector.DivBasedTextViewer.prototype._mouseDown):
+        (WebInspector.DivBasedTextViewer.prototype._contextMenu):
+        (WebInspector.DivBasedTextViewer.prototype._caretForMouseEvent):
+        (WebInspector.DivBasedTextViewer.prototype._paintLine):
+        (WebInspector.DivBasedTextViewer.prototype._createSpan):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype._registerMouseListeners):
+        (WebInspector.TextEditor.prototype._registerKeyboardListeners):
+        (WebInspector.TextEditor.prototype._registerClipboardListeners):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype.revalidateDecorationsAndPaint):
+        (WebInspector.TextEditor.prototype._updatePreferredSize):
+        (WebInspector.TextEditor.prototype.resize):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLine):
+        (WebInspector.TextEditor.prototype._contextMenu):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._changeFont):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css:
 
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+2010-01-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
-        is mostly a code shuffle.  The non-suffle changes are:
-           1) Creation of a caretBlinkIntervalInternal.
-           2) Moving of some inline functions into the implementation files.
-           3) Changing of defaultGUIFont into a static class constant from a
-              static function.  Also the type is changed to String.
-           4) Changing of defaultFontSize into a static class constant from a
-              static variable in the file scope.
-           5) The static supportsFocus function was collapsed into
-              supportsFocusRing.
-           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
-        (WebCore::RenderThemeChromiumSkia::systemFont):
-        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-        (WebCore::RenderThemeChromiumSkia::setRadioSize):
-        (WebCore::RenderThemeChromiumSkia::paintButton):
-        (WebCore::RenderThemeChromiumSkia::paintTextField):
-        (WebCore::RenderThemeChromiumSkia::paintTextArea):
-        (WebCore::RenderThemeChromiumSkia::paintSearchField):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuList):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::systemColor):
-        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Add a SOFT_LINK_OPTIONAL macro
-
-        This macro is useful when soft-linking functions that are present in
-        only some versions of a particular library (e.g., APIs added in
-        Windows Vista that aren't available on Windows XP).
-
-        Reviewed by Ada Chan.
-
-        * platform/graphics/win/ColorSafari.cpp:
-        (WebCore::focusRingColor):
-        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
-        Also removed an unused call to focusRingColor.isValid().
-
-        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
-        The use of zero-width or zero-height rectangles in generating
-        gradients caused Windows Cairo to crash, and webkitgtk to
-        produce invalid images.
-
-        We now test for NaN in the phase argument, which is calculated
-        using fmodf and can blow up when the width/height values passed
-        are zero.
-
-        Test: fast/gradients/border-image-gradient-sides-and-corners.html
+        [Qt] Enable FAST_MOBILE_SCROLLING on Qt embedded platforms
+        https://bugs.webkit.org/show_bug.cgi?id=34168
 
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
+        Enable FAST_MOBILE_SCROLLING for Qt on Maemo 5, Linux embedded
+        and Symbian
 
-2009-06-17  Ojan Vafai  <ojan@chromium.org>
+        * WebCore.pro:
 
-        Reviewed by Dimitri Glazkov.
+2010-01-31  Yury Semikhatsky  <yurys@chromium.org>
 
-        If loading a font fails because of the sandbox, we ask the browser process to
-        try to load it by calling ensureFontLoaded. If it still fails after
-        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
+        Reviewed by Pavel Feldman.
 
-        This case happens once in a while during browser shutdown. The browser will
-        queue a message to the renderer to shutdown, and will then stop answering sync
-        messages from the renderer. If the renderer is still loading a page during this
-        time, it might try to call the browser process to ask to load a font. The
-        browser process will ignore the request, and the font will fail to load, even
-        after the second try.
+        Make ScriptState destructor protected since all non-empty
+        ScriptStates are managed by GC. Remove obsolete constructor.
 
-        This is unfortunate, but there is no real risk here, since the renderer will be
-        going away as soon as it processes another message.
-        
-        This can't be layout tested as it depends on the sandbox.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26484
+        https://bugs.webkit.org/show_bug.cgi?id=34266
 
-        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
-        (WebCore::fontContainsCharacter):
+        * bindings/v8/ScriptState.cpp:
+        * bindings/v8/ScriptState.h:
 
-2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+2010-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26482
-        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
-        playing (doesn't resume later)
+        Use CGGradient on Leopard and later, since it's faster than CGShading
+        https://bugs.webkit.org/show_bug.cgi?id=34384
 
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::setRate): Ditto.
+        Use CGGradient on Leopard and later, rather than CGShading, for
+        performance.
 
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Add all the generated JS*.cpp files back to WebCore.vcproj
-
-        They are not compiled by the vcproj directly. Instead they are
-        compiled as part of DerivedSources.cpp. Having them listed in the
-        vcproj makes them be included in Project Find, etc.
-
-        Rubber-stamped in advance by Steve Falkenburg.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-06-17  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Don't fire redundant 'change' events for a file upload form.
-        https://bugs.webkit.org/show_bug.cgi?id=26471
-
-        * platform/FileChooser.cpp:
-        (WebCore::FileChooser::chooseFiles): Suppress change event if the
-        existing selected files and the incoming selected files are equal.
-        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
-        files.
-
-2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23155
-        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
-
-        * platform/KeyboardCodes.h:
-
-2009-06-17  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23155
-        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::getWindowsContext):
-        * platform/win/SystemTimeWin.cpp:
-        (WebCore::userIdleTime):
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * page/Page.h: Forward-declare RenderTheme instead of including
-        RenderTheme.h so that we don't need to make RenderTheme.h a private
-        header for WebKit's benefit.
-
-        * editing/SelectionController.cpp:
-        * rendering/InlineTextBox.cpp:
-        * rendering/RenderObject.cpp:
-        Added #includes of RenderTheme.h.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::create): Added.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
-        parameter.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * page/Page.cpp:
-        (WebCore::Page::Page): Change the initializer order to match the
-        declaration order.
-
-2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Simon Hausmann.
-
-        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
-        Patch that make WebCore have a RenderTheme per page
-
-        Make the Qt implementation of RenderTheme create a theme per page,
-        and use the QStyle associated with the view of each page, in order
-        to make the QWidget setStyle() method work as advertised.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::qStyle):
-        (WebCore::findFrameLineWidth):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::adjustRepaintRect):
-        (WebCore::RenderThemeQt::isControlStyled):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::setButtonPadding):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::setPopupPadding):
-        * platform/qt/RenderThemeQt.h:
-
-2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Dave Hyatt and Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26278
-        Patch that make WebCore have a RenderTheme per page
-
-
-        Create a different RenderTheme per page, so that RenderTheme has
-        access to page specific theming. This is needed for the Qt port, as Qt
-        supports setting the theme (style) per widget.
-
-        This change was suggested and discussed with Dave Hyatt.
-
-        More detailed:
-
-        1) Create a theme per page or one global one, depending on the needs
-           of the platform.
-        2) Add an accesser to the theme from RenderObject.
-        3) Change all uses of the theming to access the theme through
-           RenderObject, using the global default theme as fallback, when the
-           document of RenderObject has no page.
-           When we don't have access to a RenderObject, use the default theme.
-        4) Modify all RenderTheme platform implementations to work with the
-           above changes, still creating only one global theme.
-
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::boundingBoxRect):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        (WebCore::CSSStyleSelector::styleForElement):
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        (WebCore::CSSStyleSelector::applyProperty):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::setActive):
-        (WebCore::ContainerNode::setHovered):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::focusedOrActiveStateChanged):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        (WebCore::HTMLInputElement::setIndeterminate):
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionLayoutChanged):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateControlTints):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::theme):
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow):
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::create):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeGtk::RenderThemeGtk):
-        (WebCore::RenderThemeGtk::~RenderThemeGtk):
-        (WebCore::RenderThemeGtk::gtkEntry):
-        (WebCore::RenderThemeGtk::gtkTreeView):
-        * platform/gtk/RenderThemeGtk.h:
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::create):
-        (WebCore::RenderTheme::themeForPage):
-        * platform/qt/RenderThemeQt.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::determineState):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlInputElement::hitTest):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::theme):
-        * rendering/RenderObject.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::defaultTheme):
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumLinux.h:
-        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumWin.h:
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeSafari.h:
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeWin.h:
-
-2009-06-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
-
-        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
-        appears to be fundaementally incorrect - PropertySlots are only used to get
-        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
-        used in the fashion desired here - it only reports the caching type of a
-        write that has been performed.
-
-        (This caused a bug where the put should have triggered a transition, and
-        failed to do so.)
-
-        Removing the faulty case from the optimization leads to a ~0.5% progression
-        on in-browser SunSpider (presumably the very first case was not being hit
-        often, and the simplification here is beneficial).
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::put):
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY, layout tests fix.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-        This reverts commit r44751.
-
-        Once that change was checked scrollbars/scrollbar-orientation.html started
-        crashing on Windows.
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        * page/FrameView.cpp:
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        * rendering/RenderScrollbar.h:
-
-2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26458
-
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::setData):
-
-2009-06-16  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
-        https://bugs.webkit.org/show_bug.cgi?id=26326
+        * platform/graphics/Gradient.h:
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::sortStopsIfNecessary): Utility method to sort stops.
+        Did not call this from getColor() to avoid overhead of a function call.
 
-        Test: scrollbars/scrollbar-crash-on-refresh.html
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformDestroy): Use CGGradientRelease() post-Tiger.
+        (WebCore::Gradient::platformGradient): Create and return a CGGradientRef post-Tiger.
+        (WebCore::Gradient::fill): Call new paint() method.
+        (WebCore::Gradient::paint): New convenence method that avoids testing
+        isRadial() in a bunch of other places.
 
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Gives the FrameView a change to do any necessary cleanup on
-        Document::detach() which is where the renderArena gets detroyed.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Gets rid of any custom scrollbars (if the docment supplied them).
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::isCustomScrollbar):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        Removed the check for document()->frame().  If frame() is 0 in this code,
-        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
-        * rendering/RenderScrollbar.h:
-        (WebCore::RenderScrollbar::isCustomScrollbar):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath): Call the gradient's paint() method.
+        (WebCore::GraphicsContext::strokePath): Ditto
+        (WebCore::GraphicsContext::fillRect): Ditto
+        (WebCore::GraphicsContext::strokeRect): Ditto
 
-2009-06-16  Brian Weinstein  <bweinstein@apple.com>
+2010-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Adele Peterson.
 
-        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
-        This patch kept the way events were firing as they were before, and Windows events are
-        consistent with Mac.       
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
-        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
-
-2009-06-16  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
-        
-        When revalidating a resource, calling addClient() on one client might cause another to get removed.
-        
-        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
-        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
-        - check if the client is still in the set before invoking didAddClient() for it
-        
-        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
-        reference each other via @imports and reloading.
-
-        * WebCore.base.exp:
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::didAddClient):
-        * loader/CachedCSSStyleSheet.h:
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::didAddClient):
-        * loader/CachedFont.h:
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::didAddClient):
-        * loader/CachedImage.h:
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::addClient):
-        (WebCore::CachedResource::addClientToSet):
-        (WebCore::CachedResource::switchClientsToRevalidatedResource):
-        * loader/CachedResource.h:
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::didAddClient):
-        * loader/CachedScript.h:
-        * loader/CachedXSLStyleSheet.cpp:
-        (WebCore::CachedXSLStyleSheet::didAddClient):
-        * loader/CachedXSLStyleSheet.h:
-
-2009-06-16  Simon Fraser  <simon.fraser@apple.com>
-
-        No Review
-
-        Fix code inside an #ifdef that draws the video framerate.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::paint):
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
-        https://bugs.webkit.org/show_bug.cgi?id=26456
-
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
-          handling in Worker constructor for V8 bindings.
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
-        Provide an assignment operator to avoid improper reference
-        counts on the Cairo font objects.  This brings the Windows
-        Cairo port in line with the GTKport.
-
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::operator=):
-
-2009-06-16  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
-        the MediaControlInputElement, rather than computing it again
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
-        * html/HTMLMediaElement.h:
-
-        * rendering/MediaControlElements.h:
-        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
-
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
-        state from the button itself and get movie state from HTMLMediaElement.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
-        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 26450: Rename values of enum RedirectOriginCheck to make them
-        clearer.
-        https://bugs.webkit.org/show_bug.cgi?id=26450
-
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::create):
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
-        (WebCore::DocumentThreadableLoader::willSendRequest):
-        * loader/DocumentThreadableLoader.h:
-        * loader/ThreadableLoader.cpp:
-        (WebCore::ThreadableLoader::create):
-        (WebCore::ThreadableLoader::loadResourceSynchronously):
-        * loader/ThreadableLoader.h:
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
-        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
-        * loader/WorkerThreadableLoader.h:
-        (WebCore::WorkerThreadableLoader::create):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        * workers/WorkerScriptLoader.h:
-        (WebCore::WorkerContext::importScripts):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-
-2009-06-16  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
-        https://bugs.webkit.org/show_bug.cgi?id=26449
-        No new tests, covered by purify.
-
-        * editing/TextIterator.cpp:
-        (WebCore::BitStack::push):
-
-2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        Test: fast/multicol/columns-shorthand-parsing.html 
-
-        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
-        Null Cairo contextwill crash Windows Cairo build.
-
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::syncContext):
-          Add a check for null context before attempting to
-          retrieve the Cairo surface.
-
-2009-06-16  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26447
-        Fix animated GIF breakage in Cairo/wx ports.
-
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::operator=):
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::operator=):
-
-2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by John Sullivan
+        Do color animations on premultiplied colors
+        https://bugs.webkit.org/show_bug.cgi?id=34383
         
-        <rdar://problem/6937882>
-        
-        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
-
-        * css/mediaControlsQT.css:
+        Convert colors to premultiplied alpha before interpolating them,
+        then convert the result back to non-premultiplied. This gives better
+        results when animating from transparent colors.
 
-2009-06-16  Jian Li  <jianli@chromium.org>
+        Test: transitions/color-transition-premultiplied.html
 
-        Reviewed by Adam Barth and David Levin.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
 
-        Bug 26146: Change to use ThreadableLoader to load the worker script
-        in order to check URL origin for redirection.
-        https://bugs.webkit.org/show_bug.cgi?id=26146
+2010-01-30  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Test: http/tests/workers/worker-redirect.html
+        Build fixes needed for make distcheck.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerImportScriptsClient.cpp: Removed.
-        * workers/WorkerImportScriptsClient.h: Removed.
-        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
-          This to make it more generic so worker script loading could use it.
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::didFinishLoading):
-        (WebCore::WorkerScriptLoader::didFail):
-        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
-        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
-        (WebCore::WorkerScriptLoader::notifyFinished):
-        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
-          This to make it more generic so worker script loading could use it.
-        * workers/WorkerScriptLoaderClient.h: Added.
-
-2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
-
-        Reviewed by Darin Adler.
 
-        Use consistent GUID comparison functions.
-        https://bugs.webkit.org/show_bug.cgi?id=26427
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        * platform/win/WCDataObject.cpp:
-        (WebCore::WCDataObject::QueryInterface):
-
-2009-06-16  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Fix compiler warning.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_class_init):
+        Stop copying an IDL file in to the framework wrapper.
 
-2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27424
-
-        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
-        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
-
-2009-06-16  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Remove dummy AtkStreamableContent implementation.
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        It's completely empty, we'll add it back (and conditionally
-        instead of unconditionally) when it does something.
+        Sort Xcode projects.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (GetAtkInterfaceTypeFromWAIType):
-        (getInterfaceMaskFromObject):
+        * WebCore.xcodeproj/project.pbxproj:
 
-== Rolled over to ChangeLog-2009-06-16 ==
+== Rolled over to ChangeLog-2010-01-29 ==
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29 b/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29
new file mode 100644
index 0000000..cce1125
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29
@@ -0,0 +1,98486 @@
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Timeout for client-based Geolocation shouldn't start until user gives consent
+        https://bugs.webkit.org/show_bug.cgi?id=34352
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startRequest): Don't start timer if we're blocked on user consent.
+        (WebCore::Geolocation::setIsAllowed): Start timer after user gives consent.
+
+2010-01-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Implement more graphics primitives
+        https://bugs.webkit.org/show_bug.cgi?id=34339
+
+        Adds lines, arcs, ellipses, polygons and rounded
+        rectangles to PainterOpenVG and GraphicsContext.
+
+        Rounded rects support by Eli Fidler <efidler@rim.com>.
+
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::drawRect):
+        (WebCore::PainterOpenVG::drawRoundedRect):
+        (WebCore::PainterOpenVG::drawLine):
+        (WebCore::PainterOpenVG::drawArc):
+        (WebCore::PainterOpenVG::drawEllipse):
+        (WebCore::PainterOpenVG::drawPolygon):
+        * platform/graphics/openvg/PainterOpenVG.h:
+
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        A first step towards the Indexed Database API
+        https://bugs.webkit.org/show_bug.cgi?id=34342
+
+        Flesh out the first part of Indexed Database API.
+        Currently only compiles with v8 + chromium for now.
+        Completely non-functional, but it seems best to do
+        this in chunks.
+
+        No tests because nothing works yet.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setIndexedDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::indexedDatabaseEnabled):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::IndexedDBEnabled):
+        * bindings/v8/custom/V8IDBRequestCustom.cpp: Added.
+        (WebCore::V8IDBRequest::resultAccessorGetter):
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp: Added.
+        (WebCore::V8IndexedDatabaseRequest::openCallback):
+        * dom/EventNames.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::indexedDB):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/IDBDatabaseError.h: Added.
+        (WebCore::IDBDatabaseError::create):
+        (WebCore::IDBDatabaseError::~IDBDatabaseError):
+        (WebCore::IDBDatabaseError::code):
+        (WebCore::IDBDatabaseError::setCode):
+        (WebCore::IDBDatabaseError::message):
+        (WebCore::IDBDatabaseError::setMessage):
+        (WebCore::IDBDatabaseError::IDBDatabaseError):
+        * storage/IDBDatabaseError.idl: Added.
+        * storage/IDBDatabaseException.h: Added.
+        (WebCore::IDBDatabaseException::create):
+        (WebCore::IDBDatabaseException::~IDBDatabaseException):
+        (WebCore::IDBDatabaseException::code):
+        (WebCore::IDBDatabaseException::setCode):
+        (WebCore::IDBDatabaseException::message):
+        (WebCore::IDBDatabaseException::setMessage):
+        (WebCore::IDBDatabaseException::IDBDatabaseException):
+        * storage/IDBDatabaseException.idl: Added.
+        * storage/IDBRequest.cpp: Added.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::~IDBRequest):
+        (WebCore::IDBRequest::abort):
+        (WebCore::IDBRequest::eventTargetData):
+        (WebCore::IDBRequest::ensureEventTargetData):
+        * storage/IDBRequest.h: Added.
+        (WebCore::IDBRequest::create):
+        (WebCore::IDBRequest::readyState):
+        (WebCore::IDBRequest::error):
+        (WebCore::IDBRequest::result):
+        (WebCore::IDBRequest::scriptExecutionContext):
+        (WebCore::IDBRequest::toIDBRequest):
+        (WebCore::IDBRequest::refEventTarget):
+        (WebCore::IDBRequest::derefEventTarget):
+        * storage/IDBRequest.idl: Added.
+        * storage/IndexedDatabaseRequest.cpp: Added.
+        (WebCore::IndexedDatabaseRequest::IndexedDatabaseRequest):
+        (WebCore::IndexedDatabaseRequest::~IndexedDatabaseRequest):
+        (WebCore::IndexedDatabaseRequest::open):
+        * storage/IndexedDatabaseRequest.h: Added.
+        (WebCore::IndexedDatabaseRequest::create):
+        (WebCore::IndexedDatabaseRequest::request):
+        * storage/IndexedDatabaseRequest.idl: Added.
+
+2010-01-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop: Windows uses "stop" sign as cursor when dragging
+        https://bugs.webkit.org/show_bug.cgi?id=34305
+        <rdar://problem/7589672>
+
+        Add a FIXME for the code that needs to be changed to support full
+        custom cursors.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+
+2010-01-29  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by darin@apple.com.
+
+        Fix the issue that both main frome and iframe are
+        focused if window.onblur calls window.focus.
+        https://bugs.webkit.org/show_bug.cgi?id=31692
+
+        The problem is caused by the focused frame in FocusController
+        is messed up if window.onblur calls window.focus:
+        When user clicks iframe to switch focus from main frame to iframe,
+        FocusController::setFocusedFrame fires onblur event, which calls
+        window.focus and then calls setFocusedFrame again to switch back.
+        This messes up the old focused frame and new focused frame and
+        leaves the FocusController confused. As a result, controlls
+        in both main frame and iframe look like get focused.
+
+        To fix it, add a flag to FocusController and do no switch the focused
+        frame when FocusController is in the middle of changing the focused frame. 
+
+        Test: fast/events/change-frame-focus.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::FocusController):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/FocusController.h:
+        (WebCore::FocusController::focusedFrame):
+        (WebCore::FocusController::isActive):
+        (WebCore::FocusController::isFocused):
+
+2010-01-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441982> REGRESSION (TOT): Adobe CS4: Installer alerts are displayed as
+        blank windows
+
+        We probably shouldn't be deferring loads below modal dialogs and alerts, because that's not
+        what being modal means. But making such a change for general Web content would require fixes
+        in other parts of code, which I'm not ready to implement right now, so making it application
+        specific.
+
+        * page/Page.cpp: (WebCore::Page::setDefersLoading): Do nothing if load deferring is not
+        enabled in page settings.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLoadDeferringEnabled):
+        * page/Settings.h: (WebCore::Settings::loadDeferringEnabled):
+        Add the ability for client to disable page deferring (still enabled by default).
+
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm: (WebCore::applicationIsAdobeInstaller):
+        Added a bundle ID test for Adobe installer.
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startUpdating):
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Client-based Geolocation starts updating before getting consent from the user
+        https://bugs.webkit.org/show_bug.cgi?id=34343
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startRequest): Pass notifier instead of options to startUpdating.
+        (WebCore::Geolocation::setIsAllowed): Add the observer or notify of error for deferred startUpdating.
+        (WebCore::Geolocation::startUpdating): Pass notifier instead of options, since we may need to call it if we fail to get user consent.
+        Defer adding the observer if we don't yet have user consent, since this could kick off
+        server-based wifi Geolocation requests.
+        * page/Geolocation.h:
+
+2010-01-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Crash when posting a notification for a detached object
+
+        https://bugs.webkit.org/show_bug.cgi?id=34309
+        <rdar://problem/7409759>
+
+        Reviewed by Darin Adler.
+
+        Test: platform/win/accessibility/detached-object-notification-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::document):
+        Null check m_renderer. This is the bug fix; the other changes in the
+        patch are for the test.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Map AXValueChanged to EVENT_OBJECT_VALUECHANGED, so we'll post a
+        notification when AXValueChanged is posted. Receiving an event of this
+        type tells us that the test passed.
+
+2010-01-29  Darin Fisher  <darin@chromium.org>
+
+        Okayed by Oliver Hunt.
+
+        Rollout r53949, r53951 and r54013 due to a Chromium regression that it
+        causes.  Somehow this code change is triggering an endless repaint loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33808
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+
+2010-01-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add gdb helper methods for Ranges like we have for VisibleSelections.
+        https://bugs.webkit.org/show_bug.cgi?id=34308
+
+        No new tests, these are only for debugging.
+
+        * dom/Position.cpp:
+        (WebCore::Position::showTreeForThis):
+        * dom/Range.cpp:
+        (showTree):
+        * dom/Range.h:
+
+2010-01-29  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 implementation of MessageEvent.initMessageEvent() does not set source correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=34292
+
+        Test: fast/events/init-events.html will pass in Chrome now.
+
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        Now properly extracts the reference to the DOMWindow object from the passed-in window parameter.
+
+2010-01-29  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android needs functionality in the ChromeClient to be informed when touch events are and are not needed by the webpage.
+        https://bugs.webkit.org/show_bug.cgi?id=34215
+
+        Add a function on the ChromeClient that WebCore can use to inform the platform when it needs touch events. This way the platform can optimise by not forwarding the events if they are not required.
+
+        No new tests as the only implementation is specific to Android.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Check if this is the top level document and if so, stop forwarding touch events.
+        (WebCore::Document::addListenerTypeIfNeeded): Inform the ChromeClient it should start forwarding touch events and guard touch event code properly.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): If the document uses touch events, inform the ChromeClient to start forwarding them.
+        (WebCore::CachedFrame::CachedFrame): If the document uses touch events, inform the ChromeClient to stop forwarding them, as the document is being put into the page cache.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::needTouchEvents): Add an empty implementation.
+        * page/ChromeClient.h: Add the needTouchEvents() function.
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix toolbar gradient to match the window's titlebar on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=34320
+
+        * inspector/front-end/inspector.css:
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix MacOS X version detection
+
+        MacOS X version can have 2 or 3 segments.
+        https://bugs.webkit.org/show_bug.cgi?id=34322
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._detectPlatform):
+
+2010-01-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Implement a basic GraphicsContext on top of a new PainterOpenVG class
+        https://bugs.webkit.org/show_bug.cgi?id=33405
+
+        PainterOpenVG provides painter state management that works
+        on a single (EGL) context, and apart from painter state
+        implements a single drawing operation (for now), drawRect().
+
+        It is a generic painter class that cooperates with
+        SurfaceOpenVG to enable robust surface/context switching
+        (given that EGL doesn't notify us if somebody switches
+        the surface/context behind our backs), and provides
+        painting operations close to OpenVG's way of working
+        that GraphicsContext, Path, Image, Font and other WebKit
+        platform classes can use to draw on.
+
+        Initial code for state management and OpenVG scissoring by
+        Eli Fidler <efidler@rim.com>. VGRect/VGMatrix and the bulk
+        of the transformations code by Adam Treat <atreat@rim.com>.
+        Preliminary drawFocusRing() implementation by Yong Li <yoli@rim.com>.
+
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        * platform/graphics/openvg/PainterOpenVG.cpp: Added.
+        (WebCore::isNonRotatedAffineTransformation):
+        (WebCore::toVGCapStyle):
+        (WebCore::toVGJoinStyle):
+        (WebCore::toVGFillRule):
+        (WebCore::colorToVGColor):
+        (WebCore::setVGSolidColor):
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::copyPaintState):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::applyBlending):
+        (WebCore::PlatformPainterState::applyTransformationMatrix):
+        (WebCore::PlatformPainterState::applyScissorRect):
+        (WebCore::PlatformPainterState::applyStrokeStyle):
+        (WebCore::PlatformPainterState::strokeDisabled):
+        (WebCore::PlatformPainterState::fillDisabled):
+        (WebCore::PainterOpenVG::PainterOpenVG):
+        (WebCore::PainterOpenVG::~PainterOpenVG):
+        (WebCore::PainterOpenVG::begin):
+        (WebCore::PainterOpenVG::end):
+        (WebCore::PainterOpenVG::destroyPainterStates):
+        (WebCore::PainterOpenVG::applyState):
+        (WebCore::PainterOpenVG::blitToSurface):
+        (WebCore::PainterOpenVG::transformationMatrix):
+        (WebCore::PainterOpenVG::concatTransformationMatrix):
+        (WebCore::PainterOpenVG::setTransformationMatrix):
+        (WebCore::PainterOpenVG::compositeOperation):
+        (WebCore::PainterOpenVG::setCompositeOperation):
+        (WebCore::PainterOpenVG::opacity):
+        (WebCore::PainterOpenVG::setOpacity):
+        (WebCore::PainterOpenVG::strokeThickness):
+        (WebCore::PainterOpenVG::setStrokeThickness):
+        (WebCore::PainterOpenVG::strokeStyle):
+        (WebCore::PainterOpenVG::setStrokeStyle):
+        (WebCore::PainterOpenVG::setLineDash):
+        (WebCore::PainterOpenVG::setLineCap):
+        (WebCore::PainterOpenVG::setLineJoin):
+        (WebCore::PainterOpenVG::setMiterLimit):
+        (WebCore::PainterOpenVG::strokeColor):
+        (WebCore::PainterOpenVG::setStrokeColor):
+        (WebCore::PainterOpenVG::fillColor):
+        (WebCore::PainterOpenVG::setFillColor):
+        (WebCore::PainterOpenVG::antialiasingEnabled):
+        (WebCore::PainterOpenVG::setAntialiasingEnabled):
+        (WebCore::PainterOpenVG::scale):
+        (WebCore::PainterOpenVG::rotate):
+        (WebCore::PainterOpenVG::translate):
+        (WebCore::PainterOpenVG::intersectScissorRect):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        (WebCore::PainterOpenVG::drawRect):
+        (WebCore::PainterOpenVG::save):
+        (WebCore::PainterOpenVG::restore):
+        * platform/graphics/openvg/PainterOpenVG.h: Added.
+        (WebCore::PainterOpenVG::):
+        (WebCore::PainterOpenVG::surface):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::~SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        (WebCore::SurfaceOpenVG::setActivePainter):
+        (WebCore::SurfaceOpenVG::activePainter):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        (WebCore::SurfaceOpenVG::):
+        * platform/graphics/openvg/VGUtils.cpp: Added.
+        (WebCore::VGMatrix::VGMatrix):
+        (WebCore::VGMatrix::operator TransformationMatrix):
+        (WebCore::TransformationMatrix::operator VGMatrix):
+        (WebCore::VGRect::VGRect):
+        (WebCore::VGRect::operator FloatRect):
+        (WebCore::FloatRect::operator VGRect):
+        * platform/graphics/openvg/VGUtils.h:
+        (WebCore::VGMatrix::toVGfloat):
+        (WebCore::VGRect::toVGfloat):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Vimeo HTML5 player doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=34327
+
+        Send Referer when requesting media over HTTP.
+
+        Test: http/tests/media/video-referer.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+
+2010-01-29  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Speed up the WebCore::String -> QString conversion
+
+        Use QString(const QChar *, int len) constructor instead of QString::fromUtf16 to
+        avoid BOM checks and byteswapping.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Source view displays text using wrong fonts
+        https://bugs.webkit.org/show_bug.cgi?id=34269
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._initFont):
+        * inspector/front-end/inspector.js:
+
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Apple trailers don't play anymore
+        https://bugs.webkit.org/show_bug.cgi?id=34316
+
+        Fake QuickTime when accessing movie trailers.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+
+2010-01-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: migrate to tokenizer-based highlighting in the Elements panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34273
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/DOMSyntaxHighlighter.js: Added.
+        (WebInspector.DOMSyntaxHighlighter):
+        (WebInspector.DOMSyntaxHighlighter.prototype.createSpan):
+        (WebInspector.DOMSyntaxHighlighter.prototype.syntaxHighlightNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/SourceCSSTokenizer.js:
+        (WebInspector.SourceCSSTokenizer):
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/SourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/SourceTokenizer.js: Added.
+        (WebInspector.SourceTokenizer):
+        (WebInspector.SourceTokenizer.prototype.set line):
+        (WebInspector.SourceTokenizer.prototype.set condition):
+        (WebInspector.SourceTokenizer.prototype.get condition):
+        (WebInspector.SourceTokenizer.prototype.hasCondition):
+        (WebInspector.SourceTokenizer.prototype.getLexCondition):
+        (WebInspector.SourceTokenizer.prototype.setLexCondition):
+        (WebInspector.SourceTokenizer.prototype._charAt):
+        (WebInspector.SourceTokenizer.Registry):
+        (WebInspector.SourceTokenizer.Registry.getInstance):
+        (WebInspector.SourceTokenizer.Registry.prototype.getTokenizer):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: No need to render background sources
+        when performing search.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34263
+
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        (WebInspector.ScriptView.prototype.show):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.clearSelection):
+        (WebInspector.SourceFrame.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.hide):
+        (WebInspector.SourceView.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel):
+        (WebInspector.TextEditorModel.prototype.set changeListener):
+        (WebInspector.TextEditorModel.prototype.setText):
+
+2010-01-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove ScriptState::frame which is only used for reporting exceptions
+        in some cases in a way that diverges from the regular exception reporting in
+        v8 bindings.
+
+        Cache ScriptState directly on v8::Context instead of providing
+        implementations specific for isolated worlds and ScriptController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::mainWorldScriptState):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::forContext):
+        (WebCore::ScriptState::current):
+        (WebCore::ScriptState::weakReferenceCallback):
+        (WebCore::mainWorldScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::EmptyScriptState::EmptyScriptState):
+        (WebCore::EmptyScriptState::~EmptyScriptState):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-29  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add FrameLoaderClient::allowImages method to allow the client to
+        overrule image loading policy on a per frame basis.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34225
+
+        For completeness, this patch also adds Settings::areImagesEnabled.
+        This is different from loadsImagesAutomatically as is explained in
+        Settings.h.
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestImage):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowImages):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::writeRawData):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setImagesEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::areImagesEnabled):
+
+2010-01-28  Nicholas Young  <nicholas.young@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Prefer provided video element width/height properties to hard coded
+        defaults for intrinsic size when natural video size is unavailable.
+        https://bugs.webkit.org/show_bug.cgi?id=34302
+
+        No new tests needed.
+
+        * rendering/RenderVideo.cpp: Attempt to use width/height properties
+        (WebCore::RenderVideo::RenderVideo):
+        * rendering/RenderVideo.h: More appropriate constructor signature
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MessageEvent.data should not be repeated deserialised
+        https://bugs.webkit.org/show_bug.cgi?id=34311
+
+        Cache the result of deserialising the event data
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/MessageEvent.idl:
+
+2010-01-28  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change CSS 'page-break-inside' property from inherited one to non-inherited one because CSS specification defines so.
+
+        Note: Currently, the 'page-break-inside' property is used only when parsing the CSS. That property is not used when rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34195
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::NonInheritedFlags::operator==):
+        (WebCore::InheritedFlags::setBitDefaults):
+        (WebCore::InheritedFlags::pageBreakInside):
+        (WebCore::InheritedFlags::setPageBreakInside):
+        * rendering/style/StyleInheritedData.cpp:
+        (WebCore::StyleInheritedData::StyleInheritedData):
+        (WebCore::StyleInheritedData::operator==):
+        * rendering/style/StyleInheritedData.h:
+
+2010-01-28  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCache events should be deferred until after Document onload has fired.
+        https://bugs.webkit.org/show_bug.cgi?id=29690
+
+        Test: http/tests/appcache/deferred-events.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::handledOnloadEvents):  Tells the ApplicationCacheHost to stop deferring events.
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost): Initialize m_isDeferringEvents to true.
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache): Depending, defer or raise the event.
+        (WebCore::ApplicationCacheHost::stopDeferringEvents): Raise any deferred events and reset the flag.
+        * loader/appcache/ApplicationCacheHost.h: Declare new data members and method.
+
+2010-01-28  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Generate header declaration for custom constructor callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=33680
+
+        Added handling of 'CanBeConstructed' and 'OmitConstructor' and a new extended attribute
+        CustomConstructor'.
+
+        Deleted implementation .cpp files for corresponding 'CanBeConstructed'
+        extended attributes. These are now generated via CodeGeneratorV8.pm
+        Treating 'OmitConstructor' and 'CustomConstructor' to be the same in
+        CodeGeneratorJS.pm
+        Cleaned idls that had 'CustomConstructor' and 'OmitConstructor' together, and
+        same with CustomConstructor and CanBeConstructed.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi: Removed deps for classes being generated.
+        * bindings/scripts/CodeGeneratorJS.pm: OmitConstructor and CustomConstructor have the same behavior in generator.
+        * bindings/scripts/CodeGeneratorV8.pm: Generating the callbacks for constructors.
+        * bindings/v8/V8DOMWrapper.cpp: Removed manual calls to SetCallHandler() for constructor callbacks.
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h: Removed manual declarations of constructor callbacks.
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        (WebCore::V8EventSource::constructorCallback):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::V8SharedWorker::constructorCallback):
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::V8WebGLArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::V8WebGLByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::V8WebGLFloatArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::V8WebGLIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::V8WebGLShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::V8WebKitCSSMatrix::constructorCallback):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::V8WebKitPoint::constructorCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp: Deleted the file. Implementation now being generated.
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp: Deleted the file. Implementation now being generated.
+        (WebCore::V8XSLTProcessor::constructorCallback): Deleted the file. Implementation now being generated.
+        * css/WebKitCSSMatrix.idl: Added CustomConstructor attribute.
+        * dom/MessageChannel.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLArrayBuffer.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLByteArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLFloatArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLIntArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLShortArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLUnsignedByteArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLUnsignedIntArray.idl: Added CustomConstructor attribute.
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Add stub for AXObjectCache::contentChanged when HAVE(ACCESSIBILITY) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=34271
+
+        No new tests, build fix only.
+
+        * accessibility/AXObjectCache.cpp: Modified. Added HAVE(ACCESSIBILITY) guards around contentChanged
+        * accessibility/AXObjectCache.h: Modified.
+        (WebCore::AXObjectCache::contentChanged): Added stub
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Use long long rather than int64 in V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=34270
+
+        No new tests, build fix only.
+
+        * bindings/v8/V8Binding.h: Modified.
+        (WebCore::toInt64): Returns long long
+
+2010-01-28  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unused variable in ThemeMac (followup to change 49103).
+        https://bugs.webkit.org/show_bug.cgi?id=34274
+
+        Covered by existing tests.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::setupButtonCell):
+
+2010-01-28  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Huge plain text pastes are slow
+        <rdar://problem/5195056>
+        https://bugs.webkit.org/show_bug.cgi?id=34237
+
+        No new tests. It is a performance improvement.
+
+        The performance of the plain text paste is now linear.
+        We treat as a special case, a fragment that has been
+        created from plain text. Finding VisiblePositions and
+        applying style is greatly simplified, given the nature of
+        the fragment.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/markup.cpp:
+        (WebCore::isPlainTextMarkup):
+        * editing/markup.h:
+
+2010-01-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Initialize DOM Storage's quota's current length parameter when we clone it.
+        https://bugs.webkit.org/show_bug.cgi?id=34294
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::copy):
+
+2010-01-28  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix after r53411 on WinCairo.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount):
+
+2010-01-28  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Fix for compilation error in WML enabled build introduced because of the changeset 53514.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34254
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+
+2010-01-28  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Eric Seidel.
+
+        Update to CSS to remove unnecessary line-height settings
+
+        * css/mathml.css:
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Add missing includes for HashMap/HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=34276
+
+        No new tests, build fix only.
+
+        * platform/KURL.cpp: Modified. Include HashMap.h
+        * platform/network/CredentialStorage.cpp: Modified. Include HashMap.h and HashSet.h
+        * platform/network/ProtectionSpaceHash.h: Modified. Include HashTraits.h
+
+2010-01-28  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        Pass cookies to the GStreamer HTTP source
+        https://bugs.webkit.org/show_bug.cgi?id=34003
+
+        Test: http/tests/media/video-cookie.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        When using an appropiate GStreamer HTTP source element, pass
+        the cookies for the media URI to it. This fixes playback of
+        the YouTube HTML5 videos.
+
+2010-01-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r54022.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2010-01-28  Adam Roben  <aroben@apple.com>
+
+        Fix an assertion beneath SerializedScriptValue::deserialize on 32-bit
+        builds (e.g., on Windows)
+
+        Passing a JSValue to toRef on 32-bit builds can perform an allocation,
+        so we need to make sure we hold a JSLock when that occurs.
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::SerializedScriptValueData::deserialize):
+        Moved JSLocks from here...
+
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        ...to this higher level, from which toRef can be called.
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make DOMObjectWithGlobalPointer use an anonymous slot to store the global object
+        reference.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::globalObject):
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        Update the WebCore JS DOM bindings to correctly pass and
+        propagate the anonymous slot count information.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2010-01-27  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] hebrew vowel marks incorrectly positioned
+        https://bugs.webkit.org/show_bug.cgi?id=34234
+
+        Fix glyph metrics computation such that the glyph offsets
+        are correct, so we can now make use of them.
+
+        Test: fast/text/international/hebrew-vowels.html
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::createGlyphArrays): initialize per-glyph
+        offset table.
+        (WebCore::TextRunWalker::setGlyphXPositions): use per-glyph
+        offsets.
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::getGlyphMetrics): fix metrics computation such that
+        per-glyph offsets are computed correctly.
+
+2010-01-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix if websockets support is turned off after r53947.
+
+        * WebCore.pro:
+
+2010-01-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r54012.
+        http://trac.webkit.org/changeset/54012
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        Introduced 33 crashes in V8 traversal/ tests.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        (WebCore::ScriptController::currentScriptState):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::frame):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::scriptState):
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fix missing forward-declarations and includes in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=34272
+
+        No new tests, build fix only.
+
+        * bindings/v8/ScriptController.h: Modified. Forward-declare NPObject
+        * bindings/v8/V8DOMWindowShell.cpp: Modified. Include CString.h and PlatformBridge.h
+        * bindings/v8/V8DOMWrapper.h: Modified. Forward-declare V8Proxy
+
+2010-01-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove ScriptState::frame which is only used for reporting exceptions
+        in some cases in a way that diverges from the regular exception reporting in
+        v8 bindings.
+        
+        Cache ScriptState directly on v8::Context instead of providing
+        implementations specific for isolated worlds and ScriptController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::mainWorldScriptState):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::forContext):
+        (WebCore::ScriptState::current):
+        (WebCore::ScriptState::empty):
+        (WebCore::ScriptState::weakReferenceCallback):
+        (WebCore::mainWorldScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove XSSAuditor false positive for Google Translate
+        https://bugs.webkit.org/show_bug.cgi?id=34242
+
+        Google translate takes a base URL as a parameter, causing a false
+        positive in the XSS filter.  This patch removes the false positive by
+        allowing direct injections into the href property of the base tag.
+
+        Test: http/tests/security/xssAuditor/base-href-direct.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+
+2010-01-28  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Save additional memory in SVG*Element classes, by introducing SVGElementRareData
+        https://bugs.webkit.org/show_bug.cgi?id=34268
+
+        Introduce SVGElementRareData, to remove the need to store any members in SVGElement/SVGStyledElement.
+        This saves some additional MB for the svg-node-count-vs-scroll.xhtml testcase.
+
+        SVGElementRareData works just like NodeRareData. Unlike ElementRareData, we're not inheriting from
+        NodeRareData in SVG, as we don't need all the rare data stored there, unlike Element.
+
+        * GNUmakefile.am: Add SVGElementRareData.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/Node.cpp: Use Nodes bitfield to keep track wheter a SVGElement has a SVGElementRareData object associated.
+        (WebCore::Node::Node):
+        * dom/Node.h: Add m_hasRareSVGData flag, merged with the existing bitfield, 10 bits remaining now.
+        (WebCore::Node::hasRareSVGData):
+        * svg/SVGAnimateMotionElement.cpp: SVGElement::instancesForElement() now returns a const-reference to the HashMap instead of copying.
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateTransformElement.cpp: Ditto.
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimationElement.cpp: Ditto.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGElement.cpp: Move the element instances HashSet and two cursor-related pointers into SVGElementRareData.
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::rareSVGData): Modelled just like Node::rareData().
+        (WebCore::SVGElement::ensureRareSVGData): Dito.
+        (WebCore::SVGElement::accessDocumentSVGExtensions):
+        (WebCore::SVGElement::mapInstanceToElement): Route call through SVGElementRareData.
+        (WebCore::SVGElement::removeInstanceMapping): Ditto.
+        (WebCore::SVGElement::instancesForElement): Ditto.
+        (WebCore::SVGElement::setCursorElement): Ditto.
+        (WebCore::SVGElement::setCursorImageValue): Ditto.
+        * svg/SVGElement.h:
+        * svg/SVGElementInstance.cpp: Ditto.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        * svg/SVGElementRareData.h: Added. Based on NodeRareData - works exactly the same.
+        (WebCore::SVGElementRareData::SVGElementRareData):
+        (WebCore::SVGElementRareData::rareDataMap):
+        (WebCore::SVGElementRareData::rareDataFromMap):
+        (WebCore::SVGElementRareData::elementInstances):
+        (WebCore::SVGElementRareData::instanceUpdatesBlocked):
+        (WebCore::SVGElementRareData::setInstanceUpdatesBlocked):
+        (WebCore::SVGElementRareData::cursorElement):
+        (WebCore::SVGElementRareData::setCursorElement):
+        (WebCore::SVGElementRareData::cursorImageValue):
+        (WebCore::SVGElementRareData::setCursorImageValue):
+        * svg/SVGStyledElement.cpp: Move m_instancesUpdatesBlocked into SVGElementRareData.
+        (WebCore::SVGStyledElement::SVGStyledElement):
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        * svg/SVGStyledElement.h:
+        * svg/SVGUseElement.cpp: Adapt to element instances changes, now passed as const-reference.
+        (WebCore::dumpInstanceTree):
+
+2010-01-28  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Expand the NotificationPresenter::checkPermission() interface to send the full
+        URL of the requesting context, as well as a pointer to the document if that
+        context was a document.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34238
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        Pass the full URL and document from the requesting context when calling
+        NotificationPresenter::checkPermission().
+        
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+        Expand interface.
+
+2010-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Video can overlap position:fixed element when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=32180
+        
+        When the scroll position changes, and we're using overlap to decide what gets composited,
+        then we need to re-evaluate what gets compositing when scrolling in case fixed postion elements
+        overlap composited elements (e.g. video).
+
+        Test: compositing/geometry/video-fixed-scrolling.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::scrollPositionChanged): Annotate the calls to updateCompositingLayers()
+        with the type of change that occurred.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded): Ditto.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers): For scroll changes, check
+        for hierarchy update if m_compositingConsultsOverlap is true, and do
+        a geometry update. For other changes, always check for hierarchy updates.
+
+2010-01-27  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for user stylesheet bugs where they get parsed using the wrong compatibility mode.  This was a regression
+        caused from Safari 3 -> 4 by the Acid3 fixes to create a real DOCTYPE in the DOM.
+
+        This patch makes style selector creation lazy, so that the selector isn't built unless someone asks for it.
+
+        In order to avoid creating the style selector before the compatibility mode has been determined, document
+        style is now created without having a dependence on an instantiated style selector.  The creation of the style
+        is now done as a static method on CSSStyleSelector called styleForDocument, and a couple of font-related
+        functions have been made static as well so that they can be used by this method.
+
+        m_styleSelector on Document is now an OwnPtr.
+
+        Added userscripts/mixed-case-stylesheet.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+        (WebCore::CSSStyleSelector::setFontSize):
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize):
+        (WebCore::CSSStyleSelector::fontSizeForKeyword):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::createStyleSelector):
+        (WebCore::Document::attach):
+        (WebCore::Document::setVisuallyOrdered):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        (WebCore::Document::styleSelector):
+        (WebCore::Document::visuallyOrdered):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::determineParseMode):
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+
+2010-01-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename ISODateTime.{cpp,h} to DateComponents.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=34245
+
+        No functional changes.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DateComponents.cpp: Copied from WebCore/html/ISODateTime.cpp.
+        (WebCore::DateComponents::maxWeekNumberInYear):
+        (WebCore::DateComponents::parseYear):
+        (WebCore::DateComponents::addDay):
+        (WebCore::DateComponents::addMinute):
+        (WebCore::DateComponents::parseTimeZone):
+        (WebCore::DateComponents::parseMonth):
+        (WebCore::DateComponents::parseDate):
+        (WebCore::DateComponents::parseWeek):
+        (WebCore::DateComponents::parseTime):
+        (WebCore::DateComponents::parseDateTimeLocal):
+        (WebCore::DateComponents::parseDateTime):
+        (WebCore::DateComponents::setMillisecondsSinceMidnightInternal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateInternal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDate):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateTime):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateTimeLocal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForMonth):
+        (WebCore::DateComponents::setMillisecondsSinceMidnight):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForWeek):
+        (WebCore::DateComponents::millisecondsSinceEpochForTime):
+        (WebCore::DateComponents::millisecondsSinceEpoch):
+        (WebCore::DateComponents::toStringForTime):
+        (WebCore::DateComponents::toString):
+        * html/DateComponents.h: Copied from WebCore/html/ISODateTime.h.
+        (WebCore::DateComponents::DateComponents):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseToDouble):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::formStringToDateComponents):
+        * html/HTMLInputElement.h:
+        * html/ISODateTime.cpp: Removed.
+        * html/ISODateTime.h: Removed.
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2010-01-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Use platform-specific monospace fonts in the Web Inspector
+
+        Move the OS version detection code into the frontend,
+        add custom CSS monospace styles for known platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=34040
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::platform):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setInjectedScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.URLRegExp.i.get platform):
+        (WebInspector._detectPlatform):
+
+2010-01-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Simplify views logic in Profiler panel, and fix the problem described in the issue.
+        Remove image from Welcome view.
+        Preserve border on status bar-like buttons in Welcome view on window deactivation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34201
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        * inspector/front-end/inspector.css:
+
+2010-01-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Speed up KURL to QUrl conversion
+        https://bugs.webkit.org/show_bug.cgi?id=33873
+
+        The WebCore::String::utf8 method will use the generic WebCore::TextCodec
+        and then call the encode method on it. In QtWebKit this class is implemented
+        around the QTextCodec class. Instead of going the generic codec way we treat
+        the WebCore::String as a QString (no copying) and then use the built-in
+        QString::toUtf8 to do the conversion.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+
+2010-01-28  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Android] [Qt] Touch event page co-ordinates are incorrect when touch is received in an iframe.
+        https://bugs.webkit.org/show_bug.cgi?id=34162
+
+        The pageX/pageY co-ordinates of a touch event should be relative to the containing frame, not the main frame. This change implements that and also updates the existing touch-inside-iframe test to also examine the page co-ordinates.
+
+        * dom/Touch.cpp:
+        (WebCore::Touch::Touch): Remove dead code.
+        * dom/Touch.h: Remove dead code.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Rename framePoint to pagePoint, as it seems a clearer name. Also adjust the pagePoint to be relative to the touch target element's containing frame rather than the main frame.
+        * platform/PlatformTouchEvent.h: Rename Android specific constructor parameter to better reflect it's contents.
+        * platform/PlatformTouchPoint.h: Ditto.
+        * platform/android/PlatformTouchEventAndroid.cpp: Ditto.
+        * platform/android/PlatformTouchPointAndroid.cpp: Ditto.
+
+2010-01-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Simplify isActivation method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34161
+
+        Test: WebCore/manual-tests/inspector/debugger-scopes-inspection.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::isActivation):
+
+2010-01-27  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rangeOverflow/rangeUnderflow support for type=date
+        https://bugs.webkit.org/show_bug.cgi?id=34209
+
+        Add DATE type support to rangeUnderflow(), rangeOverflow(),
+        minimum(), and maximum() of HTMLInputElement.
+        In order to unify parsing code for value, min, and max strings,
+        introduce parseToDouble() function and it is called by
+        valueAsDate() and valueAsNumber() too.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-date.html
+               fast/forms/ValidityState-rangeUnderflow-date.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Support DATE type, and use parseToDouble().
+        (WebCore::HTMLInputElement::rangeOverflow): ditto.
+        (WebCore::HTMLInputElement::minimum): ditto.
+        (WebCore::HTMLInputElement::maximum): ditto.
+        (WebCore::HTMLInputElement::doubleValueFor): Added.
+        (WebCore::HTMLInputElement::valueAsDate): Use parseToDouble().
+        (WebCore::HTMLInputElement::valueAsNumber): Use parseToDouble().
+        * html/HTMLInputElement.h: Declare parseToDouble().
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix chromium build bustage (take 2).
+
+        * bindings/scripts/CodeGeneratorV8.pm: Really treat V8CustomGetter like CustomGetter in all cases.
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix chromium build bustage.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Treat V8CustomGetter like CustomGetter in all cases.
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Make ScriptValue deserialisation support the provision of a specific global
+        object to use when creating new objects.  This then allows us to make
+        MessageEvent.data and PopStateEvent.state deserialize in the correct
+        context.
+
+        Test: fast/dom/Window/window-postmessage-clone-frames.html
+
+        * bindings/js/JSPopStateEventCustom.cpp:
+          Remove custom implementation of state getter
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/scripts/CodeGeneratorJS.pm:
+          Update bindings generation to pass the correct global object, and to
+          treat "any" as synonymous with SerializedValue.
+        * dom/PopStateEvent.idl:
+
+2010-01-27  Nicholas Young  <nicholas.young@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Make media controls fade in/out transition duration configurable on a theme level.
+        https://bugs.webkit.org/show_bug.cgi?id=34196
+
+        No new tests needed (I hope).
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Removed constant from contructor - the initial value is meaningless.
+        (WebCore::RenderMedia::updateControlVisibility): Get fade in/out duration from theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::mediaControlsFadeInDuration): New virtual method.
+        (WebCore::RenderTheme::mediaControlsFadeOutDuration): New virtual method.
+
+2010-01-27  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests that when a page removes an iframe that sleeps in its unload handler and
+        terminates its JS execution, the outer page's JS continues running.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34226
+
+        Tests: fast/dom/Window/slow-unload-handler-only-frame-is-stopped.html
+               fast/dom/Window/slow-unload-handler.html
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::OnSleepDetected):
+
+2010-01-27  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add valueAsNumber support for type=datetime-local.
+        https://bugs.webkit.org/show_bug.cgi?id=34200
+
+        Implement necessary methods of ISODateTime, and call them from
+        HTMLInputElement.
+
+        Test: fast/forms/input-valueasnumber-datetimelocal.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsNumber):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateTimeLocal):
+          Implemented.  Just call setMillisecondsSinceEpochForDateTime().
+        (WebCore::ISODateTime::millisecondsSinceEpochForTime):
+          Accept to be called for m_type=DateTimeLocal.
+        (WebCore::ISODateTime::toString): Add DateTimeLocal support.
+        * html/ISODateTime.h: Declare new methods.
+
+2010-01-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows Debug_All build fix.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+
+2010-01-27  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] complex text draws newlines as bells
+        https://bugs.webkit.org/show_bug.cgi?id=34186
+
+        Revert r45496 -- once we've got a glyph array, it is too late to normalize
+        because we could have had multiple codepoints combine into one glyph.  The
+        Uniscribe code it mentions it's duplicating uses the log cluster map to fix
+        this.
+
+        Instead, we just normalize the input text if it contains any non-ascii-space
+        whitespace.
+
+        This fixes fast/text/international/hindi-whitespace, which currently has an
+        incorrect baseline containing a square box glyph.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun):
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::stringToGlyphs):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        Added checkConsistency checks before lookups in HashMaps with AtomicStringImpl* keys.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef): Clear m_elementsById map, because removeAllChildren()
+        doesn't always update it correctly when called during docuemnt destruction.
+        (WebCore::Document::getElementById): Added checkConsistency().
+        (WebCore::Document::removeElementById): Ditto.
+        (WebCore::Document::removeImageMap): Ditto.
+        (WebCore::Document::getImageMap): Ditto.
+        (WebCore::Document::nameCollectionInfo): Ditto.
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo): Ditto.
+
+        * html/CollectionCache.cpp:
+        (WebCore::CollectionCache::checkConsistency):
+        * html/CollectionCache.h:
+        Added a checkConsistency() method that checks both HashMaps in the cache.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared): Assert that m_refCount is null. Since Nodes can be
+        destroyed with operator delete (as done in ContainerNodeAlgorithms), this is important to check.
+        (WebCore::TreeShared::deref): Assert that m_refCount isn't already negative.
+
+2010-01-27  Brian Tarricone  <brian@kakai.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [gtk] Add support for windowless NPAPI plugins
+
+        Much of this is a translation of how the Qt backend does this,
+        modified for Gtk.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18831
+
+        No new tests; there is already a windowless test in the tree.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::getRootWindow):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::getPluginDisplay):
+        (WebCore::plug_removed_cb):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [v8] minor cosmetic fix in V8 bindings codegenerator
+        https://bugs.webkit.org/show_bug.cgi?id=34224
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * rendering/RenderBoxModelObject.cpp: Add wtf/CurrentTime.h include.
+
+2010-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson and David Levin.
+
+        Chains of history items representing same-document navigation need to
+        always remember that association
+
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Replace HistoryItem's Document pointer with a DocumentSequenceNumber.
+        During session history traversal, if the current HistoryItem and the
+        target HistoryItem have the same DocumentSequenceNumber, then it means
+        that the current Document should remain.
+
+        NOTE: To support Chromium's serialization of HistoryItems, I generate
+        DocumentSequenceNumbers that are unique across application launches.
+        DocumentSequenceNumbers are generated using a counter initialized with
+        the time of day.
+
+        Test: fast/loader/stateobjects/document-destroyed-navigate-back.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::generateDocumentSequenceNumber):
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setDocumentSequenceNumber):
+        (WebCore::HistoryItem::documentSequenceNumber):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Animated scaling of background-image is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=33808
+
+        Implement a version of the RenderImage animated scaling optimisation
+        for background images.  Due to the possibility of arbitrary transforms
+        being applied to containing elements we explicitly check the current
+        CTM of the context for scaling or rotation.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::~RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::size):
+        (WebCore::RenderBoxModelScaleData::time):
+        (WebCore::RenderBoxModelScaleData::useLowQualityScale):
+        (WebCore::RenderBoxModelScaleData::hiqhQualityRepaintTimer):
+        (WebCore::RenderBoxModelScaleData::setSize):
+        (WebCore::RenderBoxModelScaleData::setTime):
+        (WebCore::RenderBoxModelScaleData::setUseLowQualityScale):
+        (WebCore::RenderBoxModelScaleObserver::boxModelObjectDestroyed):
+        (WebCore::RenderBoxModelScaleObserver::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+
+2010-01-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Enable websockets support in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=34180
+
+        Connected between SocketStreamHandle and QTcpSocket/QSslSocket
+        to enable support for websockets.
+        Proxy authentication is not yet supported.
+        SSL certificate errors are ignored while this is under development.
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamHandle.h:
+        * platform/network/qt/SocketStreamHandlePrivate.h: Added.
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::~SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::socketConnected):
+        (WebCore::SocketStreamHandlePrivate::socketReadyRead):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
+        (WebCore::SocketStreamHandlePrivate::socketSentdata):
+        (WebCore::SocketStreamHandlePrivate::socketClosed):
+        (WebCore::SocketStreamHandlePrivate::socketError):
+        (WebCore::SocketStreamHandlePrivate::socketClosedCallback):
+        (WebCore::SocketStreamHandlePrivate::socketErrorCallback):
+        (WebCore::SocketStreamHandlePrivate::socketSslErrors):
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+
+2010-01-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Support getting integer-named properties using indexing notation on document object
+        https://bugs.webkit.org/show_bug.cgi?id=34211
+
+        Add indexed property getter to HTMLDocument to support getting
+        elements with integer names using indexing notation on document.
+
+        Test: fast/dom/HTMLDocument/get-iframe-with-integer-name.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::indexedPropertyGetter):
+
+2010-01-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Instead of relying on Object.prototype.toString result use JSObject::isActivationObject
+        to check if a scope node is a JSActivation. Object.prototype.toString for JSActivation
+        will call JSActivation::toThisObject whose result depends on the current call stack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34161
+
+        Test: WebCore/manual-tests/inspector/debugger-scopes-inspection.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::isActivation):
+        * inspector/InjectedScriptHost.idl:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        * manual-tests/inspector/debugger-scopes-inspection.html: Added.
+
+2010-01-27 Anton Muhin <antonm@google.com>
+        Review by Adam Barth.
+
+        Implement Node map in intrusive way for better speed.
+        https://bugs.webkit.org/show_bug.cgi?id=33957
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::get):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::set):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::removeIfPresent):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::contains):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::visit):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::allocateTableEntry):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::freeTableEntry):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::IntrusiveDOMWrapperMap):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clearEntry):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clearEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::visitEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::TableChunk::TableChunk):
+        (WebCore::DOMDataStore::domNodeMap):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::AbstractWeakReferenceMap::AbstractWeakReferenceMap):
+        (WebCore::AbstractWeakReferenceMap::weakReferenceCallback):
+        (WebCore::WeakReferenceMap::WeakReferenceMap):
+        (WebCore::WeakReferenceMap::set):
+        (WebCore::WeakReferenceMap::visit):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::getWrapper):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+
+2010-01-27  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add key event mappings for numpad keys for Gtk and Chromium/Gtk.
+        http://bugs.webkit.org/show_bug.cgi?id=28247
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2010-01-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: migrate from SourceFrame to SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34171
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorBackendStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.getResourceContent):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._sidebarResizeDrag):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.findSearchMatches):
+        (WebInspector.SourceFrame.prototype._collectRegexMatches):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype._incrementMessageRepeatCount):
+        (WebInspector.SourceFrame.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        (WebInspector.SourceFrame.prototype._keyDown):
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+        (WebInspector.SourceFrame.prototype._breakpointChanged):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintProgramCounter):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.contextMenu):
+        (WebInspector.ExecutionLineDecorator):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/SourceFrame2.js: Removed.
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.resize):
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype._contentLoaded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        (WebInspector.SourceView.prototype._jumpToSearchResult):
+        (WebInspector.SourceView.prototype._sourceFrameSetupFinished):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._copy.delayCopy):
+        (WebInspector.TextEditor.prototype._copy):
+        (WebInspector.TextEditor.prototype._cut):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-27  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] For removing ICU, implement IDN support by means of libidn
+        https://bugs.webkit.org/show_bug.cgi?id=31470
+
+        In order to avoid a new dependency, 
+        IDN support now based on GLib for the GLib unicode backend.
+
+        * platform/KURL.cpp:
+        (WebCore::appendEncodedHostname):
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] For package builds use the .def files on Symbian
+
+        * WebCore.pro:
+
+2010-01-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Avoid watch expressions duplication
+        https://bugs.webkit.org/show_bug.cgi?id=33996
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane.prototype._settingsLoaded):
+
+2010-01-27  Marcus Bulach  <bulach@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds EventSource bindings for V8
+        https://bugs.webkit.org/show_bug.cgi?id=33695
+
+        No new tests (existing layout tests for EventSource should pass).
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp: Added.
+        * bindings/v8/custom/V8EventSourceCustom.cpp: Added.
+
+2010-01-27  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Meta-methods can't be introspected using ES5 API
+        https://bugs.webkit.org/show_bug.cgi?id=34087
+
+        Add getOwnPropertyDescriptor() and getOwnPropertyNames() reimplementations.
+
+        Tests are in WebKit/qt/tests/qwebframe
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyDescriptor):
+        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyNames):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyDescriptor):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyNames):
+        * bridge/qt/qt_runtime.h:
+
+2010-01-27  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a crash when trying to indent a block element that was contained
+        in a list.  This was happening because enclosingBlock() in
+        htmlediting.cpp can return the current the same Node when a block
+        element (like an <hr> or a <table>) is passed in.  This causes
+        the indent command to think that it is not in a list item.
+
+        Work around this by checking to see if enclosingBlock returned the
+        same Node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32390
+
+        Test: editing/execCommand/indent-block-in-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add the "d" suffix to QtWebKit's dll on Windows.
+
+        * WebCore.pro:
+
+2010-01-27  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a bug where dispatchDocumentElementAvailable was fired for fragment parsing on XML documents.
+        https://bugs.webkit.org/show_bug.cgi?id=33920
+
+        Tests: userscripts/script-not-run-for-fragments.html
+               userscripts/script-run-at-start.html
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+
+2010-01-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Improve SourceHTMLTokenizer so that it treats script tag well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34177
+
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._isAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: nuke quarantine wrappers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34203
+
+        * Android.jscbindings.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp: Removed.
+        * bindings/js/JSInspectedObjectWrapper.h: Removed.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Removed.
+        * bindings/js/JSInspectorCallbackWrapper.h: Removed.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp: Removed.
+        * bindings/js/JSQuarantinedObjectWrapper.h: Removed.
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::removeAllChildrenInContainer):
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::removeElementById):
+        (WebCore::Document::removeImageMap):
+        (WebCore::Document::getImageMap):
+        (WebCore::Document::nameCollectionInfo):
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/CollectionCache.cpp:
+        * html/CollectionCache.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::deref):
+
+2010-01-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        autobuffer value not forwarded media element to MediaPlayer
+        https://bugs.webkit.org/show_bug.cgi?id=33889
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Forward autobuffer
+        value to MediaPlayer instance.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Forward autobuffer and
+        preservesPitch values to newly created platform media player instance.
+
+2010-01-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Gtk] media/video-reverse-play-duration.html fails on and off on Gtk buildbots
+        https://bugs.webkit.org/show_bug.cgi?id=34086
+
+        Cache media duration and fix didEnd() in case of reverse
+        playback. When EOS was reached but in case of reverse playback the
+        position is not always 0. So to not confuse the HTMLMediaElement
+        we synchronize position and duration values.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        * WebCore.xcodeproj/project.pbxproj: Actually land the change to add ContainerNodeAlgorithms.h
+        (it's "svn resolved", not "svn revert"!).
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        * WebCore.xcodeproj/project.pbxproj: Added ContainerNodeAlgorithms.h to the project to make
+        it easier to search for.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::removeElementById):
+        (WebCore::Document::removeImageMap):
+        (WebCore::Document::getImageMap):
+        (WebCore::Document::nameCollectionInfo):
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        Added checkConsistency checks before lookups in HashMaps with AtomicStringImpl* keys.
+
+        * dom/ContainerNodeAlgorithms.h: (WebCore::removeAllChildrenInContainer): Be sure to notify
+        about removed child nodes that can be deleted immediately.
+
+        * html/CollectionCache.cpp:
+        (WebCore::CollectionCache::checkConsistency):
+        * html/CollectionCache.h:
+        Added a checkConsistency() method that checks both HashMaps in the cache.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared): Assert that m_refCount is null. Since Nodes can be
+        destroyed with operator delete (as done in ContainerNodeAlgorithms), this is important to check.
+        (WebCore::TreeShared::deref): Assert that m_refCount isn't already negative.
+
+2010-01-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        [Qt] Fixes an issue where the height of <button>- and
+        <input type="button">- elements are fixed to the height of the
+        button label font plus padding. That is, the CSS height property
+        is being ignored.
+
+        Instead, we should honor the user-specified height, if appropriate
+        for the platform and context. Notice, the Mac ports do not honor the
+        height for <input type="button"> elements unless a border and/or
+        background is also specified.
+
+        Test: fast/css/button-height.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-26  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable the Audits panel via a shortcut (Cmd/Ctrl+Alt+A)
+        https://bugs.webkit.org/show_bug.cgi?id=34158
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2010-01-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsNumber support except type=datetime-local.
+        https://bugs.webkit.org/show_bug.cgi?id=32696
+
+        Tests: fast/forms/input-valueasnumber-date.html
+               fast/forms/input-valueasnumber-datetime.html
+               fast/forms/input-valueasnumber-month.html
+               fast/forms/input-valueasnumber-number.html
+               fast/forms/input-valueasnumber-range.html
+               fast/forms/input-valueasnumber-time.html
+               fast/forms/input-valueasnumber-unsupported.html
+               fast/forms/input-valueasnumber-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsNumber):
+          According to the specification, we should return NaN for invalid values.
+        (WebCore::HTMLInputElement::setValueAsNumber):
+          According to the specification, throws NOT_SUPPORTED_ERR for Infinitiy or NaN,
+          and throws INVALID_STATE_ERR for unsupported types.
+        (WebCore::HTMLInputElement::formStringToDouble):
+          According to the step 14 of Real Number in the specification, we
+          should round -0 to 0.
+        * html/HTMLInputElement.h: Declare valueAsNumber() and setValueAsNumber().
+        * html/HTMLInputElement.idl: Add valueAsNumber.
+
+2010-01-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure there is a lock on serialize in SerializedScriptValueData, since type errors can be created when
+        exceptions are thrown.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::serialize):
+
+2010-01-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Date type support for Objective-C binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32810
+
+        The Date type in IDLs is mapped to NSTimeInterval in Objective-C.
+
+        * bindings/objc/DOMInternal.h: Add kit() and core() for NSTimeInterval.
+        * bindings/scripts/CodeGenerator.pm: Make Date a primitive type.
+        * bindings/scripts/CodeGeneratorJS.pm: Move some code for the CodeGeenrator.pm change.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm: Move some code for the CodeGeenrator.pm change.
+        * html/HTMLInputElement.idl: Remove Objective-C exclusion for valueAsDate.
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Tiger build.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write): Use UNUSED_PARAM macros to prevent compiler warning on targets without accelerated compositing.
+
+2010-01-26  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Incorrect boolean expression in isMailBlockquote() (WebCore/htmlediting.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=34156
+
+        No new tests (minor code change).
+
+        * editing/htmlediting.cpp:
+        (WebCore::isMailBlockquote):
+
+2010-01-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        Handle broken images more correctly in the open-source image decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=33747
+
+        No tests since Safari doesn't use these decoders and there's already a
+        broken-image test in the tree.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::createFrameAtIndex): No need to check isSizeAvailable() since size() is now always safe.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Don't assert that the bitmap is valid; we don't need a complete successful decode to be able to give info about the size.
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setSize): Don't set the frame to complete on failure, since it's not complete, but empty, and callers can better handle empty frames.
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::setSize): Don't set the frame to complete on failure, since it's not complete, but empty, and callers can better handle empty frames.
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Synchronize Qt/Gtk build systems with Mac/Win, should fix Qt compilation. Gtk results still pending.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Attempt to fix V8 - change SetterMethod function signatures, just like it has been done for JSSVGPODTypeWrapper.
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Revert Base.xcconfig changes, was not meant to be committed.
+
+        * Configurations/Base.xcconfig:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVG consumes way too much memory to store animated properties in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=34188
+
+        Shrink WebCore library size to 75% (measured in debug builds) and reduce SVG memory usage to <25%.
+        Adding Oliver testcase as manual-tests/svg-node-count-vs-scroll.xhtml, which creates an arbitary number of
+        rects (50.000 <rect> elements added to the DOM by default) - memory usage down to 111M from 503M (RPRVT).
+        The SVG DOM side is almost fine, still some optimizations possible, that will be implemented soon - next
+        target is the SVG render tree, there are plenty of possibilities to reduce memory usage there.
+
+        Redesign the way we store animated properties in the individual SVG*Element files. Short story: In order
+        to support SVG DOM through the bindings (e.g. JS) we need to associate SVGAnimatedProperty objects with
+        the SVGElement object that created it - we used to store this pointer directly in the SVGAnimatedProperty.
+        This means, every SVGAnimatedProperty stored in a SVGRectElement, stored a pointer to the SVGRectElement, resulting
+        in excessive memory usage. This is now properly implemented, without wasting tons of memory. Unfortunately this
+        requires touching all SVG*Element files.
+
+        Detailed list of changes:
+        - Remove template bloat by not specializing class templates for each attributeName/tagName combination. Instead
+          SVGAnimatedProperty is a non-specialized template class now, only depending on the AnimatedType (ie. SVGLength for SVGAnimatedLength)
+          -> This heavily reduces the generated code, thus shrinking WebCore size. I hope we can build windows again without SVGAllInOne.cpp
+
+        - Remove "exportStrings" / "exportString" handling from make_names.pl - SVG defined string literals for each QualifiedName,
+          in order to use template specialization based on "const char*" parameters. All that bloat is gone, so there's no need for it anymore.
+
+        - Redesign SVGAnimatedProperty so it does not need any back-pointers to the SVGElement that created it
+
+        - Don't actually store the XML DOM attribute name associated with a SVG DOM property in SVGAnimatedProperty, move the associatedAttributeName()
+          function inside the macro declaration and just return the passed macro parameter DOMAttribute there, storing is inefficient and useless.
+
+        - Remove SynchronizablePropertyController, which was living in SVGElement as member variable, keeping a HashMap<AttributeName, SVGAnimatedProperty>.
+          It was needed before to lookup a SVGAnimatedProperty for a XML DOM attribute, in order to synchronize SVG <-> XML dom properties/attributes.
+          Instead just add a "synchronizeProperty(const QualifiedName&)" method to all SVG*Element classes. As each SVG*Element class knows about its
+          animated properties it can just ask them to synchronize themselves - no need for any dynamic lookups anymore.
+
+        - Remove SynchronizableTypeWrapper which added more complexity for the sake of SVG <-> XML DOM synchronization, all replaced by synchronizeProperty.
+
+        - Pass around any POD objects as const references, instead of copying them for no reason.
+
+        - Clean up SVGAnimatedProperty, splitting up into SVGAnimatedProperty/PropertySynchronizer/PropertyTraits.
+
+        - Remove baseValue/setBaseValue code from SVGDocumentExtensions, not needed anymore.
+
+        ... and tons of changes to all SVG*Element classes, adapting to the new way of handling animated properties.
+
+        * GNUmakefile.am: Remove Synchronizable* from build, add new SVGAnimatedPropertySynchronizer/Traits files
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGPODTypeWrapper.h: Change synchronization callback signatures, as we pass around const-references now.
+        * dom/Element.cpp: Let updateAnimatedSVGAttribute take a QualifiedName instead of pure Strings.
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::hasAttributes):
+        * dom/Element.h:
+        (WebCore::Element::updateAnimatedSVGAttribute):
+        (WebCore::Element::attributes):
+        * dom/make_names.pl: Remove SVG specific "exportString" / "exportStrings" functionality, see above.
+        * html/HTMLAttributeNames.in: Remove "exportString" tag from "className" attribute.
+        * manual-tests/svg-node-count-vs-scroll.xhtml: Added. Can be used to verify memory consumption with a lot of DOM objects.
+        * mathml/mathattrs.in: MathML doesn't need "exportStrings" - remove it.
+        * mathml/mathtags.in: Ditto.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        (WebCore::SVGAElement::synchronizeProperty):
+        * svg/SVGAElement.h:
+        * svg/SVGAllInOne.cpp: Remove SynchronizablePropertyController.cpp
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        (WebCore::SVGAltGlyphElement::synchronizeProperty):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimatedProperty.h: Rewritten, see above for details.
+        (WebCore::SVGAnimatedPropertyTearOff::create):
+        (WebCore::SVGAnimatedPropertyTearOff::setBaseVal):
+        (WebCore::SVGAnimatedPropertyTearOff::setAnimVal):
+        (WebCore::SVGAnimatedPropertyTearOff::baseVal):
+        (WebCore::SVGAnimatedPropertyTearOff::animVal):
+        (WebCore::SVGAnimatedPropertyTearOff::associatedAttributeName):
+        (WebCore::SVGAnimatedPropertyTearOff::SVGAnimatedPropertyTearOff):
+        (WebCore::SVGAnimatedPropertyTearOff::~SVGAnimatedPropertyTearOff):
+        (WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
+        (WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
+        (WebCore::SVGAnimatedProperty::value):
+        (WebCore::SVGAnimatedProperty::baseValue):
+        (WebCore::SVGAnimatedProperty::setValue):
+        (WebCore::SVGAnimatedProperty::setBaseValue):
+        (WebCore::SVGAnimatedProperty::shouldSynchronize):
+        (WebCore::SVGAnimatedProperty::setShouldSynchronize):
+        * svg/SVGAnimatedPropertySynchronizer.h: Added.
+        (WebCore::):
+        * svg/SVGAnimatedPropertyTraits.h: Added.
+        (WebCore::):
+        * svg/SVGAnimatedTemplate.h: Move SVGAnimatedPropertyTraits into its own file.
+        (WebCore::SVGAnimatedTemplate::forgetWrapper):
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        (WebCore::SVGAnimationElement::synchronizeProperty):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        (WebCore::SVGCircleElement::synchronizeProperty):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        (WebCore::SVGClipPathElement::synchronizeProperty):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::SVGComponentTransferFunctionElement):
+        (WebCore::SVGComponentTransferFunctionElement::parseMappedAttribute):
+        (WebCore::SVGComponentTransferFunctionElement::synchronizeProperty):
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        (WebCore::SVGCursorElement::synchronizeProperty):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        (WebCore::SVGDefsElement::synchronizeProperty):
+        * svg/SVGDefsElement.h:
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp: Adapt to synchronization changes: use synchronizeProperty() call, instead of SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Don't store SynchronizablePropertyController anymore, it's gone.
+        (WebCore::SVGElement::synchronizeProperty):
+        (WebCore::SVGElement::setSynchronizedSVGAttributes):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        (WebCore::SVGEllipseElement::synchronizeProperty):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::SVGFEBlendElement):
+        (WebCore::SVGFEBlendElement::synchronizeProperty):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::synchronizeProperty):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::SVGFEComponentTransferElement):
+        (WebCore::SVGFEComponentTransferElement::synchronizeProperty):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::SVGFECompositeElement):
+        (WebCore::SVGFECompositeElement::parseMappedAttribute):
+        (WebCore::SVGFECompositeElement::synchronizeProperty):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):
+        (WebCore::SVGFEDiffuseLightingElement::synchronizeProperty):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::SVGFEDisplacementMapElement):
+        (WebCore::SVGFEDisplacementMapElement::synchronizeProperty):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::SVGFEGaussianBlurElement):
+        (WebCore::SVGFEGaussianBlurElement::synchronizeProperty):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::synchronizeProperty):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::SVGFELightElement):
+        (WebCore::SVGFELightElement::synchronizeProperty):
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::SVGFEMergeNodeElement):
+        (WebCore::SVGFEMergeNodeElement::synchronizeProperty):
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::synchronizeProperty):
+        * svg/SVGFEMorphologyElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::SVGFEOffsetElement):
+        (WebCore::SVGFEOffsetElement::synchronizeProperty):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):
+        (WebCore::SVGFESpecularLightingElement::synchronizeProperty):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::SVGFETileElement):
+        (WebCore::SVGFETileElement::synchronizeProperty):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):
+        (WebCore::SVGFETurbulenceElement::synchronizeProperty):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        (WebCore::SVGFilterElement::synchronizeProperty):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::SVGFilterPrimitiveStandardAttributes):
+        (WebCore::SVGFilterPrimitiveStandardAttributes::synchronizeProperty):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/SVGFitToViewBox.cpp:
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        (WebCore::SVGFontElement::synchronizeProperty):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        (WebCore::SVGForeignObjectElement::synchronizeProperty):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        (WebCore::SVGGElement::synchronizeProperty):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        (WebCore::SVGGradientElement::synchronizeProperty):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        (WebCore::SVGImageElement::synchronizeProperty):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        (WebCore::SVGLineElement::synchronizeProperty):
+        * svg/SVGLineElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::SVGLinearGradientElement):
+        (WebCore::SVGLinearGradientElement::synchronizeProperty):
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h: Adapt to const-reference changes.
+        (WebCore::SVGPODListItem::setValue):
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::synchronizeProperty):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::synchronizeProperty):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        (WebCore::SVGMaskElement::synchronizeProperty):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        (WebCore::SVGPathElement::synchronizeProperty):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::synchronizeProperty):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        (WebCore::SVGPolyElement::svgAttributeChanged):
+        (WebCore::SVGPolyElement::synchronizeProperty):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::SVGRadialGradientElement):
+        (WebCore::SVGRadialGradientElement::synchronizeProperty):
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        (WebCore::SVGRectElement::synchronizeProperty):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::synchronizeProperty):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        (WebCore::SVGScriptElement::synchronizeProperty):
+        * svg/SVGScriptElement.h:
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::SVGStopElement):
+        (WebCore::SVGStopElement::synchronizeProperty):
+        * svg/SVGStopElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::SVGStyledElement):
+        (WebCore::SVGStyledElement::parseMappedAttribute):
+        (WebCore::SVGStyledElement::synchronizeProperty):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::SVGStyledTransformableElement):
+        (WebCore::SVGStyledTransformableElement::synchronizeProperty):
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        (WebCore::SVGSwitchElement::synchronizeProperty):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        (WebCore::SVGSymbolElement::synchronizeProperty):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        (WebCore::SVGTRefElement::synchronizeProperty):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        (WebCore::SVGTextContentElement::synchronizeProperty):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::SVGTextElement):
+        (WebCore::SVGTextElement::synchronizeProperty):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        (WebCore::SVGTextPathElement::synchronizeProperty):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::SVGTextPositioningElement):
+        (WebCore::SVGTextPositioningElement::synchronizeProperty):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGURIReference.cpp:
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        (WebCore::SVGUseElement::synchronizeProperty):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        (WebCore::SVGViewElement::synchronizeProperty):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Removed.
+        * svg/SynchronizablePropertyController.h: Removed.
+        * svg/SynchronizableTypeWrapper.h: Removed.
+        * svg/svgattrs.in: Remove "exportStrings" tag.
+        * svg/svgtags.in: Ditto.
+        * svg/xlinkattrs.in:
+
+2010-01-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7169464> REGRESSION (r47444): PLT is 1% slower due to implementation of :valid and :invalid CSS selectors
+        https://bugs.webkit.org/show_bug.cgi?id=34029
+
+        If we never hit the valid or invalid selectors for a particular document, 
+        then we'll skip the validity checks when deciding about style sharing.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        
+        * dom/Document.cpp: (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::considerValidity):
+        (WebCore::Document::setConsiderValidity):
+
+2010-01-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Revert 53797 as it seems to be causing crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=34153
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Steve Falkenburg.
+
+        DumpRenderTree silently crashes at the end of the run because geolocationControllerClient pointer is 0.
+        https://bugs.webkit.org/show_bug.cgi?id=34191
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController): Add check for m_client being 0.
+        (WebCore::GeolocationController::addObserver): Ditto.
+        (WebCore::GeolocationController::removeObserver): Ditto.
+        (WebCore::GeolocationController::lastPosition): Ditto.
+
+2010-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Enhance externalRepresentation() to make it more useful for layer debugging
+        https://bugs.webkit.org/show_bug.cgi?id=34143
+
+        Enhance externalRepresentation() to output additional information about layers when certain flags are passed.
+        The new flags allow you to show all layers (not just those that would paint), to the structure of the z-order
+        and normal flow lists, and to show which layers are composited.
+
+        * WebCore.base.exp: The signature of externalRepresentation() changed.
+
+        * platform/text/TextStream.h: Add operator<<(void*)
+        * platform/text/TextStream.cpp: Implement operator<<(void*)
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (showLayerTree): New method outside the WebCore namespace, for ease of calling from gdb.
+
+        * rendering/RenderTreeAsText.h: New behavior flags for externalRepresentation().
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write): Output compositing information if requested. Also clean up some -1/1 magic
+        numbers with an enum.
+        (WebCore::writeLayers): If requested, show layer nesting via the z-order and normal flow lists.
+        (WebCore::externalRepresentation): New arguments
+
+2010-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed an off-by-one error.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter):
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Avoid reloading iframe on re-parenting between documents.
+        https://bugs.webkit.org/show_bug.cgi?id=32848
+
+        Achieved by setting a flag on iframe element when it is a target of document.adoptNode(node) operation.
+        The flag prevents unload/load cycle and is reset once element is attached to a new document.
+        If iframe is adopted but not actually inserted into the tree, it gets unloaded by async timer
+        once JS yields, to avoid having active content in non-attached iframe.
+
+        Test: fast/frames/iframe-reparenting.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::adoptNode): If the adopted node is iframe, set a remainsAliveOnRemovalFromTree on it.
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase):
+        (WebCore::HTMLFrameElementBase::attach): Skip actual loading of the frame if it has remainsAliveOnRemovalFromTree flag. Reset the flag.
+        (WebCore::HTMLFrameElementBase::willRemove): Skip unloading the frame if it has remainsAliveOnRemovalFromTree flag set.
+        (WebCore::HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree): Set the flag, start the async timer to check if the frame was actually attached.
+        (WebCore::HTMLFrameElementBase::checkAttachedTimerFired):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::willRemove): Move from private to protected, since it is conditionally called in HTMLFrameElementBase::willRemove now.
+
+2010-01-26  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r53861.
+        http://trac.webkit.org/changeset/53861
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Caused 2 regression tests to fail.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        (WebCore::Document::registerHistoryItem):
+        (WebCore::Document::unregisterHistoryItem):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::document):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/7576663> Crash caused by anonymous list item
+        https://bugs.webkit.org/show_bug.cgi?id=34183
+
+        Test: fast/lists/anonymous-items.html
+
+        enclosingList() and previousListItem() were DOM-based, but in order to work with anonymous
+        list items, they need to work with rthe render tree.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::isList): Factored out.
+        (WebCore::enclosingList): Added this variant that takes a RenderObject.
+        (WebCore::previousListItem): Changed to travers the render tree.
+        (WebCore::RenderListItem::calcValue): Use the RenderObject version of enclosingList()
+        (WebCore::RenderListItem::setExplicitValue): Added an assertion.
+        (WebCore::RenderListItem::clearExplicitValue): Ditto.
+
+2010-01-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Crash in WebKit!WebCore::RenderMenuList::itemStyle
+        https://bugs.webkit.org/show_bug.cgi?id=34182
+        <rdar://7087757>
+        
+        Added bounds checks in RenderMenuList to make sure we are
+        not making an out of bounds check in a vector once an option
+        element has been deleted. If we are out of bounds, we fall back to
+        a default value and return early, and in the case of itemStyle, we use a 
+        previous option's style, if it is available.
+
+        * manual-tests/select-delete-item.html: Added.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemText): If out of bounds check, return early.
+        (WebCore::RenderMenuList::itemToolTip): Ditto.
+        (WebCore::RenderMenuList::itemIsEnabled): Ditto.
+        (WebCore::RenderMenuList::itemStyle): If out of bounds check, try using the 0th index
+            option style, then fall back to the select's style if that option doesn't exist.
+        (WebCore::RenderMenuList::itemBackgroundColor): If out of bounds check, return early.
+        (WebCore::RenderMenuList::itemIsSeparator): Ditto.
+        (WebCore::RenderMenuList::itemIsLabel): Ditto.
+        (WebCore::RenderMenuList::itemIsSelected): Ditto.
+
+2010-01-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Some methods in JSC JNI bridge need more error checking of results from JNI.
+        https://bugs.webkit.org/show_bug.cgi?id=34149
+
+        In JNIUtility.h, callJNIMethodV<jobject> might return null (from CallObjectMethodV, via
+        JNICaller<jobject>::callV) if an exception is thrown.  All clients of callJNIMethodV<jobject>
+        that are calling methods on the returned object should null check first.
+
+        * bridge/jni/JNIBridge.cpp:
+        (JavaField::JavaField):
+        (JavaMethod::JavaMethod):
+        * bridge/jni/JNIUtility.h:
+        (JSC::Bindings::):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Chains of history items representing same-document navigation need to
+        always remember that association
+
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Replace HistoryItem's Document pointer with a DocumentSequenceNumber.
+        During session history traversal, if the current HistoryItem and the
+        target HistoryItem have the same DocumentSequenceNumber, then it means
+        that the current Document should remain.
+
+        NOTE: To support Chromium's serialization of HistoryItems, I generate
+        DocumentSequenceNumbers that are unique across application launches.
+        DocumentSequenceNumbers are generated using a counter initialized with
+        the time of day.
+
+        Test: fast/loader/stateobjects/document-destroyed-navigate-back.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::generateDocumentSequenceNumber):
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setDocumentSequenceNumber):
+        (WebCore::HistoryItem::documentSequenceNumber):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add ability for image maps to be focused via tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=17513
+
+        Test: fast/events/tab-imagemap.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedImageMapUIElement):
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::areaElement):
+        (WebCore::AccessibilityImageMapLink::mapElement):
+        (WebCore::AccessibilityImageMapLink::isImageMapLink):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isImageMapLink):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getPath):
+        (WebCore::HTMLAreaElement::getRect):
+        (WebCore::HTMLAreaElement::imageElement):
+        (WebCore::HTMLAreaElement::isKeyboardFocusable):
+        (WebCore::HTMLAreaElement::isFocusable):
+        (WebCore::HTMLAreaElement::dispatchBlurEvent):
+        (WebCore::HTMLAreaElement::updateFocusAppearance):
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
+        * html/HTMLMapElement.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::drawFocusRingToContext):
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paint):
+        (WebCore::RenderImage::paintFocusRings):
+        (WebCore::RenderImage::imageMap):
+        * rendering/RenderImage.h:
+        * rendering/RenderReplaced.h:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add support for breakpoints, messages and search into the SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34165
+
+        * inspector/front-end/SourceFrame2.js:
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.get executionLine):
+        (WebInspector.SourceFrame2.prototype.set executionLine):
+        (WebInspector.SourceFrame2.prototype.revealLine):
+        (WebInspector.SourceFrame2.prototype.addBreakpoint):
+        (WebInspector.SourceFrame2.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame2.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame2.prototype.setContent):
+        (WebInspector.SourceFrame2.prototype.findSearchMatches):
+        (WebInspector.SourceFrame2.prototype.setSelection):
+        (WebInspector.SourceFrame2.prototype._addMessageToSource):
+        (WebInspector.SourceFrame2.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame2.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame2.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame2.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame2.prototype._contextMenu):
+        (WebInspector.SourceFrame2.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame2.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame2.prototype._createConditionElement):
+        (WebInspector.SourceFrame2.prototype._keyDown):
+        (WebInspector.SourceFrame2.prototype._evalSelectionInCallFrame):
+        (WebInspector.SourceFrame2.prototype._breakpointChanged):
+        (WebInspector.SourceFrame2.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.contextMenu):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.set mimeType):
+        (WebInspector.TextEditor.prototype.set readOnly):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype.packAndRepaintAll):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype.updateCanvasSize):
+        (WebInspector.TextEditor.prototype.repaintAll):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._repaintOnScroll):
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._contextMenu):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._columnForOffset):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._positionDivDecoration):
+        (WebInspector.TextEditor.prototype._replaceSelectionWith):
+        (WebInspector.TextEditor.prototype.setCoalescingUpdate):
+        (WebInspector.TextEditor.prototype._handleUndo):
+        (WebInspector.TextEditor.prototype._handleRedo):
+        (WebInspector.TextEditor.prototype._changeFont):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/textEditor.css:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add methods for getting resource content from within frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34163
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getResourceContent):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetResourceContent):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.getResourceContent):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: added null check into the timeline agent getter.
+
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::retrieve):
+
+2010-01-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific classes from bridge/jni/JNIBridge to bridge/jni/jsc/JNIBridgeJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33958
+
+        This allows bridge/jni/JNIBridge to be used with both JSC and V8.
+        A later change will add the V8 equivalent of these JSC-specific classes.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Added JNIBridgeJSC.cpp
+        * GNUmakefile.am: Modified. Added JNIBridgeJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added JNIBridgeJSC.[cpp|h]
+        * bridge/jni/JNIBridge.cpp: Modified. Moved JavaField and JavaArray to JNIBridgeJSC.cpp
+        (appendClassName): Modfied. Guard calls to JSLock
+        (JavaMethod::signature): Modfied. Guard calls to JSLock
+        * bridge/jni/JNIBridge.h: Modified. Moved JavaField and JavaArray to JNIBridgeJSC.h
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: Copied from WebCore/bridge/jni/JNIBridge.cpp.
+        * bridge/jni/jsc/JNIBridgeJSC.h: Copied from WebCore/bridge/jni/JNIBridge.h.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Modified. Include JNIBridgeJSC.h
+        * bridge/jni/jsc/JavaClassJSC.h: Modified. Include JNIBridgeJSC.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Include JNIBridgeJSC.h
+
+2010-01-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Fix Windows build when sqlite is not available.
+
+        * WebCore.pri:
+        * WebCore.pro:
+
+2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] JavaScript prompt is currently broken.
+        https://bugs.webkit.org/show_bug.cgi?id=30914
+
+        Remove the manual test case in favor of an automated
+        test case in WebKit/qt/tests/qwebpage.
+
+        * manual-tests/qt/java-script-prompt.html: Removed.
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement HTML and CSS highlighters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34144
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptTokenizer.js: Removed.
+        * inspector/front-end/JavaScriptTokenizer.re2js: Removed.
+        * inspector/front-end/SourceCSSTokenizer.js: Added.
+        (WebInspector.SourceCSSTokenizer):
+        (WebInspector.SourceCSSTokenizer.prototype._stringToken):
+        (WebInspector.SourceCSSTokenizer.prototype._isPropertyValue):
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js: Added.
+        * inspector/front-end/SourceHTMLTokenizer.js: Added.
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js: Added.
+        * inspector/front-end/SourceJavaScriptTokenizer.js: Added.
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js: Added.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.Tokenizer):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.set line):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.set condition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.get condition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.hasCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.getLexCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.setLexCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype._charAt):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        REGRESSION(r53835): Fix editing/pasteboard/paste-noscript-xhtml.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=34157
+
+        Pass the FragmentScriptingPermission correctly through to the DOM
+        and disallow scripting elements in parseEndElement(), similar to
+        the libxml tokenizer change in r53835.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2010-01-26  Garret Kelly  <gdk@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing declaration for the feMorphology SVG element.
+        https://bugs.webkit.org/show_bug.cgi?id=34151
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2010-01-26  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix after API changes in r53835.
+
+        No new tests needed.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::parseXMLDocumentFragment):
+
+2010-01-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make storage events match the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=30546
+
+        This meat of the patch I just posted is very simple.  It's just making events
+        asynchronous, not posting them to the frame that generated them, passing a null
+        for the key when issuing a clear storage event, and making the events
+        non-cancelable/non-bubbleable...all of which are clearly stated in the spec.
+
+        The asynchronous and not posting to the frame that generated them forced me to
+        re-write all the layout tests that dealt with storage events.  There's a lot of
+        code there, but I tried to be fairly careful to ensure that test coverage did
+        not shrink in any area.
+
+        Tests: storage/domstorage/events/basic-body-attribute.html
+               storage/domstorage/events/basic-setattribute.html
+               storage/domstorage/events/basic.html
+               storage/domstorage/events/case-sensitive.html
+               storage/domstorage/events/documentURI.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::enqueueStorageEvent):
+        (WebCore::Document::storageEventTimerFired):
+        * dom/Document.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2010-01-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7573493> Error with line break inside ?&raquo; pair of characters.
+        https://bugs.webkit.org/show_bug.cgi?id=17475
+
+        Test: fast/text/line-break-after-question-mark.html
+
+        Instead of unconditionally allowing lines to break after a question mark, which was intended
+        to mimic Internet Explorer, apply the Unicode line breaking behavior after a question mark,
+        with one exception in the ASCII range to match IE, namely not allowing a line break between
+        a question mark and a vertical line.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter): Added a next character parameter. Changed to consult a table
+        for the question mark case in order to keep it fast and not require a text break iterator in
+        the ASCII case.
+        (WebCore::nextBreakablePosition): Pass the next character to shouldBreakAfter.
+
+2010-01-25  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Mac scrollbar thumbs were drawn with the wrong size.
+        https://bugs.webkit.org/show_bug.cgi?id=34049
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+
+2010-01-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup unwanted tags after pasting.
+        https://bugs.webkit.org/show_bug.cgi?id=34148
+        
+        Test: editing/pasteboard/paste-noscript-xhtml.xhtml
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeNS):
+        * dom/Element.h:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::parseXMLDocumentFragment):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment):
+
+2010-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        A WebGeolocationControllerClient is leaked for every WebView
+        https://bugs.webkit.org/show_bug.cgi?id=34145
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/GeolocationControllerClient.h:
+
+2010-01-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed bug in positioning of scroll layer within the
+        parent root layer.
+        https://bugs.webkit.org/show_bug.cgi?id=33847
+        
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
+        assertions added in the previous patch - it's mot true that m_for is always a parent; table
+        parsing can reparent the image element, but m_form still needs to be set.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Tests: fast/forms/removed-image-as-property.html
+               fast/forms/reparented-image-as-property.html
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
+        to make observable changes to DOM.
+        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
+        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
+        which happens during parsing.
+        (WebCore::HTMLImageElement::removedFromTree): Ditto.
+
+        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
+        and insertedIntoDocument to private section, as they shouldn't be called directly.
+
+2010-01-25  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34073
+
+        Fixes misspelled words in comments.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper detach]):
+        (AXAttributeStringSetElement):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::completeURL):
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::sortMatchedRules):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+        * dom/Element.h:
+        * dom/MessagePortChannel.h:
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+        (WebCore::Node::shadowAncestorNode):
+        * dom/Node.h:
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        * dom/Position.h:
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::reconcileTextDecorationProperties):
+        (WebCore::StyleChange::extractTextStyles):
+        (WebCore::prepareEditingStyleToApplyAt):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        * editing/Editor.cpp:
+        (WebCore::Editor::learnSpelling):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        (WebCore::Cache::pruneDeadResources):
+        * loader/Cache.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::makePurgeable):
+        * loader/CachedResource.h:
+        * loader/CachedResourceHandle.h:
+        * loader/DocumentLoader.h:
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::parseOneFTPLine):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didExplicitOpen):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didCancel):
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::spaceNeeded):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations):
+        * platform/LinkHash.cpp:
+        (WebCore::cleanPath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::offsetForPosition):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::doSeek):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames):
+        * platform/text/TextEncodingDetectorICU.cpp:
+        (WebCore::detectTextEncoding):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::calcEffectiveWidth):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::stateChanged):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::flattenWithTransform):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::suggestedValue):
+
+2010-01-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Fixed a spelling error, tightened up some grammar.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+
+2010-01-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Instead of adding inspector methods to the inspected global objects
+        use private implementation visible from inspector code only.
+        https://bugs.webkit.org/show_bug.cgi?id=34089
+
+        Test: inspector/inspected-objects-not-overriden.html
+
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+
+2010-01-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: don't show headers/content tabs in scripts view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34083
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype.set headersVisible):
+        (WebInspector.ResourceView.prototype._selectContentTab):
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.css:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Reduce the size of the library when compiling for Maemo5
+        https://bugs.webkit.org/show_bug.cgi?id=34050
+
+        Exclude the Web Inspector's qrc file in the Maemo5 build, just
+        like we do for the Symbian build. Saves about ~900k.
+
+        * WebCore.pro:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In the StyledPainter determine the style from the Render and Scrollbar theme instead of from the paint device
+        https://bugs.webkit.org/show_bug.cgi?id=34054
+
+        Getting the style from the painter's paint device is a hack that breaks when
+        the paint device's style is different than the style that is used when
+        calculating the metries earlier when there is no painter available.
+
+        This change moves us closer to always using the same style.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::StylePainter::StylePainter):
+        (WebCore::StylePainter::init):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaMuteButton):
+        (WebCore::RenderThemeQt::paintMediaPlayButton):
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::hitTest):
+        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQt::scrollbarThickness):
+        (WebCore::ScrollbarThemeQt::thumbLength):
+        (WebCore::ScrollbarThemeQt::trackPosition):
+        (WebCore::ScrollbarThemeQt::trackLength):
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        (WebCore::ScrollbarThemeQt::style):
+        * platform/qt/ScrollbarThemeQt.h:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In RenderThemeQt determine the QStyle from the page client instead of the page's view
+        https://bugs.webkit.org/show_bug.cgi?id=34053
+
+        * platform/qt/QWebPageClient.h: Add function to return the style.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::qStyle): Determine the style from the page client instead of the page's view.
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Clean up code to determine palette from page client in RenderThemeQt
+        https://bugs.webkit.org/show_bug.cgi?id=34052
+
+        Use the RenderTheme's associated page instead of going through the
+        render tree and the document.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+        * platform/qt/RenderThemeQt.h:
+
+2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Phone backup support for QtWebkit for Symbian devices.
+        https://bugs.webkit.org/show_bug.cgi?id=34077
+
+        * WebCore.pro:
+
+2010-01-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::registerFixedPositionedObject):
+        (WebCore::FrameView::unregisterFixedPositionedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add support for addMessage/clearMessages to SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33904
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame2.js:
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.addMessage):
+        (WebInspector.SourceFrame2.prototype.clearMessages):
+        (WebInspector.SourceFrame2.prototype._incrementMessageRepeatCount):
+        (WebInspector.SourceFrame2.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame2.prototype._addMessageToSource):
+        (WebInspector.SourceFrame2.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype._highlightChanged):
+        (WebInspector.TextEditor.prototype.packAndRepaintAll):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paint):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._mouseOut):
+        (WebInspector.TextEditor.prototype._updateDivDecorations):
+        (WebInspector.TextEditor.prototype._positionDivDecoration):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._replaceSelectionWith):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css: Added.
+
+2010-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Replace split pane with tabbed pane in resource
+        contents view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32453
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype.attach):
+        (WebInspector.ResourceView.prototype.show):
+        (WebInspector.ResourceView.prototype._selectTab):
+        (WebInspector.ResourceView.prototype._selectHeadersTab):
+        (WebInspector.ResourceView.prototype._selectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        * inspector/front-end/inspector.css:
+
+2010-01-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Media element duration changes to zero after playing in reverse
+        https://bugs.webkit.org/show_bug.cgi?id=34041
+
+        Test: media/video-reverse-play-duration.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::didEnd): QTKit's ended notification fires at time zero when 
+        playing in reverse, so don't reset duration in that case.
+
+2010-01-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Content with heavily nested residual style is so slow, it seems like a hang
+        https://bugs.webkit.org/show_bug.cgi?id=34059
+        <rdar://problem/7292906>
+        
+        Test cast: fast/parser/residual-style-hang.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks):
+        Limit the number of iterations of the main loop to 5.
+        
+        The reason this limit is necessary is that otherwise, N misnested open tags followed
+        by N misnested close tags will cause O(N^2) of work due to cloning and attaching subtrees;
+        at a fixed limit, the cost is at worst O(N).
+        
+        The code that was in the loop originally ran exactly once - the loop was added in
+        r21472 to fix <https://bugs.webkit.org/show_bug.cgi?id=13603>. I have verified that
+        with the iteration limit, the bug is still fixed, both with the original test case
+        and with the layout tests tht were added.
+
+2010-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=week.
+        https://bugs.webkit.org/show_bug.cgi?id=33986
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForWeek() and add
+        Week type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate): Avoid default:.
+        (WebCore::HTMLInputElement::setValueAsDate):
+          Add WEEK type handling and avoid default:.
+        * html/ISODateTime.cpp:
+        (WebCore::offsetTo1stWeekStart):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForWeek):
+        (WebCore::ISODateTime::millisecondsSinceEpoch):
+        (WebCore::ISODateTime::toString):
+          Add Week type support and avoid default:.
+        * html/ISODateTime.h:
+
+2010-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Object Serialization assumes deserialization will always occur in the context of a webpage
+        https://bugs.webkit.org/show_bug.cgi?id=34056
+        rdar://7573833
+
+        Added ClassInfo to JSDOMGlobalObject and make the window and worker class info
+        inherit from it.  With this in place we're able to determine whether a given
+        global object is a DOMGlobalObject, and then use that information to avoid
+        attempting to deserialize types that require the presence of the DOM.
+
+        No test as all global objects in webkit inherit from JSDOMGlobalObject.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::classInfo):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+
+2010-01-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34047
+        <rdar://problem/7573699>
+        Media element "endedPlayback" logic doesn't match spec
+
+        Test: media/video-timeupdate-reverse-play.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::ended): The 'ended' attribute should only be true when playback
+        rate is positive.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Always schedule a 'timeupdate' event when
+        the media engine signals a time discontinuity, scheduleTimeupdateEvent will only queue an event
+        if one hasn't already been posted for the current movie time.
+        (WebCore::HTMLMediaElement::endedPlayback): Update to match the spec logic.
+
+2010-01-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video that loads inside reflection doesn't get reflected
+        https://bugs.webkit.org/show_bug.cgi?id=34046
+        
+        ensureCloneLayers() made an incorrect assumption that if a clone of the primaryLayer
+        exists already, then the structural layer and content layer can just be returned.
+        However, this doesn't account for the situation where a content layer may have
+        been create after the clone tree was last updated.
+        
+        Fix by always creating the structural and clone layers on demand.
+
+        Test: compositing/reflections/load-video-in-reflection.html
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Added utility method, findOrMakeClone().
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::findOrMakeClone): Utility that efficiently finds
+        or creates a layer in a LayerMap.
+        (WebCore::GraphicsLayerCA::ensureCloneLayers): Always look for or clone the
+        structural and content layers, rather than relying on whether there's a primary
+        layer clone already.
+
+2010-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement support for FileList cloning in postMessage
+        https://bugs.webkit.org/show_bug.cgi?id=34048
+
+        Support passing FileList through postMessage APIs.  Basically
+        mechanical task in line with other terminals in the object
+        graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedFileList::create):
+        (WebCore::SerializedFileList::length):
+        (WebCore::SerializedFileList::item):
+        (WebCore::SerializedFileList::SerializedFileList):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asFileList):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+            Rearrange these functions to not use 'default:' handling
+            so that the compiler will actually tell us when we're
+            not handling cases.
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asFileList):
+
+2010-01-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Test: inspector/console-log-before-inspector-open.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::globalState):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::globalState):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-22  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by David Hyatt.
+
+        Added support for RenderMathMLBlock base object and isRenderMathMLBlock()
+        method on RenderObject. 
+
+        Added support for text elements and updated tag and attribute names
+
+        Also, updated the stylesheet added files to the project
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mathml.css:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLTextElement.cpp: Added.
+        (WebCore::MathMLTextElement::MathMLTextElement):
+        (WebCore::MathMLTextElement::create):
+        (WebCore::MathMLTextElement::createRenderer):
+        * mathml/MathMLTextElement.h: Added.
+        * mathml/RenderMathMLBlock.cpp: Added.
+        (WebCore::RenderMathMLBlock::RenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::styleDidChange):
+        (WebCore::RenderMathMLBlock::isChildAllowed):
+        (WebCore::RenderMathMLBlock::makeBlockStyle):
+        (WebCore::RenderMathMLBlock::nonOperatorHeight):
+        (WebCore::RenderMathMLBlock::stretchToHeight):
+        * mathml/RenderMathMLBlock.h: Added.
+        (WebCore::RenderMathMLBlock::isRenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::isRenderMathMLOperator):
+        (WebCore::RenderMathMLBlock::isRenderMathMLRow):
+        (WebCore::RenderMathMLBlock::isRenderMathMLMath):
+        (WebCore::RenderMathMLBlock::hasBase):
+        (WebCore::toRenderMathMLBlock):
+        * mathml/mathattrs.in: Added.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderMathMLBlock):
+
+2010-01-22  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ensures that the 'selected' attribute of an <option> is correct
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Adds a check in OptionElement::selected() that checks if list items need to be recalculated and does so if needed,
+        so the attribute is up to date more often.  Also gets rid of most of the recalcStyle() side effects.
+
+         Our behavior now matches Firefox 3.5 and IE8 after the </select> is parsed.
+
+         Tests: fast/forms/HTMLOptionElement_selected2.html
+                fast/forms/HTMLOptionElement_selected3.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setOptionsChangedOnRenderer):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::recalcListItemsIfNeeded):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to handle WebGLUnsignedByteArray as method argument for V8 binding
+        https://bugs.webkit.org/show_bug.cgi?id=33929
+
+        V8 code generator does not have associated tests
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-01-22  Elliot Glaysher  <erg@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium: theme selection colors to match gtk theme
+        Add functions to RenderThemeChromiumLinux to change the selection color
+        according to the current GTK+ theme.
+
+        Since the change is to the Chromium WebKit API layer, testing is done
+        in Chromium's test shell (see Chromium side of this patch:
+        http://codereview.chromium.org/554004)
+
+        https://bugs.webkit.org/show_bug.cgi?id=33921
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumLinux::setSelectionColors):
+        * rendering/RenderThemeChromiumLinux.h: Adds static members.
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * WebCoreSources.bkl: Removed.
+        * webcore-base.bkl: Removed.
+        * webcore-wx.bkl: Removed.
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary copy of zlib.
+        https://bugs.webkit.org/show_bug.cgi?id=34028
+
+        * platform/image-decoders/zlib: Removed.
+        * platform/image-decoders/zlib/adler32.c: Removed.
+        * platform/image-decoders/zlib/compress.c: Removed.
+        * platform/image-decoders/zlib/crc32.c: Removed.
+        * platform/image-decoders/zlib/crc32.h: Removed.
+        * platform/image-decoders/zlib/deflate.c: Removed.
+        * platform/image-decoders/zlib/deflate.h: Removed.
+        * platform/image-decoders/zlib/gzio.c: Removed.
+        * platform/image-decoders/zlib/infback.c: Removed.
+        * platform/image-decoders/zlib/inffast.c: Removed.
+        * platform/image-decoders/zlib/inffast.h: Removed.
+        * platform/image-decoders/zlib/inffixed.h: Removed.
+        * platform/image-decoders/zlib/inflate.c: Removed.
+        * platform/image-decoders/zlib/inflate.h: Removed.
+        * platform/image-decoders/zlib/inftrees.c: Removed.
+        * platform/image-decoders/zlib/inftrees.h: Removed.
+        * platform/image-decoders/zlib/mozzconf.h: Removed.
+        * platform/image-decoders/zlib/trees.c: Removed.
+        * platform/image-decoders/zlib/trees.h: Removed.
+        * platform/image-decoders/zlib/uncompr.c: Removed.
+        * platform/image-decoders/zlib/zconf.h: Removed.
+        * platform/image-decoders/zlib/zlib.h: Removed.
+        * platform/image-decoders/zlib/zutil.c: Removed.
+        * platform/image-decoders/zlib/zutil.h: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Race condition in video setup can force videos into software mode
+        https://bugs.webkit.org/show_bug.cgi?id=34034
+
+        We used to call setUpVideoRendering() unconditionally from
+        acceleratedRenderingStateChanged(); this could happen before the movie had any
+        data, and thus force the movie into software rendering mode.
+        
+        Fix by returning early from setUpVideoRendering() if isReadyForRendering() returns false,
+        which also allows us to remove some other checks for being ready to render.
+        
+        Timing dependent, hard to make a test for.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToMedia): Optimize to do an early return
+        if passing in the same layer that is already being used.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Return without doing anything
+        if not ready to render.
+        (WebCore::MediaPlayerPrivate::updateStates): No need to call isReadyForRendering()
+        any more, since setUpVideoRendering() does that.
+        (WebCore::MediaPlayerPrivate::setVisible): No need to check the ready state; this
+        is equivalent to the check inside of setUpVideoRendering().
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r53110): Find My iPhone message dialog is offset from original position once it gets focus
+        https://bugs.webkit.org/show_bug.cgi?id=33821
+
+        Fix an issue with the geometry of fixed position, composited layers inside other
+        composited layers. If we called convertToLayerCoords() on a fixed layer with an ancestor
+        layer which is not the root, then we assumed that the fixed layer had a positioning root.
+        However, this is not always the case, since the fixed layer may have a compositing ancestor
+        which is not a fixed container.
+        
+        Test: compositing/geometry/fixed-in-composited.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isFixedPositionedContainer): Utility function to test whether a layer acts
+        as a fixed position container.
+        
+        (WebCore::RenderLayer::convertToLayerCoords): When called on a fixed position layer
+        for an ancestor layer that is not the root, compute the correct offsets by looking for
+        the fixed position container, and computing offsets relative to that. If the ancestorLayer
+        is the fixed position container, fall through to the existing code that is shared
+        with absolutely positioned layers.
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        webkitConvertPointFromNodeToPage doesn't take into account most recent transform style
+        https://bugs.webkit.org/show_bug.cgi?id=34023
+
+        Be sure to call updateLayoutIgnorePendingStylesheets() before doing point mapping,
+        to apply any style changes since the last layout.
+
+        Test: fast/dom/Window/webkitConvertPointUpdateLayout.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitConvertPointFromNodeToPage): Call updateLayoutIgnorePendingStylesheets().
+        (WebCore::DOMWindow::webkitConvertPointFromPageToNode): Ditto.
+
+2010-01-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use stale cache data when going back and forward but not using WebCore’s page cache
+        https://bugs.webkit.org/show_bug.cgi?id=33993
+        <rdar://problem/7383392>
+
+        No tests since this is a performance change.
+
+        * loader/CachePolicy.h:
+        (WebCore::): Add CachePolicyAllowStale.
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::checkForReload): Never reload in the case of
+        CachePolicyAllowStale.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy): Return CachePolicyAllowStale
+        if the main resource is being loaded to allow stale data.
+        (WebCore::FrameLoader::addExtraFieldsToRequest): Use ReturnCacheDataElseLoad
+        on back/forward loads - needed when going back of forward to a page with frames.
+
+2010-01-22  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: JavaScript Error in DOMAgent.js:375 (_attributesUpdated)
+        https://bugs.webkit.org/show_bug.cgi?id=33915
+
+        Errors were caused by the fact that Element::attributes calls Element::setAttribute to
+        synchronized the styleAttr. The fix is to simply check the synchronizing style attribute
+        flag.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute): Checked for case where styleAttr is being synchronized.
+
+2010-01-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Update r53711 for GraphicsLayer method rename.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): Rename from change setContentsToVideo.
+
+2010-01-22  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add BlobConstructor to DOMWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=33982
+
+        * page/DOMWindow.idl:
+
+2010-01-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Commit files that were supposed to be part of r53696, but weren't
+        landed.
+
+        * English.lproj/localizedStrings.js:
+        * manual-tests/debugger-caught-uncaught-exceptions.html: Added.
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        When scrolling by page, hold back 1/8th of the visible size instead of
+        40 px.
+        https://bugs.webkit.org/show_bug.cgi?id=32595
+
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.h:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, backout.
+
+        Back out r52673, which caused several regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=32533
+
+        * platform/PopupMenuClient.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        * platform/qt/QtAbstractWebPopup.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+
+2010-01-22  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Revert r53693 because it broke scrolling of pages with fixed elements on
+        Mac OS X.
+
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34008
+        Assertion failure in KURL::setProtocol when running DOM Fuzzer
+
+        Test: fast/dom/Window/invalid-protocol.html
+
+        * bindings/js/JSLocationCustom.cpp: (WebCore::JSLocation::setProtocol): Raise an exception
+        if KURL::setProtocol fails.
+
+        * html/HTMLAnchorElement.cpp: (WebCore::HTMLAnchorElement::setProtocol): Move argument
+        tweaking logic into KURL. This way, the ':' trick applies to both JSLocation and
+        HTMLAnchorElement, matching IE (but not Firefox). IE behavior is more permissive, and even
+        more logical in my opinion.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::iconURL): Assert that setting protocol
+        succeeded.
+
+        * platform/KURL.cpp: (WebCore::KURL::setProtocol): Remove everything past ':', if present.
+        Return false if the protocol to set is not valid.
+        (WebCore::isValidProtocol): Made this work correctly for empty strings.
+
+        * platform/KURL.h: isValidProtocol() is now static in KURL.cpp, it's only used in setProtocol().
+
+        * platform/KURLGoogle.cpp: 
+        (WebCore::KURL::setProtocol): Always return true. This should hopefully prevent Chromium build
+        breakage, alhough tests will likely fail.
+        (WebCore::isValidProtocol): Removed, as this isn't used at the moment.
+
+        * websockets/WebSocketHandshake.cpp: (WebCore::WebSocketHandshake::httpURLForAuthenticationAndCookies):
+        Assert that setting protocol succeeded.
+
+2010-01-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7373568>
+        https://bugs.webkit.org/show_bug.cgi?id=34007
+        Implement hardware acceleration of video compositing on Windows
+
+        Internally we still have QuickTime render to a bitmap, but frames are then composited
+        with the page using an accelerated renderer.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_newFrameAvailable.
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate): Call tearDownVideoRendering.
+        (WebCore::MediaPlayerPrivate::cancelLoad): Call tearDownVideoRendering.
+        (WebCore::MediaPlayerPrivate::updateStates): Call setUpVideoRendering once the movie 
+            is ready to draw.
+        (WebCore::MediaPlayerPrivate::isReadyForRendering): New, utility function returns true 
+            only when movie is ready to render.
+        (WebCore::MediaPlayerPrivate::setSize): Remember the size as we need it when rendering 
+            in accelerated mode.
+        (WebCore::MediaPlayerPrivate::setVisible): Call setUpVideoRendering when made visible.
+        (WebCore::MediaPlayerPrivate::paint): Do nothing when rendering to a layer. Move frame 
+            rate drawing code to paintCompleted.
+        (WebCore::MediaPlayerPrivate::paintCompleted): New, clear m_newFrameAvailable and, when 
+            built with DRAW_FRAME_RATE, draw framerate.
+        (WebCore::MediaPlayerPrivate::movieNewImageAvailable): Set m_newFrameAvailable, trigger 
+            repaint differently when drawing to a layer.
+        (WebCore::MediaPlayerPrivate::currentRenderingMode): New, return the current rendering mode.
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode): New, return preferred rendering mode
+            (render to a layer whenever possible).
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): New, tear down current rendering mode 
+            and set up new mode when necessary.
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering): New, noop unless rendering to a layer.
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering): New.
+        (WebCore::MediaPlayerPrivate::paintContents): New, callback from compositing layer when it
+            is time to draw the current frame.
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): New, allocate a layer for the movie.
+        (WebCore::MediaPlayerPrivate::destroyLayerForMovie): New, delete movie layer.
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering): New, return true unless the 
+            movie is not ready to render.
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged): New, deal with change in 
+            accelerated rendering state.
+        (WebCore::MediaPlayerPrivate::notifySyncRequired): New, callback from compositing layer 
+            when it wants to schedule a redraw.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        (WebCore::MediaPlayerPrivate::notifyAnimationStarted):
+        (WebCore::MediaPlayerPrivate::showDebugBorders):
+        (WebCore::MediaPlayerPrivate::showRepaintCounter):
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getCurrentFrameInfo):
+            New, return information about the offscreen render buffer.
+        (QTMovieWin::initializeQuickTime):
+        * platform/graphics/win/QTMovieWin.h:
+
+2010-01-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        The Chromium WebKit API needs to expose storage event related data
+        https://bugs.webkit.org/show_bug.cgi?id=33985
+
+        This change is not visible to layoutTests/web pages.
+
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem): return the old value
+        (WebCore::StorageAreaImpl::removeItem): return the old value
+        (WebCore::StorageAreaImpl::clear): return whether there was anything to clear
+        * storage/StorageAreaImpl.h:
+
+2010-01-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        An element that doesn't validate and an invalid element shouldn't share style
+        https://bugs.webkit.org/show_bug.cgi?id=34010
+
+        Test: fast/css/pseudo-invalid-novalidate-001.html
+
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::canShareStyleWithElement): 
+          Separate the check for willValidate from the check for isValidFormControlElement.
+        * html/HTMLFormControlElement.h: The validity method doesn't need to be virtual.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash in fast/dom/Window/window-properties if Geolocation enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34013
+        
+        Add null check to fix Geolocation crash in fast/dom/Window/window-properties.
+        
+        * page/Geolocation.cpp:
+        (WebCore::createGeoposition):
+
+2010-01-22  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Object.getOwnPropertyDescriptor(window) returns descriptors for properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33948
+
+        Even though prototype properties are proxied by JSDOMWindow::getOwnPropertySlot(),
+        that proxying should not be performed by JSDOMWindow::getOwnPropertyDescriptor().
+
+        This makes getOwnPropertyDescriptor() consistent with getOwnPropertyNames().
+
+        Test: fast/dom/Window/window-property-descriptors.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+
+2010-01-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Save the QWebPageClient instead of the ownerWidget in QtAbstractWebPopup
+        
+        The QWebPageClient is required for the QtFallbackWebPopup. QtFallbackWebPopup will
+        need it to create a QGraphicsProxyWidget (in a future commit) for the 
+        QGraphicsWebView's web popup.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        (WebCore::QtAbstractWebPopup::valueChanged):
+        (WebCore::QtAbstractWebPopup::itemType):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::itemText):
+        (WebCore::QtAbstractWebPopup::itemToolTip):
+        (WebCore::QtAbstractWebPopup::itemIsEnabled):
+        (WebCore::QtAbstractWebPopup::itemCount):
+        (WebCore::QtAbstractWebPopup::pageClient):
+        (WebCore::QtAbstractWebPopup::font):
+
+2010-01-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt "build" fix.
+
+        * WebCore.pro: Fix warning about missing header file that isn't present anymore.
+
+2010-01-22  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Update copy of the source whenever playbin2's source property
+        changes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Connect to the notify::source signal and update the source
+        element pointer from there. This makes sure that we never
+        store a pointer to an old source element.
+
+2010-01-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Caught exceptions still pause the debugger.
+        <https://bugs.webkit.org/show_bug.cgi?id=28622>.
+
+        Turn the pauseOnExceptions variable from a bool to an int, because we now have
+        3 states, in an enum: DontPauseOnExceptions, PauseOnAllExceptions, and
+        PauseOnUncaughtExceptions. The status button for pausing on exceptions is now
+        a tri-state button, which cycles from Don't pause (no background) to Pause on All
+        (blue background) to Pause on Uncaught (purple background).
+
+        Also added the ability for a status button to have more than 2 states, and added
+        style rules for a CSS three state button.
+
+        Added a manual test, manual-tests/debugger-caught-uncaught-exceptions.html, that
+        generates caught and uncaught exceptions.
+
+        * English.lproj/localizedStrings.js: Added updated Action / Click to Action text.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::pauseOnExceptions): Changed from a bool to an int.
+        (WebCore::InspectorBackend::setPauseOnExceptions): Ditto.
+        * inspector/InspectorBackend.h: Ditto.
+        * inspector/InspectorBackend.idl: Ditto.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::JavaScriptDebugServer): Changed from bool to PauseOnExceptionsState.
+        (WebCore::JavaScriptDebugServer::setPauseOnExceptions): Ditto.
+        (WebCore::JavaScriptDebugServer::exception): Updated logic to see if we are breaking
+            on uncaught exceptions, and check if we have a handler.
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::): Changed from bool to PauseOnExceptionsState.
+        (WebCore::JavaScriptDebugServer::pauseOnExceptions): Ditto.
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptionsState): Changed from returning false to returning 0 (stub function).
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton): Updated to new text/new cycling of variables.
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions): Updated to new text/new cycling of variables.
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton): Added the option for a different number of states.
+        (WebInspector.StatusBarButton.prototype.set toggled): Added rules to toggle on/off with multiple states.
+        * inspector/front-end/inspector.css: Added rules for toggled-1 and toggled-2.
+        * manual-tests/debugger-caught-uncaught-exceptions.html: Added.
+
+2010-01-22  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Android platform specific PlatformTouchEvent and PlatformTouchPoint implementations are not upstream.
+        https://bugs.webkit.org/show_bug.cgi?id=33719
+
+        Add the Android specific files and update the Android makefile.
+
+        No new tests as this is all Android-specific code.
+
+        * Android.mk: Add Touch event related files to the makefile.
+        * platform/PlatformTouchEvent.h: Add Android constructor.
+        * platform/PlatformTouchPoint.h: Ditto.
+        * platform/android/PlatformTouchEventAndroid.cpp: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Android implementation.
+        * platform/android/PlatformTouchPointAndroid.cpp: Added.
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint): Android implementation.
+
+2010-01-22  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        The RenderObjects with fixed position register to the view
+        to be taken into account while scrolling.
+        The scrolling code update specifically those elements after blitting the pixels.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::registerFixedPositionedObject):
+        (WebCore::FrameView::unregisterFixedPositionedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-22  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Adding ScriptWrappable into WebCore.
+        This allows to associate custom information when Node
+        gets wrapped into JavaScript wrapper.
+
+        [v8, dom] Add a pointer field to C++ Node class
+        https://bugs.webkit.org/show_bug.cgi?id=32430
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptWrappable.h: Added.
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        * bindings/v8/ScriptWrappable.h: Added.
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * dom/Node.h:
+
+2010-01-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Add stub implementation of dispatchOnInjectedScript method so that
+        Chromium source can compile against it and the main fix for the bug
+        28622 can be landed without breaking Chromium build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28622
+
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+
+2010-01-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Dmitry Titov.
+
+        ENABLE(DATABASE) guard is missing in ScriptExecutionContext::~ScriptExecutionContext
+        https://bugs.webkit.org/show_bug.cgi?id=33990
+
+        Add missing ENABLE(DATABASE) guard.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+
+2010-01-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=33590
+
+        * bindings/scripts/generate-bindings.pl:
+
+2010-01-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=33590
+
+        Rename FEATURE_DEFINES_JAVASCRIPT to FEATURE_DEFINES and remove
+        the hardcoded LANGUAGE_JAVASCRIPT=1, in preparation for its use by
+        the GObject DOM bindings.
+
+        * GNUmakefile.am:
+
+2010-01-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7568696> Zoom applied to embedded SVG incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=33988
+
+        Test: svg/custom/text-zoom.xhtml
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement): Initialize m_scale.
+        (WebCore::SVGSVGElement::currentScale): If this is the document element,
+        return the frame’s zoom factor. Otherwise, return m_scale.
+        (WebCore::SVGSVGElement::setCurrentScale): If this is the document element,
+        set the frame’s zoom factor. Otherwise, set m_scale and mark for layout.
+        * svg/SVGSVGElement.h: Added m_scale member.
+
+2010-01-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Add allowPlugins callback to allow per-site enabling of plugins
+        https://bugs.webkit.org/show_bug.cgi?id=33974
+
+        Add a callback into the FrameLoaderClient to let the embedder enable or
+        disable plugins on a per-site basis.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowPlugins):
+
+2010-01-21  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25501
+        Remove empty font tags when applying a style to a content editable
+        region.
+
+        Test: editing/execCommand/change-font.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isEmptyFontTag):
+
+2010-01-21  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Promote pow argument to double to resolve ambiguous overload (compile fix for RVCT 4.0)
+        https://bugs.webkit.org/show_bug.cgi?id=33952
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::gamma):
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/ScriptController.cpp needs to include
+        PlatformBridge.h instead of ChromiumBridge.h so that it can
+        be used on both Chromium and Android.
+        https://bugs.webkit.org/show_bug.cgi?id=33673
+
+        Add "static NPObject* pluginScriptableObject(Widget*);" method
+        to PlatformBridge.h
+        Include PlatformBridge.h from ScriptController.cpp.
+
+        No new tests, just platform code.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * platform/android/PlatformBridge.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        In resolving https://bugs.webkit.org/show_bug.cgi?id=25570, all history.back()/forward()/go() navigations
+        were made asynchronous. That doesn't agree with the HTML5 spec and might have been overreaching for fixing
+        that particular bug. In working with the new history state APIs I noticed some things that should've been
+        possible were not possible because of this change.
+
+        The change in loading behavior is well covered via modifications to previous tests.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Determine beforehand if the traversal is
+          a same-document navigation. If it is, perform the load directly instead of scheduling it.
+
+2010-01-21  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Don't allow Phonon's invisible video widget to keep the app running.
+        https://bugs.webkit.org/show_bug.cgi?id=33842
+
+        The change made in r38223 should not be limited to Qt < 4.5 only.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2010-01-21  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=datetime.
+        https://bugs.webkit.org/show_bug.cgi?id=33939
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForDateTime() and add
+        DateTime type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDate):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateTime):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForMonth):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::setMillisecondsSinceMidnight):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::toString):
+         Support DateTime type. This always produces UTC representation.
+        * html/ISODateTime.h:
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7562574> ASSERT in WebCore::removeWrapper() at the
+        end of run-webkit-tests
+        
+        This was an ASSERT-only bug, introduced by isolated worlds, which
+        created the novelty of a wrapper that might outlive its wrapper cache.
+        
+        When a wrapper outlived its wrapper cache, both the wrapper's destructor
+        and the wrapper cache's destructor would claim to have uncached the wrapper,
+        causing an ASSERT to fire.
+        
+        The solution is to distinguish between operations that logically add and
+        remove cache entries, and operations that delete whole caches. We track
+        when a cache entry is logically added, and when it's logically removed,
+        independent of whether the actual cache still exists.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::willCacheWrapper):
+        (WebCore::didUncacheWrapper): New names for these functions to help
+        explain what they track.
+
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld): Don't claim to uncache
+        all the wrappers in the world; we're deleting the cache, not managing its
+        entries.
+
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument): Updated for renames.
+
+2010-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Sam Weinig.
+
+        SVG JS bindings "context" pointer needs to move onto binding impls
+        https://bugs.webkit.org/show_bug.cgi?id=27243
+
+        Rewrite SVG DOM JSC bindings to use a global DOMObject <-> SVGElement context map, similar to V8's approach.
+        This allows us to remove DOMObjectWithSVGContext and make all SVG JS objects use DOMObjectWithGlobalPointer.
+        We're fitting again in JS_CELL_SIZE, and there's no need to special case SVG anymore.
+
+        Not adding a new test, as we have yet to identify how to test that we're passing around correct global objects.
+        For now this is just a code cleanup which lets me continue making progress in that area of the code.
+
+        * GNUmakefile.am: Add new DOMObjectWithSVGContext.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/DOMObjectWithSVGContext.h: Removed.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): Add comment, that passing 0 context is intentional.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper): Add to JSSVGContextCache, when creating wrappers.
+        (WebCore::getDOMObjectWrapper): Add assertion guarding the JSSVGContextCache is in-sync with the passed context.
+        * bindings/js/JSSVGContextCache.h: Added. Maps DOMObjects to SVGElements - just like V8 approachs to this problem.
+        (WebCore::JSSVGContextCache::wrapperMap):
+        (WebCore::JSSVGContextCache::addWrapper):
+        (WebCore::JSSVGContextCache::forgetWrapper):
+        (WebCore::JSSVGContextCache::propagateSVGDOMChange): 
+        (WebCore::JSSVGContextCache::svgContextForDOMObject):
+        * bindings/js/JSSVGLengthCustom.cpp: Retrieve context from cache, instead of taking it from the JS* class.
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp Ditto.:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPODListCustom.h: Ditto.
+        (WebCore::JSSVGPODListCustom::finishGetter):
+        (WebCore::JSSVGPODListCustom::finishSetter):
+        (WebCore::JSSVGPODListCustom::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPODListCustom::clear):
+        (WebCore::JSSVGPODListCustom::initialize):
+        * bindings/js/JSSVGPODTypeWrapper.h: Ditto.
+        (WebCore::JSSVGDynamicPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::commitChange):
+        (WebCore::JSSVGPODTypeWrapperCreatorForList::create):
+        (WebCore::JSSVGPODTypeWrapperCreatorForList::commitChange):
+        * bindings/js/JSSVGPathSegCustom.cpp: Ditto.
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp: Ditto.
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGAngle.h: Remove unneeded associatedAttributeName() method.
+        * svg/SVGPreserveAspectRatio.h: Ditto.
+        * svg/SVGTransform.h: Ditto.
+
+2010-01-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix, add missing header.
+
+        * dom/ScriptExecutionContext.cpp:
+
+2010-01-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -webkit-mask-box-image draws a box while loading
+        https://bugs.webkit.org/show_bug.cgi?id=33979
+        <rdar://problem/7378662>
+        
+        Don't render masked elements until the mask images are fully loaded.
+
+        Test: http/tests/misc/slow-loading-mask.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages): Check that all mask images (both the single mask-box-image,
+        and the possibly multiple mask-image) are fully loaded before allowing the masked content to render.
+        If they are not fully loaded, use a fully transparent transparency layer.
+        
+        * rendering/style/FillLayer.h:
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::imagesAreLoaded): New utility function that returns true if the image
+        in every FillLayer is loaded.
+
+2010-01-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION (r52795): New message created in response to mailto: URL has random character in message body
+        rdar://problem/7565902
+
+        This regression affects the Mac OS X Mail application.
+        I was not able to find a simple way to create a regression test.
+
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Initialize m_size to 0 as in the other constructors.
+
+2010-01-21  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Script tags are copied and pasted, making cross-domain attacks possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33970
+
+        Tests: editing/pasteboard/paste-noscript-svg.html
+               editing/pasteboard/paste-visible-script.html
+
+        We remove the content and the attributes of every script tag before
+        pasting into the destination.
+        
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeMap): Now we are removing xlink:href
+        if it contains javascript protocol.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken): We strip all the script tag attributes
+        we are parsing to create a fragment to paste.
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::scriptHandler): Removes the script text after it was parsed.
+        * html/HTMLTokenizer.h:
+
+2010-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        <use> with % lengths does not update on window resize
+        https://bugs.webkit.org/show_bug.cgi?id=14639
+
+        appendChild broken for symbol-use
+        https://bugs.webkit.org/show_bug.cgi?id=24802
+
+        Test: svg/custom/relative-sized-shadow-tree-content-with-symbol.xhtml
+              svg/custom/svg/custom/relative-sized-use-on-symbol.xhtml
+
+        Fix reaction on window size changes for relative sized elements within <symbol> elements.
+        Don't evaluate SVGUseElement width/height attributes in order to propagate them to the shadow tree,
+        instead just propagate the attribute values itself so "100%" remains "100%" instead of being evaluated
+        to an absolute pixel value in the parent <svg> user-space.
+
+        Needs another fix in SVGStyledElement::childrenChanged(), which is a regression from my last <use>
+        patch, that hasn't been detected, as the use-dynamic-append.svg testcase was broken.
+
+        The combination of all the last <use> patches finally fixes the peepo.co.uk website, which was broken by several bugs for years.
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::childrenChanged): Need to mark shadow trees needing recalcs, even when parsing.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged): Don't reclone for width/height attribute changes, just propagate them down the render tree
+        (WebCore::updateContainerSize): Added helper function, updating the width/height attributes in the shadow tree.
+        (WebCore::SVGUseElement::updateContainerSizes):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree): Update container width/height after shadow tree creation, instead of doing it inbetween.
+        (WebCore::SVGUseElement::buildShadowTree): Don't alter width/height attributes here anymore.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree): Ditto.
+        * svg/SVGUseElement.h:
+
+2010-01-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33972
+        Assertion failure in FrameLoader::checkLoadComplete()
+
+        I couldn't make a test for this, after trying rather hard. I'm not too worried, because such
+        a test has to depend on details of current implementation so intimately that it would become
+        ineffective very quickly anyway.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopAllLoaders): Stop the check timer, we
+        don't need it after aborting load.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Buildfix for r53646.
+
+        * bindings/js/SerializedScriptValue.cpp: path of JSLock.h fixed.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after r53644.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scroll): missing HAVE(ACCESSIBILITY) guard added.
+
+2010-01-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unnecessary call to HistoryItem::targetItem in HistoryController::pushState
+        https://bugs.webkit.org/show_bug.cgi?id=33969
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState): Remove unnecessary code.
+
+2010-01-21  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix. Add AccessibilityScrollbar.h and .cpp to WebCore.gypi
+
+        * WebCore.gypi:
+
+2010-01-21  Albert J. Wong  <ajwong@chromium.org>
+
+        [chromium] Unreviewed build fix.
+
+        Fix possible use of initialized variable warning in release mode.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::ZigZag::Deserializer::doDeserialize):
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r53644.
+
+        * WebCore.pro: accessibility/AccessibilityScrollbar.cpp and accessibility/AccessibilityScrollbar.h added.
+
+2010-01-21  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure to do a JSLock before deserialization of script values, since they can heap allocate.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::deserialize):
+
+2010-01-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33923 REGRESSION 
+        (Safari 4): AXValueChanged no longer sent for text area scrollbars
+        -and corresponding-
+        <rdar://problem/6942686>
+
+        New class AccessibilityScrollbar inherits directly from 
+        AccessibilityObject.
+        * accessibility/AccessibilityScrollbar.cpp: Added.
+        (WebCore::AccessibilityScrollbar::AccessibilityScrollbar):
+        (WebCore::AccessibilityScrollbar::create):
+        (WebCore::AccessibilityScrollbar::valueForRange):
+        * accessibility/AccessibilityScrollbar.h: Added.
+        (WebCore::AccessibilityScrollbar::setScrollbar):
+        (WebCore::AccessibilityScrollbar::roleValue):
+        (WebCore::AccessibilityScrollbar::accessibilityIsIgnored):
+        (WebCore::AccessibilityScrollbar::size):
+        (WebCore::AccessibilityScrollbar::elementRect):
+        (WebCore::AccessibilityScrollbar::parentObject):
+
+        AXObjectCache::getOrCreate() now has a case for ScrollBarRole, 
+        which will create a new AccessibilityScrollbar. I also added a new 
+        version of postNotification() that does not require a renderer. The 
+        old postNotification() calls the new one.
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+        When AX is enabled, getOrCreate an AccessibilityScrollbar and send 
+        a notification.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scroll):
+
+        Fix project files.
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+2010-01-21  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add changes missing from r53595, without which Chromium has no database.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33966
+
+        No new tests - fixes database layout tests in Chromium.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+
+2010-01-21  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Don't call vgGetError()/eglGetError() repeatedly
+        https://bugs.webkit.org/show_bug.cgi?id=33959
+
+        For vgGetError(), I missed the part of the spec where
+        it says that calling that function clears the error
+        and subsequent calls will return VG_NO_ERROR again.
+
+        For eglGetError(), the specification doesn't mention
+        that kind of behavior, and interpretations seem to
+        differ between EGL implementations (even within
+        Khronos: the OpenVG reference implementation doesn't
+        reset the error code - and even mentions the difference
+        to vgGetError() in a comment - whereas the online
+        OpenGL ES API document explicitly specifies clearing
+        the error code).
+
+        It thus makes sense not to call either of the two
+        error functions more than once for checking a single
+        EGL/OpenVG call. This patch adapts assertions to
+        accommodate for this behavior, and also needs to
+        change surface creation methods as they previously
+        relied on multiple calls of eglGetError().
+
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp:
+        (WebCore::EGLDisplayOpenVG::sharedPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::createPbufferSurface):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h:
+        * platform/graphics/openvg/EGLUtils.h:
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        * platform/graphics/openvg/VGUtils.h:
+
+2010-01-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hit testing on composited plugins is broken
+        https://bugs.webkit.org/show_bug.cgi?id=33927
+        <rdar://problem/7559069>
+
+        RenderWidget::paint()'s strategy of moving widgets at paint time, using tx and ty, was flawed
+        because tx,ty are not always root-relative, especially when painting into compositing layers.
+        This would move widgets to the wrong location, which caused hit testing issues.
+        
+        Widgets are usually positioned by layout. The one time this was not true was scrolling fixed-position
+        elements, so we now reposition widgets after scrolling too.
+        
+        There was a related problem, which was that widgets expect the graphics context to be set up for
+        root-relative painting. To fix this, adjust the CTM and the paintRect when the widget's frameRect
+        is in a different coordinate system to the painting offset.
+        
+        Test: plugins/mouse-events-fixedpos.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged): Update widget positions, to handle widgets in fixed position
+        elements, but only if we're not already inside of layout.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::translate): Add a translate() convenience method that takes a FloatSize.
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::isZero): Add a convenience method for testing for a zero size.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint): Adjust a comment.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Detect when the widget's frame is in a different coordinate system
+        to painting, and adjust the CTM and paintRect in that case.
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/NPV8Object.cpp does not compile on Android
+        https://bugs.webkit.org/show_bug.cgi?id=33608
+
+        Use the standard WebKit header in bridge/npruntime.h.
+        Include PlatformBridge.h instead of ChroimiumBridge.h.
+        Add popupsAllowed() method to PlatformBridge.h on Android.
+        Add ARRAYSIZE_UNSAFE to PlatformBridge.h on Android.
+
+        No new tests, fixing the build.
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_Evaluate):
+        * bindings/v8/NPV8Object.h:
+        * platform/android/PlatformBridge.h:
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add PlatformBridge.h header and a typedef to give ChromiumBridge a new name: PlatformBridge.
+        https://bugs.webkit.org/show_bug.cgi?id=33917
+
+        No new tests needed, this is just to allow other methods to call ChromiumBridge
+        using the new 'PlatformBridge' name.
+
+        * platform/chromium/PlatformBridge.h: Added.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r53625.
+
+        Cleanup MediaPlayer and MediaPlayerPrivateInterface to remove dead methods
+        https://bugs.webkit.org/show_bug.cgi?id=30106
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/V8DOMWrapper.h[cpp] are missing guards for XPATH and XSLT features
+        https://bugs.webkit.org/show_bug.cgi?id=33944
+
+        Inside V8DOMWrapper.h[cpp], the code for XPATH and XSLT features is not guarded
+        by the appropriate #if ENABLE(feature) macros. Add the missing guards.
+        V8DOMWrapper.cpp includes ChromiumBridge.h for no reason. Remove the include.
+
+        No new tests needed, functionality not changed.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8DOMWrapper.h:
+
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Intermittent crash when media element is adopted by another document
+        https://bugs.webkit.org/show_bug.cgi?id=33919
+        rdar://problem/7557527
+        
+        Test: media/adopt-node-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::willMoveToNewOwnerDocument): Unregister for
+        document callbacks.
+        (WebCore::HTMLMediaElement::didMoveToNewOwnerDocument): Register for
+        document callbacks.
+        * html/HTMLMediaElement.h:
+
+2010-01-21  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixing
+
+        * WebCore.vcproj/WebCore.vcproj: Copy bridge/jsc in the post-build
+        event of all configurations, not just Debug.
+
+2010-01-21  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix incorrect dependency to QtXmlPatterns in generated include/QtWebKit/QtWebKit header
+
+        The generated file includes QtXmlPatterns/QtXmlPatterns, which is neither used/required by
+        the public QtWebKit API nor will it be available if Qt is configured with -no-xmlpatterns.
+
+        * WebCore.pro: Trick syncqt to believe that xmlpatterns is not a dependency, so that it's not
+        included in the generated file. It'll still be used and linked to with this trick.
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Copy BridgeJSC.h to generated headers on Windows
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup MediaPlayer and MediaPlayerPrivateInterface to remove dead methods
+        https://bugs.webkit.org/show_bug.cgi?id=30106
+
+        No new tests, only dead code was removed.
+
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::doSeek):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+
+2010-01-21  Iain Campbell <iain.campbell@accenture.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Simplify the qmake code for freezing QtWebKit on Symbian.
+
+        * WebCore.pro:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed speculative build fix for Windows.
+
+        Adds missing include path for JSCBridge.h on Windows, added in http://trac.webkit.org/changeset/53620
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Adds missing include path for JSCBridge.h, added in http://trac.webkit.org/changeset/53620
+
+        No new tests, build fix only.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Move bridge interfaces Field, Class, Instance and Array from Bridge to BridgeJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33589
+
+        These interfaces use JSC-specific types, so are moved out of Bridge.h to allow the file to
+        be used with both JSC and V8.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed Bridge.cpp and added BridgeJSC.cpp
+        * GNUmakefile.am: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCore.pro: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCoreSources.bkl: Modified. Removed Bridge.cpp and added BridgeJSC.cpp
+        * bridge/Bridge.cpp: Removed.
+        * bridge/Bridge.h: Modfied. Moved Field, Class, Instance and Array interfaces to BridgeJSC.h
+        * bridge/jsc: Added.
+        * bridge/jsc/BridgeJSC.cpp: Copied from WebCore/bridge/Bridge.cpp.
+        * bridge/jsc/BridgeJSC.h: Copied from WebCore/bridge/Bridge.h.
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/jni/JNIBridge
+        https://bugs.webkit.org/show_bug.cgi?id=33914
+
+        No new tests, style fixes only.
+
+        * bridge/jni/JNIBridge.cpp:
+        * bridge/jni/JNIBridge.h:
+
+2010-01-13  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] handle media redirections
+        https://bugs.webkit.org/show_bug.cgi?id=33539
+
+        Media redirections support.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        (WebCore::MediaPlayerPrivate::loadNextLocation):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::pipelineReset):
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        No new tests: tests in LayoutTests/compositing are now relevant for
+        QtWebkit!
+
+        * WebCore.pro: added accelerated-compositing related files 
+        * platform/graphics/GraphicsLayer.h: define Qt-specific implementation           of GraphicsLayer
+        * platform/graphics/qt/GraphicsLayerQt.cpp: Added.
+        (WebCore::GraphicsLayerQtImpl::): Implementation of GraphicsLayer with
+        a QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::ContentData::ContentData): save 
+        pixmap/color info for directly composited content
+        (WebCore::GraphicsLayerQtImpl::State::State): save info for syncing
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl): ctor
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl): dtor
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform): set Qt
+        transformation in the way WebCore wants it
+        (WebCore::GraphicsLayerQtImpl::opaqueArea): calculate opaque area
+        based on info we have
+        (WebCore::GraphicsLayerQtImpl::boundingRect): reimp QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::paint): reimp QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::drawContents): draw HTML/Pixmap/Color
+        (WebCore::GraphicsLayerQtImpl::notifyChange): let WebCore know
+        something has changed
+        (WebCore::GraphicsLayerQtImpl::flushChanges): Make the changes appear
+        on screen by setting them to QGraphicsItems
+        (WebCore::GraphicsLayerQtImpl::notifyAnimationStarted): let WebCore
+        know the QAnimation started
+        (WebCore::GraphicsLayerQt::GraphicsLayerQt): ctor
+        (WebCore::GraphicsLayerQt::~GraphicsLayerQt): dtor
+        (WebCore::GraphicsLayer::create): hook for WebCore to know we're
+        implementing compositing
+        (WebCore::GraphicsLayer::compositingCoordinatesOrientation): hook for
+        WebCore to know we use a top-down system
+        (WebCore::GraphicsLayerQt::setNeedsDisplay): update the display
+        (WebCore::GraphicsLayerQt::setNeedsDisplayInRect): udpate part of the
+        display
+        (WebCore::GraphicsLayerQt::setName): reimp
+        (WebCore::GraphicsLayerQt::setParent): reimp
+        (WebCore::GraphicsLayerQt::setChildren): reimp
+        (WebCore::GraphicsLayerQt::addChild): reimp
+        (WebCore::GraphicsLayerQt::addChildAtIndex): reimp
+        (WebCore::GraphicsLayerQt::addChildAbove): reimp
+        (WebCore::GraphicsLayerQt::addChildBelow): reimp
+        (WebCore::GraphicsLayerQt::replaceChild): reimp
+        (WebCore::GraphicsLayerQt::removeFromParent): reimp
+        (WebCore::GraphicsLayerQt::setMaskLayer): reimp
+        (WebCore::GraphicsLayerQt::setPosition): reimp
+        (WebCore::GraphicsLayerQt::setAnchorPoint): reimp
+        (WebCore::GraphicsLayerQt::setSize): reimp
+        (WebCore::GraphicsLayerQt::setTransform): reimp
+        (WebCore::GraphicsLayerQt::setChildrenTransform): reimp
+        (WebCore::GraphicsLayerQt::setPreserves3D): reimp
+        (WebCore::GraphicsLayerQt::setMasksToBounds): reimp
+        (WebCore::GraphicsLayerQt::setDrawsContent): reimp
+        (WebCore::GraphicsLayerQt::setBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::clearBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::setContentsOpaque): reimp
+        (WebCore::GraphicsLayerQt::setBackfaceVisibility): reimp
+        (WebCore::GraphicsLayerQt::setOpacity): reimp
+        (WebCore::GraphicsLayerQt::setContentsRect): reimp
+        (WebCore::GraphicsLayerQt::setContentsToImage): reimp
+        (WebCore::GraphicsLayerQt::setContentsBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::setGeometryOrientation): reimp
+        (WebCore::GraphicsLayerQt::setContentsOrientation): reimp
+        (WebCore::GraphicsLayerQt::distributeOpacity): reimp
+        (WebCore::GraphicsLayerQt::accumulatedOpacity): reimp
+        (WebCore::GraphicsLayerQt::syncCompositingState): reimp
+        (WebCore::GraphicsLayerQt::nativeLayer): reimp (QGraphicsItem*)
+        (WebCore::GraphicsLayerQt::platformLayer): reimp (QGraphicsItem*)
+        (WebCore::solveEpsilon): copy from AnimationBase.cpp
+        (WebCore::solveCubicBezierFunction): copy from AniamtionBase.cpp
+        (WebCore::applyTimingFunction): use WebCore's timing and not Qt's
+        (WebCore::webkitAnimationToQtAnimationValue): safely figure out
+        animation values
+        (WebCore::AnimationQtBase::AnimationQtBase): base class for Qt-based
+        Webcore-initiated animations
+        (WebCore::AnimationQtBase::updateState): notify when an animation
+        starts
+        (WebCore::AnimationQtBase::duration): reimp QAbstractAnimation
+        (WebCore::AnimationQt:::AnimationQtBase):
+        (WebCore::AnimationQt::updateCurrentTime): realize keyframes from
+        progress
+        (WebCore::TransformAnimationQt::TransformAnimationQt): ctor
+        (WebCore::TransformAnimationQt::~TransformAnimationQt): dtor
+        (WebCore::TransformAnimationQt::applyFrame): set the actual QTransform
+        based on WebCore TransformOperations
+        (WebCore::TransformAnimationQt::updateState): change cache mode
+        (WebCore::OpacityAnimationQt::OpacityAnimationQt):
+        (WebCore::OpacityAnimationQt::applyFrame): change item's opacity
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::addAnimation): convert WebCore Animation to
+        Qt Animation
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty):
+        (WebCore::GraphicsLayerQt::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
+        (WebCore::GraphicsLayerQt::suspendAnimations):
+        (WebCore::GraphicsLayerQt::resumeAnimations):
+        * platform/graphics/qt/GraphicsLayerQt.h: Added.
+        * platform/qt/QWebPageClient.h: virtual functions for QGraphicsWebView
+        compositing
+        (QWebPageClient::setRootGraphicsLayer): let QGraphicsWebView know that
+        compositing has started/ended
+        (QWebPageClient::markForSync): let QGraphicsWebView know the
+        compositing layers need to sync, either soon or with the next update
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Adding QPixmap/QImage support for the Qt hybrid layer
+        Allows accesing QPixmap and QImage based arguments from Qt signals,
+        slots and properties
+        This is done by an intermediate object that can be turned into
+        web-based objects by calling either toHTMLImageElement() or
+        toDataURL()
+        https://bugs.webkit.org/show_bug.cgi?id=32461
+
+        Tests are in WebKit/qt/tests/hybridPixmap
+
+        * WebCore.pro:
+        * bridge/qt/qt_pixmapruntime.cpp: Added.
+        (JSC::Bindings::QtPixmapWidthField::name): "width"
+        (JSC::Bindings::QtPixmapWidthField::valueFromInstance): width of
+        pixmap
+        (JSC::Bindings::QtPixmapWidthField::setValueToInstance): nothing
+        (JSC::Bindings::QtPixmapHeightField::name): "height"
+        (JSC::Bindings::QtPixmapHeightField::valueFromInstance): height of
+        pixmap
+        (JSC::Bindings::QtPixmapHeightField::setValueToInstance): nothing
+        (JSC::Bindings::QtPixmapRuntimeMethod::numParameters): 0
+        (JSC::Bindings::QtPixmapCreateElementMethod::name): toHTMLImageElement
+        (JSC::Bindings::QtPixmapCreateElementMethod::invoke): creates an HTML
+        element from the QPixmap
+        (JSC::Bindings::QtPixmapToDataUrlMethod::name): "toDataURL"
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke): encodes the image to
+        a base64 data url
+        (JSC::Bindings::QtPixmapToStringMethod::name): "toString"
+        (JSC::Bindings::QtPixmapToStringMethod::invoke): [Qt Native Pixmap
+        w,h]
+
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::createStructure):
+        runtime-object broilerplate
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::classInfo): ditto
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::QtPixmapRuntimeObjectImp):
+        ditto
+        (JSC::Bindings::): ditto
+        (JSC::Bindings::QtPixmapClass::QtPixmapClass): class for the
+        intermediate pixmap-holder 
+        (JSC::Bindings::QtPixmapInstance::getClass): ditto
+        (JSC::Bindings::QtPixmapInstance::invokeMethod): ditto
+        (JSC::Bindings::QtPixmapClass::methodsNamed): toHTMLImageElement,
+        toDataURL
+        (JSC::Bindings::QtPixmapClass::fieldNamed): width, height
+        (JSC::Bindings::QtPixmapInstance::getPropertyNames):
+                toHTMLImageElement, toDataURL, width, height
+        (JSC::Bindings::QtPixmapInstance::defaultValue): nothing
+        (JSC::Bindings::QtPixmapInstance::valueOf): toString
+        (JSC::Bindings::data): holds a QVariant of type QImage/QPixmap
+        (JSC::Bindings::QtPixmapInstance::width): width of the image/pixmap
+        (JSC::Bindings::QtPixmapInstance::height): height of the image/pixmap
+        (JSC::Bindings::QtPixmapInstance::toPixmap): converts to a QPixmap
+        (JSC::Bindings::QtPixmapInstance::toImage): converts to a QImage
+        (JSC::Bindings::QtPixmapInstance::variantFromObject): makes sure this
+        is the right type of object, and creates a QVariant
+        (JSC::Bindings::QtPixmapInstance::createRuntimeObject): creates a new
+        intermediate pixmap holder from a QVariant
+        (JSC::Bindings::QtPixmapInstance::canHandle): returns true if a
+        QPixmap/QImage is required
+        * bridge/qt/qt_pixmapruntime.h: Added.
+        * bridge/qt/qt_runtime.cpp: hooks for the bridge
+        (JSC::Bindings::convertValueToQVariant): handle QPixmap/QImage if the
+        object is the intermediate pixmap holder or an HTMLImageElement
+        (JSC::Bindings::convertQVariantToValue): creates the intermediate
+        object from a QVariant of type QImage/QPixmap
+
+2010-01-21  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Custom select popups.
+        https://bugs.webkit.org/show_bug.cgi?id=33418
+
+        Optimization of the WebCore support to combobox popup delegate.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::itemType):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::):
+        (WebCore::QtAbstractWebPopup::itemText):
+        (WebCore::QtAbstractWebPopup::itemToolTip):
+        (WebCore::QtAbstractWebPopup::itemIsEnabled):
+        (WebCore::QtAbstractWebPopup::itemCount):
+        (WebCore::QtAbstractWebPopup::view):
+        (WebCore::QtAbstractWebPopup::geometry):
+        (WebCore::QtAbstractWebPopup::currentIndex):
+        (WebCore::QtAbstractWebPopup::font):
+
+2010-01-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Stylesheet href property shows redirected URL unlike other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=33683
+
+        Teach StyleSheet the difference between original and final URLs in
+        redirect chains.  Unfortunately, StyleSheet needs to know both of these
+        URLs.  The original URL is needed for the href property and the final
+        URL is needed as the baseURL.
+
+        This change required touching a lot of lines of code because we need to
+        plumb this information to the StyleSheet object.  I audited all
+        existing clients of href() and setHref() to see whether they wanted the
+        original or final URLs.  I then updated the clients (except the JS
+        bindings themselves) to use the correct accessor.
+
+        Test: http/tests/security/stylesheet-href-redirect.html
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSImportRule.h:
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create): 
+        (WebCore::CSSStyleSheet::createInline): Added a new constructor to deal
+        with "inline" style sheets that don't have a distinct original and
+        final URL.
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL): This code wants to use the final URL,
+        not the original URL.  Updated it to grab the baseURL directly.
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::href):
+        (WebCore::StyleSheet::setBaseURL): This function really just updates
+        the base URL of the style sheet, so I made it more explicit.
+        (WebCore::StyleSheet::putativeBaseURL): We need an accessor for the
+        base URL, but baseURL is already taken.
+        * dom/Document.cpp:
+        (WebCore::Document::updateBaseURL):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::elementSheet):
+        (WebCore::Document::mappedElementSheet):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setCSSStyleSheet):
+        (WebCore::ProcessingInstruction::setXSLStyleSheet):
+        * dom/ProcessingInstruction.h:
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::createSheet):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        * html/HTMLLinkElement.h:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        (WebCore::CachedCSSStyleSheet::checkNotify): This code now passes both
+        the original and final URL into setCSSStyleSheet so that the style
+        sheet can have both.
+        * loader/CachedResourceClient.h:
+        (WebCore::CachedResourceClient::setCSSStyleSheet):
+        (WebCore::CachedResourceClient::setXSLStyleSheet):
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        (WebCore::CachedXSLStyleSheet::checkNotify): I don't have any direct
+        evidence that we need to change the XSLStyleSheet behavior, which is
+        why I wasn't able to add a test for the behavior.  However, the objects
+        are parallel enough that it seemed like the right thing to do.
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::setXSLStyleSheet):
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLImportRule.h:
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::create):
+        (WebCore::XSLStyleSheet::createEmbedded):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::parseString):
+        (WebCore::XSLStyleSheet::loadChildSheets):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xsltStylesheetPointer):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTProcessor::transformToString):
+
+2010-01-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use xmlStrdup instead of strdup for consistency in Libxml2.
+        https://bugs.webkit.org/show_bug.cgi?id=33935
+
+        Remove the direct use of strdup.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::appendErrorCallback):
+        (WebCore::PendingCallbacks::):
+        (WebCore::XMLTokenizer::error):
+
+2010-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Final part of fix -- now we render the selection rect of list
+        markers in a transformed context.
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::localSelectionRect):
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderListMarker.h:
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out 53591.
+        http://trac.webkit.org/changeset/53591
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        Rolling out the change committed in change set 53591
+        <http://trac.webkit.org/changeset/53591> because it caused
+        a regression of test /fast/replaced/table-percent-height.html
+        on the Qt bot.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Disable the "seatbelt" coordinate validation functions in the
+        Skia graphics layer.  We believe all the underlying bugs have
+        been fixed, but just in case we're being overly optimistic, this
+        leaves in the code for an easy revert.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33908
+        Exercised by many layout tests.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=date.
+        https://bugs.webkit.org/show_bug.cgi?id=33911
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForDate() and add Date
+        type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDate):
+        (WebCore::ISODateTime::toString):
+        * html/ISODateTime.h:
+
+2010-01-20  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        Touch Events are not sent to iframes
+        https://bugs.webkit.org/show_bug.cgi?id=33894
+
+        Fix the touch event handler so it does not bail out early if the main frame document does not have any touch listeners registered, as there may be embedded iframes that have registered for touch events.
+
+        Test: fast/events/touch/touch-inside-iframe.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Instead of looking at the document of the main frame to see if touch event listeners are registered, look at the document of the target element to account for iframes.
+
+2010-01-20  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove an assertion that is not valid in some detached iframes cases.
+        https://bugs.webkit.org/show_bug.cgi?id=33827
+
+        Test: http/tests/appcache/detached-iframe.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+
+2010-01-20  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Refactoring and plumbing to get the HTML5 SQL Database API accessible to
+        web workers.  No new functionality is exposed yet; this just gets the
+        infrastructure in place.  It touches a lot of files in small ways; here
+        are the main changes:
+
+        1) Database members and methods move from Document up to
+        ScriptExecutionContext.  Each of Document and WorkerContext must
+        implement a few virtual methods where the Database code requires
+        differentiation.
+        2) Worker thread shutdown got changed a bunch to handle Database cleanup
+        and thread synchronization issues.  Database cleanup tasks need to post
+        some cleanup tasks to the JavaScript thread.  However, since database
+        cleanup may happen due to the destruction of the WorkerThread, I added a
+        handshake [involving WorkerThreadShutdownStartTask,
+        WorkerThreadShutdownFinishTask, and a DatabaseTaskSynchronizer] between
+        the Database thread and WorkerThread that cleans up all the Database
+        stuff before the WorkerThread's runLoop can exit.
+        3) The runtime enabler for the Database moved to a static variable
+        accessible through Database::isAvailable, following the model used by
+        WebSocket.
+        4) Worker threads don't run their JavaScript on the Main thread, so
+        Database code that differentiated between the Main thread and the
+        Database thread now need to deal with a third possibility.
+        5) Most of the other changes have to do with having a
+        ScriptExecutionContext pointer instead of a Document pointer when
+        dealing with a Database.  In many cases it's just a string replacement,
+        but in some it required the creation of a new virtual function [e.g.
+        databaseExceededQuota, isDatabaseReadOnly]
+
+        https://bugs.webkit.org/show_bug.cgi?id=22725
+
+        No new tests; in a future patch I'll add JSC and V8 bindings and new
+        layout tests to exercise them.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::OpenDatabaseEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::isDatabaseReadOnly):
+        (WebCore::Document::databaseExceededQuota):
+        (WebCore::Document::isContextThread):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::databaseThread):
+        (WebCore::ScriptExecutionContext::addOpenDatabase):
+        (WebCore::ScriptExecutionContext::removeOpenDatabase):
+        (WebCore::ScriptExecutionContext::stopDatabases):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::setHasOpenDatabases):
+        (WebCore::ScriptExecutionContext::hasOpenDatabases):
+        (WebCore::ScriptExecutionContext::Task::isCleanupTask):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * storage/Database.cpp:
+        (WebCore::Database::setIsAvailable):
+        (WebCore::Database::isAvailable):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::DerefContextTask::create):
+        (WebCore::DerefContextTask::performTask):
+        (WebCore::DerefContextTask::isCleanupTask):
+        (WebCore::Database::~Database):
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::ContextRemoveOpenDatabaseTask::create):
+        (WebCore::ContextRemoveOpenDatabaseTask::performTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::isCleanupTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::ContextRemoveOpenDatabaseTask):
+        (WebCore::Database::close):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::DeliverPendingCallbackTask::create):
+        (WebCore::DeliverPendingCallbackTask::performTask):
+        (WebCore::DeliverPendingCallbackTask::DeliverPendingCallbackTask):
+        (WebCore::Database::scheduleTransactionCallback):
+        (WebCore::Database::transactionClient):
+        (WebCore::Database::transactionCoordinator):
+        (WebCore::Database::tableNames):
+        (WebCore::Database::securityOrigin):
+        * storage/Database.h:
+        (WebCore::Database::scriptExecutionContext):
+        * storage/DatabaseTask.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::~DatabaseThread):
+        (WebCore::DatabaseThread::requestTermination):
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks):
+        * storage/DatabaseThread.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::TrackerRemoveOpenDatabaseTask::create):
+        (WebCore::TrackerRemoveOpenDatabaseTask::performTask):
+        (WebCore::TrackerRemoveOpenDatabaseTask::TrackerRemoveOpenDatabaseTask):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/SQLTransactionClientChromium.cpp:
+        (WebCore::NotifyDatabaseChangedTask::create):
+        (WebCore::NotifyDatabaseChangedTask::performTask):
+        (WebCore::NotifyDatabaseChangedTask::NotifyDatabaseChangedTask):
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        (WebCore::WorkerContext::isContextThread):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::clearScript):
+        (WebCore::WorkerContext::thread):
+        (WebCore::WorkerContext::isDatabaseReadOnly):
+        (WebCore::WorkerContext::databaseExceededQuota):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThreadShutdownFinishTask::create):
+        (WebCore::WorkerThreadShutdownFinishTask::performTask):
+        (WebCore::WorkerThreadShutdownFinishTask::isCleanupTask):
+        (WebCore::WorkerThreadShutdownStartTask::create):
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
+        (WebCore::WorkerThreadShutdownStartTask::isCleanupTask):
+        (WebCore::WorkerThread::stop):
+
+2010-01-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket: Request-URI should not be empty when no tralling slash in host
+        https://bugs.webkit.org/show_bug.cgi?id=33689
+
+        Test: websocket/tests/url-no-trailing-slash.html
+
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName):
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        [Qt] Fixes an issue where the height of <button>- and
+        <input type="button">- elements are fixed to the height of the
+        button label font plus padding. That is, the CSS height property
+        is being ignored.
+
+        Instead, we should honor the user-specified height, if appropriate
+        for the platform and context. Notice, the Mac ports do not honor the
+        height for <input type="button"> elements unless a border and/or
+        background is also specified.
+
+        Test: fast/css/button-height.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Assertion failure calling history.pushState within popstate event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=33830
+
+        Test: fast/loader/stateobjects/pushstate-within-popstate-handler-assert.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument): Remove the ASSERT and invalid part of the comment.
+
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash on dispatching SVG mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=33841
+
+        Return early SVGUseElement::instanceForShadowTreeElement if m_targetElementInstance is zero.
+        This only happens if the SVGUseElement has just been removed from the document and EventHandler
+        tries to dispatch a mouseout event to the corresponding SVGElementInstance. This is not testable
+        using DRT unfortunately, so we have to add another manual testcase for that.
+
+        Tests: manual-tests/use-crash-on-mouse-hover.svg
+
+        * manual-tests/svg-crash-hovering-use.svg: Added.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::instanceForShadowTreeElement): Add ASSERT(!inDocument()) when returning 0 here if m_targetElementInstance is 0.
+
+2010-01-20  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Timeline reset button doesn't clean timeline if the panel is scrolled down.
+        The overview pane also stay dirty after reset.
+        https://bugs.webkit.org/show_bug.cgi?id=33829
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+
+2010-01-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33930
+        Crash in JSDOMWindowBase::crossDomainAccessErrorMessage when accessing a detached sandboxed frame
+
+        Test: http/tests/security/detached-sandboxed-frame-access.html
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
+        Changed the way we discover the url to match what the actual check does. Both old and new
+        code correctly fetch the URL of the current window displayed in frame, but going via
+        DOMWindowShell avoids crashing on null DOMWindow::m_frame pointer.
+
+2010-01-20  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Support SerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+        http://crbug.com/30620
+
+        Initial implementation of SerializedScriptValue which is used to
+        to create a serialized representation of JavaScript objects.  This
+        representation is needed for structured clones and worker messages.
+
+        * WebCore.gypi: Added SerializedScriptValue.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Removed conversion to string before using SerializedScriptValue.
+        * bindings/v8/SerializedScriptValue.cpp: Added.
+        (WebCore::):
+        (WebCore::ZigZag::encode):
+        (WebCore::ZigZag::decode):
+        (WebCore::Writer::Writer):
+        (WebCore::Writer::writeUndefined):
+        (WebCore::Writer::writeNull):
+        (WebCore::Writer::writeTrue):
+        (WebCore::Writer::writeFalse):
+        (WebCore::Writer::writeString):
+        (WebCore::Writer::writeInt32):
+        (WebCore::Writer::writeNumber):
+        (WebCore::Writer::endComposite):
+        (WebCore::Writer::data):
+        (WebCore::Writer::doWriteUint32):
+        (WebCore::Writer::append):
+        (WebCore::Writer::ensureSpace):
+        (WebCore::Writer::fillHole):
+        (WebCore::Writer::charAt):
+        (WebCore::Serializer::Serializer):
+        (WebCore::Serializer::serialize):
+        (WebCore::Serializer::StateBase::~StateBase):
+        (WebCore::Serializer::StateBase::nextState):
+        (WebCore::Serializer::StateBase::setNextState):
+        (WebCore::Serializer::StateBase::composite):
+        (WebCore::Serializer::StateBase::StateBase):
+        (WebCore::Serializer::State::composite):
+        (WebCore::Serializer::State::tag):
+        (WebCore::Serializer::State::State):
+        (WebCore::Serializer::StackCleaner::StackCleaner):
+        (WebCore::Serializer::StackCleaner::~StackCleaner):
+        (WebCore::Serializer::ArrayState::ArrayState):
+        (WebCore::Serializer::ArrayState::done):
+        (WebCore::Serializer::ArrayState::advance):
+        (WebCore::Serializer::ObjectState::ObjectState):
+        (WebCore::Serializer::ObjectState::done):
+        (WebCore::Serializer::ObjectState::advance):
+        (WebCore::Serializer::ObjectState::nextProperty):
+        (WebCore::Serializer::doSerialize):
+        (WebCore::Serializer::push):
+        (WebCore::Serializer::top):
+        (WebCore::Serializer::pop):
+        (WebCore::Serializer::checkComposite):
+        (WebCore::Reader::Reader):
+        (WebCore::Reader::isEof):
+        (WebCore::Reader::read):
+        (WebCore::Reader::readTag):
+        (WebCore::Reader::readString):
+        (WebCore::Reader::readInt32):
+        (WebCore::Reader::readNumber):
+        (WebCore::Reader::doReadUint32):
+        (WebCore::Deserializer::Deserializer):
+        (WebCore::Deserializer::deserialize):
+        (WebCore::Deserializer::doDeserialize):
+        (WebCore::Deserializer::push):
+        (WebCore::Deserializer::pop):
+        (WebCore::Deserializer::stackDepth):
+        (WebCore::Deserializer::element):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toWireString):
+
+        Updated uses of SerializedScriptValue:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix crash in geolocation when observers change during iteration.
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::positionChanged): Copy observers to vector while iterating.
+        (WebCore::GeolocationController::errorOccurred): Copy observers to vector while iterating.
+
+2010-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Partial fix for selection repaint in foreignObject, basically we
+        just need to make sure foreignObject correctly applies the svg
+        transform to the selection rect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderForeignObject.h:
+
+2010-01-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY.
+
+        <rdar://problem/7557695> REGRESSION(r53445-r53449): Many new memory leaks (33867)
+
+        Revert r53447, since this caused leaks.
+
+        * WebCore.base.exp:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::operator delete):
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-01-20  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement File and Blob interfaces as defined in File API spec.
+        https://bugs.webkit.org/show_bug.cgi?id=32912
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/objc/DOMHTML.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt64):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * html/File.cpp:
+        (WebCore::File::File):
+        * html/File.h:
+        (WebCore::File::create):
+        (WebCore::File::name):
+        (WebCore::File::fileName):
+        (WebCore::File::fileSize):
+        * html/File.idl:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
+
+2010-01-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA popup buttons spoken as simply 'button'
+        https://bugs.webkit.org/show_bug.cgi?id=33922
+
+        Test: platform/mac/accessibility/aria-popup.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        * html/HTMLAttributeNames.in:
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        Now the copier is able to handle types that derive from ThreadSafeShared.
+
+        No change functionality so no new tests.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel): Remove unnecessary cast.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::clearClientWrapper): Ditto.
+        * loader/WorkerThreadableLoader.h:
+        Change to use the derived class instead of the ThreadSafeShared version.
+        * platform/CrossThreadCopier.cpp:
+        Add the new template parameter throughout the classes and adjust the class that 
+        handles ThreadSafeShared to allow for derived types.
+        * platform/CrossThreadCopier.h:
+        Add another template parameter to be able to detect classes that derive 
+        from ThreadSafeShared.
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        Removed unnecessary casts and changed a type to use the derived class instead of
+        the ThreadSafeShared version.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
+        (WebCore::workerContextDidSend):
+        (WebCore::workerContextDidGetBufferedAmount):
+        (WebCore::workerContextDidConnect):
+        (WebCore::workerContextDidReceiveMessage):
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setWebSocketChannel):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadCreateWebSocketChannel):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::clearClientWrapper):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
+        * websockets/WorkerThreadableWebSocketChannel.h:
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::create): Changed a type to use the
+        derived class instead of the ThreadSafeShared version.
+
+2010-01-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7086565> Crash in WebCore::PlugInView::dispatchNPEvent
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        Ref the PluginView to protect it from deletion while calling into the
+        plug-in.
+
+2010-01-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: accSelect() is not implemented
+
+        https://bugs.webkit.org/show_bug.cgi?id=33918
+        <rdar://problem/7436861>
+
+        Reviewed by Darin Adler.
+
+        Test: platform/win/accessibility/selection-and-focus.html
+
+        * accessibility/AccessibilityMenuListOption.cpp:
+        (WebCore::AccessibilityMenuListOption::setSelected):
+        Return early if the object is not selectable.
+
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Fix chromium build, introduced a copy&paste error.
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+
+2010-01-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6579204> Exception thrown when opening a <select> pop-up that
+        uses a web font
+        https://bugs.webkit.org/show_bug.cgi?id=23911
+
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Use the (bold) system font if an NSFont cannot
+        be obtained.
+
+2010-01-19  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Alexey Proskuryakov. 
+
+        svg/custom/use-instanceRoot-event-bubbling.xhtml is flakey
+        https://bugs.webkit.org/show_bug.cgi?id=33835
+
+        mouseEvent fires mutiple times in svg/custom/use-instanceRoot-as-event-target.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=32519
+
+        Test: svg/custom/use-instanceRoot-event-listener-liveness.xhtml
+
+        Stabilize <use> scripting support - use tests are reliable now (tested using --repeach-each 50 --random -p)
+
+        Do not reclone trees anymore because of event listener changes, instead keep correspondingElement & shadowTreeElement
+        synchronized for each SVGElementInstance - any mutations on any event listeners are live, and take immediate effect,
+        w/o having to rely on a reclone - this was the root of several race conditions making the <use> tests flakey.
+
+        Fix SVGUseElement::instanceRoot() to force shadow tree creation, even if it was not attached so far - we can't wait
+        for finishedParsing() to be called which would recalculate the document style and attach the shadow tree as result.
+        This is now matching Operas behaviour.
+
+        Optimize createAttributeEventListener() to not create event listeners if the supplied Attribute isNull() - otherwhise
+        DOM calls like removeAttribute("onclick") cause a temporary JSEventListener to be created, added to the event listener
+        cache and removed afterwards.
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Return early if the supplied attribute is null as discussed with Geoffrey.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Ditto.
+        * dom/Node.cpp: Synchronize event listeners with all element instances, instead of marking the use elements to reclone.
+        (WebCore::instancesForSVGElement):
+        (WebCore::tryAddEventListener):
+        (WebCore::Node::addEventListener): When adding a listener, get a list of element instances and add it their as well.
+        (WebCore::tryRemoveEventListener):
+        (WebCore::Node::removeEventListener): Ditto for removals, but with special logic for listeners created from markup (see comments)
+        * svg/SVGElementInstance.cpp: Cleaned up, removing unncessary checks of correspondingElement() - there is an ASSERT in the ctor.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData):
+        * svg/SVGUseElement.cpp: Call document()->updateLayoutIgnorePendingStylesheets() to force shadow tree creation, just like CSSStyleDecl works.
+        (WebCore::SVGUseElement::instanceRoot):
+
+2010-01-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move local utility class DocumentWeakReference entirely from Document.h into Document.cpp
+        since it is only used there. It is a followup for http://trac.webkit.org/changeset/53345.
+
+        No new tests since no change in functionality.
+
+        * dom/Document.cpp: Move definitions of the methods into declaration of the class, remove 'inline'.
+        * dom/Document.h: Replace DocumentWeakReference declaration with a forward declaration.
+
+2010-01-20  Oliver Hunt  <oliver@apple.com>
+
+        No review, rolling out r53561.
+        http://trac.webkit.org/changeset/53561
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        broke selection repaint for transformed text in html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        * rendering/RenderForeignObject.h:
+
+2010-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Partial fix for selection repaint in foreignObject, basically we
+        just need to make sure foreignObject correctly applies the svg
+        transform to the selection rect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderForeignObject.h:
+
+2010-01-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for !ENABLE(SVG).
+
+        * rendering/TrailingFloatsRootInlineBox.h:
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox):
+
+2010-01-20  David Levin  <levin@chromium.org>
+
+        No review, rolling out r53552.
+        http://trac.webkit.org/changeset/53552
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Caused lots of fast/profile test failures.
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::inspectedWindow):
+        (WebCore::JSInjectedScriptHost::wrapCallback):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::wrapObject):
+        (WebCore::JSInjectedScriptHost::unwrapObject):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedWindowCallback):
+        (WebCore::V8InjectedScriptHost::wrapCallbackCallback):
+        (WebCore::V8InjectedScriptHost::wrapObjectCallback):
+        (WebCore::V8InjectedScriptHost::unwrapObjectCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        (WebCore::InspectorController::resetInjectedScript):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._window):
+        (InjectedScript._objectForId):
+        (InjectedScript.createProxyObject):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        (Object.type):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectProxy.getPropertiesAsync):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Renames jni_runtime.[cpp|h] to JNIBridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33899
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removes jni_runtime.cpp and adds JNIBridge.cpp
+        * GNUmakefile.am: Modified. Removes jni_runtime.h and adds JNIBridge.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes jni_runtime.[cpp|h] and adds JNIBridge.[cpp|h]
+        * bridge/jni/JNIBridge.cpp: Copied from WebCore/bridge/jni/jni_runtime.cpp.
+        * bridge/jni/JNIBridge.h: Copied from WebCore/bridge/jni/jni_runtime.h.
+        * bridge/jni/jni_jsobject.mm: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jni_runtime.cpp: Removed.
+        * bridge/jni/jni_runtime.h: Removed.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jsc/JavaClassJSC.cpp: Modified. Removed superfluous include
+        * bridge/jni/jsc/JavaClassJSC.h: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Updated to include JNIBridge.h
+
+2010-01-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33913
+        Crash under Media::matchMedium in detached frame
+
+        Also took the opportunity to fix JS bindings for the Media object.
+
+        Test: fast/media/lifetime.html
+
+        * css/Media.h:
+        (WebCore::Media::create): Take and store a Frame pointer, like other similar objects do.
+        (WebCore::Media::disconnectFrame): Zero out the frame pointer (this is called from
+        DOMWindow::clear()).
+
+        * css/Media.cpp:
+        (WebCore::Media::Media): Updated to storing Frame pointer.
+        (WebCore::Media::type): Ditto.
+        (WebCore::Media::matchMedium): Removed null check for document element - every document has
+        one. Also, every Frame has a document, so we only need to check for m_frame being zero.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalMedia):
+        Make sure there's only one Media object per window, and keep its wrapper alive.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * WebCore.vcproj/MigrateIDLAndScripts: Remove reference to file that no longer exists.
+        * WebCore.vcproj/QTMovieWin.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * WebCore.vcproj/WebCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Remove ENABLE_ preprocessor definitions.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Added Cairo configuration for selecting proper features.
+        * WebCore.vcproj/WebCoreMediaQT.vsprops: Remove ENABLE_VIDEO. This is picked up from FeatureDefines.vsprops.
+        * WebCore.vcproj/build-generated-files.sh: Pick up features from FeatureDefines.vsprops or FeatureDefinesCairo.vsprops.
+
+2010-01-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Test: inspector/console-log-before-inspector-open.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=time.
+        https://bugs.webkit.org/show_bug.cgi?id=33825
+
+        Introduce ISODateTime::setMillisecondsSinceMidnight() and add a
+        SecondFormat parameter to ISODateTime::toString(). The main code
+        logic for type=time is implemented in
+        setMillisecondsSinceMidnightInternal() and toStringForTime()
+        because the logic is going to be used for other types.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::positiveFmod):
+        (WebCore::ISODateTime::setMillisecondsSinceMidnightInternal):
+        (WebCore::ISODateTime::setMillisecondsSinceMidnight):
+        (WebCore::ISODateTime::toStringForTime):
+        (WebCore::ISODateTime::toString):
+        * html/ISODateTime.h:
+        (WebCore::ISODateTime::):
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * WebCore.pri:
+
+2010-01-20  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        The touchcancel event is not supported.
+        https://bugs.webkit.org/show_bug.cgi?id=33598
+
+        This change adds support for the touchcancel event in WebCore and adds a test.
+
+        Test: fast/events/touch/send-oncancel-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent): Considers touchcancel with the other touch events when working out if the event is a user gesture.
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded): Adds a check to consider ontouchcancel a touch event listener.
+        * dom/Document.h: Add the touchcancel attribute event listener.
+        * dom/Document.idl: ditto.
+        * dom/Element.h: ditto.
+        * dom/Element.idl: ditto.
+        * dom/EventNames.h: Adds touchcancel as an event name.
+        * html/HTMLAttributeNames.in:Adds touchcancel as an HTML attribute name.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): Parses the ontouchcancel attribute.
+        * page/DOMWindow.h: Adds the touchcancel attribute event listener.
+        * page/DOMWindow.idl: ditto.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Add code to detect and dispatch touchcancel events.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::): Add TouchCancel as a touch event type.
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::): Add TouchCanceled as a touch point state.
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+        * WebCore.pri:
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium][V8] Fix null pointer dereference in V8Proxy::retrieve().
+        https://bugs.webkit.org/show_bug.cgi?id=33886
+
+        This is equivalent to r53433, and fix a crash by
+        LayoutTests/http/tests/appcache/destroyed-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve): Check if context is null.
+
+2010-01-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Optimize resize event handling for hidden views
+        https://bugs.webkit.org/show_bug.cgi?id=33803
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        * inspector/front-end/AuditsPanel.js:
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.updateSidebarWidth):
+        (WebInspector.Panel.prototype.resize):
+        * inspector/front-end/PanelEnablerView.js:
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype.show):
+        (WebInspector.PanelEnablerView.prototype.resize):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.get visibleView):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth):
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        (WebInspector.WelcomeView.prototype.show):
+        (WebInspector.WelcomeView.prototype.resize):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowResize):
+
+2010-01-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/Bridge
+        https://bugs.webkit.org/show_bug.cgi?id=33839
+
+        No new tests, style fixes only.
+
+        * bridge/Bridge.cpp: Modified.
+        * bridge/Bridge.h: Modified.
+        * bridge/c/c_instance.cpp: Modified.
+        (JSC::Bindings::CInstance::invokeMethod): Modified. Use renamed m_rootObject member
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Modified. Use renamed m_rootObject member
+        (JSC::Bindings::CInstance::invokeConstruct): Modified. Use renamed m_rootObject member
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaArray::JavaArray): Modified. Use renamed m_rootObject member
+        (JavaArray::rootObject): Modified. Use renamed m_rootObject member
+        * bridge/objc/objc_instance.mm: Modified.
+        (ObjcInstance::invokeMethod): Modified. Use renamed m_rootObject member
+        (ObjcInstance::invokeDefaultMethod): Modified. Use renamed m_rootObject member
+        (ObjcInstance::getValueOfUndefinedField): Modified. Use renamed m_rootObject member
+        * bridge/objc/objc_runtime.mm: Modified.
+        (JSC::Bindings::ObjcArray::valueAt): Modified. Use renamed m_rootObject member
+        * bridge/qt/qt_runtime.cpp: Modified.
+        (JSC::Bindings::::rootObject): Modified. Use renamed m_rootObject member
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33885
+
+        Fixes style errors exposed by the style bot in the patch
+        for bug #33770. Moreover, fixes all style errors reported
+        by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/JNIUtility
+        https://bugs.webkit.org/show_bug.cgi?id=33870
+
+        No new tests, style fixes only.
+
+        * bridge/jni/JNIUtility.cpp:
+        * bridge/jni/JNIUtility.h:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        On Linux link QtWebKit with -no-undefined to catch build breakages due to missing
+        files in the .pro file, resulting in unresolved symbols.
+
+        * WebCore.pro:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make it possible to link with -no-undefined.
+
+        * WebCore.pro: Add missing explicit dependency to libXrender due to the
+        use of XRenderFindVisualFormat in the X11 plugin code.
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add missing files to the build.
+
+        * WebCore.pro:
+
+2010-01-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] computePageRectsForFrame seems to be unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=33881
+
+        * WebCore.gypi: Removed FrameChromium.h
+        * page/chromium/FrameChromium.cpp: Removed computePageRectsForFrame.
+        * page/chromium/FrameChromium.h: Removed.
+
+2010-01-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 33266 - WebCore::InlineFlowBox::determineSpacingForFlowBoxes ReadAV@NULL (43c64e8abbda6766e5f5edbd254c2d57)
+        (https://bugs.webkit.org/show_bug.cgi?id=33266)
+        
+        Ruby did not handle malformed cases correctly when the ruby base was in
+        block flow. Changed the code to handle all possible cases.
+        Also, added some simplification methods to RenderBlock.
+
+        Tests: fast/ruby/ruby-illegal-1.html
+               fast/ruby/ruby-illegal-2.html
+               fast/ruby/ruby-illegal-3.html
+               fast/ruby/ruby-illegal-4.html
+               fast/ruby/ruby-illegal-5.html
+               fast/ruby/ruby-illegal-6.html
+               fast/ruby/ruby-illegal-7.html
+               fast/ruby/ruby-illegal-combined.html
+               fast/ruby/rubyDOM-insert-rt-block-1.html
+               fast/ruby/rubyDOM-insert-rt-block-2.html
+               fast/ruby/rubyDOM-insert-rt-block-3.html
+               fast/ruby/rubyDOM-remove-rt-block-1.html
+               fast/ruby/rubyDOM-remove-rt-block-2.html
+               fast/ruby/rubyDOM-remove-rt-block-3.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveAllChildrenTo): useful for anonymous block manipulation
+        (WebCore::RenderBlock::removeChild): making use of moveAllChildrenTo
+        * rendering/RenderBlock.h:
+        * rendering/RenderRubyBase.cpp:
+        (WebCore::RenderRubyBase::hasOnlyWrappedInlineChildren):
+        (WebCore::RenderRubyBase::moveChildren):
+        (WebCore::RenderRubyBase::moveInlineChildren):
+        (WebCore::RenderRubyBase::moveBlockChildren):
+        (WebCore::RenderRubyBase::mergeBlockChildren):
+        * rendering/RenderRubyBase.h:
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+
+2010-01-19  Dan Bernstein  <mitz@apple.com>
+
+        Build fix after r53514
+
+        * WebCore.base.exp: Removed threadGlobalData(), which was inlined in r53514.
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid calling NSEqualRects() on the garbage rect obtained
+        by calling -frame on a null view.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::setFrameRect):
+
+2010-01-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix.
+
+        Remove currentWorld from the exports file again, since it is now inline.
+
+        * WebCore.base.exp:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Part of <http://webkit.org/b/28622>.
+        Caught exceptions still pause the debugger.
+        
+        Update JavaScriptDebugServer::exception to take a hasHandler parameter,
+        so later we can differentiate between a caught and an uncaught exception.
+        
+        This just adds a new parameter, no behavior is changed.
+
+        No change in functionality, so no tests.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::exception):
+        * inspector/JavaScriptDebugServer.h:
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::currentWorld): Inlined.
+        (WebCore::jsString): Inlined String& overload and split off slow case.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringSlowCase): Slow case for the above.
+        * dom/Document.h:
+        (WebCore::Document::isHTMLDocument): Use a bit and an inline method
+        instead of a virtual method, since this is so hot and size of Document
+        is not a prime concern.
+        (WebCore::Document::create): Adapt for above.
+        (WebCore::Document::createXHTML): ditto
+        * dom/Document.cpp:
+        (WebCore::Document::Document): ditto
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::HTMLDocument): ditto
+        * html/HTMLDocument.h: ditto
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::PlaceholderDocument): ditto
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::SVGDocument): ditto
+        * dom/Element.h:
+        (WebCore::Element::attributes): Inlined.
+        (WebCore::Element::updateId): Inlined.
+        * dom/Element.cpp: (Remove inlined methods.)
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedNodeMap::getAttributeItem): Inlined and split off slow case.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItemSlowCase): Slow case for the above.
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::didInsertDOMNode): Inlined so the fast case
+        early exit doesn't incur a function call.
+        (WebCore::InspectorController::didRemoveDOMNode): ditto
+        (WebCore::InspectorController::didModifyDOMAttr): ditto
+        * platform/ThreadGlobalData.h:
+        (WebCore::threadGlobalData): Inlined.
+        * platform/ThreadGlobalData.cpp: (Removed inline methods).
+        * platform/Timer.h:
+        (WebCore::TimerBase::isActive): Inlined.
+        * platform/Timer.cpp: (Removed inline methods).
+        * WebCore.xcodeproj/project.pbxproj: Install new heares.
+        * WebCore.base.exp: Add appropriate exports.
+
+2010-01-19  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Chromium build fix.
+
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Call correct function.
+
+2010-01-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: The child <option> elements of a non-multiple <select> are not
+        exposed
+
+        https://bugs.webkit.org/show_bug.cgi?id=33773
+        <rdar://problem/7550556>
+
+        Reviewed by Alice Liu.
+
+        This exposes the child <option> elements in a format similar to
+        Firefox's: the <select> element has one child, a hidden list object,
+        and this list has as its children the <option> elements.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new files to project.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        If the element is a RenderMenuList, create an AccessibilityMenuList.
+        (WebCore::AXObjectCache::getOrCreate):
+        Add new types to create by role value.
+
+        * accessibility/AccessibilityMenuList.cpp: Added.
+        (WebCore::AccessibilityMenuList::AccessibilityMenuList):
+        Call the base class constructor. Assert that the RenderObject passed
+        is a RenderMenuList.
+        (WebCore::AccessibilityMenuList::press):
+        Show or hide the popup menu.
+        (WebCore::AccessibilityMenuList::addChildren):
+        Create an AccessibilityMenuListPopup. If the platform ignores its
+        accessibility, remove it from the object cache and return early.
+        Otherwise, set its parent object to this object, add it to our list of
+        children, and tell it to add its children.
+        (WebCore::AccessibilityMenuList::childrenChanged):
+        Tell our child hidden list that its children changed.
+        (WebCore::AccessibilityMenuList::isCollapsed):
+        Return whether the popup menu is visible.
+
+        * accessibility/AccessibilityMenuList.h: Added.
+        (WebCore::AccessibilityMenuList::create):
+        Adopt and return a new RenderMenuList.
+        (WebCore::AccessibilityMenuList::isMenuList):
+        (WebCore::AccessibilityMenuList::roleValue):
+        (WebCore::AccessibilityMenuList::accessibilityIsIgnored):
+        (WebCore::AccessibilityMenuList::canSetFocusAttribute):
+
+        * accessibility/AccessibilityMenuListOption.cpp: Added.
+        (WebCore::AccessibilityMenuListOption::AccessibilityMenuListOption):
+        Initialize the pointer to our parent popup menu.
+        (WebCore::AccessibilityMenuListOption::setElement):
+        Assert that the element is an <option> element.
+        (WebCore::AccessibilityMenuListOption::actionElement):
+        Return our element.
+        (WebCore::AccessibilityMenuListOption::parentObject):
+        Return our parent popup menu.
+        (WebCore::AccessibilityMenuListOption::isEnabled):
+        Return true if the element itself is enabled.
+        (WebCore::AccessibilityMenuListOption::isVisible):
+        Return true if the popup is visible, or return true if the popup is
+        collapsed but the element is selected.
+        (WebCore::AccessibilityMenuListOption::isOffScreen):
+        Return true if the object is invisible.
+        (WebCore::AccessibilityMenuListOption::isSelected):
+        (WebCore::AccessibilityMenuListOption::setSelected):
+        (WebCore::AccessibilityMenuListOption::nameForMSAA):
+        Return the <option> element's text.
+        (WebCore::AccessibilityMenuListOption::canSetSelectedAttribute):
+        Return true if enabled.
+        (WebCore::AccessibilityMenuListOption::elementRect):
+        Return the AccessibilityMenuList's rect.
+
+        * accessibility/AccessibilityMenuListOption.h: Added.
+        (WebCore::AccessibilityMenuListOption::create):
+        Adopt and return a new AccessibilityMenuListOption.
+        (WebCore::AccessibilityMenuListOption::setParent):
+        (WebCore::AccessibilityMenuListOption::isMenuListOption):
+        (WebCore::AccessibilityMenuListOption::roleValue):
+        (WebCore::AccessibilityMenuListOption::canHaveChildren):
+        (WebCore::AccessibilityMenuListOption::size):
+
+        * accessibility/AccessibilityMenuListPopup.cpp: Added.
+        (WebCore::AccessibilityMenuListPopup::AccessibilityMenuListPopup):
+        Initialize the pointer to our parent list.
+        (WebCore::AccessibilityMenuListPopup::isVisible):
+        Return false; we're never considered visible.
+        (WebCore::AccessibilityMenuListPopup::isOffScreen):
+        Return true if the popup is collapsed.
+        (WebCore::AccessibilityMenuListPopup::parentObject):
+        Return our parent AccessibilityMenuList.
+        (WebCore::AccessibilityMenuListPopup::isEnabled):
+        Return true if our parent is enabled.
+        (WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
+        If the element is an <option> element, create a list item for it, and
+        set the object's element to this element.
+        (WebCore::AccessibilityMenuListPopup::press):
+        Call our parent's press() function to show or hide the popup menu.
+        (WebCore::AccessibilityMenuListPopup::addChildren):
+        Walk the select element's children, and create list items for them. Add
+        them to our list of children.
+        (WebCore::AccessibilityMenuListPopup::childrenChanged):
+        If any of our children have been detached from the document, remove
+        them from the AXObjectCache and from our child list.
+        (WebCore::AccessibilityMenuListPopup::setMenuList):
+
+        * accessibility/AccessibilityMenuListPopup.h: Added.
+        (WebCore::AccessibilityMenuListPopup::create):
+        Adopt and return an AccessibilityMenuListPopup.
+        (WebCore::AccessibilityMenuListPopup::isMenuListPopup):
+        (WebCore::AccessibilityMenuListPopup::elementRect):
+        (WebCore::AccessibilityMenuListPopup::size):
+        (WebCore::AccessibilityMenuListPopup::roleValue):
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::actionVerb):
+        Add the menuListAction and menuListPopupAction verbs.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add new roles.
+        (WebCore::AccessibilityObject::isMenuList):
+        Stubbed.
+        (WebCore::AccessibilityObject::isMenuListHiddenList):
+        Stubbed.
+        (WebCore::AccessibilityObject::isMenuListOption):
+        Stubbed.
+        (WebCore::AccessibilityObject::isVisible):
+        Stubbed.
+
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore the new object type.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Allow the new object types.
+
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore the new object type.
+
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        If the object is an AccessibilityMenuListHiddenList or
+        AccessibilityMenuListOption, include it.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::disabled):
+        Call ownElementDisabled().
+
+        * html/HTMLOptionElement.h:
+        (WebCore::HTMLOptionElement::ownElementDisabled):
+        Return the base class implementation of disabled, which returns
+        whether this <option> itself is disabled.
+
+        * platform/LocalizedStrings.h:
+        Declare new localized string functions.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::AXMenuListPopupActionVerb):
+        Call the view factory's method.
+        (WebCore::AXMenuListActionVerb):
+        Ditto.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Support reflections on WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=33754
+
+        Support reflections of WebGL content, by ensuring that when the Canvas3DLayer containing the
+        WebGL content gets displayed, we correctly copy its content to the clone layers.
+        
+        Test: compositing/webgl/webgl-reflection.html
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::didDisplay): Give the didDisplay() client method a parameter
+        which is the layer that displayed.
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer display]): Override -[CALayer display], and call the client didDisplay().
+        * platform/graphics/mac/GraphicsLayerCA.h: didDisplay() takes a PlatformLayer parameter.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::~GraphicsLayerCA): We need to clear the layer owner on the content
+        layer, since we're setting it for WebGL layers now.
+        
+        (WebCore::GraphicsLayerCA::didDisplay): Handle didDisplay() calls for the content layer,
+        as well as the main layer now, getting the correct layer to copy contents from, and using
+        the correct clone map.
+        
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D): Set the layer owner for WebGL
+        layers, because we need the didDisplay() callback.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer display]): didDisplay() takes a layer argument.
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer display]): ditto.
+
+2010-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7555330> <http://webkit.org/b/33770> dataFunctionMatrix leaks the array allocated by toArray
+
+        Rework toArray to extract elements in to a vector rather than handing out raw pointers.  This prevents
+        callers from forgetting to free the memory, and gives them the option of using stack buffers for
+        sufficiently small allocations.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        (WebCore::toVector):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
+2010-01-19  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Another crazy counters bug
+        https://bugs.webkit.org/show_bug.cgi?id=11031
+
+        This patch actually provides for counter updating when the style
+        of a renderer changes.
+
+        Tests: fast/css/counters/counter-increment-002.html
+               fast/css/counters/counter-reset-000.html
+               fast/css/counters/counter-reset-002.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::rendererStyleChanged):
+        This function is added to update the counter hierarchy in 
+        response to changes to the style of a renderer.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange):
+        For changes that may include the counter directives added a
+        call to RenderCounter::rendererStyleChanged.
+
+2010-01-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Build fixes for make distcheck - missing files.
+
+        * GNUmakefile.am:
+
+2010-01-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33850
+        Attr.childNodes does not get updated after DOM mutations
+
+        Test: fast/dom/Attr/child-nodes-cache.html
+
+        * dom/Node.cpp: (WebCore::Node::notifyLocalNodeListsAttributeChanged): If the node is an
+        attribute, then changing it shouldn't take the shortcut that only resets a subset of caches.
+
+2010-01-19  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=33854
+        Would like a variant of WebHTMLRepresentation's searchForLabelsBeforeElement that returns 
+        more info about where the result was found
+
+        Reviewed by Darin Adler.
+
+        No new tests. This just adds a couple of out parameters for the benefit of WebKit clients.
+
+        * WebCore.base.exp:
+        Updated mangled signature for export.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        Now fills in an out parameter with the number of characters from the start of the cell.
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        Now fills in an out parameter with the distance as a number of characters, and another
+        with a bool for whether the result was in a table cell above the current cell (otherwise
+        it was found in the text before this element and after the previous element or start of form).
+
+        * page/Frame.h:
+        Updated signatures.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        Same as above. This is a parallel copy of the function using Mac-specific data structures.
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        Ditto
+
+2010-01-19  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Add (EGL) surface/context management
+        https://bugs.webkit.org/show_bug.cgi?id=33403
+
+        The foundations for a new OpenVG port.
+
+        OpenVG is not tied to EGL per se, EGL just happens to be
+        the only usable backend for OpenVG state and painting
+        at the time of writing.
+
+        The purpose of the SurfaceOpenVG class is to provide
+        an EGL-independent interface for OpenVG-specific code.
+        The EGLDisplayOpenVG class takes care of keeping track
+        of EGL displays, surfaces and contexts. It also makes
+        sure that all created contexts are interoperable, and
+        that different surfaces use a single context if possible.
+
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp: Added.
+        (WebCore::displayManagers):
+        (WebCore::EGLDisplayOpenVG::currentSurface):
+        (WebCore::EGLDisplayOpenVG::registerPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::unregisterPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::setCurrentDisplay):
+        (WebCore::EGLDisplayOpenVG::current):
+        (WebCore::EGLDisplayOpenVG::forDisplay):
+        (WebCore::EGLDisplayOpenVG::EGLDisplayOpenVG):
+        (WebCore::EGLDisplayOpenVG::~EGLDisplayOpenVG):
+        (WebCore::EGLDisplayOpenVG::setDefaultPbufferConfig):
+        (WebCore::EGLDisplayOpenVG::defaultPbufferConfig):
+        (WebCore::EGLDisplayOpenVG::setDefaultWindowConfig):
+        (WebCore::EGLDisplayOpenVG::defaultWindowConfig):
+        (WebCore::EGLDisplayOpenVG::sharedPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::createPbufferSurface):
+        (WebCore::EGLDisplayOpenVG::surfaceForWindow):
+        (WebCore::EGLDisplayOpenVG::surfacesCompatible):
+        (WebCore::EGLDisplayOpenVG::destroySurface):
+        (WebCore::EGLDisplayOpenVG::contextForSurface):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h: Added.
+        (WebCore::EGLDisplayOpenVG::display):
+        * platform/graphics/openvg/EGLUtils.h: Added.
+        (toEGLErrorConstant):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp: Added.
+        (WebCore::SurfaceOpenVG::currentSurface):
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::~SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::isValid):
+        (WebCore::SurfaceOpenVG::width):
+        (WebCore::SurfaceOpenVG::height):
+        (WebCore::SurfaceOpenVG::sharedSurface):
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        (WebCore::SurfaceOpenVG::flush):
+        * platform/graphics/openvg/SurfaceOpenVG.h: Added.
+        (WebCore::SurfaceOpenVG::eglDisplay):
+        (WebCore::SurfaceOpenVG::eglSurface):
+        (WebCore::SurfaceOpenVG::eglContext):
+        * platform/graphics/openvg/VGUtils.h: Added.
+        (toVGErrorConstant):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Renames jni_utility and jni_utility_private to JNIUtility and JNIUtilityPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=33843
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JNIUtility.cpp: Copied from WebCore/bridge/jni/jni_utility.cpp.
+        * bridge/jni/JNIUtility.h: Copied from WebCore/bridge/jni/jni_utility.h.
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_objc.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp: Removed.
+        * bridge/jni/jni_utility.h: Removed.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Copied from WebCore/bridge/jni/jsc/jni_utility_private.cpp.
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JNIUtilityPrivate.h: Copied from WebCore/bridge/jni/jsc/jni_utility_private.h.
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        * bridge/jni/jsc/JavaStringJSC.h:
+        * bridge/jni/jsc/jni_utility_private.cpp: Removed.
+        * bridge/jni/jsc/jni_utility_private.h: Removed.
+        * platform/android/GeolocationServiceBridge.cpp:
+        * platform/android/GeolocationServiceBridge.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Occasional crash when interacting with page with reflected WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=33863
+        
+        If updateCompositingLayers() was called with an updateRoot that was a reflection layer,
+        then we would determine that the layer does not require compositing, and tear down its
+        backing (without clearing replicaLayer() on the source layer's GraphicsLayer).
+        
+        Fix by changing requiresCompositingLayer() on a reflection layer to always give the
+        same answer for a reflection and its original.
+        
+        Also add various belt-and-brances code and null checks to ensure that if we ever end up
+        with a non-composited reflection layer, we won't crash.
+        
+        No new tests, because the crash depends on timing issues that are hard to reproduce in a test.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::replicaLayer): Make this public so we can use it in an assertion.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking): Clear the source layer's replica layer
+        pointer if tearing down backing store of a reflection.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Null-check reflection->backing().
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Null-check reflection->backing().
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): reflection->backing().
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer): If being called for a reflection layer,
+        use the source layer to answer the question.        
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Some composited reflections incorrectly positioned
+        https://bugs.webkit.org/show_bug.cgi?id=33856
+        
+        When setting the position of the replicated layer inside the reflection, we need to take
+        into account the bounds of the original layer, and the replica layer to get the
+        reflection in the right place.
+
+        Tests: compositing/reflections/nested-reflection-transformed2.html
+               compositing/reflections/reflection-positioning2.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2010-01-19  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=33864
+        <rdar://problem/7552959>
+        
+        Regression has been introduced by changeset 53085.
+        The original fix had to be limited to editable content.
+
+        Test: editing/selection/selection-applet.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+
+2010-01-19  Kristian Amlie <kristian.amlie@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix qmake warning with qmake in Qt for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=33786
+
+        * WebCore.pro: Use QMAKE_LFLAGS instead of MMP_RULES.
+
+2010-01-19  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33851
+
+        Fixes an issue in the Apple Mac port where ScrollView::platformVisibleContentRect
+        returns the rectangle of the document within the content view of
+        the scroll view (i.e. the rectangle not including scrollbars) when
+        the parameter includeScrollbars == true
+
+        Currently, this behavior contradicts both the comment in ScrollView.h
+        for method visibleContentRect as well as the behavior in
+        ScrollView::visibleContentRect() for a platform-independent scroll view.
+
+        Instead, it should return the rectangle whose dimensions include
+        the scrollbars.
+
+        Also, removes some extra whitespace at the end of the lines.
+
+        No tests included because we cannot test this using either DRT
+        or a manual test.
+
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformVisibleContentRect): If includeScrollbars == true
+        then return the rectangle whose dimensions are that of
+        the frame (i.e. -[NSScrollView frame]).
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/jni/jsc/JavaClassJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33819
+
+        No new tests, style fixes only.
+
+        * bridge/jni/jsc/JavaClassJSC.cpp: Modified.
+        * bridge/jni/jsc/JavaClassJSC.h: Modified.
+
+2010-01-19  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Pavel Feldman.
+        
+        Refactors the TimelineRecordFactory and InspectorTimelineAgent to support reporting data
+        when closing a record. Also includes grabbing the start and end line number for parse HTML
+        records as a reference use case for the above refactor
+
+        Tests updated:
+            inspector/timeline-parse-html-expected.txt
+            inspector/timeline-layout-expected.txt
+            inspector/timeline-recalculate-styles-expected.txt
+
+        https://bugs.webkit.org/show_bug.cgi?id=33853
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchData):
+        (WebCore::TimelineRecordFactory::createGenericTimerData):
+        (WebCore::TimelineRecordFactory::createTimerInstallData):
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeData):
+        (WebCore::TimelineRecordFactory::createXHRLoadData):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptData):
+        (WebCore::TimelineRecordFactory::createMarkTimelineData):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestData):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseData):
+        (WebCore::TimelineRecordFactory::createResourceFinishData):
+        (WebCore::TimelineRecordFactory::createPaintData):
+        (WebCore::TimelineRecordFactory::createParseHTMLData):
+        * inspector/TimelineRecordFactory.h:
+
+2010-01-19 Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        Moves the text assembling functionality from getPangoLayoutForAtk to
+        textForObject, which webkit_accessible_text_get_text now falls back on
+        when it comes up empty.
+
+        Adds a check in textForObject so that we don't double-add newlines
+        when we have a BR.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text):
+
+2010-01-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        error events don't fire if no <source> elements passed to media engine
+        https://bugs.webkit.org/show_bug.cgi?id=33855
+
+        Test: media/video-source-error-no-candidate.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Only bail early if
+        there is no 'src' attribute and no <source> child elements at all.
+
+2010-01-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33822
+
+        REGRESSION(r53273): Fixes redefinition of XFORM error when building
+        WebKit using Qt Windows with the MinGW compiler.
+ 
+        Note, MinGW has a slightly different declaration of the struct XFORM
+        from that in the Microsoft SDK. So, we need to substitute an alternative
+        typedef for XFORM when compiling with MinGW.
+
+        No functionality was changed. So, no new tests.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-19  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for crash on large TransparencyWin allocation.  The fix is
+        to leave m_layerValid false when the allocPixels of
+        OwnedBuffers::m_referenceBitmap fails.  Then TransparencyWin won't
+        attempt to use it.
+
+        Will be covered by a new unit test in Chromium's test_shell_tests (when
+        this is rolled into Chromium).
+
+        https://bugs.webkit.org/show_bug.cgi?id=33844
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::initializeNewContext):
+        Early return when m_referenceBitmap or its pixels is NULL, leaving
+        m_layerValid false.
+
+2010-01-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        video.networkState remains NETWORK_LOADING indefinitely when no <source> element was able to be loaded
+        https://bugs.webkit.org/show_bug.cgi?id=33744
+
+        Test: media/video-source-none-supported.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadNextSourceChild): Call waitForSourceChange if
+            there are no valid source elements.
+        (WebCore::HTMLMediaElement::waitForSourceChange): New, set networkState to NETWORK_NO_SOURCE.
+        (WebCore::HTMLMediaElement::setNetworkState): Call waitForSourceChange if the movie
+            hasn't reached HAVE_METADATA and there are no more <source> elements to try.
+        * html/HTMLMediaElement.h: Declare waitForSourceChange.
+
+2010-01-19  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33408
+
+        Implements an optimization to ignore fixed background images
+        (i.e. background-attachment: fixed) when a page does not contain
+        any fixed position elements so as to allow fast repaints (via bit
+        blit) when scrolling a page.
+
+        Currently, if a page has elements that specify either a fixed
+        background or a fixed position then we perform a slow repaint
+        (i.e disable blitting) so as to avoid rendering artifacts.
+        However, on low-powered/mobile devices slow repaints can cause
+        noticeable delays when scrolling a page with a fixed background
+        image. By sacrificing support for fixed background images when
+        there are no fixed elements on the page and with come care, we
+        don't need to force slow repaints and can avoid rendering artifacts.
+        Hence, on such devices we can improve the responsiveness of
+        scrolling a page with a fixed background image.
+
+        Note, this optimization is only enabled if the WebKit is built
+        with FAST_MOBILE_SCROLLING enabled.
+
+        Tests: fast/fast-mobile-scrolling/fixed-position-element.html
+               fast/fast-mobile-scrolling/no-fixed-position-elements.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        Disable fixed background attachment if we can blit on scroll.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2010-01-19  Dave Hyatt  <hyatt@apple.com>
+
+        Build bustage fix.  Land modified WebCore.base.exp file that includes export of currentWorld().
+
+        * WebCore.base.exp:
+
+2010-01-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in Page::backForwardList when using History object from a detached window
+        <rdar://problem/7556252> and https://bugs.webkit.org/show_bug.cgi?id=33828
+
+        Test: fast/loader/stateobjects/state-api-on-detached-frame-crash.html
+
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded): Do an early return when detached. The spec
+          doesn't really cover expected behavior and we already do something similar in 
+          other places, such as in History::length().
+
+2010-01-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53467. Browser crashes on opening inspector if there
+        are messages in console.
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::inspectedWindow):
+        (WebCore::JSInjectedScriptHost::wrapCallback):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::wrapObject):
+        (WebCore::JSInjectedScriptHost::unwrapObject):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedWindowCallback):
+        (WebCore::V8InjectedScriptHost::wrapCallbackCallback):
+        (WebCore::V8InjectedScriptHost::wrapObjectCallback):
+        (WebCore::V8InjectedScriptHost::unwrapObjectCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._window):
+        (InjectedScript._objectForId):
+        (InjectedScript.createProxyObject):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        (Object.type):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectProxy.getPropertiesAsync):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Fixes Windows build due to http://trac.webkit.org/changeset/53464
+        Updates WebCore.vcproj to reflect renaming of runtime.[cpp|h] to Bridge.[cpp|h]
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Renames WebCore/bridge/runtime.[cpp|h] to WebCore/bridge/Bridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33801
+
+        runtime.[cpp|h] contains general interface classes for use in the bridge,
+        so Bridge is a more appropriate name than runtime.
+
+        No new tests, renaming only.
+
+        * Android.jscbindings.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/ScriptControllerGtk.cpp:
+        * bindings/js/ScriptControllerHaiku.cpp:
+        * bindings/js/ScriptControllerMac.mm:
+        * bindings/js/ScriptControllerQt.cpp:
+        * bindings/js/ScriptControllerWin.cpp:
+        * bindings/js/ScriptControllerWx.cpp:
+        * bindings/js/ScriptInstance.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bridge/Bridge.cpp: Copied from WebCore/bridge/runtime.cpp.
+        * bridge/Bridge.h: Copied from WebCore/bridge/runtime.h.
+        * bridge/c/c_class.h:
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.h:
+        * bridge/jni/jni_instance.h:
+        * bridge/objc/objc_runtime.h:
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime.cpp: Removed.
+        * bridge/runtime.h: Removed.
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        * bridge/testbindings.cpp:
+        * bridge/testbindings.mm:
+        * bridge/testqtbindings.cpp:
+        * page/win/FrameWin.cpp:
+        * platform/graphics/wince/MediaPlayerProxy.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        Test: fast/workers/worker-gc2.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController): Removed some
+        ASSERTs that have moved to JavaScriptCore.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        Test: fast/workers/worker-gc2.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController): Removed some
+        ASSERTs that have moved to JavaScriptCore.
+
+2010-01-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33089
+
+        Implements all of the alphabetic CSS3 list-style-types as per
+        section 4.4 of the CSS3 Lists module <http://www.w3.org/TR/css3-lists/#alphabetic>.
+
+        Test: fast/lists/w3-css3-list-styles-alphabetic.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Updated comment to include
+        added list-style-types.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added new list style types,
+        alphabetized enums, and removed indent to conform to the WebKit Code Style Guidelines.
+        * css/CSSValueKeywords.in:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js:
+        (WebInspector.CSSSourceSyntaxHighlighter): Added new list style types
+        and alphabetized array valueKeywords.
+        * platform/text/CharacterNames.h: Added constant ethiopicPrefaceColon.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toAlphabetic):
+        (WebCore::listMarkerSuffix): Added.
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint): Modified to call WebCore::listMarkerSuffix.
+        (WebCore::RenderListMarker::calcPrefWidths): Ditto.
+        (WebCore::RenderListMarker::getRelativeMarkerRect): Ditto.
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2010-01-18  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix misspelling of the word maximum in comment.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::maximum):
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        <rdar://problem/7476957> REGRESSION (r49567): Business widget list does not line up: too tall due to line height rounding change
+
+        Reverted r49567.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific implementation of JavaString to a private implementation class.
+        https://bugs.webkit.org/show_bug.cgi?id=33558
+
+        Also modifies JavaField::name and JavaMethod::name to return const JavaString&, rather than UString::Rep*,
+        which is JSC-specific. This allows this code to be used with both JSC and V8, as required by Android.
+
+        No new tests, refactoring only.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added JavaStringJSC.h
+        * bridge/jni/jni_class.cpp: Modified.
+        (JavaClass::JavaClass): Modified. Updates call sites of JavaField::name and JavaMethod::name.
+        * bridge/jni/jni_runtime.h: Modified.
+        (JSC::Bindings::JavaString::JavaString): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::UTF8String): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::uchars): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::length): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::operator UString): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaField::name): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaMethod::name): Modified. Pass through to implementation.
+        * bridge/jni/jsc/JavaStringJSC.h: Added.
+        (JSC::Bindings::JavaStringImpl::~JavaStringImpl):
+        (JSC::Bindings::JavaStringImpl::init):
+        (JSC::Bindings::JavaStringImpl::UTF8String):
+        (JSC::Bindings::JavaStringImpl::uchars):
+        (JSC::Bindings::JavaStringImpl::length):
+        (JSC::Bindings::JavaStringImpl::uString):
+
+2010-01-18  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Skip an error after invalid blocks in a CSS expression.
+        https://bugs.webkit.org/show_bug.cgi?id=33650
+
+        * css/CSSGrammar.y:
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler & Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
+
+        These break the OS X Leaks tool.  Move the management of null-terminated copies
+        out from StringImpl to String, and use a bit stolen from the refCount to hold the
+        'InTable' flag.
+
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::copyWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+
+2010-01-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Rewrite SVG <use> support in a modern-fashion
+        https://bugs.webkit.org/show_bug.cgi?id=33776
+
+        Tests: svg/custom/relative-sized-deep-shadow-tree-content.xhtml
+               svg/custom/relative-sized-shadow-tree-content.xhtml
+
+        Fixes: svg/W3C-SVG-1.1/animate-elem-30-t.svg (animated circle sometimes takes wrong path)
+
+        Rewrite <use> support in less intrusive way. Try hard to avoid recloning where possible, and do it lazily.
+        Introduce RenderSVGShadowTreeRootContainer as special renderer for SVGUseElement, that now manages the
+        render tree, instead of SVGUseElement manually hacking around it's own renderer from the DOM side.
+
+        Instead of recloning the whole shadow tree for every attribute change (DOM setAttribute / SVG DOM changes / CSS changes / childrenChanged()...)
+        just notify the RenderSVGShadowTreeRootContainer that it's supposed to reclone the tree upon the next updateFromElement() call.
+
+        updateFromElement() is fired from SVGUseElement::attach() / recalcStyle(), as it's done for HTMLFormControlElement/HTMLMediaElement, thus
+        lazily recloning the shadow tree if necessary.
+
+        Animations for <use> elements was a real performance bottlenck as the tree got recloned on every attribute change. Reclones are _completly_
+        avoided for animations now - the SVGAnim*Element classes already updated the instances of an element manually, though that resulted in a reclone
+        nontheless, and thus killing performance. <use> elements can only be recloned through mutations of the elements that they reference to.
+        For example referencing a <rect> element from a <use> element and scripting the <rect> element (setAttribute, or child tree mutations etc.).
+        We reclone instead of trying to synchronize trees - as it's currenty implemented - because it's very hard to do it right.
+
+        Any DOM / SVG DOM / CSS change on the <use> element don't reclone the tree anymore, this is a huge speed benefit.
+        x/y attribute changes are correctly handled in the render tree now (by an additional local transformation), now percentual values work
+        as expected, and resize on window changes - affecting lots of testcases.
+
+        The <use> implementation is much safer now, not doing any mutations synchronously from svgAttributeChanged etc.
+        Remove hack to force garbage collection on SVGElementInstance destruction - can't reproduce it anymore.
+
+        * Android.mk: Add new files to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/RenderSVGShadowTreeRootContainer.cpp: Added. This is the rendered now created by SVGUseElement.
+        (WebCore::RenderSVGShadowTreeRootContainer::RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::updateStyle): Used form SVGUseElement to request style recalculations for the shadow tree renderers
+        (WebCore::RenderSVGShadowTreeRootContainer::updateFromElement): Used from SVGUseElement attach/recalcStyle to eventually request shadow tree updates.
+        (WebCore::RenderSVGShadowTreeRootContainer::styleDidChange): Used to propage style updates across shadow tree boundaries.
+        * rendering/RenderSVGShadowTreeRootContainer.h: Added.
+        (WebCore::RenderSVGShadowTreeRootContainer::markShadowTreeForRecreation): Marks the shadow tree for a reclone, next time updateFromElement is used.
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform): Take containerTranslation() into account, supplied by RenderSVGSDhadowTreeContainer.
+        * rendering/SVGShadowTreeElements.cpp: Added. This is the root element of the SVG shadow tree residing as (hidden) child of SVGUseElement (DOM wise).
+        (WebCore::SVGShadowTreeContainerElement::SVGShadowTreeContainerElement):
+        (WebCore::SVGShadowTreeContainerElement::~SVGShadowTreeContainerElement):
+        (WebCore::SVGShadowTreeContainerElement::containerTranslation): Used from calculateLocalTransform() to take x/y translation into account for shadow tree container elements.
+        (WebCore::SVGShadowTreeRootElement::SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::~SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::attachElement): Used by RenderSVGShadowTreeRootContainer, instead of attach(), as we're a shadow tree root node.
+        * rendering/SVGShadowTreeElements.h: Added. This is the root element of each SVG shadow sub-tree (whenever a <use> element is expanded in the shadow tree).
+        (WebCore::SVGShadowTreeContainerElement::isShadowTreeContainerElement): Return true here.
+        (WebCore::SVGShadowTreeContainerElement::setContainerOffset): Used from SVGUseElement to propagate x/y translation values set on <use> elements in the shadow tree.
+        (WebCore::SVGShadowTreeRootElement::isShadowNode): Identify us as shadow node.
+        (WebCore::SVGShadowTreeRootElement::shadowParentNode): Ditto. Return actual shadow parent node (== corresponding use element).
+        * svg/SVGElement.cpp: Shrink size of all SVG*Elements, by removing the m_shadowParent parent. SVGShadowTreeRootElement is the new base class for shadow tree.
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::eventParentNode): Call virtual shadowParentNode() method, instead of accessing m_shadowParent.
+        * svg/SVGElement.h: Remove isShadowNode() / shadowParentNode() / setShadowParentNode().
+        * svg/SVGElementInstance.cpp: Remove the hack, calling garbage collection before destruction. Can't reproduce this anymore, let's see what the bots say.
+        (WebCore::SVGElementInstance::SVGElementInstance): Remove now unnecessary m_needsUpdate flag.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement): Don't invalidate if instance updates are blocked (see SVGStyledElement changes)
+        * svg/SVGElementInstance.h: Remove m_needsUpdate, and forgetWrapper() method.
+        * svg/SVGGElement.h:
+        (WebCore::SVGGElement::isShadowTreeContainerElement): Add new virtual method here returning false by default, SVGShadowTreeContainerElement will override it.
+        * svg/SVGStyledElement.cpp: Remove gElementsWithInstanceUpdatesBlocked HashSet tracking the state of instancesUpdatesBlocked() per SVGStyledElement - make it a member variable.
+        * svg/SVGStyledElement.h: Add inline getter/setters around m_instanceUpdatesBlocked.
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        * svg/SVGUseElement.cpp: Full rewrite of <use> support, a detailed discussion would blow the ChangeLog - see short version above.
+        (WebCore::SVGUseElement::SVGUseElement):
+        (WebCore::SVGUseElement::instanceRoot):
+        (WebCore::SVGUseElement::insertedIntoDocument):
+        (WebCore::SVGUseElement::removedFromDocument):
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::updateContainerOffset):
+        (WebCore::SVGUseElement::updateContainerOffsets):
+        (WebCore::SVGUseElement::recalcStyle):
+        (WebCore::dumpInstanceTree):
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::createRenderer):
+        (WebCore::updateFromElementCallback):
+        (WebCore::SVGUseElement::attach):
+        (WebCore::SVGUseElement::detach):
+        (WebCore::SVGUseElement::toClipPath):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+        (WebCore::SVGUseElement::buildShadowTree):
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
+        (WebCore::SVGUseElement::instanceForShadowTreeElement):
+        (WebCore::SVGUseElement::invalidateShadowTree):
+        (WebCore::SVGUseElement::transferUseAttributesToReplacedElement):
+        * svg/SVGUseElement.h:
+        (WebCore::SVGUseElement::isPendingResource):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForMonth() and
+        toString() for the Month type, and HTMLInputElement::setValueAsDate()
+        calls them.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::beforeGregorianStartDate):
+        (WebCore::ISODateTime::addDay): Use beforeGregorianStartDate().
+        (WebCore::ISODateTime::parseMonth): Use beforeGregorianStartDate().
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateInternal):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForMonth):
+        (WebCore::ISODateTime::toString): Implement only for the Month type.
+        * html/ISODateTime.h:
+
+2010-01-18  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Script attributes are copied and pasted, making cross-domain attacks possible (30019)
+        <rdar://problem/6008809>
+        https://bugs.webkit.org/show_bug.cgi?id=30019
+
+        When we create the document fragment from a markup string,
+        either to perform a paste operation or a drag and drop, we
+        want to remove all the event handlers and any attribute that contain
+        a value that leads to code execution.
+        The HTMLParser class is now aware of the needs of stripping these attributes.
+        I've modified the call to createMarkupString for every platform.
+
+        Test: editing/pasteboard/paste-noscript.html
+
+        * WebCore.base.exp:
+        * dom/Element.cpp:
+        (WebCore::isEventHandlerAttribute):
+        (WebCore::Element::setAttributeMap):
+        * dom/Element.h:
+        * dom/MappedAttributeEntry.h:
+        (WebCore::):
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup):
+        * editing/markup.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment):
+        * html/HTMLElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::parseToken):
+        * html/HTMLParser.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::parseHTMLDocumentFragment):
+        * html/HTMLTokenizer.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::fragmentFromCF_HTML):
+        (WebCore::fragmentFromHTML):
+
+2010-01-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=33816>        
+        Crashes in Geolocation code due to refcounting, observer balance issues.
+        
+        Hold a ref to the GeoNotifier while dispatching a callback. The code was
+        copying a data member to avoid accessing a freed this ptr, but was still
+        using the this ptr.
+        
+        Geolocation::removeObserver calls are not always balanced with addObserver.
+        Instead of asserting and continuing, don't try to remove non-existant
+        observers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::timerFired): Protect notifier.
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::removeObserver): Change ASSERT into an if with early return.
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33815
+        Crash when using DOMTimer from a detached frame
+
+        Test: fast/dom/Window/timer-null-script-execution-context.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Make setTimer and setInterval raise an exception. It is not specified in HTML5, but both
+        IE and Firefox do raise an exception in this situation, although different ones.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout): Raise INVALID_ACCESS_ERR if script execution context is
+        null (meaning that the window is detached).
+        (WebCore::DOMWindow::setInterval): Ditto.
+        (WebCore::DOMWindow::clearTimeout): Silently return early if there is no script execution
+        context.
+        (WebCore::DOMWindow::clearInterval): Ditto.
+        Raise INVALID_ACCESS_ERR if script execution context is null (meaning .
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific version of JavaClass from bridge/jni/jni_class to bridge/jni/jsc/JavaClassJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33561
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed jni_class.cpp and added JavaClassJSC.cpp
+        * GNUmakefile.am: Modified. Removed jni_class.h and added JavaClassJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed jni_class.[cpp|h] and added JavaClassJSC.[cpp|h]
+        * bridge/jni/jni_class.cpp: Removed.
+        * bridge/jni/jni_class.h: Removed.
+        * bridge/jni/jsc/JavaClassJSC.cpp: Copied from WebCore/bridge/jni/jni_class.cpp.
+        * bridge/jni/jsc/JavaClassJSC.h: Copied from WebCore/bridge/jni/jni_class.h.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Includes JavaClassJSC.h
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fix style in WebCore/bridge/jni/jsc/JavaInstanceJSC.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33792
+
+        No new tests, style fixes only.
+
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaField::dispatchValueFromInstance): Modified. Updated to use renamed JavaInstance::m_instance
+        (JavaField::dispatchSetValueToInstance): Modified. Updated to use renamed JavaInstance::m_instance
+        (JavaArray::JavaArray): Modified. Updated to use renamed JavaInstance::m_instance
+        * bridge/jni/jni_runtime.h: Modified.
+        (JSC::Bindings::JavaArray::javaArray): Modified. Updated to use renamed JavaInstance::m_instance
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Fixed style
+        * bridge/jni/jsc/JavaInstanceJSC.h: Modified. Fixed style
+
+2010-01-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30073
+        Moved reshape to HTMLCanvasElement::reset and have it always
+        set the size to the canvas width and height attrs.
+
+        This is not testable with LayoutTests, so I instead added logic
+        to the demo at:
+
+        https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/demos/webkit/SpinningBox.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33813
+        <rdar://problem/7545104> Crash when using DOMApplicationCache from a destroyed frame
+
+        Test: http/tests/appcache/destroyed-frame.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::scriptExecutionContext): Return null when there is no frame.
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r53420): incomplete repaint of bottom of bugs.webkit.org comment field
+        https://bugs.webkit.org/show_bug.cgi?id=33809
+
+        Test: fast/repaint/trailing-floats-root-line-box-overflow.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Copy bottom overflow from the last
+        root box to the trailing floats box, which is becoming the last root box. This is
+        needed because painting code assumes that the last line in a block is the one with the
+        lowest overflow bottom.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed trivial buildfix. (r53429)
+
+        * WebCore.pri: missing XMLNS_NAMES added.
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed unnecessary use of scriptExecutionContext() when creating a JS event listener.
+        https://bugs.webkit.org/show_bug.cgi?id=33811
+
+        This change simplifies a bunch of code, and also reduces
+        the number of places that use the difficult-to-understand and possibly
+        crashy-null scriptExecutionContext() idiom.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSEventListener.h:
+        (WebCore::createJSAttributeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33787
+        Add constants for more XML strings
+
+        No change in functionality, so no tests.
+
+        * WebCore/xml/xmlnsattrs.in: Added a new file for xmlns namespace and attribute - 
+        XMLNames.{h,cpp} are auto-generated, and I dodn't see a reasonable way to extend it.
+
+        * platform/text/AtomicString.cpp: (WebCore::AtomicString::init):
+        * platform/text/AtomicString.h:
+        Added atomic strings for "xml" and "xmlns".
+
+        * page/Frame.cpp: (WebCore::Frame::Frame): Call XMLNSNames::init().
+
+        * dom/Attr.cpp: (WebCore::Attr::setPrefix):
+        * dom/Document.cpp:
+        (WebCore::Document::hasPrefixNamespaceMismatch):
+        (WebCore::Document::createAttributeNS):
+        * dom/Node.cpp:
+        (WebCore::Node::checkSetPrefix):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::Node::lookupNamespacePrefix):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::handleElementNamespaces):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::nodeMatchesBasicTest):
+        (WebCore::XPath::Step::nodesInAxis):
+        Use the new constants.
+
+        * Android.derived.mk:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added the new files to projects.
+
+2010-01-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix !ENABLE(3D_CANVAS) build.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::is3DCanvas):
+
+2010-01-18  Timothy Hatcher  <timothy@apple.com>
+
+        Adjust the scroll position when doing a full page zoom, so the content
+        stays in relatively the same position.
+
+        <rdar://problem/6150099> Zooming should keep the page content in the same place
+
+        Reviewed by Oliver Hunt.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setZoomFactor): Apply the zoom percent difference to
+        the scroll position, only when doing a full page zoom.
+
+2010-01-18  Adam Roben  <aroben@apple.com>
+
+        Add SecurityOrigin::{set,is}DomainRelaxationForbiddenForURLScheme and
+        respect it
+
+        WebCore part of fixing <http://webkit.org/b/33806>
+        <rdar://problem/7552837> Would like API to disallow setting of
+        document.domain for pages with certain URL schemes
+
+        Test: http/tests/security/setDomainRelaxationForbiddenForURLScheme.html
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.base.exp: Export
+        SecurityOrigin::setDomainRelaxationForbiddenForURLScheme.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain): If domain relaxation is forbidden for
+        our security origin's scheme, throw an exception and don't allow
+        the domain to be set.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemesForbiddenFromDomainRelaxation): Added. Returns a
+        global set of schemes.
+        (WebCore::SecurityOrigin::setDomainRelaxationForbiddenForURLScheme):
+        Add or remove the scheme to schemesForbiddenFromDomainRelaxation, as
+        appropriate.
+        (WebCore::SecurityOrigin::isDomainRelaxationForbiddenForURLScheme):
+        Returns true if the scheme is in schemesForbiddenFromDomainRelaxation.
+
+        * page/SecurityOrigin.h: Added
+        {set,is}DomainRelaxationForbiddenForURLScheme.
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Address review comments on the last change
+
+        * rendering/TrailingFloatsRootInlineBox.h:
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox):
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6892207> REGRESSION (Safari 4): Menus at sciencedirect.com push the main article context down the page
+        <rdar://problem/7546035> Second right floated image misplacment
+        https://bugs.webkit.org/show_bug.cgi?id=33245
+
+        Test: fast/dynamic/float-in-trailing-whitespace-after-last-line-break-2.html
+
+        When the last line of a block contains a line break and there are floats
+        after the line break, it is incorrect to put those floats in the last line’s
+        floats vector (along with floats from before the break). Instead, create
+        an additional line box (a TrailingFloatsRootInlineBox) and put those floats
+        in its floats vector. 
+
+        * WebCore.vcproj/WebCore.vcproj: Added TrailingFloatsRootInlineBox.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markLinesDirtyInVerticalRange): Added an optional
+        parameter, which is the highest line to dirty.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Create a TrailingFloatsRootInlineBox
+        for the floats occurring after the line break on the last line.
+        (WebCore::RenderBlock::determineStartPosition): Prevent dirtying of lines
+        above the first dirty line.
+        * rendering/TrailingFloatsRootInlineBox.h: Added.
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox): Call
+        setHasVirtualHeight().
+        (WebCore::TrailingFloatsRootInlineBox::virtualHeight): Return 0.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Eeeep! reverting r53416 & r53417, more to be done to fix windows.
+
+        * WebCore.base.exp:
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::charactersWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::operator delete):
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::createGlobalData):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::createGlobalData):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
+
+        These break the OS X Leaks tool.  Move the management of null-terminated copies
+        out from StringImpl to String, and use a bit stolen from the refCount to hold the
+        'InTable' flag.
+
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::copyWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+
+2010-01-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Made root compositing layer scroll rather than scroll parent.
+        https://bugs.webkit.org/show_bug.cgi?id=32279
+        
+        There's some general cleanup here so the frames, bounds and
+        positions of all the associated layers are correct.
+        I also changed API of setScrollFrame to use an IntRect.
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        (WebCore::WKCACFLayerRenderer::resize):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+
+2010-01-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Timeline panel scrolling speed can be 2 times faster.
+        https://bugs.webkit.org/show_bug.cgi?id=33794
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.calculateWindow):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific version of JavaInstance from bridge/jni/jni_instance to bridge/jni/jsc/JavaInstanceJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33672
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed jni_instance.cpp and added JavaInstanceJSC.cpp
+        * GNUmakefile.am: Modified. Removed jni_instance.h and added JavaInstanceJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed jni_instance.[cpp|h] and added JavaInstanceJSC.[cpp|h]
+        * bindings/js/ScriptControllerMac.mm: Modified. Includes JavaInstanceJSC.h
+        * bridge/jni/jni_instance.cpp: Removed.
+        * bridge/jni/jni_instance.h: Removed.
+        * bridge/jni/jni_runtime.h: Modified. Includes JavaInstanceJSC.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Copied from WebCore/bridge/jni/jni_instance.cpp.
+        * bridge/jni/jsc/JavaInstanceJSC.h: Copied from WebCore/bridge/jni/jni_instance.h.
+
+2010-01-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Simplify image decoders slightly by using OwnPtr instead of raw pointers
+        and eliminating a basically-useless wrapper class in the GIF decoder.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::~ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::~GIFImageDecoder):
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::decodingHalted):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::gifComplete):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::JPEGImageDecoder):
+        (WebCore::JPEGImageDecoder::~JPEGImageDecoder):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::PNGImageDecoder):
+        (WebCore::PNGImageDecoder::~PNGImageDecoder):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+
+2010-01-18  Daniel Cheng  <dcheng@google.com>
+
+        Reviewed by Adam Roben.
+
+        DataTransfer interface broken on Windows--types member is always
+        undefined, and getData() does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=30527
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat): pass FORMATETC as a const ref.
+        (WebCore::ClipboardWin::types): fix calls to IEnumFORMATETC.
+        (WebCore::ClipboardWin::hasData): fix calls to IEnumFORMATETC.
+
+2010-01-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Don't show Profiles welcome screen on panel switch,
+        if a profile view is shown.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33799
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for enabling navigator.geolocation at runtime in the V8 bindings.
+        Adds the [EnabledAtRuntime] modifier to the navigator IDL.
+        https://bugs.webkit.org/show_bug.cgi?id=33467
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setGeolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::geolocationEnabled):
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Added.
+        (WebCore::V8Navigator::GeolocationEnabled):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::geolocation):
+        * page/Navigator.idl:
+
+2010-01-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Improve Resources panel performance for lots of resources
+
+        DOM properties are extracted into const's, comparisons are faster.
+        https://bugs.webkit.org/show_bug.cgi?id=33790
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.CompareByStartTime):
+        (WebInspector.Resource.CompareByResponseReceivedTime):
+        (WebInspector.Resource.CompareByEndTime):
+        (WebInspector.Resource.CompareByDuration):
+        (WebInspector.Resource.CompareByLatency):
+        (WebInspector.Resource.CompareBySize):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions):
+
+2010-01-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33726
+
+        Following up on changes made with respect to bug #33498, we should
+        fix the the style errors found by the style bot.
+        
+        Moreover, this fixes all the style errors found by check-webkit-style
+        except the use of an underline in the variable name _niflags. We should
+        fix this in a second run through for all the other variables names that
+        contain an underline because there are many.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::create):
+        (WebCore::SVGRenderStyle::copy):
+        (WebCore::SVGRenderStyle::operator!=):
+        (WebCore::SVGRenderStyle::hasStroke):
+        (WebCore::SVGRenderStyle::hasFill):
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::InheritedFlags::operator!=):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::operator!=):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::):
+        (WebCore::SVGRenderStyle::):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+
+2010-01-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] DOMWrapperMap::Visitor needs virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=33675
+
+        Add protected virtual dtor to DOMWrapperMap::Visitor. See bug for further discussion.
+
+        No new tests needed, functionality not changed.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMWrapperMap::Visitor::~Visitor): Added.
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        If we don't link with def files, then we have to pass EXPORTUNFROZEN,
+        so that the build system still creates the .dso files in
+        release/armv5/lib and we can actually link against the created QtWebKit
+        dlls.
+
+        Thanks Iain for the help!
+
+        * WebCore.pro:
+
+2010-01-17  Srinidhi Shreedhara  <srinidhi.shreedhara@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] [Symbian] SetWindow call in npapi plugin does not happen when the cooridnates are negative
+        https://bugs.webkit.org/show_bug.cgi?id=33573
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Remove tests for negative
+        coordinates for early return.
+
+2010-01-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r52449): SVG mask wrongly clipped when not at origin for recent nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=33782
+
+        Test: svg/custom/transformedMaskFails.svg
+
+        When computing the bounds for elements in a mask, we iterate through
+        all of our children requesting their repaint bounds using
+        repaintRectInLocalCoordinates(), but we were not converting that
+        rect into our own coordinate system, thus leading to an incorrect
+        repaint rect.  This patch simply adds the missing localToParent
+        transform.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2010-01-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid slow access to AX objects on attribute access when AX is off
+        https://bugs.webkit.org/show_bug.cgi?id=33779
+
+        ~4% Dromaeo attributes test speedup
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged): Don't do expensive lookup of
+        AX object cache unless accessibility is on and an AX-related attribute is
+        changed.
+
+2010-01-17  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] On Win and GTK, we need to manually apply the transforms when falling back
+        to GDI / GDK drawing, but this is not needed on Mac since we always use CG there.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33730
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+
+2010-01-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GtkWebKit incompatible with rgba colormaps
+        https://bugs.webkit.org/show_bug.cgi?id=20736
+
+        Fix GTK theme rendering onto drawables with RGBA colormaps. Now
+        each type of colormap has its own collection of GtkWidgets.
+
+        This fix does not introduce any functionality changes, so does not
+        includes new tests.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::partsForDrawable):
+        (WebCore::adjustMozillaStyle):
+        (WebCore::setMozillaState):
+        (WebCore::paintMozillaGtkWidget):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::setCheckboxSize):
+        (WebCore::RenderThemeGtk::paintCheckbox):
+        (WebCore::RenderThemeGtk::setRadioSize):
+        (WebCore::RenderThemeGtk::paintRadio):
+        (WebCore::RenderThemeGtk::paintButton):
+        (WebCore::RenderThemeGtk::adjustMenuListStyle):
+        (WebCore::RenderThemeGtk::paintMenuList):
+        (WebCore::RenderThemeGtk::adjustTextFieldStyle):
+        (WebCore::RenderThemeGtk::paintTextField):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_use_theme_parts):
+        (ensure_window_widget):
+        (setup_widget_prototype):
+        (ensure_button_widget):
+        (ensure_hpaned_widget):
+        (ensure_vpaned_widget):
+        (ensure_toggle_button_widget):
+        (ensure_button_arrow_widget):
+        (ensure_checkbox_widget):
+        (ensure_radiobutton_widget):
+        (ensure_scrollbar_widget):
+        (ensure_spin_widget):
+        (ensure_scale_widget):
+        (ensure_entry_widget):
+        (moz_gtk_get_combo_box_inner_button):
+        (moz_gtk_get_combo_box_button_inner_widgets):
+        (ensure_combo_box_widgets):
+        (moz_gtk_get_combo_box_entry_inner_widgets):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_combo_box_entry_widgets):
+        (ensure_handlebox_widget):
+        (ensure_toolbar_widget):
+        (ensure_toolbar_separator_widget):
+        (ensure_tooltip_widget):
+        (ensure_tab_widget):
+        (ensure_progress_widget):
+        (ensure_statusbar_widget):
+        (ensure_frame_widget):
+        (ensure_menu_bar_widget):
+        (ensure_menu_bar_item_widget):
+        (ensure_menu_popup_widget):
+        (ensure_menu_item_widget):
+        (ensure_image_menu_item_widget):
+        (ensure_menu_separator_widget):
+        (ensure_check_menu_item_widget):
+        (ensure_tree_view_widget):
+        (ensure_tree_header_cell_widget):
+        (ensure_expander_widget):
+        (ensure_scrolled_window_widget):
+        (moz_gtk_checkbox_get_metrics):
+        (moz_gtk_radio_get_metrics):
+        (moz_gtk_splitter_get_metrics):
+        (moz_gtk_toggle_paint):
+        (moz_gtk_scrollbar_button_paint):
+        (moz_gtk_scrollbar_trough_paint):
+        (moz_gtk_scrollbar_thumb_paint):
+        (moz_gtk_spin_paint):
+        (moz_gtk_spin_updown_paint):
+        (moz_gtk_scale_paint):
+        (moz_gtk_scale_thumb_paint):
+        (moz_gtk_gripper_paint):
+        (moz_gtk_hpaned_paint):
+        (moz_gtk_vpaned_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_treeview_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_tree_header_sort_arrow_paint):
+        (moz_gtk_treeview_expander_paint):
+        (moz_gtk_expander_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_downarrow_paint):
+        (moz_gtk_combo_box_entry_button_paint):
+        (moz_gtk_container_paint):
+        (moz_gtk_toggle_label_paint):
+        (moz_gtk_toolbar_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_tooltip_paint):
+        (moz_gtk_resizer_paint):
+        (moz_gtk_frame_paint):
+        (moz_gtk_progressbar_paint):
+        (moz_gtk_progress_chunk_paint):
+        (moz_gtk_get_tab_thickness):
+        (moz_gtk_tab_paint):
+        (moz_gtk_tabpanels_paint):
+        (moz_gtk_tab_scroll_arrow_paint):
+        (moz_gtk_menu_bar_paint):
+        (moz_gtk_menu_popup_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_menu_item_paint):
+        (moz_gtk_menu_arrow_paint):
+        (moz_gtk_check_menu_item_paint):
+        (moz_gtk_window_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_combo_box_entry_button_size):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_downarrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_expander_size):
+        (moz_gtk_get_treeview_expander_size):
+        (moz_gtk_get_menu_separator_height):
+        (moz_gtk_get_scalethumb_metrics):
+        (moz_gtk_get_scrollbar_metrics):
+        (moz_gtk_images_in_menus):
+        (moz_gtk_widget_paint):
+        (moz_gtk_get_scrollbar_widget):
+        (moz_gtk_shutdown):
+        (moz_gtk_destroy_theme_parts_widgets):
+        * platform/gtk/gtkdrawing.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        Added a new cache for JSString values that are created from Strings or AtomicStrings
+        in the DOM. It's common for the same string to be retrieved from the DOM repeatedly,
+        and it is wasteful to make a new JS-level string value every time.
+        
+        The string cache is per-world, and thus thread-safe and not a
+        vector for accidental information exchange.
+        
+        ~30% speedup on Dromaeo Attributes test, also substantially helps other Dromaeo DOM tests.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringCache): Helper function to get the string cache for the current world.
+        (WebCore::jsString): Some new overloads including the caching version.
+        (WebCore::stringWrapperDestroyed): Finalizer callback - remove from relevant caches.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::jsString): Prototype new overloads (and define a few inline).
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::type): Explicitly make a UString.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Ditto.
+        * WebCore.base.exp: Add new JSString overloads that WebCore gets to see.
+
+2010-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Markers are getting culled incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=33767
+
+        Use applyTransformToPaintInfo to transform the paintInfo, otherwise
+        the paint rect is not updated leading to incorrect culling.
+
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+
+2010-01-15  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=33751 and <rdar://problem/7538330>
+        Zip code field is misidentified as street address because id attribute isn't checked.
+
+        Reviewed by Darin Adler
+
+        No new tests. I believe this code is used only by Safari AutoFill, but in any case
+        it does not affect page rendering or anything else at the WebCore/WebKit level.
+
+        * page/Frame.cpp:
+        (WebCore::matchLabelsAgainstString):
+        New function, split out from matchLabelsAgainstElement.
+        (WebCore::Frame::matchLabelsAgainstElement):
+        Now calls matchLabelsAgainstString for the id attribute if no match is found for the name attribute.
+        
+        * page/mac/FrameMac.mm:
+        (WebCore::matchLabelsAgainstString):
+        Same as above. This is a parallel copy of the function using Mac-specific data structures.
+        (WebCore::Frame::matchLabelsAgainstElement):
+        Ditto.
+
+2010-01-16  Timothy Hatcher  <timothy@apple.com>
+
+        Use String.trim() instead of a regex in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33765
+
+        Reviewed by George Staikos.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch): Use .trim().
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression): Ditto.
+        * inspector/front-end/ProfileView.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame): Ditto.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype): Ditto.
+        * inspector/front-end/utilities.js:
+        (String.prototype.trimLeadingWhitespace): Removed.
+        (String.prototype.trimTrailingWhitespace): Removed.
+        (String.prototype.trimWhitespace): Removed.
+
+2010-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Copying TransformationMatrix consumed a lot of cpu time while scroll with cursor over content
+        https://bugs.webkit.org/show_bug.cgi?id=33766
+
+        Make localToParentTransform return by reference to avid copy overhead.
+        This is a little gnarly in places as it means we need to be able to 
+        return temporary values in a few implementations, so we have to add
+        class fields to hold them, heppily the classes that these effect are
+         sufficiently uncommon for this to be okay.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localTransform):
+        (WebCore::RenderObject::localToParentTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/RenderSVGViewportContainer.h:
+
+2010-01-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt and Alexey Proskuryakov.
+
+        ValidityState can hold a stale pointer to control
+        https://bugs.webkit.org/show_bug.cgi?id=33729
+        rdar://problem/7545114
+
+        Test: fast/forms/ValidityState-removed-control.html
+
+        * html/HTMLFormControlElement.h: Use OwnPtr instead of
+        RefPtr to point to the ValidityState object.
+
+        * html/ValidityState.cpp: Use a constant instead of a
+        macro for the email validation regular expression.
+        (WebCore::ValidityState::validationMessage): Use
+        m_control instead of control function; we don't need
+        a function for this. Also marked const.
+        (WebCore::ValidityState::typeMismatch): Ditto.
+        Fixed some minor style problems.
+        (WebCore::ValidityState::rangeUnderflow): Ditto.
+        (WebCore::ValidityState::rangeOverflow): Ditto.
+        (WebCore::ValidityState::stepMismatch): Ditto.
+        (WebCore::ValidityState::valid): Ditto.
+        (WebCore::ValidityState::isValidEmailAddress):
+        Changed local variable names for clarity. Got rid of
+        an unneeded global variable.
+
+        * html/ValidityState.h: Removed RefCounted as a base
+        class, deriving from Noncopyable instead. Changed
+        creation to use PassOwnPtr instead of PassRefPtr.
+        Eliminated unneeded control function. Added ref and
+        deref functions that forward the reference counting
+        to the control. Moved constructor here and made it
+        inline.
+
+2010-01-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33752
+        Assertion failure when getting a href attribute with prefix
+
+        This was due to a temporary change made in 2005 (r9639) - checks in checkSetPrefix were
+        disabled during introduction of QualifiedName, but never re-enabled.
+
+        Tests: fast/dom/bad-href-attribute.html
+               fast/dom/node-prefix-setter-namespace-exception.html
+
+        * dom/Attr.cpp: (WebCore::Attr::setPrefix):
+        * dom/Element.cpp: (WebCore::Element::setPrefix):
+        * dom/Node.cpp: (WebCore::Node::checkSetPrefix):
+        Re-enabled the checks. Also, changed the prefix setter to treat "" as null, matching Firefox
+        (DOM 3 Core spec says this behavior is implementation defined).
+
+2010-01-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7536748> and https://bugs.webkit.org/show_bug.cgi?id=33571
+        History traversals to a new document do not get the popstate event
+
+        State objects now live-on in their HistoryItem indefinitely.
+        This means any back/forward navigation might result in a popstate event, not just to 
+        pre-existing documents as was previously the case.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached): State objects are held beyond Document lifetime.
+       
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin): If there is a pending state object for this Frame load, pass it
+          on to the Document after the Document is created.
+        (WebCore::FrameLoader::transitionToCommitted): If the current history item has a state object,
+          set it as the FrameLoad's pending state object.
+        * loader/FrameLoader.h:
+        
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Remove a now-invalid ASSERT.
+
+2010-01-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein and Adele Peterson.
+
+        Support reflections on composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=31885
+        
+        Implement reflections (via -webkit-box-reflect:) on compositing layers.
+        
+        We add to the GraphicsLayer the notion of having a replica, and being a replicated layer.
+        The replica layer is not parented in the tree, but referenced by another layer.
+        RenderLayerBacking sets this up when it finds RenderLayers for reflections.
+        
+        GraphicsLayerCA implements rendering of replica layers by cloning CA layers,
+        and copying their properties, including animations and contents. Deep reflections
+        are supported by a hash of clone layers on each GraphicsLayerCA, indexed by
+        the path down the tree to each replica instance.
+        
+        When GraphicsLayerCA properties are changed, in most cases the clones must also
+        be updated.
+
+        Tests: compositing/masks/direct-image-mask.html
+               compositing/reflections/animation-inside-reflection.html
+               compositing/reflections/compositing-change-inside-reflection.html
+               compositing/reflections/deeply-nested-reflections.html
+               compositing/reflections/masked-reflection-on-composited.html
+               compositing/reflections/nested-reflection-anchor-point.html
+               compositing/reflections/nested-reflection-animated.html
+               compositing/reflections/nested-reflection-mask-change.html
+               compositing/reflections/nested-reflection-on-overflow.html
+               compositing/reflections/nested-reflection-opacity.html
+               compositing/reflections/nested-reflection-size-change.html
+               compositing/reflections/nested-reflection-transformed.html
+               compositing/reflections/nested-reflection-transition.html
+               compositing/reflections/nested-reflection.html
+               compositing/reflections/reflection-opacity.html
+               compositing/reflections/reflection-ordering.html
+               compositing/reflections/reflection-positioning.html
+               compositing/reflections/transform-inside-reflection.html
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::isReplicated): Returns true when this layer has a replicated layer.
+        (WebCore::GraphicsLayer::replicatedLayerPosition):
+        (WebCore::GraphicsLayer::setReplicatedLayerPosition): The position of the replica layer must be 
+        special-cased; we cannot just copy the position of the original.
+        (WebCore::GraphicsLayer::didDisplay): Method that indicates that the contents of the layer changed,
+        which gives us a chance to update clone layers.
+        (WebCore::GraphicsLayer::replicaLayer): reference to the replica layer.
+        (WebCore::GraphicsLayer::replicatedLayer): reference to the layer that this (replica) layer is replicating.
+        (WebCore::GraphicsLayer::setReplicatedLayer):
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setReplicatedByLayer): Hook up a replica with its replicated layer.
+        (WebCore::GraphicsLayer::dumpProperties):
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::primaryLayer): Returns a CALayer, since structural layers may not be WebLayers.
+        (WebCore::GraphicsLayerCA::isReplicatedRootClone): Given a cloneID (string representation of the path to a clone
+        down the tree, which is a bitstring of 1 (replica), or 0 (non-replica)), returns true if this ID represents the
+        root of a replica tree.
+        (WebCore::GraphicsLayerCA::primaryLayerClones): Returns a pointer to the hash map of clones of the primary layers.
+
+        (WebCore::GraphicsLayerCA::ReplicaState::ReplicaState): Small struct used to track original/clone branching
+        down the tree during recursion, to build cloneID paths.
+
+        (WebCore::GraphicsLayerCA::hasCloneLayers): returns true if this layer has clone layers.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::~GraphicsLayerCA): remove the clone layers.
+        (WebCore::GraphicsLayerCA::setChildren): call noteSublayersChanged() since we may have to update replicas too.
+        (WebCore::GraphicsLayerCA::addChild): ditto
+        (WebCore::GraphicsLayerCA::addChildAtIndex): ditto
+        (WebCore::GraphicsLayerCA::addChildBelow): ditto
+        (WebCore::GraphicsLayerCA::addChildAbove): ditto
+        (WebCore::GraphicsLayerCA::replaceChild): ditto
+        (WebCore::GraphicsLayerCA::removeFromParent): ditto
+        (WebCore::GraphicsLayerCA::setMaskLayer): call propagateLayerChangeToReplicas()
+        (WebCore::GraphicsLayerCA::setReplicatedLayer): note replica changed.
+        (WebCore::GraphicsLayerCA::setReplicatedByLayer): ditto
+        (WebCore::GraphicsLayerCA::moveOrCopyAllAnimationsForProperty): Enhanced to allow moving or copying animations.
+        (WebCore::GraphicsLayerCA::moveOrCopyAnimationsForProperty): Ditto.
+        (WebCore::GraphicsLayerCA::setContentsToImage): call noteSublayersChanged()
+        (WebCore::GraphicsLayerCA::setContentsToVideo): call noteSublayersChanged()
+        (WebCore::GraphicsLayerCA::didDisplay): here is our chance to copy updated contents to clone layers.
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers): pre-order commit, for things that need to be
+            committed before we recurse on children.
+        (WebCore::GraphicsLayerCA::commitLayerChangesAfterSublayers): post-order commit, for things that need to be
+            committed after we recurse on children, like clones.
+        (WebCore::GraphicsLayerCA::updateLayerNames): New method to match the other 'update' methods.
+        (WebCore::GraphicsLayerCA::updateSublayerList): Insert replica layers into the hierarchy.
+        (WebCore::GraphicsLayerCA::updateLayerPosition): update clones.
+        (WebCore::GraphicsLayerCA::updateLayerSize): ditto
+        (WebCore::GraphicsLayerCA::updateAnchorPoint): ditto
+        (WebCore::GraphicsLayerCA::updateTransform): ditto
+        (WebCore::GraphicsLayerCA::updateChildrenTransform): ditto
+        (WebCore::GraphicsLayerCA::updateMasksToBounds): ditto
+        (WebCore::GraphicsLayerCA::updateContentsOpaque): ditto
+        (WebCore::GraphicsLayerCA::updateBackfaceVisibility): ditto
+        (WebCore::GraphicsLayerCA::updateStructuralLayer): call ensureStructuralLayer()
+        (WebCore::moveAnimation): utility to move a CAAnimation from one layer to another.
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer): refactored code which creates enclosing CALayers for reflection
+        flattening, or CATransformLayers for preserve-3d.
+        (WebCore::GraphicsLayerCA::structuralLayerPurpose): indicates why we need a structural layer.
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent): update clones
+        (WebCore::GraphicsLayerCA::updateContentsImage): ditto
+        (WebCore::GraphicsLayerCA::updateContentsRect): ditto
+        (WebCore::GraphicsLayerCA::updateMaskLayer): ditto
+        (WebCore::GraphicsLayerCA::updateReplicatedLayers): This is where we ask for the tree of layers for the replica
+        and its children, and attach them as sublayers.
+        (WebCore::GraphicsLayerCA::ReplicaState::cloneID): Build a bitstring from the array of original/clone values; this
+        string serves to identify clones in the hash map.
+        (WebCore::GraphicsLayerCA::replicatedLayerRoot): Request the tree of clone layers, set its position and transform,
+        and return it.
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer): update clones
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer): ditto
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer): ditto
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D): udpate sublayers.
+        (WebCore::GraphicsLayerCA::suspendAnimations): update clones.
+        (WebCore::GraphicsLayerCA::resumeAnimations): ditto
+        (WebCore::GraphicsLayerCA::animatedLayerClones): return the hash map for clones of the appropriate layer for the given property.
+        (WebCore::GraphicsLayerCA::ensureCloneLayers): create and return clones for the CALayers for this layer.
+        (WebCore::GraphicsLayerCA::removeCloneLayers): clear out the clone layers.
+        (WebCore::GraphicsLayerCA::positionForCloneRootLayer): the root of a clonal subtree needs its position and transform to be special-cased,
+        since it doesn't just copy those properties from the original.
+        (WebCore::GraphicsLayerCA::propagateLayerChangeToReplicas): push the change flags onto the replica.
+        (WebCore::GraphicsLayerCA::fetchCloneLayers): recurse down sublayers, creating clones of the CALayers along the way, and returning
+        the root of the clone tree.
+        (WebCore::copyAnimation): utility to copy an animation from one layer to another. Animations can be shared between layers.
+        (WebCore::GraphicsLayerCA::cloneLayer): utility to clone a CALayer, copying those properties which GraphicsLayerCA makes use of
+        (WebCore::GraphicsLayerCA::setOpacityInternal): push opacity changes to clones.
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer): ditto
+        (WebCore::GraphicsLayerCA::noteSublayersChanged): set the ChildrenChanged flag, and proprate changes to the replica, if any.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer display]): override -display so we know when to update the contents of clone layers
+
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer display]): ditto.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isReflection): New method that returns true if the renderer is a replica.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer): initialize m_isReflection
+        (WebCore::RenderLayer::updateReflectionStyle): call setIsReflection
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Put a name on the reflection layer.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Hook up the GraphicsLayers for the reflection.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Reflection overrides preserve-3d (you have to flatten to reflect).
+        Also hook up updating the reflection layer geometry, and the relica position.
+        
+        (WebCore::RenderLayerBacking::paintIntoLayer): We no longer paint the reflection in software.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Hook reflection layers into the compositing logic.
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering): No longer have to push video into software if it's reflected.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Update the bounds of the reflection layer.
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): ditto
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing): a compositing descendant forces
+        a reflection ancestor to composite now.
+        (WebCore::RenderLayerBacking::containsPaintedContent): Reflection layers don't paint anything.
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage): No need to fall out of direct compositing mode
+        for masks or reflections any more.
+        (WebCore::RenderLayerBacking::paintIntoLayer): No need to paint the reflection manually now.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isReplica):
+        * rendering/RenderReplica.h:
+        (WebCore::RenderReplica::isReplica):
+        New method used to determine if a render is a replica.
+
+2010-01-15  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS2.1 Counters not updated when new elements are inserted in the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=32884
+
+        Test: fast/css/counters/adding-nodes.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::insertAfter):
+        Modified to handle the addition of nodes with children. Needed when formerly 
+        root nodes become descendants of a new node.
+        * rendering/RenderCounter.cpp:
+        (WebCore::makeCounterNode):
+        Changed to handle the case when root counter nodes lose their root 
+        status as a result of a new root counter node creation. 
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        Refactored more code into destroyCounterNodeChildren and renamed the
+        function according to its new action.
+        (WebCore::RenderCounter::destroyCounterNodes):
+        Simplified to share more code with the new destroyCounterNode.
+        (WebCore::RenderCounter::destroyCounterNode):
+        Added to allow for selective counterNode destruction.
+        (WebCore::RenderCounter::rendererSubtreeAttached):
+        Added to refresh counter values in response to DOM changes.
+        For renderers with no attached counters the execution time of this
+        function cannot be discerned in comparison with the time needed to
+        add a node or change the style of a node.
+        (WebCore::updateCounters):
+        Helper function for rendererSubtreeAttached. Updates the counters
+        attached to a Renderer in response to the renderer or its ancestors
+        being attached to the renderer tree.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        Changed to update counter values if needed.
+
+2010-01-15  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Original patch by David Ronis <david.ronis@mcgill.ca>
+
+        Upgrade 1.1.17->1.1.18 fails: GTK_WIDGET_TOPLEVEL' was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=33486
+
+        Deprecated symbols replaced for gtk+ versions over 2.18.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Improve the performance of the early culling check by avoiding save/restore
+        of graphics state in culled case.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r53344.
+        http://trac.webkit.org/changeset/53344
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+
+        Broke the Chromium Mac builder.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.cpp: Removed.
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        (WebCore::V8PopStateEvent::initPopStateEventCallback):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-15  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        history.length does not return number of elements in history list
+        https://bugs.webkit.org/show_bug.cgi?id=24472
+
+        Test: fast/history/history-length.html
+
+        * page/Page.cpp:
+        (WebCore::Page::getHistoryLength):
+
+2010-01-15  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ensure that Document::postTask does not provide the Task with a dangling pointer to destroyed Document
+        https://bugs.webkit.org/show_bug.cgi?id=31633
+
+        Don't see a way to add test for it, we don't have a way to reproduce the issue currently.
+
+        * dom/Document.cpp:
+        (WebCore::DocumentWeakReference::DocumentWeakReference):
+        (WebCore::DocumentWeakReference::document):
+        (WebCore::DocumentWeakReference::clear):
+        (WebCore::Document::Document): Create a weak reference to this Document.
+        (WebCore::Document::~Document): Clear the weak pointer, preventing further execution of tasks.
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask): Check if the documentWeakReference is cleared by Document destructor - in this case do not run the task.
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        (WebCore::DocumentWeakReference::create):
+
+2010-01-15  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Support SerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+        http://crbug.com/30620
+
+        Initial implementation of SerializedScriptValue which is used to
+        to create a serialized representation of JavaScript objects.  This
+        representation is needed for structured clones and worker messages.
+
+        * WebCore.gypi: Added SerializedScriptValue.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Removed conversion to string before using SerializedScriptValue.
+        * bindings/v8/SerializedScriptValue.cpp: Added.
+        (WebCore::):
+        (WebCore::ZigZag::encode):
+        (WebCore::ZigZag::decode):
+        (WebCore::Writer::Writer):
+        (WebCore::Writer::writeUndefined):
+        (WebCore::Writer::writeNull):
+        (WebCore::Writer::writeTrue):
+        (WebCore::Writer::writeFalse):
+        (WebCore::Writer::writeString):
+        (WebCore::Writer::writeInt32):
+        (WebCore::Writer::writeNumber):
+        (WebCore::Writer::endComposite):
+        (WebCore::Writer::data):
+        (WebCore::Writer::doWriteUint32):
+        (WebCore::Writer::append):
+        (WebCore::Writer::ensureSpace):
+        (WebCore::Writer::fillHole):
+        (WebCore::Writer::charAt):
+        (WebCore::Serializer::Serializer):
+        (WebCore::Serializer::serialize):
+        (WebCore::Serializer::StateBase::~StateBase):
+        (WebCore::Serializer::StateBase::nextState):
+        (WebCore::Serializer::StateBase::setNextState):
+        (WebCore::Serializer::StateBase::composite):
+        (WebCore::Serializer::StateBase::StateBase):
+        (WebCore::Serializer::State::composite):
+        (WebCore::Serializer::State::tag):
+        (WebCore::Serializer::State::State):
+        (WebCore::Serializer::StackCleaner::StackCleaner):
+        (WebCore::Serializer::StackCleaner::~StackCleaner):
+        (WebCore::Serializer::ArrayState::ArrayState):
+        (WebCore::Serializer::ArrayState::done):
+        (WebCore::Serializer::ArrayState::advance):
+        (WebCore::Serializer::ObjectState::ObjectState):
+        (WebCore::Serializer::ObjectState::done):
+        (WebCore::Serializer::ObjectState::advance):
+        (WebCore::Serializer::ObjectState::nextProperty):
+        (WebCore::Serializer::doSerialize):
+        (WebCore::Serializer::push):
+        (WebCore::Serializer::top):
+        (WebCore::Serializer::pop):
+        (WebCore::Serializer::checkComposite):
+        (WebCore::Reader::Reader):
+        (WebCore::Reader::isEof):
+        (WebCore::Reader::read):
+        (WebCore::Reader::readTag):
+        (WebCore::Reader::readString):
+        (WebCore::Reader::readInt32):
+        (WebCore::Reader::readNumber):
+        (WebCore::Reader::doReadUint32):
+        (WebCore::Deserializer::Deserializer):
+        (WebCore::Deserializer::deserialize):
+        (WebCore::Deserializer::doDeserialize):
+        (WebCore::Deserializer::push):
+        (WebCore::Deserializer::pop):
+        (WebCore::Deserializer::stackDepth):
+        (WebCore::Deserializer::element):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toWireString):
+
+        Updated uses of SerializedScriptValue:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dirk Schulze.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Add an early return when we go to paint a RenderPath that
+        isn't in the current clip.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+
+2010-01-15  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Make Geolocation::suspend/resume public.
+        https://bugs.webkit.org/show_bug.cgi?id=33679
+
+        These were made private in Bug 32499, but are required by Android to be public.
+
+        No new tests, build fix only.
+
+        * page/Geolocation.cpp: Modified
+        (WebCore::Geolocation::suspend): Added back in
+        (WebCore::Geolocation::resume): Added back in
+        * page/Geolocation.h: Modified. Make suspend and resume public
+
+2010-01-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set pointer cursor when over a breakpoint in the BreakpointsSidebarPane
+
+        https://bugs.webkit.org/show_bug.cgi?id=33713
+
+        * inspector/front-end/inspector.css:
+
+2010-01-15  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Generate more of the custom behaviors that the v8 bindings attach to v8 FunctionTemplates.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getToStringName):
+        (WebCore::constructorToString):
+        (WebCore::getToStringTemplate):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2010-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r53331.
+        http://trac.webkit.org/changeset/53331
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Broke fast/borders/svg-as-border-image-3.html. Don't give up,
+        Oliver! You are really, really close.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Add an early return when we go to paint a RenderPath that
+        isn't in the current clip.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Use OS(MAC_OS_X) instead of PLATFORM(MAC) when determining navigator.platform
+
+        https://bugs.webkit.org/show_bug.cgi?id=33711
+
+        * page/NavigatorBase.cpp:
+
+2010-01-14  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Compiler warning: comparisons like 'X<=Y<=Z' do not have their mathematical meaning
+        https://bugs.webkit.org/show_bug.cgi?id=33575
+
+        Patch from Magnus Boman <captain.magnus@gmail.com>
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): fix compiler warnings.
+
+2010-01-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add welcome screen to Profiles pane to provide some instructions for novices.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19268
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.get welcomeMessage):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.get welcomeMessage):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._addWelcomeMessage.messageButtonClicked):
+        (WebInspector.ProfilesPanel.prototype._addWelcomeMessage):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WelcomeView.js: Added.
+        (WebInspector.WelcomeView):
+        (WebInspector.WelcomeView.prototype._windowResized):
+        (WebInspector.WelcomeView.prototype.addMessage):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2010-01-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Win] Flash in QGraphicsWebView does not process hover correctly.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33591
+        
+        Mouse hover does not work as expected with the flash in some sites.
+        - http://www.bbc.co.uk/ Hover over the map
+        - http://www.barbie.com/ Hover over the menu items (Games, Videos)
+        The problem appears to be that Flash queries NPNVnetscapeWindow on every
+        mouse hover. I do not how flash uses this value but returning 0 when flash
+        is in windowless mode solves the problem (When using QGraphicsWebView we
+        inject wmode opaque, thereby putting the plugin in windowless mode).
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2010-01-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for Peer class
+        https://bugs.webkit.org/show_bug.cgi?id=33670
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name - instantiated at: WebCore/'location'
+        class Peer - websockets/WebSocketChannelClient.h:38
+
+        * websockets/WorkerThreadableWebSocketChannel.h:
+
+2010-01-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for GraphicsContextPlatformPrivate class
+        https://bugs.webkit.org/show_bug.cgi?id=33669
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name                           - instantiated at: WebCore/'location'
+        class GraphicsContextPlatformPrivate - platform/graphics/qt/GraphicsContextQt.cpp:254
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        history.pushState should clear the entire forward history
+        https://bugs.webkit.org/show_bug.cgi?id=33160
+
+        Test: fast/loader/stateobjects/pushstate-clears-forward-history.html
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem):
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardList.h:
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        WebCore change reflecting UString method name change computedHash() -> existingHash().
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
+
+2010-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6020083> -webkit-gradient slows down scrolling when page has horizontal scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=19650
+
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern): Added call to adjustParametersForTiledDrawing(),
+        letting the generator substitute the parameters with visually-equivalent values that
+        are more efficient.
+        * platform/graphics/Generator.h:
+        (WebCore::Generator::adjustParametersForTiledDrawing): Added a base class implementation
+        that does nothing.
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::adjustParametersForTiledDrawing): Added. If the gradient is a horizontal
+        or vertical linear gradient, changes to use a 1-pixel tall (or wide) tile.
+        * platform/graphics/Gradient.h:
+
+2010-01-14  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Platform Symbian specific:
+        Added time-based optimization (-Otime) and increased optimization level to -O3,
+        conditionally for RVCT compiler (for ARM), for increasing performance
+        (primarily affecting JavaScript execution).
+        Default settings are -Ospace and -O2.
+
+        No new tests needed because no new funtionality is introduced,
+        only potential regression on existing tests needs to be evaluated.
+
+        * WebCore.pro:
+
+2010-01-14  Jungshik Shin  <jshin@chromium.org>
+
+        Unreviewed, attempted build fix on chromium.
+
+        Fix a Chromium build failure due to an unused variable in V8 binding.(part 2)
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedPropertyOfCollection):
+
+2010-01-14  Jungshik Shin  <jshin@chromium.org>
+
+        Unreviewed, attempted build fix on chromium.
+
+        Fix a Chromium build failure due to an unused variable in V8 binding. 
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getIndexedPropertyOfCollection):
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, attempted build fix.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Simplify image decoders by making downsampling functions available at
+        all times, allowing much duplicated logic to be collapsed.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::prepareScaleDataIfNecessary):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::scaledSize):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::setSize):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-01-14  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Remove obsolete CF related files from gyp build.
+        https://bugs.webkit.org/show_bug.cgi?id=33002
+
+        * WebCore.gypi:
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Decoding images to scaled output buffers resulted in garbage for
+        no-alpha PNGs and CMYK JPEGs.
+        https://bugs.webkit.org/show_bug.cgi?id=33624
+        
+        No layout test since I don't have access to a platform that scales the
+        output buffers.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix an assertion that was causing test crashes. Filed a bug
+        about the weirdness that causes this assertion (inconsistencies 
+        between DragOperationMove and DragOperationGeneric).
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp):
+        (WebCore::Clipboard::setDestinationOperation):
+
+2010-01-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33498 REGRESSION: 
+        svg/css/circle-in-mask-with-shadow.svg failing pixel tests
+        -and corresponding-
+        <rdar://problem/7544176>
+
+        This change makes repaintRectInLocalCoordinates return a rect that 
+        is -webkit-svg-shadow-aware.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::inflateForShadow):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop source/destination code needs cleanup.
+        <https://bugs.webkit.org/show_bug.cgi?id=33691>.
+        
+        Cleaned up some Drag and Drop code that deals with getting
+        source and destination operations, and added some ASSERTS to make
+        sure we don't get in bad states.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::sourceOperation): Make this return the operation itself.
+        (WebCore::Clipboard::destinationOperation): Ditto.
+        (WebCore::Clipboard::setSourceOperation): Add an assert to make sure we're valud.
+        (WebCore::Clipboard::setDestinationOperation): Ditto.
+        * dom/Clipboard.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDHTMLDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+
+2010-01-14  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Web Inspector's JavaScript debugger work with isolated worlds.
+        Console evaluation is not performed in the correct world yet, tracked
+        by bug http://webkit.org/b/33692.
+
+        http://webkit.org/b/33690
+
+        Reviewed by Adam Roben.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore): Attach the debugger to
+        any window shell, not just for the debugger world.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Detach the debugger, and
+        reattach to all window shells, not just for the debugger world.
+        (WebCore::ScriptController::initScript): Attach the debugger to
+        any window shell, not just for the debugger world.
+        (WebCore::ScriptController::attachDebugger): Changed to loop through
+        all the window shells and call the new overloaded attachDebugger.
+        (WebCore::ScriptController::attachDebugger): Added. An overload that
+        takes a window shell to attach the debugger to. Has most of the
+        logic from the original attachDebugger.
+        * bindings/js/ScriptController.h: Added the new attachDebugger.
+
+2010-01-14  Adam Roben  <aroben@apple.com>
+
+        Make Cache::requestResource return 0 if the resource's load fails
+        immediately
+
+        Fixes <rdar://problem/7543406> <http://webkit.org/b/33687>
+        window.onload never fires if page contains a <script src=foo> whose
+        load is cancelled by resource load delegate returning null from
+        willSendRequest
+
+        Test: fast/loader/onload-willSendRequest-null-for-script.html
+
+        Reviewed by Dave Hyatt.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource): Moved code to handle immediate load
+        failure out of the "cache is disabled" block so that it will run even
+        when the cache is enabled.
+
+2010-01-14  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by mitz@webkit.org.
+
+        Fix for crash with gradient on table cell.  Pass the correct
+        background object down to
+        RenderBoxModelObject::paintFillLayerExtended().  This also allowed a
+        rework of the fix to bug 18445 by passing the correct RenderObject
+        from RenderBox::paintRootBoxDecorations() down to
+        RenderBoxModelObject::paintFillLayerExtended().
+        https://bugs.webkit.org/show_bug.cgi?id=28426
+
+        Covered by new layout test:  LayoutTests/fast/gradients/crash-on-tr.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        Plumb through the correct background RenderObject.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Use the passed-in background RenderObject (if present) when painting background images.  Remove the previous fix for bug 18445.
+        * rendering/RenderBoxModelObject.h:
+        Plumb through the correct background RenderObject.
+        * rendering/RenderTableCell.cpp:
+        Pass in the correct backgroundObject to paintFillLayers().
+
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+
+2010-01-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Standardize the rest of the v8 bindings on toNative() wherever possible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33677
+
+        * bindings/v8/NPV8Object.cpp:
+        (v8ObjectToNPObject): Special case for converting NPObjects, since there aren't genereated bindings for them.
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/V8Collection.cpp:
+        * bindings/v8/V8Collection.h:
+        (WebCore::toNativeCollection): Special case for converting V8Collections, since there aren't genereated bindings for them.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+
+2010-01-14  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: don't stretch checkboxes
+        https://bugs.webkit.org/show_bug.cgi?id=28631
+
+        Make the default size for checkboxes/radio buttons also the maximum
+        size.
+
+        Based on patch by Adam Langley.
+
+        Test: fast/css/non-standard-checkbox-size.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::center):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Follow up to <https://bugs.webkit.org/show_bug.cgi?id=33635>.
+        
+        Now that dropEffect and effectAllowed are guaranteed to not be
+        null, change null checks into asserts to make sure we are returning
+        a proper DragOperation value.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::sourceOperation): Change null check to assert.
+        (WebCore::Clipboard::destinationOperation): Ditto.
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [DnD] effectAllowed and dropEffect can be set to bogus values.
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=33635>.
+        
+        Test to make aure dropEffect and effectAllowed are being set to valid values
+        when they are being set (list of valid values given by HTML5 specification).
+        
+        Also, drive by change to initialize dropEffect to none (as described in spec).
+
+        Test: fast/events/bogus-dropEffect-effectAllowed.html
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard): Initialize m_dropEffect to "none".
+        (WebCore::Clipboard::setDropEffect): Check if dropEffect is being set to a valid value.
+        (WebCore::Clipboard::setEffectAllowed): Check if effectAllowed is being set to a valid value.
+
+2010-01-14  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Infinite recursion in RuntimeObjectImp::getOwnPropertyNames()
+        https://bugs.webkit.org/show_bug.cgi?id=33371
+
+        RuntimeObjectImp should not reimplement getPropertyNames();
+        move the implementation to getOwnPropertyNames().
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2010-01-14  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ENABLE(XSLT) guard to TransformSourceLibxslt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33665
+
+        TransformSource is available only when ENABLE(XSLT) guard is true.
+
+        * dom/TransformSourceLibxslt.cpp:
+
+2010-01-14  Adam Roben  <aroben@apple.com>
+
+        Treat all synchronous loads equally in FrameLoader::loadSubframe
+
+        Only loads of the empty URL or about:blank were being treated as
+        synchronous loads. But other loads can be synchronous (e.g., when we
+        receive a null ResourceRequest from requestFromDelegate or when a
+        policy decision of "ignore" is made). We now treat those loads the
+        same way we treated empty URLs and about:blank.
+
+        Fixes <rdar://problem/7533333> <http://webkit.org/b/33533>
+        window.onload never fires if page contains an <iframe> with a bad
+        scheme or whose load is cancelled by returning null from resource load
+        delegate's willSendRequest
+
+        Tests: fast/loader/onload-bad-scheme-for-frame.html
+               fast/loader/onload-policy-ignore-for-frame.html
+               fast/loader/onload-willSendRequest-null-for-frame.html
+
+        Reviewed by Brady Eidson.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+          - Detect synchronous loads by checking the subframe's loader's
+            state, rather than by checking its URL
+          - Removed unnecessary call to completed(), since checkCompleted()
+            will call completed() if needed (the call to completed() was added
+            first and wasn't removed when the call to checkCompleted() was
+            added in r8316)
+          - Added more comments about the strange thing this function does
+            with the subframe's loader
+
+2010-01-14  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Missing fileSystemPath() method in Qt KURL implementation
+        https://bugs.webkit.org/show_bug.cgi?id=33614
+
+        No new tests.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::fileSystemPath):
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33652
+        REGRESSION: Frames stop appearing after browsing for a while
+
+        <rdar://problem/7308312> REGRESSION: iBench gets slower after several runs
+
+        I do not know how not creating renderers for frames could make iBench slower, but it did.
+
+        Test: fast/frames/cached-frame-counter.html
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): A frame that's cached is moved away from Page,
+        so decrement frame count here.
+        (WebCore::CachedFrame::open): Increase frame count when a frame is restored.
+
+        * history/CachedFrame.h: Remove unneeded forward declarations.
+
+        * history/CachedPage.h: Ditto.
+
+        * history/CachedPage.cpp: (WebCore::CachedPage::restore): Assert that page frame count is
+        zero prior to restoring a page from b/f cache.
+        
+        * page/Page.cpp: (WebCore::Page::checkFrameCountConsistency): A debug-only method to
+        check that frame count stored in Page matches the number of frames in frame tree.
+
+        * page/Page.h:
+        (WebCore::Page::decrementFrameCount): Assert that frame count is positive.
+        (WebCore::Page::frameCount): Call checkFrameCountConsistency().
+
+2010-01-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fixes.
+        Add forward declarations and additional includes of windows.h.
+
+        * platform/Cursor.h: Add forward declaration of HCURSOR. Move destructor implementation into cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Add forward declaration of XFORM. Remove windows.h include.
+        * platform/graphics/win/TransformationMatrixWin.cpp: Add include of windows.h.
+        * platform/win/CursorWin.cpp: Moved destructor of SharedCursor here.
+        (WebCore::SharedCursor::~SharedCursor): Moved here.
+        * platform/win/EventLoopWin.cpp: Add include of windows.h.
+        * platform/win/SystemInfo.cpp: Add include of windows.h.
+
+2010-01-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Switch the custom V8 bindings to use class toNative() functions.
+
+        Refactoring, so no new tests.
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2010-01-14  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Add DataObjectGtk, a container for pasteboard and drag-and-drop data.
+
+        No new tests, because functionality has not changed.
+
+        * GNUmakefile.am:
+        * platform/gtk/DataObjectGtk.cpp: Added.
+        (WebCore::DataObjectGtk::text):
+        (WebCore::DataObjectGtk::markup):
+        (WebCore::DataObjectGtk::setText):
+        (WebCore::DataObjectGtk::setMarkup):
+        (WebCore::DataObjectGtk::files):
+        (WebCore::DataObjectGtk::url):
+        (WebCore::DataObjectGtk::urlLabel):
+        (WebCore::DataObjectGtk::hasURL):
+        (WebCore::DataObjectGtk::clear):
+        (WebCore::DataObjectGtk::forClipboard):
+        * platform/gtk/DataObjectGtk.h: Added.
+        (WebCore::DataObjectGtk::create):
+        (WebCore::DataObjectGtk::uriList):
+        (WebCore::DataObjectGtk::image):
+        (WebCore::DataObjectGtk::setRange):
+        (WebCore::DataObjectGtk::setURIList):
+        (WebCore::DataObjectGtk::setImage):
+        (WebCore::DataObjectGtk::setDragContext):
+        (WebCore::DataObjectGtk::hasText):
+        (WebCore::DataObjectGtk::hasMarkup):
+        (WebCore::DataObjectGtk::hasURIList):
+        (WebCore::DataObjectGtk::hasImage):
+        (WebCore::DataObjectGtk::dragContext):
+
+2010-01-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Scrolling of Timeline Page was broken by fix for bug 33470.
+        https://bugs.webkit.org/show_bug.cgi?id=33666
+
+        * inspector/front-end/inspector.css:
+
+2010-01-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Unreviewed fix of builds with the --no-svg switch.
+
+        * WebCore.pri:
+
+2010-01-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Unreviewed build fix on Windows.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-14  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable scrolling optimization for pages with embedded widgets
+
+        https://bugs.webkit.org/show_bug.cgi?id=33373
+
+        Added a basic manual test for scrolling of embedded QWidgets.
+
+        * manual-tests/qt/qtplugin-scrolling.html: Added.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::setParent):
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::invalidateRect):
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GStreamer] Check return values of gst_element_set_state()
+        https://bugs.webkit.org/show_bug.cgi?id=30000
+
+        Check for state change failure when going from READY/NULL to
+        PAUSED or PLAYING. Also refactored the common code of play() and
+        pause() to a new private method of the player.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::changePipelineState):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-14  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r53248.
+        http://trac.webkit.org/changeset/53248
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Caused 2 tests to crash on various bots:
+        fast/dom/HTMLSelectElement/listbox-select-reset.html and
+        fast/forms/listbox-typeahead-scroll.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-14  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] [Qt] The document.createEvent API does not support touch events.
+        https://bugs.webkit.org/show_bug.cgi?id=33605
+
+        Test: fast/events/touch/create-touch-event.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent): add creation of a TouchEvent when the "TouchEvent" argument is supplied.
+
+2010-01-14  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ensures that the 'selected' attribute of an <option> is correct
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Adds a check in OptionElement::selected() that checks if list items need to be recalculated and does so if needed,
+        so the attribute is up to date more often.  Also gets rid of most of the recalcStyle() side effects.
+
+         Our behavior now matches Firefox 3.5 and IE8 after the </select> is parsed.
+
+         Tests: fast/forms/HTMLOptionElement_selected2.html
+                fast/forms/HTMLOptionElement_selected3.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setOptionsChangedOnRenderer):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::recalcListItemsIfNeeded):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-14  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for TransparencyLayer class
+        https://bugs.webkit.org/show_bug.cgi?id=33585
+
+        Inherits the following class from FastAllocBase because it is 
+        instantiated by 'new':
+
+        class name              - instantiated at: WebCore/'location'
+        class TransparencyLayer - platform/graphics/qt/GraphicsContextQt.cpp:906
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-01-14  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for FontPlatformDataPrivate class
+        https://bugs.webkit.org/show_bug.cgi?id=33583
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name                    - instantiated at: WebCore/'location'
+        class FontPlatformDataPrivate - platform/graphics/qt/FontPlatformData.h:70
+
+        * platform/graphics/qt/FontPlatformData.h:
+
+2010-01-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] un-needed seeks
+        https://bugs.webkit.org/show_bug.cgi?id=33532
+
+        Avoid un-needed seeks. Don't seek at current playback position and
+        don't update the rate if it is already set to target value.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-14  Eric Seidel  <eric@webkit.org>
+
+        No review.  Tiger build fix after http://trac.webkit.org/changeset/53238.
+
+        Need to implement WebGLContextAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=31169
+
+        Fix a build break when ENABLE(3D_CANVAS) is disabled.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): UNUSED_PARAM(attrs) when 3D_CANVAS is disabled.
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: use hidden text area for clipboard in order to
+        workaround windows setData bug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33633
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._copy):
+        * inspector/front-end/inspector.css:
+
+2010-01-13  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Slow named property lookup on DOMWindow because of missing fast case
+        https://bugs.webkit.org/show_bug.cgi?id=33584
+
+        Add fast case checks to V8 named property getter on DOMWindow
+        objects.  If the property is not in the DOM there is no reason to
+        search the DOM for all occurrences.
+
+        Covered by layout tests.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7403736> REGRESSION (r49963,r49965): 8% Dromaeo Core DOM test regression
+
+        Adding isolated worlds support to the JSC bindings introduced a regression due to
+        additional map lookups.  Add a mechanism to quickly detect that a lookup is for the
+        'normal' world, and add fast paths to a couple of methods to check the normal world
+        first.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::Document::getWrapperCache):
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::forgetDOMObject):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::isNormal):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+
+2010-01-13  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Need to implement WebGLContextAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=31169
+
+        Added the WebGLContextAttributes class and custom JavaScript
+        bindings to accept a native object as the second argument to
+        getContext("experimental-webgl") per the WebGL specification.
+        Added GraphicsContext3D::Attributes struct to isolate DOM and
+        graphics layers. Added getContextAttributes() to
+        WebGLRenderingContext. Added test case ensuring that context
+        attributes can be passed down and returned. Tested in Safari and
+        Chromium. The attributes will be hooked up to the creation of the
+        OpenGL context in bug 33416.
+
+        Test: fast/canvas/webgl/context-attributes.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/HTMLCanvasElement.h:
+        * html/HTMLCanvasElement.idl:
+        * html/canvas/CanvasContextAttributes.cpp: Added.
+        (WebCore::CanvasContextAttributes::CanvasContextAttributes):
+        (WebCore::CanvasContextAttributes::~CanvasContextAttributes):
+        * html/canvas/CanvasContextAttributes.h: Added.
+        * html/canvas/WebGLContextAttributes.cpp: Added.
+        (WebCore::WebGLContextAttributes::create):
+        (WebCore::WebGLContextAttributes::WebGLContextAttributes):
+        (WebCore::WebGLContextAttributes::~WebGLContextAttributes):
+        (WebCore::WebGLContextAttributes::alpha):
+        (WebCore::WebGLContextAttributes::setAlpha):
+        (WebCore::WebGLContextAttributes::depth):
+        (WebCore::WebGLContextAttributes::setDepth):
+        (WebCore::WebGLContextAttributes::stencil):
+        (WebCore::WebGLContextAttributes::setStencil):
+        (WebCore::WebGLContextAttributes::antialias):
+        (WebCore::WebGLContextAttributes::setAntialias):
+        (WebCore::WebGLContextAttributes::premultipliedAlpha):
+        (WebCore::WebGLContextAttributes::setPremultipliedAlpha):
+        (WebCore::WebGLContextAttributes::attributes):
+        * html/canvas/WebGLContextAttributes.h: Added.
+        * html/canvas/WebGLContextAttributes.idl: Added.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create):
+        (WebCore::WebGLRenderingContext::getContextAttributes):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Transition followed by animation fails to run the animation sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=33563
+
+        If a transition was closely followed by an animation, it was possible for the cleanup
+        after the end of the transition to kill the animation.
+        
+        Fix this by including the keyframes name (or empty string for transitions) in the labels
+        used to identify CAAnimations on layers.
+        
+        No test because this was a subtle timing issue that is hard to reproduce in a layout test.
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Some new methods and signature changes.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::animationIdentifier): Pass the keyframes name, since this is included in the identifier string now.
+        (WebCore::moveAllAnimationsForProperty): Pass the keyframes name.
+        (WebCore::GraphicsLayerCA::moveAnimationsForProperty): Try to move both transition- and animation-related
+        CAAnimations, using the list of running animations to get the keyframe names for the latter.
+
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer): moveAnimation renamed to moveAnimationsForProperty
+        and takes the keyframes name.
+
+        (WebCore::GraphicsLayerCA::updateLayerAnimations): Pass keyframes name down (or "" for transitions).
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer): Pass keyframes name down.
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix shadow drawing to do the correct computations using the base coordinate space
+        https://bugs.webkit.org/show_bug.cgi?id=33629
+        
+        Shadows draw using the CGContext base CTM, so we need to convert the shadow offet
+        and size from user CTM into into base CTM coordinates, via the matix obtained from wkGetUserToBaseCTM().
+
+        Test: compositing/shadows/shadow-drawing.html
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2010-01-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGClipPathElement shouldn't resolve style manually
+        https://bugs.webkit.org/show_bug.cgi?id=33647
+
+        Build renderers for SVGClipPathElement, so we can query the style from the renderer
+        instead of re-resolving style on every clip path resource invalidation.
+
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::createRenderer):
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGClipPathElement.h:
+        (WebCore::SVGClipPathElement::isValid):
+
+2010-01-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector does not update the DOM tree when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=20162
+
+        * dom/Element.cpp: Moves callbacks to InspectorController directly into setAttribute
+        and removeAttribute and removes the existing call sites. This makes it possible to
+        see attribute modifications.
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::dispatchAttrRemovalEvent):
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        (WebCore::Element::removeAttribute):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._setAttributesPayload): Clear existing attributes.
+        (WebInspector.DOMAgent.prototype._didApplyDomChange): Updated call site and fixed style.
+        (WebInspector.DOMAgent.prototype._attributesUpdated): Added.
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._attributesUpdated): Added.
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes): Updated call site.
+        * inspector/front-end/ElementsTreeOutline.js: Renamed _updateTitle to updateTitle.
+        (WebInspector.ElementsTreeElement.prototype.onattach): Updated updateTitle call site.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Ditto.
+
+2010-01-13  Carol Szabo <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CounterNode::nextInPreOrderAfterChildren(stayWithin) does not stay within.
+        https://bugs.webkit.org/show_bug.cgi?id=33625
+
+        No new tests because the fix should affect strictly performance.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+
+2010-01-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Window size changes are not propagated down the render tree
+        https://bugs.webkit.org/show_bug.cgi?id=33643
+
+        Test: svg/custom/relative-sized-content.xhtml
+
+        * rendering/RenderSVGContainer.cpp: Fix incorrect markParents=true usage, leading to unnecessary relayouts.
+        (WebCore::RenderSVGContainer::layout): Use new layoutChildren() method.
+        (WebCore::RenderSVGContainer::paint): Fix indention.
+        * rendering/RenderSVGHiddenContainer.cpp: Fix incorrect markParents=true usage.
+        (WebCore::RenderSVGHiddenContainer::layout): Use new layoutChildren() helper.
+        * rendering/RenderSVGRoot.cpp: Refactor existing code to layout children in SVGRenderSupport::layoutChildren.
+        (WebCore::RenderSVGRoot::layout): Make children relayouting depend on width/height changes, if the outermost svg uses relative viewport sizes.
+        * rendering/SVGRenderSupport.cpp: Add central place handling child layout, skips relayouting non-relative sized children as benefit.
+        (WebCore::SVGRenderBase::layoutChildren): This methods contains the actual changes.
+        * rendering/SVGRenderSupport.h:
+        * svg/SVGGElement.h: Remove dead code.
+        * svg/SVGSVGElement.h: Make hasRelativeValues() public to remove the need for friendship declarations.
+        * svg/SVGStyledElement.h: Change default return value for hasRelativeValues() to false, as it was intended.
+        (WebCore::SVGStyledElement::hasRelativeValues): Make it public, to be usable from SVGRenderSupport.
+        * svg/SVGSymbolElement.h: Remove dead code.
+        * svg/SVGUseElement.cpp: Implement hasRelativeValues() - it was simply missing here.
+        (WebCore::SVGUseElement::hasRelativeValues):
+        * svg/SVGUseElement.h:
+
+2010-01-13  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix websocket/tests/worker/worker-simple.html crash on Leopard Intel Debug (Tests) builder
+        https://bugs.webkit.org/show_bug.cgi?id=33581
+
+        unref m_workerContext when websocket is disconnected, so that avoid
+        keeping reference to workerContext longer than worker thread runs.
+
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
+
+2010-01-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: selected, selectable, extended selectable, and multiple
+        selectable states are not reported
+
+        https://bugs.webkit.org/show_bug.cgi?id=33574
+        <rdar://problem/7536826>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isMultiSelectable):
+        Use the correct function name - the function name overriden by
+        and used in AccessiblityRenderObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+        Update for function rename.
+        (webkit_accessible_selection_select_all_selection):
+        Ditto.
+
+2010-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move more of the selection and caret painting code from Frame to SelectionController.
+        https://bugs.webkit.org/show_bug.cgi?id=33619
+
+        Helpful preparation step for a bug fix I am working on.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController): Initialize new data members.
+        Note that m_caretVisible starts as true for the drag caret controller to match the
+        old behavior for painting.
+        (WebCore::SelectionController::setSelection): Changed to call selectionLayoutChanged
+        in its new name and location.
+        (WebCore::SelectionController::paintCaret): Added checks that were formerly done
+        at the Frame level. Tweaked formatting and changed to use early return as well.
+        (WebCore::SelectionController::focusedOrActiveStateChanged): Updated for call
+        moved into this class.
+        (WebCore::SelectionController::updateAppearance): Moved the
+        Frame::selectionLayoutChanged function here. Had to rename it because the word
+        "layout" is usedfor other purposes in this function.
+        (WebCore::SelectionController::setCaretVisible): Moved here from Frame.
+        (WebCore::SelectionController::clearCaretRectIfNeeded): Ditto.
+        (WebCore::SelectionController::caretBlinkTimerFired): Ditto.
+
+        * editing/SelectionController.h: Added new functions. Moved conditional function
+        out of class definition for clarity. Removed unneeded == and != operators.
+        Removed unneeded use of bit fields.
+
+        * page/Frame.cpp: Moved functions to SelectionController.
+        (WebCore::Frame::Frame): Removed initialization of moved data members.
+
+        * page/Frame.h: Removed things moved to SelectionController as well as unneeded
+        forward declaration of Timer class template.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Updated for new location of function.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret): Ditto.
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7532544>
+        
+        Expose new method on WebKitSystemInterface, WKGetUserToBaseCTM(), which will
+        be used for a shadow drawing fix.
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix shadow drawing to do the correct computations using the base coordinate space
+        https://bugs.webkit.org/show_bug.cgi?id=33629
+
+        Step 1: do some renames in setPlatformShadow():
+            size -> offset
+            width -> xOffset
+            height -> yOffset
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2010-01-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Move getSessionStorageNamespace from WebKitClient to WebViewClient
+        https://bugs.webkit.org/show_bug.cgi?id=33492
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Repaint bug dragging a star shape with a dash stroke
+        https://bugs.webkit.org/show_bug.cgi?id=33406
+
+        Calculation of repaint rects for RenderPath objects was wrong. We must take the
+        union of strokeBoundingBox and objectBoundingBox, since the strokeBoundingBox
+        must not contain the objectBoundingBox. This is mainly visible on dash-arrays for
+        strokes.
+
+        Test: svg/custom/js-repaint-rect-on-path-with-stroke.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeBoundingBox):
+
+2010-01-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix. Make the XFORM operator work on wx port.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * wscript:
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce SourceFrame2 with basic breakpoint / execution line
+        rendering capabilities.
+
+        Contains a drive-by naming fix (lineNumberOffset and lineNumberToOffset were
+        too close to each other, but were unrelated).
+
+        https://bugs.webkit.org/show_bug.cgi?id=33618
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame2.js: Added.
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.set text):
+        (WebInspector.SourceFrame2.prototype.get executionLine):
+        (WebInspector.SourceFrame2.prototype.set executionLine):
+        (WebInspector.SourceFrame2.prototype.revealLine):
+        (WebInspector.SourceFrame2.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame2.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintProgramCounter):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.ExecutionLineDecorator):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.get textModel):
+        (WebInspector.TextEditor.prototype.set readOnly):
+        (WebInspector.TextEditor.prototype.set lineNumberDecorator):
+        (WebInspector.TextEditor.prototype.set lineDecorator):
+        (WebInspector.TextEditor.prototype.selectionRange):
+        (WebInspector.TextEditor.prototype._offsetToLine):
+        (WebInspector.TextEditor.prototype._lineToOffset):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype.updateCanvasSize):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype.paintLineNumbers):
+        (WebInspector.TextEditor.prototype._paintCurrentLine):
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._keyDown):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._textInput):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._initFont):
+
+2010-01-13  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate a function in the V8 bindings to convert v8 objects
+        to native WebCore objects.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate and use toNative().
+        * bindings/v8/V8Binding.cpp: Remove manually defined conversion helprs.
+        (WebCore::getElementStringAttr):
+        (WebCore::setElementStringAttr):
+        * bindings/v8/V8Binding.h: Remove manually defined conversion helprs.
+        * bindings/v8/V8SVGPODTypeWrapper.h: Still need a manually defined coversion helper for SVGPODTypes.
+        (WebCore::V8SVGPODTypeWrapper::toNative):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
+        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
+        (WebCore::V8WebGLRenderingContext::getUniformCallback):
+
+2010-01-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r49268): DHTML drag not allowed unless event.dataTransfer.effectAllowed
+        is set (differs from HTML5).
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=33607> and <rdar://7507114>.
+
+        If no effectAllowed is set in the dragStart operation, we should default to
+        uninitialized instead of none, so the user doesn't have to manually set the
+        effectAllowed to enable drag and drop.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+
+2010-01-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32495
+
+        font-size:small with background-color causes text to get clipped.  Make sure to only paint within the lineTop/lineBottom of
+        a line for quirky inline flow boxes that didn't contribute to the overall height of the line. 
+        
+        Added fast/backgrounds/quirks-mode-line-boxes-backgrounds.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+
+2010-01-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring DatabaseAuthorizer to use a CaseFoldingHash function
+        for the set of whitelisted sqlite functions, and fixing some
+        indenting issues.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33612
+
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::allowFunction):
+        * storage/DatabaseAuthorizer.h:
+
+2010-01-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RenderObject::nextInPreOrderAfterChildren(RenderObject* stayWithin) does not stay within
+        https://bugs.webkit.org/show_bug.cgi?id=33600
+
+        No new tests as this fix affects mainly performance.
+        No test has been found yet that could evidence the bug in the layout
+        of a page, but the fix to bug 32884 exposes this bug on some pages
+        such as http://www.w3.org/Style/CSS/Test/CSS2.1/current/html4/counters-scope-implied-001.htm
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nextInPreOrderAfterChildren):
+
+2010-01-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        No reviewer.  More or less a build fix.  My 53180 broke some 
+        stuff on the Chromium port so I'm reverting.
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-13  Steve Block  <steveblock@google.com>
+
+        Update appendClassName in jni_runtime.cpp to use WebCore::StringBuilder, rather than JSC::StringBuilder.
+        https://bugs.webkit.org/show_bug.cgi?id=33586
+
+        Avoiding the JSC version of StringBuilder allows this file to be used with both JSC and V8 on Android.
+
+        No new tests, refactoring only.
+
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaMethod::signature): Modified. Use WebCore::StringBuilder.
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Some objects in the global scope are not completed
+        https://bugs.webkit.org/show_bug.cgi?id=19119
+
+        Use Object.getOwnPropertyNames instead of for-in to provide completions, since
+        Object.getOwnPropertyNames reports both enumerable and non-enumerable properties.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._getPropertyNames):
+        (InjectedScript.getCompletions):
+
+2010-01-13  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Android] [Qt] The JSC ScriptController does not consider Touch Events user gestures.
+        https://bugs.webkit.org/show_bug.cgi?id=33597
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent): Add the touch event types (touchstart, touchmove and touchend) to the set of events that are considered user gestures.
+
+2010-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        [Qt] REGRESSION(53187) Touchevent related tests fail
+
+        https://bugs.webkit.org/show_bug.cgi?id=33602
+
+        Pass the ENABLE_TOUCH_EVENTS to the IDL generators.
+
+        * WebCore.pri:
+
+2010-01-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Timeline panel scrolling speed can be increased.
+        https://bugs.webkit.org/show_bug.cgi?id=33579
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * WebCore.pri: Added. Contains common logic between source generation and compilation.
+        * WebCore.pro: Moved source generation to DerivedSources.pro.
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Scrolling editor to the 20Kth line is not smooth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33587
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._highlightChanged):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype._setLine):
+        (WebInspector.TextEditorModel.prototype.setAttribute):
+        (WebInspector.TextEditorModel.prototype.getAttribute):
+        (WebInspector.TextEditorModel.prototype.removeAttribute):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the build on Windows.
+
+        PluginViewWin.cpp requires the conversion operator from TransformationMatrix to XFORM.
+
+        * WebCore.pro: Build TransformationMatrixWin.cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Enable the conversion operator to XFORM.
+
+2010-01-13  Miikka Heikkinen <miikka.heikkinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Symbian] Added missing vendor information to qtwebkit.sis
+
+        This information is necessary to Symbian sign the package.
+
+        http://bugreports.qt.nokia.com/browse/QTBUG-7290
+
+        * WebCore.pro:
+
+2010-01-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Move getSessionStorageNamespace from WebKitClient to WebViewClient
+        https://bugs.webkit.org/show_bug.cgi?id=33492
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adding a list of whitelisted sqlite functions that users are
+        allowed to use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33549
+
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::authorizerFunction):
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::DatabaseAuthorizer):
+        (WebCore::DatabaseAuthorizer::addWhitelistedFunctions):
+        (WebCore::DatabaseAuthorizer::allowFunction):
+        * storage/DatabaseAuthorizer.h:
+
+2010-01-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt][WebSocket] SocketStreamHandleSoup.cpp is misnamed
+        https://bugs.webkit.org/show_bug.cgi?id=33077
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamHandleQt.cpp: Copied from WebCore/platform/network/qt/SocketStreamHandleSoup.cpp.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Removed.
+
+2010-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        position:fixed and transform on same element breaks fixed behavior
+        https://bugs.webkit.org/show_bug.cgi?id=31283
+
+        Fix interactions of transforms and fixed positioning, namely that fixed position
+        elements with a transformed ancestor are positioned relative to that ancestor,
+        and an element with both a transform and fixed position respects that positioning.
+        
+        Test: transforms/2d/transform-fixed-container.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        Transforms should not unconditionally stop the propagation of the 'fixed' flag to ancestors,
+        but only if the transformed element is not itself fixed.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertToLayerCoords):
+        Fix this method to behave correctly for fixed position layers whose container is not
+        the root, but some other (probably transformed) ancestor. In that case, we can fall into
+        the "position: absolute" code path.
+
+2010-01-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix an assert being triggered by how the Chromium port sets the
+        replacing flag for error pages.  This was caused by r53143.
+
+        Covered by existing Chromium UI tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add new argument to reimplementations of getPropertyNames()
+        and getOwnPropertyNames(), and update the JS bindings generator.
+
+        Test: fast/js/Object-getOwnPropertyNames.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getPropertyNames):
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getPropertyNames):
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyNames):
+        * bridge/runtime_array.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2010-01-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Safari shows an unneeded horizontal scrollbar on many websites.
+        Fixes <rdar://6321041> and <http://webkit.org/b/33555>.
+        
+        If a div has no children, and its height or width are 0, we can ignore
+        it in our calculation of lowest, rightmost, and leftmost positions. This
+        calculation was causing horizontal scrollbars to be drawn when they weren't needed.
+
+        Test: fast/block/positioning/absolute-positioning-no-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition): Added check for no children and width or height 0.
+        (WebCore::RenderBlock::rightmostPosition): Ditto.
+        (WebCore::RenderBlock::leftmostPosition): Ditto.
+
+2010-01-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Optimize WebInspector.TimelineGrid.prototype.updateDividers()
+
+        DOM element property access and modification are slow and should be done as lazily as possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33536
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype._setDividerAndBarLeft):
+
+2010-01-12  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33550 REGRESSION: -
+        webkit-svg-shadow with opacity still over-clipped
+
+        We need to call inflateForShadow() on the repaintRect before we 
+        clip for opacity or we will over-clip.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+2010-01-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Update all-in-one derived sources for Geolocation.
+
+        * DerivedSources.cpp: Add JSCoordinates.cpp, JSGeolocation.cpp, JSGeoposition.cpp, JSPositionError.cpp
+
+2010-01-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove static const ints from V8CustomBinding.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=33547
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate and use custom 
+            internal field indices from lists of custom internal fields.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp: Remove a bunch of now unnecessary
+            manually calls to setInternalFieldCount().
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h: Remove the static const ints.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2010-01-12  Darin Fisher  <darin@chromium.org>
+
+        Fixing chromium build bustage.
+
+        * bindings/v8/custom/V8PopStateEventCustom.cpp: Add V8Proxy.h include.
+
+2010-01-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add V8 bindings for PopStateEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=33546
+        
+        This is covered by existing tests for PopStateEvent.
+
+        * WebCore.gypi:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp: Added.
+        (WebCore::V8PopStateEvent::initPopStateEventCallback):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+
+2010-01-12  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds source length to ParseHTMLRecords in the inspector timeline.
+        https://bugs.webkit.org/show_bug.cgi?id=33548
+
+        Test: inspector/timeline-parse-html.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createParseHTMLRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2010-01-12  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=31597
+
+        Make ICU's text breakiterator and string search use Chrome's UI
+        language instead of 'en-US' or the OS UI language.
+
+        As long as the webkit layout tests are run in en-US locale, there'd be 
+        no visible change.
+
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
+        (UILanguage):
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+
+2010-01-12  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Dave Hyatt.
+
+        This patch changes the name of -webkit-shadow to -webkit-svg-shadow 
+        to avoid giving a custom property an overly-general name.
+        <rdar://problem/7534590>
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseShadow):
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+2010-01-12  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a null check in case of an event handler with invalid syntax.
+
+        Should make fast/js/invalid-syntax--for-function.html not crash in
+        Chromium's test shell.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction): Check the listener object before using it.
+
+2010-01-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove XBM support from the open-source image decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=27823
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/image-decoders/xbm: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Removed.
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * dom/Element.cpp: (WebCore::Element::getURLAttribute):
+        * dom/SelectElement.cpp: (WebCore::SelectElementData::checkListItems):
+        * editing/TextIterator.cpp:
+        * loader/Cache.cpp: (WebCore::Cache::removeFromLRUList):
+        * rendering/RenderArena.cpp: (WebCore::RenderArena::free):
+
+2010-01-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler and Simon Fraser.
+
+        rdar://problem/5684062
+        https://bugs.webkit.org/show_bug.cgi?id=23094
+        Flash of white when switching from poster image to video playback
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23140
+        <video> poster should scale like a video frame
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Only call updatePosterImage from one place
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::HTMLVideoElement): m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::createRenderer): Always create a RenderVideo.
+        (WebCore::HTMLVideoElement::attach): Call updatePosterImage before checking to see if we
+            should display the poster image. renderer() is never a RenderImage, don't need to check.
+            m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::detach): m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Cache poster attribute when it is set since
+            it is checked frequently. m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::updatePosterImage): Don't bother looking at the network state, 
+            display the poster as long as the attribute is valid and the media engine says it hasn't
+            rendered a video frame. m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::hasAvailableVideoFrame): New, ask the media engine if a video frame
+            is available to render.
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::poster):
+        (WebCore::HTMLVideoElement::shouldDisplayPoster):
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateRenderer): Call setCachedImage for render video too.
+
+        * manual-tests/video-player.html: Remove bit-rot from manual test so it works again.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::hasAvailableVideoFrame): New, ask the media engine if a video frame
+            is available to render.
+
+        * platform/graphics/MediaPlayer.h: Prototype for hasAvailableVideoFrame.
+        * platform/graphics/MediaPlayerPrivate.h: Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Declare hasAvailableVideoFrame, declare
+            all bool variables to aid packing.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm: 
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_videoFrameHasDrawn. Cleanup
+            floating point initializers to match coding guidelines.
+        (WebCore::MediaPlayerPrivate::load): Initialize m_videoFrameHasDrawn.
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame): New.
+        (WebCore::MediaPlayerPrivate::repaint): Set m_videoFrameHasDrawn.
+
+        (WebCore::RenderImage::paintReplaced): Split part out into paint method.
+        (WebCore::RenderImage::paint): New.
+        * rendering/RenderImage.h: Declare paint. Make isWidthSpecified and isHeightSpecified protected
+            instead of private so RenderVideo can use them.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Inherit from RenderImage, not RenderReplaced
+        (WebCore::RenderMedia::destroy): Ditto.
+        (WebCore::RenderMedia::styleDidChange): Ditto.
+        (WebCore::RenderMedia::layout): Ditto.
+        (WebCore::RenderMedia::lowestPosition): Ditto.
+        (WebCore::RenderMedia::rightmostPosition): Ditto.
+        (WebCore::RenderMedia::leftmostPosition): Ditto.
+        * rendering/RenderMedia.h: Declare isImage and isRenderImage.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::intrinsicSizeChanged): New, call RenderVideo::intrinsicSizeChanged
+            when displaying a poster so it is sized correctly.
+        (WebCore::RenderVideo::imageChanged): Override so we can cache the image's intrisic size and
+        use it when we also know the movie's intrinsic size but still need to draw the poster.
+        (WebCore::RenderVideo::videoBox): Use the poster's intrinsic size when drawing the poster,
+        use the movie's intrinsic size when drawing frames.
+        (WebCore::RenderVideo::paintReplaced): Call RenderImage::paint when drawing the poster.
+        (WebCore::RenderVideo::videoElement): New.
+        (WebCore::RenderVideo::updatePlayer):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::minimumReplacedHeight): Added.
+
+2010-01-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a crash in Chromium when receiving multipart/x-mixed-replace data.
+        If we stop a multipart load after ResourceLoader::didReceiveResponse
+        but before ResourceLoader::didReceiveData, we have a NULL document
+        loader because it has been moved back to the provisional state.  New
+        loads that happen after this will dereference the NULL document
+        loader.
+
+        Work around this by moving the provisional document loader back as
+        the document loader when the request is stopped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31446
+
+        Test: http/tests/multipart/multipart-wait-before-boundary.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2010-01-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit returns incorrect match count when first string match is on an element with user-select-none style
+        https://bugs.webkit.org/show_bug.cgi?id=33508
+        <rdar://problem/7482143>
+
+        If we use VisiblePosition to calculate the start of the new search range,
+        we skip all the nodes with user-select-none style, producing an incorrect
+        match count.
+        
+        No new tests: there are no API's available to Javascript to verify the
+        number of matches found.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::markAllMatchesForText): Changed to use the end of the previous
+        result range as the start of the new search range.
+
+2010-01-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed ".sidebar" style to allow v-scroll to appear in
+        "Profiles" panel sidebar.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33470
+
+        No new tests -- no code changed.
+
+        * inspector/front-end/inspector.css:
+
+2010-01-12  Adam Roben  <aroben@apple.com>
+
+        Windows accelerated compositing build fix after r53110
+
+        * plugins/PluginWidget.h:
+        (WebCore::PluginWidget::platformLayer): Define platformLayer() for
+        non-Mac platforms that have accelerated compositing turned on. It
+        would probably be better to make PluginWidget not be used at all on
+        non-Mac platforms, but this fix is much simpler.
+
+2010-01-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Support injection of inspector scripts into the inspected context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33523
+
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+
+2010-01-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Form Reset : Press Back Button and Reset , TextareaElemnt is not set to Default Value
+        https://bugs.webkit.org/show_bug.cgi?id=31539
+
+        Added manual test: manual-tests/textarea-reset-default-value.html.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::restoreFormControlState): set the value, rather than default value of a text area when restoring its state. This allows resetting a form with a textarea to work correctly after its state has been restored.
+        * manual-tests/resources/textarea-form-back-on-submit.html: Added.
+        * manual-tests/textarea-reset-default-value.html: Added.
+
+2010-01-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] WebCore::Path allocates QPainterPath unnecessarily on the heap
+        https://bugs.webkit.org/show_bug.cgi?id=33466
+
+        WebCore::Path is a pointer to a PlatformPath. In case of Qt that's a
+        QPainterPath, which itself is a pointer to the elements (QVector).
+        That creates unecessary allocations in PathQt.cpp.
+
+        Replaced the "PlatformPath* m_path;" with a PlatformPathPtr, which
+        is a plain QPainterPath.
+
+        * platform/graphics/Path.h:
+        (WebCore::Path::platformPath):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::drawFilledShadowPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+
+2010-01-12  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] XSL stylesheets can load documents from a different origin
+
+        https://bugs.webkit.org/show_bug.cgi?id=33423
+
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTUriResolver::XSLTUriResolver):
+        (WebCore::XSLTUriResolver::resolve):
+        (WebCore::XSLTProcessor::transformToString):
+
+2010-01-12  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        Tweak/correction: Eliminate a needless variable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
+
+2010-01-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Allow creating injected script for the inspected script state. The InjectedScript is
+        cached on the inspected ExecState global object and will be garbage collected when the
+        object is collected. Each InjectedScript object is assigned unique id.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33469
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h: InjectedScript is cached on the global object as a
+        field that is not visible from the inspected code. This InjectedScript should be alive as long as
+        the global object is alive and should be accessible from Web Inspector's native code.
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScript): Creates injected script using the lexical global object of the
+        inspected ScriptState. Reference to the object is stored on the global DOM object.
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::discardInjectedScripts): This method is expected to be called when the
+        the InjectedScript are no longer needed. In particular, this should be called before frame navigation. 
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::setInjectedScriptSource): This allows to provide injected script source.
+        The source may be loaded in a platform specific way.
+
+2010-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix handling of unusual kana sequences in search
+        https://bugs.webkit.org/show_bug.cgi?id=33506
+
+        * editing/TextIterator.cpp:
+        (WebCore::composedVoicedSoundMark): Removed unnnecessary case for a
+        non-kana-letter character. This function only works for kana letters.
+        (WebCore::SearchBuffer::isBadMatch): Fixed voiced sound mark code to
+        properly handle cases where one character has a shorter list of
+        combining voiced sound marks than the other.
+
+2010-01-11  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Clear m_acceptedIndexOnAbandon flag when user accepts the selected index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33499
+
+        TEST: manual-tests/chromium/onchange-reload-popup.html
+        It should be covered by the above test. The current
+        test shell does not support sending keyboard events to popup
+        list so use manual test for it.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::acceptIndex):
+
+2010-01-11  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Debug bots crashing in plugins/iframe-shims.html
+        https://bugs.webkit.org/show_bug.cgi?id=33472
+
+        Call computeOffsetInContainerNode() instead of
+        offsetInContainerNode(), since we are not sure this is always
+        parent-anchored.
+
+        plugins/iframe-shims.html no longer ASSERTS
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+
+2010-01-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33455
+        Allows plugins to participate in accelerated compositing
+
+        For plugins using the CoreAnimation rendering mode, host their CALayers in the
+        accelerated compositing layer tree.
+        
+        This requires making normal flow RenderLayers for RenderEmbeddedObjects when they represent
+        a plugin using this mode.
+        
+        * WebCore.base.exp: Export Node::setNeedsStyleRecalc() for use by WebKit.
+        * WebCore.xcodeproj/project.pbxproj: Re-order files for sorting.
+
+        * rendering/RenderEmbeddedObject.h:
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::requiresLayer): Make a layer if the plugin is using
+        accelerated compositing mode.
+        (WebCore::RenderEmbeddedObject::allowsAcceleratedCompositing): Asks whether the plugin has
+        a layer, via PluginWidget.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        RenderEmbeddedObjects should be normal flow layers, and self-painting layers.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        Parent the plugin's layer in the GraphicsLayer when updating the layer configuration.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin):
+        RenderEmbeddedObjects that allow accelerated compositing trip accelerated compositing mode
+        for the page.
+
+2010-01-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed an uninitialized PluginView member (m_mode) which wasn't
+        set when constructed with a null PluginPackage*
+
+        https://bugs.webkit.org/show_bug.cgi?id=33468
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2010-01-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG radialGradient example radial-gradient-with-outstanding-focalPoint.svg fails
+        https://bugs.webkit.org/show_bug.cgi?id=32201
+
+        This patch moves every focalPoint that lies outside the circle defined by the radial
+        gradients central point and its radius to stay inside this circle, as demanded by the
+        SVG 1.1 specification.
+        We use r * 0.99 as maximum radius for the aforementioned circle, when determining where
+        the focalPoint is lying, to achieve compatibility with Firefox.
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2010-01-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33493
+        Log redirect details to Network channel
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Log response code and Location header field value. Also, removed a redundant null check.
+
+2010-01-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33491 REGRESSION: 
+        Many SVG -webkit-shadow tests are currently failing (in the pixel 
+        tests)
+        -and-
+        <rdar://problem/7501200>
+
+        The real fix here is to call inflateForShadow() on the repaintRect 
+        in prepareToRenderSVGContent(). But in order to do that, I had to 
+        move inflateForShadow() to a different class since functions in 
+        SVGRenderBase cannot call each other. inflateForShadow() now exists 
+        in SVGRenderStyle which I think makes some sense because a similar 
+        function that returns a box shadow's extent exists on RenderStyle.
+
+        Now call inflateForShadow() through the SVGRenderStyle.
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+
+        No longer implement inflateForShadow() here.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent): Call new 
+        inflateForShadow() through the SVGRenderStyle
+        * rendering/SVGRenderSupport.h:
+
+        Implementation of inflateForShadow() now lives here.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::getSVGShadowExtent):
+        (WebCore::SVGRenderStyle::inflateForShadow):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-01-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Rewrite relative URLs in the ElementsTreeOutline to make them navigable
+
+        Targets for "src" and "href" attribute values in the Elements outline tree
+        are rewritten to full URLs whenever possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33024
+
+        Test: inspector/elements-panel-rewrite-href.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._rewriteAttrHref):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/inspector.js:
+
+2010-01-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Attempt to fix windows builds, by removing the no-longer existant JSSVGPointListCustom.cpp from JSBindingsAllInOne.cpp.
+
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2010-01-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Adam Roben & Dirk Schulze.
+
+        svg <text> fails to update when setting x/y
+        https://bugs.webkit.org/show_bug.cgi?id=22384
+
+        Introduce JSSVGPODListCustom, refactoring the existing custom code for SVG POD type lists.
+        (Currently SVGTransformList/SVGPointList was handled correctly, and SVGLengthList/SVGNumberList not)
+
+        Remove the need for custom JSSVG*List.cpp implementations, but instead tweak CodeGeneratorJS.pm,
+        to call into the new JSSVGPODListCustom methods. Fixes dynamic updates of the SVGTextElement
+        'rotate' & 'x'/'y' SVG DOM properties.
+
+        Tests: svg/custom/text-xy-updates-SVGList.xhtml
+               svg/dynamic-updates/SVGTextElement-svgdom-rotate-prop.html
+  
+        * Android.jscbindings.mk: Remove old files from build, add the new header.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGPODListCustom.h: Copied from bindings/js/JSSVGTransformListCustom.cpp. Refactored code to be sharable between all JSSVG*List classes.
+        (WebCore::JSSVGPODListCustom::finishGetter):
+        (WebCore::JSSVGPODListCustom::finishSetter):
+        (WebCore::JSSVGPODListCustom::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPODListCustom::clear):
+        (WebCore::JSSVGPODListCustom::initialize):
+        (WebCore::JSSVGPODListCustom::getItem):
+        (WebCore::JSSVGPODListCustom::insertItemBefore):
+        (WebCore::JSSVGPODListCustom::replaceItem):
+        (WebCore::JSSVGPODListCustom::removeItem):
+        (WebCore::JSSVGPODListCustom::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp: Removed.
+        * bindings/js/JSSVGTransformListCustom.cpp: Removed.
+        * bindings/scripts/CodeGeneratorJS.pm: Forward any SVGList call on POD list types to the new JSSVGPODListCustom.
+        * svg/SVGNumberList.cpp: Make SVGNumberList a SVGPODList, instead of a SVGList, to make dynamic updates work.
+        (WebCore::SVGNumberList::SVGNumberList):
+        * svg/SVGNumberList.h:
+        * svg/SVGPointList.idl: Remove JSCCustom markers everywhere.
+        * svg/SVGTransformList.idl: Ditto.
+
+2010-01-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cannot focus on an empty editable span in a non editable div.
+        https://bugs.webkit.org/show_bug.cgi?id=33411
+        <rdar://problem/5982901>
+
+        We now allow to set the focus inside an empty inline element if it is the only
+        editable element inside non-editable content.
+
+        * dom/Position.cpp:
+        (WebCore::Position::isCandidate): Extended to allow positions in inline elements when
+        at the border between editable and non editable content.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to be able to calculate the caret
+        position inside an empty inline.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): When merging, we don't always find a break
+        element, since now an editable inline is a VisiblePosition if it is at editability boundary.
+        * editing/VisibleSelection.h: Updated comment on the use of Position member variables
+        instead of VisiblePosition.
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged): Changed to avoid multiple calls to upstream and
+        downstream on the same position.
+
+2010-01-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [V8] IsRefPtrType() in CodeGeneratorV8.pm increases maintenance burden.
+        https://bugs.webkit.org/show_bug.cgi?id=32994
+
+        Refactoring, covered by existings tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Reversed testing for ref-counted objects,
+            since there's a much smaller (and more stable) set of non-ref-counted ones.
+
+2010-01-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes the fact that timeline panel results are skewed by the use of DOM mutation events.
+        https://bugs.webkit.org/show_bug.cgi?id=32846
+
+        Instead of using DOM mutation events in InspectorDOMAgent, InspectorController is now called
+        directly when the DOM is mutated.
+
+        * dom/ContainerNode.cpp: Calls InspectorController directly when child nodes are added/removed.
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp: Calls InspectorController directly when attributes are added/removed.
+        (WebCore::Element::dispatchAttrRemovalEvent):
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didInsertDOMNode):
+        (WebCore::InspectorController::didRemoveDOMNode):
+        (WebCore::InspectorController::didModifyDOMAttr):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::didInsertDOMNode):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        * inspector/InspectorDOMAgent.h:
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Japanese text search ignores small vs. large and voicing mark differences
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+        rdar://problem/7214058
+
+        Test: fast/text/find-kana.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::isKanaLetter): Added.
+        (WebCore::isSmallKanaLetter): Added.
+        (WebCore::composedVoicedSoundMark): Added.
+        (WebCore::isCombiningVoicedSoundMark): Added.
+        (WebCore::containsKanaLetters): Added.
+        (WebCore::normalizeCharacters): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Initialize the data members
+        m_targetRequiresKanaWorkaround and m_normalizedTarget.
+        (WebCore::SearchBuffer::isBadMatch): Added. Checks for matches that
+        ICU's default collation considers correct, but we consider incorrect.
+        (WebCore::SearchBuffer::search): Added code to call isBadMatch and
+        move to the next match with usearch_next if the result is true.
+
+2010-01-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+        (webkit_accessible_text_get_caret_offset):
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (SelectionController::notifyAccessibilityForSelectionChange)
+
+        Adjust the caret offset and object with focus to reflect the
+        unignored parent of the static text object which contains the
+        caret. This is necessary because the static text objects are
+        no longer being exposed to ATs.
+
+2010-01-11  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Touchevent coordinates are incorrect after page zoom and page scroll
+        https://bugs.webkit.org/show_bug.cgi?id=32899
+
+        Test: fast/events/touch-coords-in-zoom-and-scroll.html
+
+        * dom/Touch.cpp:
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+
+2010-01-11  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Have "Paste and Match Style" fire the dom paste event.
+        https://bugs.webkit.org/show_bug.cgi?id=30639
+
+        Test: editing/execCommand/paste-and-match-style-event.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::pasteAsPlainText):
+
+2010-01-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Rollout renderpath culling as it once again breaks pixel tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+
+2010-01-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allows plugins to participate in accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33455
+
+        Part 1: rename setContentsToVideo() on GraphicsLayer to setContentsToMedia()
+        to make it more general. Rename associated enums and methods similarly.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToMedia):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToMedia):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsMediaLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+
+2010-01-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmerman.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Cull RenderPaths before passing on to the underlying graphics system.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+
+2010-01-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add defensive initialization of iframe sandbox flags
+        https://bugs.webkit.org/show_bug.cgi?id=32368
+
+        We now initialize the SecurityOrigin's sandbox state directly duing
+        construction.  This lets us properly set the isUnique bit.
+
+        Tests: http/tests/security/sandboxed-iframe-origin-add.html
+               http/tests/security/sandboxed-iframe-origin-remove.html
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::create):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        * page/SecurityOrigin.h:
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Inspect Element selects the wrong element.
+        Drive-by fix that focuses dom tree upon settting focuesDOMNode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33449
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.prototype.select):
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce support for flexible line height in the text editor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33431
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._offsetToLineNumber):
+        (WebInspector.TextEditor.prototype._lineNumberToOffset):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._selectionChanged):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLineNumbers):
+        (WebInspector.TextEditor.prototype._paintCurrentLine):
+        (WebInspector.TextEditor.prototype._scroll):
+        (WebInspector.TextEditor.prototype._repaintOnScroll):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._invalidateHighlight):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._initFont):
+        (WebInspector.TextCursor.prototype.setTextLineHeight):
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not repaint line numbers while editing within line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33427
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._selectionChanged):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLineNumbers):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._copy):
+
+2010-01-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed whitespace fixes.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateSandboxFlags):
+        * loader/FrameLoader.h:
+
+2010-01-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Unify origin sandbox flag with m_noAccess in SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=32372
+
+        It turns out the SandboxOrigin bit is slightly different than the
+        unique origin concept because the sandbox bit is inherited by iframes.
+        These concepts are separate in the spec, so I think it's ok to keep
+        them separate in the implementation as well.
+
+        No new tests because there is no behavior change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie):
+        (WebCore::Document::setCookie):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemesWithUniqueOrigins):
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::taintsCanvas):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::toString):
+        (WebCore::SecurityOrigin::registerURLSchemeAsNoAccess):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsNoAccess):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        (WebCore::SecurityOrigin::canAccessCookies):
+        (WebCore::SecurityOrigin::isUnique):
+
+2010-01-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ScriptController::isEnabled needs to be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=32063
+
+        Rename ScriptController::isEnabled to
+        ScriptController::canExecuteScripts to reflect what the method actually
+        means.  This is a trivial change, but it involved touching a lot of
+        call sites.
+
+        * WebCore.PluginHostProcess.exp:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::processToken):
+        * inspector/InspectorController.cpp:
+        (WebCore::canPassNodeToJavaScript):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+
+2010-01-09  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector font for errors is ugly on non-OSX platforms
+        https://bugs.webkit.org/show_bug.cgi?id=33340
+
+        * css/view-source.css: Add a fallback to sans-serif on a CSS
+        selector that previously only listed Lucida Grande.
+
+2010-01-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        <rdar://problem/7525778> Font fallback kills SVG kerning
+        https://bugs.webkit.org/show_bug.cgi?id=33400
+
+        Test: platform/mac/fast/text/sticky-typesetting-features.html
+
+        Cache font attributes separately for different typesetting features.
+
+        * platform/graphics/SimpleFontData.h: Replaced single-element caches
+        with maps.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures): Added an ATSUStyle parameter.
+        (WebCore::initializeATSUStyle): Look up the ATSUStyle in the map and
+        initialize if necessary. Return the ATSUStyle.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+        Use the ATSUStyle returned from initializeATSUStyle().
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy): Destroy the ATSUStyles in the
+        map.
+        (WebCore::SimpleFontData::getCFStringAttributes): Look up the attributes
+        dictionary in the map and initialize if necessary.
+
+2010-01-08  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Fix namespace indent for SecurityOrigin.h.
+
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::domainWasSetInDOM):
+        (WebCore::SecurityOrigin::protocol):
+        (WebCore::SecurityOrigin::host):
+        (WebCore::SecurityOrigin::domain):
+        (WebCore::SecurityOrigin::port):
+        (WebCore::SecurityOrigin::canLoadLocalResources):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        (WebCore::SecurityOrigin::):
+
+2010-01-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dmitry Titov.
+
+        bindings/v8/DOMData is missing a virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=33390
+
+        DOMData is the base class for ChildThreadDOMData and MainThreadDOMData classes
+        but it does not have a virtual destructor. While this isn't currently causing
+        any leaks, since there are no instances of ChildThreadDOMData or
+        MainThreadDOMData that are manipulated via a DOMData pointer, the ARM GCC
+        compiler generates the following compilation error:
+
+        "/WebCore/bindings/v8/DOMData.h:45: error: 'class WebCore::DOMData' has virtual
+        functions and accessible non-virtual destructor"
+
+        We therefore need to add a virtual destructor to DOMData.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::~DOMData):
+        * bindings/v8/DOMData.h:
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+
+        No functionality was changed. So, no new tests.
+
+        * platform/graphics/SimpleFontData.h:
+        * plugins/PluginPackage.cpp:
+
+2010-01-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebGL canvas paints background color twice
+        https://bugs.webkit.org/show_bug.cgi?id=33361
+
+        Clean up some logic around "directly composited" content: some images, video, and WebGL.
+
+        We previously set the GraphicsLayer background color to the CSS background color
+        in some cases where the box has no other decorations. However, the content 
+        layer's bounds do not correspond with the background box in many cases,
+        and we could end up both painting the background color, and setting it on the layer.
+        
+        Simplify this logic to never use layer background colors, and thus skip allocating
+        backing store only when the element has no visible box decorations.
+
+        Tests: compositing/images/direct-image-background-color.html
+               compositing/reflections/simple-composited-reflections.html
+               compositing/video/video-background-color.html
+               compositing/webgl/webgl-background-color.html
+               compositing/webgl/webgl-blending.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::is3DCanvas): Utility to determine if a RenderObject is a canvas with WebGL
+        (WebCore::RenderLayerBacking::RenderLayerBacking): Remove m_hasDirectlyCompositedContent.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): canUseDirectCompositing()
+        is renamed to isDirectlyCompositedImage() and only applies to images now. 
+        No longer set layer background color.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Just use hasPaintedContent()
+        as the argument to setDrawsContent().
+        (WebCore::hasBoxDecorationsOrBackground): Renamed.
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        (WebCore::hasBoxDecorationsOrBackgroundImage): Renamed from hasBoxDecorations().
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Moved test for
+        hasOverflowControls() into hasNonCompositingContent() and removed the FIXME comment.
+        (WebCore::RenderLayerBacking::containsPaintedContent): New method that decides
+        if the layer (and its non-composited children) has any content that must be painted into backing store.
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage): Renamed from canUseDirectCompositing()
+        and reduced to only apply to images.
+        (WebCore::RenderLayerBacking::rendererContentChanged): 3D canvas no longer falls under the
+        canUseDirectCompositing() scope.
+
+2010-01-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use member initialization syntax instead of assignment for member variables of Document used
+        for determining minimum layout delay.
+        https://bugs.webkit.org/show_bug.cgi?id=33316
+
+        No new tests, style change only.
+
+        * dom/Document.cpp: Modified.
+        (WebCore::Document::Document): Modified. Use initializer list for m_startTime, m_overMinimumLayoutThreshold and m_extraLayoutDelay.
+
+2010-01-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Passing array that is too large to set method of WebGLArrays does not throw an exception
+        https://bugs.webkit.org/show_bug.cgi?id=33352
+
+        Added needed range checks to JSC and V8 custom bindings. Expanded
+        preexisting test suite for WebGLArrays and updated its expected
+        results. Tested in WebKit and Chromium.
+
+        Test: fast/canvas/webgl/array-set-out-of-bounds.html
+
+        * bindings/js/JSWebGLArrayHelper.h:
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::setWebGLArrayFromArray):
+
+2010-01-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32962
+        HTML tags are wrongfully parsed when setting innerHTML of a SCRIPT element
+
+        Also fixed the same for STYLE elements.
+
+        Tests: fast/dom/css-innerHTML.html
+               fast/dom/script-innerHTML-x.xhtml
+               fast/dom/script-innerHTML.html
+
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::setInnerHTML): Don't parse JS or CSS as HTML,
+        matching Firefox.
+
+2010-01-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32757 Repaint bug 
+        with -webkit-shadow on svg shapes
+        -and-
+        <rdar://problem/7389149>
+
+        Inflate the repaintRect for the shadow using its extent.
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::getSVGShadowExtent):
+        (WebCore::SVGRenderBase::inflateForShadow):
+        * rendering/SVGRenderSupport.h:
+
+2010-01-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebGLArray subclasses do the wrong conversion in indexSetter
+        https://bugs.webkit.org/show_bug.cgi?id=33350
+
+        Test: fast/canvas/webgl/array-setters.html
+
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::indexSetter):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::indexSetter):
+
+2010-01-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Delegation client
+        https://bugs.webkit.org/show_bug.cgi?id=32826
+
+        Factory related code removed from QtAbstractWebPopup. Popups are now created
+        by ChromeClientQt.
+        Popup content information struct added to class QtAbstractWebPopup.
+        PopupMenuClient is now hidden from higher layers.
+        QtAbstractWebPopup now receives content information and font as parameters
+        of method populate.
+        QtFallbackWebPopup moved to WebKit/qt/WebCoreSupport.
+
+        * WebCore.pro:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::getItems):
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        (WebCore::QtAbstractWebPopup::valueChanged):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::Item::):
+        * platform/qt/QtFallbackWebPopup.cpp: Removed.
+        * platform/qt/QtFallbackWebPopup.h: Removed.
+
+2010-01-08  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Skip invalid blocks in CSS property declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=31231
+        https://bugs.webkit.org/show_bug.cgi?id=26619
+
+        This patch makes the CSS parser skip property declarations containing invalid blocks.
+
+        Test: fast/css/parsing-error-recovery.html
+
+        * css/CSSGrammar.y:
+
+2010-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: CSS content not returned correctly in AX
+        https://bugs.webkit.org/show_bug.cgi?id=33308
+
+        Test: platform/mac/accessibility/css-content-attribute.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+
+2010-01-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Implement full-screen video for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=31318
+        
+        This is mostly support logic for taking video
+        into and out of full-screen. It also contains the
+        QTMovieWin piece which adds support for the actual
+        full-screen window itself. Events from the window
+        are sent to the FullscreenVideosController for handling.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addData):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWin::initializeQuickTime):
+        (QTMovieWin::_handleMessages):
+        (QTMovieWin::enterFullscreen):
+        (QTMovieWin::exitFullscreen):
+        * platform/graphics/win/QTMovieWin.h:
+
+2010-01-08  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a regression that removed a call to
+        FrameLoaderClient::didDestroyScriptContextForFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=33347
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+
+2010-01-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        WebKit plugins are not rendered during printing.
+        https://bugs.webkit.org/show_bug.cgi?id=33022.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Tell
+          cairo printing surface to flush so that blank regions do
+          not write over the plugin's paint operations.
+        * rendering/RenderLayer.cpp: Build fix.
+        (WebCore::RenderLayer::beginTransparencyLayers): Correct
+          method signature missing for ColorSpace.
+
+2010-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(52819?): AXLoadComplete and AXLayoutComplete causes 4 tests fail on Snow Leopard Debug bot
+        https://bugs.webkit.org/show_bug.cgi?id=33300
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilitySetPostedNotificationCallback:withContext:]):
+        (-[AccessibilityObjectWrapper accessibilityPostedNotification:]):
+
+2010-01-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Regex-based syntax highlighting is slow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33330
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptHighlighterScheme.js: Removed.
+        * inspector/front-end/JavaScriptTokenizer.js: Added.
+        (WebInspector.JavaScriptTokenizer):
+        (WebInspector.JavaScriptTokenizer.prototype.set line):
+        (WebInspector.JavaScriptTokenizer.prototype.getCondition):
+        (WebInspector.JavaScriptTokenizer.prototype.setCondition):
+        (WebInspector.JavaScriptTokenizer.prototype._charAt):
+        (WebInspector.JavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/JavaScriptTokenizer.re2js: Added.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-07  Mike Belshe  <mbelshe@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Spdy casing to match style guide.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33326
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::wasFetchedViaSPDY):
+        (WebCore::ResourceResponse::setWasFetchedViaSPDY):
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * config.h:
+
+2010-01-07  Stephanie Lewis  <slewis@apple.com>
+
+        Rolled out http://trac.webkit.org/changeset/52778 due to rolling
+        out http://trac.webkit.org/changeset/52756
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+
+2010-01-07  Stephanie Lewis  <slewis@apple.com>
+
+        Rollout http://trac.webkit.org/changeset/52756 due to a large performance regression.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayout):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::caretBlinkTimerFired):
+        (WebCore::Frame::selectionBounds):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Don't disable specific
+        function tracking here; it's too late, as some specific functions
+        may already have been tracked in the base class constructor.
+
+2010-01-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        SVGTextElement & friends need to implement svgAttributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=33284
+
+        Implement svgAttributeChanged() for SVGTextElement & SVGTRefElement. As <text> element contain children,
+        childrenChanged() has to be implemented as well for SVGTextElement.
+
+        Simplify SVGTransformable::parseTransformAttribute() code, clearing lists in the beginning
+        and on error case, after parsing - previously the calling site had to take care of that.
+
+        Tests: svg/dynamic-updates/SVGTRefElement-dom-href-attr.html
+               svg/dynamic-updates/SVGTextElement-dom-transform-attr.html
+               svg/dynamic-updates/SVGTextElement-svgdom-transform-prop.html
+
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::parseMappedAttribute):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute):
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::parseMappedAttribute):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::svgAttributeChanged):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::parseMappedAttribute):
+        (WebCore::SVGTextElement::svgAttributeChanged):
+        (WebCore::SVGTextElement::childrenChanged):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::svgAttributeChanged):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::SVGTransformable::parseTransformAttribute):
+        * svg/SVGTransformable.h:
+
+2010-01-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Padding in popup menu gets lost with styled <select> in Windows.
+        Fixes <rdar://7285538>, and <http://webkit.org/b/33235>.
+
+        [Win] Support padding-right on selects when webkit-appearance is off. Added a test
+        case for narrow selects with -webkit-appearance: none, and padding left and right to
+        show that both types of padding are honored.
+
+        * manual-tests/select-webkit-appearance-off-narrow-select.html: Added.
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::calculatePositionAndSize): Use clientPaddingRight instead of a hardcoded constant.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::clientPaddingRight): If webkit-appearance is off, use padding-right instead of
+        the hardcoded constant.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        * config.h: Define JS_EXPORTCLASS. I'm not sure why this isn't done in JSC globally for all
+        possible clients, but keeping the current design for now.
+
+2010-01-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Account for scale and current context position (as well as page
+        position) in the device context world transform passed to
+        plugins.  This is especially important for print surface DPI.
+        http://bugs.webkit.org/show_bug.cgi?id=32909.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Revise
+          world context handling to include scaling and translation
+          already set for the CTM.
+
+2010-01-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate V8 bindings header declarations for named and indexed accessors.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Better build fix: use 'this->structure()', since 'structure' is a
+        PassRefPtr, and therefore null.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: avoid a name conflict by using the local 'structure' instead
+        of the member 'structure()'.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix.
+
+        Add RenderEmbeddedObject.h/cpp to all the build systems.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Disabled specific function
+        tracking for the window object, since there's no way to do direct
+        method calls on the window object; they all go through the window shell.
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Kevin Decker, Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33338
+        Create a renderer for <object> and <embed>
+        
+        Add RenderEmbeddedObject, which derives from RenderPartObject, and is created for <object> and <embed>.
+        Instances of RenderPartObject are now only allocated for iframes.
+        
+        Move object/embed-related code from RenderPartObject to RenderEmbeddedObject.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add RenderEmbeddedObject.h/cpp
+        
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::createRenderer): Create a RenderEmbeddedObject.
+        (WebCore::HTMLEmbedElement::updateWidget): Use toRenderEmbeddedObject()
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::createRenderer): Make a RenderEmbeddedObject for the plugin-proxy case.
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use toRenderEmbeddedObject() in the plugin-proxy code.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::createRenderer): Make a RenderEmbeddedObject
+        (WebCore::HTMLObjectElement::updateWidget): Use toRenderEmbeddedObject()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addWidgetToUpdate):
+        (WebCore::FrameView::removeWidgetToUpdate):
+        (WebCore::FrameView::updateWidgets):
+        Objects in the m_widgetUpdateSet are only ever RenderEmbeddedObjects.
+        
+        * rendering/RenderEmbeddedObject.cpp: Added.
+        * rendering/RenderEmbeddedObject.h: Added.
+        Most of the code moved from RenderPartObject.
+        
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isEmbeddedObject): New method.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): Initialize m_hasFallbackContent here, rather than in the derived classes.
+        * rendering/RenderPart.h: Comments.
+        
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject): Clean up, code moved to base class, and removed object/embed-specific code.
+        (WebCore::RenderPartObject::layout): Removed object/embed-specific code.
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33338
+        Create a renderer for <object> and <embed>
+
+        First part of this change: renderPartObject->updateWidget() is a no-op for iframe elements,
+        so we don't need to call it here, and can thus remove the attach() override entirely.
+
+        * html/HTMLIFrameElement.cpp:
+        * html/HTMLIFrameElement.h:
+
+2009-01-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate to canvas-based text viewer / editor that scales.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33001
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptHighlighterScheme.js: Added.
+        (WebInspector.JavaScriptHighlighterScheme):
+        * inspector/front-end/KeyboardShortcut.js:
+        * inspector/front-end/TextEditor.js: Added.
+        (WebInspector.TextEditor):
+        (WebInspector.TextSelectionModel):
+        (WebInspector.TextCursor):
+        * inspector/front-end/TextEditorHighlighter.js: Added.
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextEditorModel.js: Added.
+        (WebInspector.TextRange):
+        (WebInspector.TextRange.prototype.clone):
+        (WebInspector.TextEditorModel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2010-01-07  Christian Sejersen  <christian.webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        document.title does not replace or remove space characters
+        https://bugs.webkit.org/show_bug.cgi?id=27032
+
+        Test: fast/dom/Document/document-title-get.html
+
+        * dom/Document.cpp: 
+        (WebCore::Document::Document): 
+        Initialization of m_rawTitle
+        (WebCore::canonicalizedTitle): 
+        Moved from DocumentLoader.cpp with minor edits
+        (WebCore::Document::updateTitle): 
+        Ensures the title is canonicalized
+        (WebCore::Document::setTitle): 
+        Uses m_rawTitle instaed of m_title 
+        (WebCore::Document::removeTitle): 
+        Uses m_rawTitle instead of m_title
+        
+        * dom/Document.h: 
+        Added m_rawTitle that stores the passed in title, m_title now stores the 
+        canonicalized title
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::setTitle): 
+        The title passed in is now canonicalized in Document.cpp
+
+2010-01-07  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Allow leading/trailing space for CSS nth-*() and lang().
+        https://bugs.webkit.org/show_bug.cgi?id=17248
+
+        For pseudo-classes :nth-*() and :lang(), space must be allowed after '(' and before ')'.
+        See the bug comments for why we don't allow space at other places.
+
+        * css/CSSGrammar.y:
+
+2010-01-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: contentEditable DIVs are not AX accessible
+        https://bugs.webkit.org/show_bug.cgi?id=33325
+
+        Test: accessibility/contenteditable-hidden-div.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2010-01-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Resolve merge conflict.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2010-01-07  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52847.
+        http://trac.webkit.org/changeset/52847
+        https://bugs.webkit.org/show_bug.cgi?id=33232
+
+        Might have caused a perf regression.  I'm rolling this out to see if it
+        heals the perf bot.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::currentContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::windowShell):
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::adjustedContext):
+
+2010-01-07  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Made TypesettingFeatures.h private.
+
+2010-01-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added Font::typesettingFeatures() and deployed it
+
+        No change in funcitonality
+
+        * WebCore.xcodeproj/project.pbxproj: Added TypesettingFeatures.h.
+        * platform/graphics/Font.h:
+        (WebCore::Font::typesettingFeatures): Added. Determines the typesetting
+            features from the text redndering mode.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache): Use typesettingFeatures().
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/TypesettingFeatures.h: Added.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures): Take TypesettingFeatures instead of
+            TextRenderingMode.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+            Use typesettingFeatures().
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+            Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes): Take
+            TypesettingFeatures instead of TextRenderingMode.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak): Use TypesettingFeatures().
+
+2010-01-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r52900.
+        http://trac.webkit.org/changeset/52900
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Broke over 30 SVG pixel tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] The library version number of the first package release is 4.7.0.
+
+        * WebCore.pro:
+
+2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow the application to override online/offline network status
+        https://bugs.webkit.org/show_bug.cgi?id=32684
+
+        Added API to NetworkStateNotifier for forcing network status.
+
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
+        (WebCore::NetworkStateNotifierPrivate::networkAccessPermissionChanged):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
+
+2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix linkage against Qt mobility API bearer management module
+
+        Use the documented .pro file syntax to link against the correct
+        library and (more importantly) get the include paths correct.
+
+        * WebCore.pro:
+
+2010-01-07  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33272
+        'abort' event still fired as a progress event
+
+        rdar://6710625
+        Test media/video-error-abort.html doesn't work
+
+        Test: http/tests/media/video-error-abort.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleEvent): Incorporate code from enqueueEvent.
+        (WebCore::HTMLMediaElement::loadInternal): Fix 'abort' event firing logic missed
+        in https://bugs.webkit.org/show_bug.cgi?id=30513. Change order of initialization 
+        to match spec wording.
+        * html/HTMLMediaElement.h: Remove enqueueEvent prototype.
+
+2010-01-07  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Wrong state and TouchLists in TouchEvents
+        https://bugs.webkit.org/show_bug.cgi?id=32878
+
+        Touch events changed to match the API and semantics of iPhone and
+        Android. Each new touch point press dispatches a touchstart event with
+        the pressed touch point(s) in the changedTouches list, and a release
+        dispatches a touchend event with the released touch point(s) in
+        changedTouches. Moved points dispatch a touchmove event, with the moved
+        points in changedTouches. Old behaviour emitted only one touchstart when
+        the first point was pressed and one touchend when the last point was
+        released, and any events in between were touchmoves. New presses or
+        releases could only be detected by comparing the lists touches and
+        changedTouches.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove COM code generation stuff.
+        https://bugs.webkit.org/show_bug.cgi?id=32854
+
+        Remove the followings:
+        - CodeGeenratorCOM.pm, COM code generator,
+        - "#if !defined(LANGUAGE_COM) || !LANGUAGE_COM" in IDL files, and
+        - UUID attributes in IDL files.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Removed.
+        * css/CSSCharsetRule.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRule.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSUnknownRule.idl:
+        * css/CSSValue.idl:
+        * css/CSSValueList.idl:
+        * css/Counter.idl:
+        * css/MediaList.idl:
+        * css/RGBColor.idl:
+        * css/Rect.idl:
+        * css/StyleSheet.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframeRule.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/Attr.idl:
+        * dom/CDATASection.idl:
+        * dom/CharacterData.idl:
+        * dom/Comment.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/EntityReference.idl:
+        * dom/Event.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeList.idl:
+        * dom/Notation.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Text.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDListElement.idl:
+        * html/HTMLDirectoryElement.idl:
+        * html/HTMLDivElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFontElement.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLHRElement.idl:
+        * html/HTMLHeadElement.idl:
+        * html/HTMLHeadingElement.idl:
+        * html/HTMLHtmlElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLIsIndexElement.idl:
+        * html/HTMLLIElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLMapElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMenuElement.idl:
+        * html/HTMLMetaElement.idl:
+        * html/HTMLModElement.idl:
+        * html/HTMLOListElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptGroupElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLParagraphElement.idl:
+        * html/HTMLParamElement.idl:
+        * html/HTMLPreElement.idl:
+        * html/HTMLQuoteElement.idl:
+        * html/HTMLScriptElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/HTMLTableCaptionElement.idl:
+        * html/HTMLTableCellElement.idl:
+        * html/HTMLTableColElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLTitleElement.idl:
+        * html/HTMLUListElement.idl:
+
+2010-01-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds the ability to increase the delay used when scheduling layout.
+        https://bugs.webkit.org/show_bug.cgi?id=32875
+
+        No new tests possible.
+
+        * dom/Document.cpp: Modified.
+        (WebCore::Document::Document): Modified. Initializes extra layout delay to zero.
+        (WebCore::Document::minimumLayoutDelay): Modified. Adds extra layout delay when calculating minimum layout delay.
+        * dom/Document.h: Modified.
+        (WebCore::Document::setExtraLayoutDelay): Added. Sets the extra layout delay.
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Some IDL files lack "," separators for extended attributes.
+        https://bugs.webkit.org/show_bug.cgi?id=33190
+
+        To find such mistakes, IDLParser.pm rejects whitespace characters in
+        extended attribute names.
+
+        * bindings/scripts/IDLParser.pm:
+          parseExtendedAttributes rejects whitespace in a name.
+        * css/WebKitCSSTransformValue.idl: Add missing ",".
+        * dom/EventTarget.idl: ditto.
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix an issue that CodeGeneratorV8.pm doesnt handle HasIndexGetter of
+        WebKitCSSTransformValue.idl correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=33193
+
+        CodeGeneratorV8.pm doesn't handle inheritance very well and it
+        tried to refer v8WebKitCSSTransformValueIndexedPropertyGetter(),
+        which does not exist. Because WebKitCSSTransformValue inherits
+        CSSValueList and CSSValueList already has HadIndexGetter, we don't
+        need to do anything for WebKitCSSTransformValue about HasIndexGetter.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+          Reset $hasGetter for WebKitCSSTransformValue.
+
+2010-01-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not return strings whose handles are in near death state (that means
+        they might be GCed) or just empty.
+        https://bugs.webkit.org/show_bug.cgi?id=31180
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2010-01-06  MORITA Hajime  <morrita@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG background color on selected text goes wrong when text has
+        gradient stroke.
+        https://bugs.webkit.org/show_bug.cgi?id=33069
+
+        Introduced SVGTextPaintSubphase like as PaintPhase on html painting,
+        and paint background and foreground in separate subphase.
+        
+        Test: svg/text/selection-background-color.xhtml
+        
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        Added m_setupBackgroundCallback, m_setupForegroundCallback
+        (WebCore::SVGTextChunkWalker::setupBackground):
+        (WebCore::SVGTextChunkWalker::setupForeground):
+        Added.
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        pass SVGTextPaintInfo instead of SVGPaintServer
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGTextPaintSubphase):
+        (WebCore::SVGTextPaintInfo::SVGTextPaintInfo):
+        Added.
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        Invoke setupBackground() and setupForeground()
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupBackgroundCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupForegroundCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::activePaintServer):        
+        Added.
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        
+2010-01-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make windowsKeyCodeForKeyEvent() return correct key code for
+        numeric-pad arrow keys.
+        https://bugs.webkit.org/show_bug.cgi?id=33250
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-18 Patrick Gansterer <paroga@paroga.com>
+
+        Reviewed by Dirk Schulze.
+
+        Improve DOM performance in large SVG files.
+        Check the dirty area before painting a path, which prevents unnecessary
+        clipping and changes to the GraphicsContext.
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use a static HashMap for HTMLElement::tagPriority().
+        https://bugs.webkit.org/show_bug.cgi?id=33269
+
+        The prior code compares AtomicStringImpl pointers 18 times at
+        worst. This change avoids it.
+
+        No new tests because this is just a refactoring.
+
+        * html/HTMLElement.cpp:
+        (WebCore::Empty1IntHashTraits): A HashTraits to return 1 as the empty value.
+        (WebCore::initializeTagPriorityMap): Initialization of a static HashMap.
+        (WebCore::HTMLElement::tagPriority): Use the static HashMap created by initializeTagPriorityMap().
+        * html/HTMLElement.h:
+        (WebCore::HTMLElement::HTMLElement): Add an assertion about non-null localName().
+
+2010-01-06  Mike Belshe  <mike@belshe.com>
+
+        Add a flag to the ResourceResponse for tracking if a request was
+        fetched via SPDY.  This is plumbed through so that we can inform
+        a webpage via JavaScript if it was fecthed via the experimental
+        SPDY protocol.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33186
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::wasFetchedViaSpdy):
+        (WebCore::ResourceResponse::setWasFetchedViaSpdy):
+
+2010-01-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] RenderTheme: Missing support for native sliders
+
+        https://bugs.webkit.org/show_bug.cgi?id=33122
+
+        Implement painting of native slider controls in RenderTheme
+        and unskip a couple of layout tests that are passing after
+        this change.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::adjustSliderTrackStyle):
+        (WebCore::RenderThemeQt::paintSliderThumb):
+        (WebCore::RenderThemeQt::adjustSliderThumbStyle):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::adjustSliderThumbSize):
+        * platform/qt/RenderThemeQt.h:
+
+2010-01-06  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        Adjust incorrect comments after r40534.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for chromium.
+        Add "bool V8WorkerContext::WebSocketEnabled()"
+
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::V8WorkerContext::WebSocketEnabled):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix.
+        remove wrong assertion
+
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::Bridge):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add WebSocket feature in Worker
+        https://bugs.webkit.org/show_bug.cgi?id=32214
+
+        Introduce ThreadableWebSocketChannel interface and add
+        WorkerThreadableWebSocketChannel for Worker.
+        WorkerThreadableWebSocketChannel uses WebSocketChannel in the
+        main thread, which is managed by Peer and communicated via Bridge.
+
+        Test: websocket/tests/workers/worker-simple.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::webSocket):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8Custom::v8WebSocketConstructorCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/CrossThreadCopier.h:
+        (WebCore::):
+        * websockets/ThreadableWebSocketChannel.cpp: Added.
+        * websockets/ThreadableWebSocketChannel.h: Added.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h: Added.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::didReceiveMessage):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::refThreadableWebSocketChannel):
+        (WebCore::WebSocketChannel::derefThreadableWebSocketChannel):
+        * websockets/WebSocketChannelClient.h:
+        * websockets/WebSocketHandshake.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Added.
+        * websockets/WorkerThreadableWebSocketChannel.h: Added.
+        * workers/WorkerContext.idl:
+
+2010-01-06  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Modified EventSource event-stream parser to support a single CR as line ending.
+        https://bugs.webkit.org/show_bug.cgi?id=33207
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::parseEventStream):
+        * page/EventSource.h:
+
+2010-01-06  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7488126> With text-rendering: optimizelegibility, sometimes lines run too long
+        https://bugs.webkit.org/show_bug.cgi?id=32794
+
+        Test: platform/mac/fast/text/line-breaking-with-kerning.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak): When kerning is enabled, include
+        the trailing space when measuring a word, then subtract its width. This
+        accounts for kerning between the last glyph of the word and the following space.
+
+2010-01-06  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Second step of:
+        <rdar://problem/6398111> Integrate hardware layers with out-of-process plug-ins layer hosting mechanism
+
+        * Plugins/Hosted/WebHostedNetscapePluginView.h: Expose the CALayer of the plugin by adding -pluginLayer method.
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView pluginLayer]): Added.
+        * Plugins/WebNetscapePluginView.h: Expose the CALayer of the plugin by adding -pluginLayer method.
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView pluginLayer]): Added.
+
+2010-01-06  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52877.
+        http://trac.webkit.org/changeset/52877
+        https://bugs.webkit.org/show_bug.cgi?id=33243
+
+        I screwed up landing this patch and only partially applied the patch I
+        was trying to land.
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::proxy):
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Rolling back in a change I should not have rolled out.
+
+        The original commit http://trac.webkit.org/changeset/52862
+        was rolled out again in http://trac.webkit.org/changeset/52871
+        but I now believe that rollout to be in error.
+        My sincerest apologies for the churn.
+
+        Fix the bug in previous commit: we shouldn't finish
+        decoding if "sizeOnly" is true.
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Let ScriptController have more than one windowShell
+        https://bugs.webkit.org/show_bug.cgi?id=33243
+
+        This patch lets ScriptController have more than one windowShell.  We're
+        currently only using one of them (for the main world), but this patch
+        lets us use other ones for isolated worlds soon.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.cpp:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::createWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::proxy):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2010-01-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.base.exp: Export symbols WebKit would like to use.
+        * plugins/PluginWidget.h:
+        (WebCore::PluginWidget::PluginWidget): Redeclare a constructor.
+
+2010-01-06  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Eric Carlson.
+        
+        First step toward:
+        <rdar://problem/6398111> Integrate hardware layers with out-of-process plug-ins layer hosting mechanism
+        
+        Small refactoring moving the PluginWidget class from WebKit to WebCore.          
+        * WebCore.xcodeproj/project.pbxproj: Added new source files and a "mac" group; exposes PluginWidget.h as a "Private" role
+        * platform/Widget.h: Added isPluginWidget(). 
+        (WebCore::Widget::isPluginWidget):
+        * plugins/PluginWidget.h: Added.
+        (WebCore::PluginWidget::isPluginWidget): Added as an interim solution until Mac plug-ins inheirt from PluginView.
+        * plugins/mac/PluginWidgetMac.mm: Added.
+        (WebCore::PluginWidget::invalidateRect): Added. Extracted from the old WebKit/FrameLoaderClientMac version of PluginWidget
+        
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52862.
+        http://trac.webkit.org/changeset/52862
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        Caused svg/W3C-SVG-1.1/linking-a-01-b.svg to crash on the
+        Leopard Release builder.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Revert the part of my last commit touching Base.xcconfig, was not meant to be commited.
+
+        * Configurations/Base.xcconfig:
+
+2010-01-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate header declarations for V8 binding security checks
+        and delete V8CustomBinding.cpp
+
+        * Android.v8bindings.mk: Removed V8CustomBinding.cpp.
+        * WebCore.gypi: Removed V8CustomBinding.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Generate security check declarations.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::getTargetFrame): Moved from V8CustomBinding.cpp.
+        (WebCore::reportUnsafeJavaScriptAccess):
+        (WebCore::V8DOMWindowShell::createNewContext):
+        (WebCore::V8DOMWindowShell::setLocation): Moved from V8CustomBinding.cpp.
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::downcastSVGPathSeg): Moved from V8CustomBinding.cpp.
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::locationAccessorSetter):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::V8Document::locationAccessorSetter):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::indexedSecurityCheck):
+        (WebCore::V8History::namedSecurityCheck):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::indexedSecurityCheck):
+        (WebCore::V8Location::namedSecurityCheck):
+
+2010-01-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it had many issues:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Filed bug 33115 (PathElementAddQuadCurveToPoint not handled for <marker>), which was just a TODO in the code before.
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+              svg/custom/marker-opacity.svg
+              svg/custom/marker-strokeWidth-changes.svg
+
+        * Android.mk: Add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * page/FrameView.cpp: Notify RenderSVGRoot children about viewport size changes, just like it's handled for <body> in HTML.
+        (WebCore::FrameView::layout): This is important, as marker bounding boxes may depend on the current viewport size through relative coordinates used in <svg>.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::markerBoundingBox): Calculates and caches marker boundaries in the layout() phase.
+        (WebCore::RenderPath::repaintRectInLocalCoordinates): Use the cached marker bounding box during paint() time.
+        (WebCore::RenderPath::setPath): Clear marker boundaries upon path changes.
+        (WebCore::RenderPath::paint): Use SVGMarkerLayoutInfo::drawMarkers() instead of the local drawMarkersIfNeeded() function, which is gone now.
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded): Utilized by markerBoundingBox() to request SVGResourceMarker objects and calculate their boundaries.
+        * rendering/RenderPath.h: Store SVGMarkerLayoutInfo objects, and rename m_markerBounds to m_cachedLocalMarkerBBox for consistency.
+        (WebCore::RenderPath::path): Inline this accessor.
+        * rendering/RenderSVGContainer.h: Make paint() public (to be used from SVGResourceMarker), all other methods protected (to be used from RenderSVGViewportContainer).
+        * rendering/RenderSVGViewportContainer.cpp: Remove useless paint() override, as the comment in the code indicated.
+        (WebCore::RenderSVGViewportContainer::markerBoundaries): Maps the marker contents repaintRectInLocalCoordinates() into the final coordinate system (see code).
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation): Add marker-specific helper method, allowing to make viewportTransform() private again.
+        * rendering/RenderSVGViewportContainer.h: Marking viewportTransform() private, it's never meant to be used outside this renderer.
+        * rendering/SVGMarkerData.h: Added. Refactored from existing RenderPath code, preserving original copyrights.
+        (WebCore::SVGMarkerData::): Helper struct for SVGMarkerLayoutInfo.
+        (WebCore::SVGMarkerData::origin): Holds the final computed destination of a marker.
+        (WebCore::SVGMarkerData::marker): Holds a pointer to the associated SVGResourceMarker object, which we're aiming to layout.
+        (WebCore::SVGMarkerData::currentAngle): Calculates the current angle for a certain marker type (start/mid/end) based upon the computed inslope/outslope values.
+        (WebCore::SVGMarkerData::updateTypeAndMarker): Helper method.
+        (WebCore::SVGMarkerData::updateOutslope): Ditto.
+        (WebCore::SVGMarkerData::updateMarkerDataForPathElement): Does the actual inslope/outslope calculation.
+        (WebCore::SVGMarkerData::updateInslope): Helper method.
+        * rendering/SVGMarkerLayoutInfo.cpp: Added. New approach to build marker layout info, this time correct during layout() time instead of paint() time.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::processStartAndMidMarkers): Static helper method used to visit each path element in order to calculate inslopes/outslopes (-> orientation angles)
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries): Build list of MarkerLayout objects, used to query boundaries, and to paint markers during drawMarkers().
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers): Cheap method walking existing MarkerLayout vector, drawing the individual RenderSVGViewportContainer of the markers.
+        (WebCore::SVGMarkerLayoutInfo::addLayoutedMarker): Helper method.
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerLayout::MarkerLayout): Helper struct storing a pair of SVGResourceMarker* and a TranformationMatrix.
+        (WebCore::SVGMarkerLayoutInfo::markerData): Public helper methods returning references to private member variables, used from processStartAndMidMarkers.
+        (WebCore::SVGMarkerLayoutInfo::midMarker): Ditto.
+        (WebCore::SVGMarkerLayoutInfo::elementIndex): Ditto.
+        * svg/SVGMarkerElement.cpp: Adopt to name change: setRef() -> setReferencePoint(). setMarker() -> setRenderer()
+        (WebCore::SVGMarkerElement::~SVGMarkerElement): Remove obsolete detach() hack, fixed by SVGUseElement changes.
+        (WebCore::SVGMarkerElement::canvasResource): Add ASSERT(renderer()) to clarify that canvasResource() is only meant to used after renderer creation.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::~SVGSVGElement): Remove obsolete detach() hack, fixed by SVGUseElement changes.
+        * svg/SVGUseElement.cpp: Rework buildPendingResource() to remove SVGSVGElement/SVGMarkerElement detach() hacks (called manually from destructors), see below.
+        (WebCore::SVGUseElement::buildPendingResource): Always detach() the shadow tree root element, before destructing it - this caused the regression with this patch before.
+        * svg/graphics/SVGResource.cpp: Instead of maintaining a global hashmap between SVGStyledElements and an array of possible SVGResources, use a HashSet of SVGResources
+                                        and directly scan the already existing list of clients for a certain SVGResource. This wrong approach has been introduced over two years
+                                        ago, making the assumption that there's only one resource type per element. Though markers can provide three resources of the same type
+                                        per element (all SVGResourceMarker objects, but in different rules: start/mid/end marker). That information is only available while painting.
+        (WebCore::resourceSet): Add global static HashSet<SVGResource*>.
+        (WebCore::SVGResource::SVGResource): Add us to the resourceSet.
+        (WebCore::SVGResource::~SVGResource): Remove us from resourceSet.
+        (WebCore::SVGResource::removeClient): Traverse all SVGResource clients and remove the passed SVGStyledElement from the client list (invoked by SVGStyledElement destructor).
+        (WebCore::SVGResource::addClient): Remove the offending part of the old approach, making the wrong assumption regarding resource types.
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerTransformation): Create TransformationMatrix in the local marker content (RenderSVGViewportContainer) coordinate system, to position a marker.
+        (WebCore::SVGResourceMarker::draw): Simplify marker drawing a lot: used the passing TransformationMatrix (cached in SVGMarkerLayoutInfo) to draw the marker content renderer.
+        (WebCore::SVGResourceMarker::externalRepresentation): Adopt to refX/refY -> referencePoint changes.
+        * svg/graphics/SVGResourceMarker.h: Store a FloatPoint m_referecePoint instead of two refX/refY float values.
+        (WebCore::SVGResourceMarker::setRenderer): Renamed from setMarker().
+        (WebCore::SVGResourceMarker::setReferencePoint): Renamed from setRef().
+        (WebCore::SVGResourceMarker::referencePoint): New accessor replacing refX() / refY().
+
+2010-01-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG feImage support
+        https://bugs.webkit.org/show_bug.cgi?id=31905
+
+        This implements the SVG Filter effect feImage with support of fragment urls.
+        It also includes a bug fix for feComposite. feComposite didn't cover values
+        bigger than 255 correctly on composite oeprator arithmetic.
+
+        Tests: There are already many feImage tests in trunk. They just needed updated
+               pixel test results.
+               The feComposite bug is covered by svg/W3C-SVG-1.1/filters-composite-02-b.svg
+               and depends on feImage.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGImage.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::requestImageResource):
+        (WebCore::SVGFEImageElement::parseMappedAttribute):
+        (WebCore::SVGFEImageElement::notifyFinished):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEImageElement.idl:
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::transformRect):
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::FEImage):
+        (WebCore::FEImage::create):
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+
+2010-01-06  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Fix the bug in previous commit: we shouldn't finish
+        decoding if "sizeOnly" is true.
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52855.
+        http://trac.webkit.org/changeset/52855
+        https://bugs.webkit.org/show_bug.cgi?id=33222
+
+        Caused 6 layout tests to fail on Mac
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::substituteResourceDeliveryTimerFired):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/ResourceLoader.cpp:
+        * loader/ResourceLoader.h:
+
+2010-01-06  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Let ReourceLoader deliver segmented data
+        when loading resource from a SharedBuffer object.
+        https://bugs.webkit.org/show_bug.cgi?id=33222
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::substituteResourceDeliveryTimerFired):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        * loader/ResourceLoader.h:
+
+2010-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Qt build fix.
+
+        Prefix the phonon includes with phonon/ to avoid conflicts with the S60
+        audio routing API ( http://wiki.forum.nokia.com/index.php/Audio_Routing_API ).
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2010-01-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Moving v8::HandleScope up above declaration of v8::Local to fix a
+        Chromium startup crash.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Move V8DOMWindowShell to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=33232
+
+        This patch moves V8DOMWindow shell to ScriptController, where the
+        window shells live in JSC land.  The next step will be to allow for
+        more than one window shell per script controller.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::~V8DOMWindowShell):
+        * bindings/v8/V8DOMWindowShell.h:
+        (WebCore::V8DOMWindowShell::localHandleForContext):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::currentContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::adjustedContext):
+
+2010-01-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <header> and <footer> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=32943
+
+        <header> and <footer> should behave the same as <nav>, <section>,
+        <article>, and <aside>. The HTML parser doesn't need to restrict
+        the nesting of header/footer elements.
+
+        Tests: fast/html/footer-element.html
+               fast/html/header-element.html
+
+        * css/html.css: Add header/footer as block elements.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add headerTag and footerTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for headerTag and footerTag.
+        (WebCore::blockTagList): Add headerTag and footerTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Rename isHeaderTag() to isHeadingTag()
+        (WebCore::HTMLParser::getNode): Add headerTag and footerTag.
+        (WebCore::HTMLParser::isHeadingTag): Renamed from isHeaderTag().
+        * html/HTMLParser.h:
+          - Rename isHeaderTag() to isHeadingTag()
+          - Remove non-existing popNestedHeaderTag().
+        * html/HTMLTagNames.in: Add header and footer.
+
+2010-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CDATA sections are merged into Text nodes when normalize() is used
+        https://bugs.webkit.org/show_bug.cgi?id=33191
+
+        Test: fast/dom/Node/normalize-with-cdata.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::normalize): Use nodeType instead of isTextNode.
+
+2010-01-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Typing in Google Wave repaints the whole screen
+        https://bugs.webkit.org/show_bug.cgi?id=32295
+
+        Marks a RenderBlock without block children for layout and painting when it has no line boxes only if it has inline immediate children.
+        The existing logic uses the existence of line boxes as a dirty flag to indicate that line boxes need to be regenerated.  This heuristic
+        fails when the RenderBlock does not have any in-flow children at all, causing the RenderBlock to get unnecessarily marked for layout and
+        painting.  This is particularly bad for common scrollbar manipulation tricks like putting one positioned div inside another - this
+        structure caused the entire outer div's bounds to get scheduled for a paint whenever there was any mutation of any descendant.
+
+        Test: LayoutTests/fast/repaint/block-no-inline-children.html (only shows up in pixel tests)
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2010-01-05  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Cleans up line box clearing when a RenderBlock loses its last child.
+        https://bugs.webkit.org/show_bug.cgi?id=33228
+
+        The 'fullLayout' flag in RenderBlock::layoutInlineChildren() is pretty vague, hopefully this will be easier for the next person to figure out.
+
+
+        No new tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2010-01-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Provide the "documentURL" property for documents and frame owner elements
+
+        This is necessary to determine owner document URLs for nodes (all nodes have
+        the top-level document set as ownerDocument).
+        https://bugs.webkit.org/show_bug.cgi?id=33025
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+
+2010-01-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Public GIF decoder should stop decoding when allocation fails
+        https://bugs.webkit.org/show_bug.cgi?id=33231
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::output_row):
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h:
+
+2010-01-05  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make PNG image decoder work with segmented SharedBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=33213
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::isAllDataReceived):
+        (WebCore::ImageDecoder::setData):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::currentBufferSize):
+        (WebCore::PNGImageReader::setComplete):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Dimitri Glazkov.
+
+        Fix namespace indent for ScriptController.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::proxy):
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::xssAuditor):
+        (WebCore::ScriptController::setProcessingTimerCallback):
+        (WebCore::ScriptController::setPaused):
+        (WebCore::ScriptController::isPaused):
+        (WebCore::ScriptController::sourceURL):
+        (WebCore::ScriptController::evaluateInWorld):
+
+2010-01-05  Rachel Petterson  <rlp@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement most cases of texImage2D and texSubImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=31562
+        
+        This fix is with Chris Marrin  <cmarrin@apple.com>.
+        Also bug: https://bugs.webkit.org/show_bug.cgi?id=31493
+
+        From Chris:
+        This implements all cases except HTMLVideoElement. It changes
+        the bindings to accept all parameter forms of the call. Then
+        it plumbs the calls through WebGLRenderingContext down to
+        GraphicsContext3D for the actual implementation.
+
+        From Rachel:
+        This implements texImage2D for chromium. It also implements the V8
+        bindings for texSubImage2D and updates the V8 bindings for texImage2D.
+
+        Tests: fast/canvas/webgl/texImage2DImageDataTest.html
+                  fast/canvas/webgl/texImageTest.html
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texImage2D):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2010-01-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Part of <https://bugs.webkit.org/show_bug.cgi?id=32568>.
+        Web Inspector: Context Menus should be used in more places.
+        
+        Add context menus to handle the interaction with breakpoints in the Source Frame. Currently
+        we use left click to add/disable/remove breakpoints, and left click to edit (for conditional
+        breakpoints), but this is hard to discover and behaves differently than Xcode.
+        
+        Change the behavior to be more like Xcode, left click adds a breakpoint if there isn't one, and
+        removes it if there is one.
+        
+        On the context menu, if there is no breakpoint there, we have Add Breakpoint, and Add Conditional
+        Breakpoint. If there is a breakpoint there, we add entries for Edit Breakpoint (edit
+        the condition), Remove Breakpoint, and Enable/Disable Breakpoint (based on the current state).
+
+        * English.lproj/localizedStrings.js: Added localized context menu entries.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentContextMenu.addAndEditBreakpoint):
+        (WebInspector.SourceFrame.prototype._documentContextMenu): Added context menu entries and handlers.
+        (WebInspector.SourceFrame.prototype._documentMouseDown): Changed left click behavior (Add -> Remove).
+
+2010-01-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: need a way to get the progress of a webpage load
+        https://bugs.webkit.org/show_bug.cgi?id=33221
+
+        Test: platform/mac/accessibility/estimated-progress.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::estimatedLoadingProgress):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::estimatedLoadingProgress):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2010-01-05  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Drag & drop layout tests fail even when run manually
+        https://bugs.webkit.org/show_bug.cgi?id=33055
+
+        No new tests. Fix 3 layout tests when run manually.
+        fast/events/drag-and-drop.html
+        fast/events/drag-and-drop-dataTransfer-types-nocrash.html
+        fast/events/drag-and-drop-fire-drag-dragover.html
+        Running these tests in DRT will be fixed in 31332.
+
+        * page/qt/DragControllerQt.cpp:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        Cleanup the drag operation if it failed to complete,
+        Otherwise, new drag operations will not be possible.
+
+2010-01-05  Gustavo Noronha Silva <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Based on idea and original patch by Evan Martin.
+
+        Remove libWebCore intermediate library, to improve link time.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2010-01-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Move allowSetting{Frame}SrcToJavascriptUrl from V8Custom to BindingSecurity and
+        remove the v8-specific pieces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33182
+
+        * bindings/BindingSecurity.h:
+        (WebCore::::allowSettingFrameSrcToJavascriptUrl): Moved from V8CustomBinding.cpp.
+        (WebCore::::allowSettingSrcToJavascriptURL): Moved from V8CustomBinding.cpp.
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::V8Attr::valueAccessorSetter):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::V8Element::setAttributeCallback):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNSCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::V8HTMLFrameElement::srcAccessorSetter):
+        (WebCore::V8HTMLFrameElement::locationAccessorSetter):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::V8HTMLIFrameElement::srcAccessorSetter):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Separate DOMWrapperWorld from V8IsolatedWorld
+        https://bugs.webkit.org/show_bug.cgi?id=33087
+
+        This change separate DOMWrapperWorld and IsolatedWorld from
+        V8IsolatedWorld.  I've also renamed V8IsolatedWorld to
+        V8IsolatedContext in preparation for having more than one context in a
+        single isolated world.
+
+        This patch moves us closer to two goals:
+        1) Matching the structure of the JSC implementation of isolated worlds.
+        2) Letting scripts running in isolated contexts see into other iframes
+           (which requires having more than one context in an isolated world.)
+
+        * WebCore.gypi:
+        * bindings/v8/DOMWrapperWorld.cpp: Added.
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/DOMWrapperWorld.h: Added.
+        (WebCore::DOMWrapperWorld::create):
+        * bindings/v8/IsolatedWorld.cpp: Added.
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        * bindings/v8/IsolatedWorld.h: Added.
+        (WebCore::IsolatedWorld::create):
+        (WebCore::IsolatedWorld::count):
+        (WebCore::IsolatedWorld::domDataStore):
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getMainThreadStore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::currentScriptState):
+        * bindings/v8/ScriptState.cpp:
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8IsolatedContext.cpp: Copied from WebCore/bindings/v8/V8IsolatedWorld.cpp.
+        (WebCore::V8IsolatedContext::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        (WebCore::V8IsolatedContext::destroy):
+        (WebCore::V8IsolatedContext::~V8IsolatedContext):
+        (WebCore::V8IsolatedContext::scriptState):
+        * bindings/v8/V8IsolatedContext.h: Copied from WebCore/bindings/v8/V8IsolatedWorld.h.
+        (WebCore::V8IsolatedContext::getEntered):
+        (WebCore::V8IsolatedContext::world):
+        * bindings/v8/V8IsolatedWorld.cpp: Removed.
+        * bindings/v8/V8IsolatedWorld.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::context):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::WorldContextHandle):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Move createWindow into generic bindings so it can be shared with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=33201
+
+        This patch moves createWindow from V8-specific code into the generic
+        bindings so that is can be re-used by the JavaScriptCore bindings.  I
+        haven't actually moved the JSC bindings over to using this yet.
+
+        Also, I organized the generic bindings a bit more as it's becoming
+        clearer how things are going to shape up.  There are still some
+        question marks, but hopefully the answers will become clear as we
+        progress.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/generic/BindingDOMWindow.h: Added.
+        (WebCore::::createWindow):
+        * bindings/generic/BindingSecurity.h: Renamed from WebCore/bindings/BindingSecurity.h.
+        (WebCore::BindingSecurity::BindingSecurity):
+        (WebCore::::canAccessWindow):
+        (WebCore::::canAccessFrame):
+        (WebCore::::checkNodeSecurity):
+        * bindings/generic/BindingSecurityBase.cpp: Renamed from WebCore/bindings/BindingSecurityBase.cpp.
+        (WebCore::BindingSecurityBase::getDOMWindow):
+        (WebCore::BindingSecurityBase::getFrame):
+        (WebCore::BindingSecurityBase::canAccess):
+        * bindings/generic/BindingSecurityBase.h: Renamed from WebCore/bindings/BindingSecurityBase.h.
+        * bindings/generic/GenericBinding.h: Renamed from WebCore/bindings/GenericBinding.h.
+        (WebCore::):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::showModalDialogCallback):
+        (WebCore::V8DOMWindow::openCallback):
+        * bindings/v8/specialization/V8BindingDOMWindow.h: Added.
+        (WebCore::V8BindingDOMWindow::storeDialogArgs):
+        * bindings/v8/specialization/V8BindingState.cpp: Renamed from WebCore/bindings/v8/V8BindingState.cpp.
+        (WebCore::::Only):
+        (WebCore::::getActiveWindow):
+        (WebCore::::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/specialization/V8BindingState.h: Renamed from WebCore/bindings/v8/V8BindingState.h.
+        (WebCore::):
+
+2010-01-05  Dominic Mazzoni  <dmazzoni@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32571
+
+        For an object with an aria role of "checkbox" or "radiobutton",
+        Use the "aria-checked" attribute to determine if it's checked.
+
+        Test: accessibility/aria-checkbox-checked.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isChecked):
+
+2010-01-05  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Roben.
+
+        Fix build warnings blindly
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::append):
+
+2010-01-05  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * platform/SharedBuffer.cpp:
+
+2010-01-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix an obvious bug and build errors in previous commit (r52795)
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::isEmpty):
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+
+2010-01-04  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Let SharedBuffer use a group of memory segments internally.
+        It will merge the segments into a flat consecutive buffer only when
+        necessary.
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::allocateSegment):
+        (WebCore::freeSegment):
+        (WebCore::SharedBuffer::SharedBuffer):
+        (WebCore::SharedBuffer::~SharedBuffer):
+        (WebCore::SharedBuffer::adoptVector):
+        (WebCore::SharedBuffer::size):
+        (WebCore::SharedBuffer::data):
+        (WebCore::SharedBuffer::append):
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::copy):
+        (WebCore::SharedBuffer::buffer):
+        (WebCore::SharedBuffer::getSomeData):
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+        * platform/haiku/SharedBufferHaiku.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/win/SharedBufferWin.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2010-01-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Symbian build fix
+
+        * plugins/symbian/PluginViewSymbian.cpp: Add missing HostWindow.h inclusion
+
+2010-01-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix broken export macros in package builds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33202
+
+        Always define QT_MAKEDLL unless we're doing a static
+        build or we're building inside of Qt. When building
+        inside of Qt the correct define is pulled from qbase.pri.
+
+        * WebCore.pro:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * accessibility/AccessibilityObject.h:
+        * config.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::platform):
+        * loader/CachedFont.cpp:
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+        * page/EventHandler.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/NavigatorBase.cpp:
+        (WebCore::NavigatorBase::platform):
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * page/chromium/DragControllerChromium.cpp:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/FileSystem.h:
+        * platform/KeyboardCodes.h:
+        * platform/PurgeableBuffer.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/ClipboardUtilitiesChromium.cpp:
+        * platform/chromium/ClipboardUtilitiesChromium.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupMenu::show):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::add):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cg/ColorCG.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        * platform/graphics/chromium/FontPlatformData.h:
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::restore):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::filenameToString):
+        (WebCore::filenameFromString):
+        (WebCore::filenameForDisplay):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        (WebCore::String::number):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/TextStream.cpp:
+        * platform/text/TextStream.h:
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::PopupMenu::registerClass):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        (WebCore::PopupMenu::wndProc):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/PluginPackage.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginDatabaseWin.cpp:
+        (WebCore::addWindowsMediaPlayerPluginDirectory):
+        (WebCore::addMacromediaPluginDirectories):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::wndProc):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintIntoTransformedContext):
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::platformStart):
+
+2010-01-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add ARIA "Live Region" support
+        https://bugs.webkit.org/show_bug.cgi?id=33117
+
+        Tests: platform/mac/accessibility/aria-liveregions-attributes.html
+               platform/mac/accessibility/aria-liveregions-notifications.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::contentChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isChildOfARIALiveRegion):
+        (WebCore::AccessibilityObject::supportsARIALiveRegion):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::contentChanged):
+        (WebCore::AccessibilityObject::ariaLiveRegionStatus):
+        (WebCore::AccessibilityObject::ariaLiveRegionRelevant):
+        (WebCore::AccessibilityObject::ariaLiveRegionAtomic):
+        (WebCore::AccessibilityObject::ariaLiveRegionBusy):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::contentChanged):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionStatus):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionRelevant):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionAtomic):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionBusy):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::areChildrenDirty):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetPostedNotificationCallback:]):
+        (-[AccessibilityObjectWrapper accessibilityPostedNotification:]):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * html/HTMLAttributeNames.in:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+
+2010-01-04  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adopt a more conservative approach for loading CSS cross-origin. When
+        loading CSS cross-origin, it must be start with valid CSS if the MIME
+        type is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29820
+
+        Test: http/tests/security/cross-origin-css.html
+        Test: http/tests/security/cross-origin-css-in-xml.xml
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): Enforce stricter load
+        requirements for cross-origin loads.
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Enforce stricter load
+        requirements for cross-origin loads.
+        * css/CSSStyleSheet.h:
+        * css/CSSStyleSheet.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSGrammar.y:
+        * css/CSSParser.h:
+        Add ability to tell whether the CSS parse started with a syntactically
+        valid CSS rule.
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::sheetText): Add ability to return
+        whether the MIME type was acceptable for CSS.
+        (WebCore::CachedCSSStyleSheet::canUseSheet): If requested, return
+        whether the MIME type was valid or not.
+        * dom/ProcessingInstruction.cpp
+        (WebCore::ProcessingInstruction::setCSSStyleSheet): Make use of strict
+        mode explicit and add comment.
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6655695> REGRESSION: VoiceOver is not highlighting some web elements correctly
+        <rdar://problem/7397558> REGRESSION: AXImages inside of AXLink cause AXLink to have wrong bounds
+
+        Test: accessibility/dimensions-include-descendants.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect): Use absoluteFocusRingQuads()
+        for non-text renderers. The focus ring encompasses descendants, which is
+        what we want for the accessibility indicator.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteFocusRingQuads): Added.
+        * rendering/RenderObject.h:
+
+2010-01-04  Ojan Vafai  <ojan@ojanmacpro.sfo.corp.google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove unnecessary division by a constant in SimpleFontDataMac.mm.
+        https://bugs.webkit.org/show_bug.cgi?id=33189
+
+        This was added in http://trac.webkit.org/changeset/8104 and seems like
+        it was just there to match the previously private function which we no
+        longer use.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Selection-related code needs stricter rules about how it relates to layout
+        https://bugs.webkit.org/show_bug.cgi?id=32882
+
+        Covered by existing tests along with the new assertions.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Make sure that m_inStyleRecalc is
+        already false by the time post-attach callbacks are done so that
+        layout triggered inside those callbacks can work properly.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout): Added code to trigger a
+        layout when it's needed.
+        (WebCore::SelectionController::recomputeCaretRect): Removed unneeded
+        code to do nothing when FrameView is 0. Added an assertion that layout
+        is not needed at the time the function is called.
+        (WebCore::SelectionController::invalidateCaretRect): Added code to
+        trigger a layout when it's needed.
+        (WebCore::SelectionController::paintCaret): Added an assertion that
+        layout is not needed at the time the function is called.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::shouldAutofocus): Added. Helper function that expresses
+        the rule for which form control elements should auto-focus.
+        (WebCore::focusPostAttach): Added. Called post-attach to focus an
+        element if we discover it should be focused during attach.
+        (WebCore::HTMLFormControlElement::attach): Refactored code for
+        which elements need auto-focus into a separate function. Instead
+        of focusing right away, use the focusPostAttach function to focus
+        after attach is done. Also added calls to suspendPostAttachCallbacks
+        and resumePostAttachCallbacks so post-attach callbacks happen late
+        enough. Before, they could run inside the base attach function.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach): Added calls to
+        suspendPostAttachCallbacks and resumePostAttachCallbacks so
+        post-attach callbacks happen late enough
+
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection): Added code to trigger a layout
+        when it's needed.
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Use WTF's string hashing functions from StringImpl.
+
+        * ForwardingHeaders/wtf/StringHashFunctions.h: Added.
+        * platform/text/StringHash.h:
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::computeHash):
+
+2010-01-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Qt build fix. Unreviewed.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+
+2010-01-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: <select> elements should broadcast value change events
+
+        https://bugs.webkit.org/show_bug.cgi?id=33088
+
+        <rdar://problem/7332364>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        If the post type is async, follow the old code path; otherwise, call
+        postPlatformNotification().
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added a new accessibility notification, AXMenuListValueChanged. Added
+        a new parameter to postNotification() to specify whether the post should
+        be synchronous or asynchronous.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the WebCore notification is AXMenuListValueChanged, broadcast an
+        EVENT_OBJECT_VALUECHANGE event.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setSelectedIndex):
+        When the selected index of a RenderMenuList is changed, call
+        RenderMenuList::didSetSelectedIndex().
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList):
+        Initialize new member
+        (WebCore::RenderMenuList::didSetSelectedIndex):
+        If the selected index has changed, post AXMenuListValueChanged to the
+        object synchronously.
+
+        * rendering/RenderMenuList.h:
+        Declare didSetSelectedIndex(), and add a member to hold the last
+        selected index.
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added missing null check in BarInfo code.
+
+        Test: fast/dom/Window/BarInfo-after-frame-removed.html
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::visible): Added null check. A few other
+        cleanups.
+
+2010-01-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        Delete an empty and unused JavaScript file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Removed.
+
+2010-01-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add a couple include dirs to the build.
+
+        * wscript:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+
+2010-01-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Repaint issues in text input under a scale transform
+        https://bugs.webkit.org/show_bug.cgi?id=32086
+        
+        When doing a subtree layout we have to look up the container chain to see if there
+        are any properties, such as transforms or reflections, that mean that we are unable
+        to use layoutState.
+
+        Test: fast/repaint/subtree-layoutstate-transform.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Call canUseLayoutStateForSubtree() to determine
+        whether it's OK to use layoutState.
+        
+        * rendering/RenderView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::canUseLayoutStateForSubtree): New method that reports whether it's
+        OK to use layoutState when doing a subtree layout from the given root.
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Reentrancy problem with selection in some edge cases.
+        https://bugs.webkit.org/show_bug.cgi?id=32842
+        rdar://problem/7449974
+
+        Test: fast/forms/selection-layout-reentry-strange-case.html
+
+        Move the selection display update process done in the
+        selectionLayoutChanged function into the layout timer
+        instead of doing it immediately when selection changes occur.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayout): Changed this to use the
+        definition of needsLayout from FrameView rather than rolling
+        its own.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Initialize m_needsDisplayUpdate to false.
+        (WebCore::SelectionController::setSelection): Call
+        the new setNeedsDisplayUpdate function instead of the old
+        badly named Frame::selectionLayoutChanged function.
+        (WebCore::SelectionController::setNeedsDisplayUpdate):
+        Set m_needsDisplayUpdate. If it is just becoming true, then
+        call FrameView::scheduleRelayout.
+
+        * editing/SelectionController.h: Added setNeedsDisplayUpdate,
+        needsDisplayUpdate, and m_needsDisplayUpdate.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible): Call setNeedsDisplayUpdate.
+        (WebCore::Frame::selectionLayoutChanged): Call
+        setNeedsDisplayUpdate to set it to false, since this is the
+        function that performs "selection display update". Later I want
+        to rename this function. Also added a global reentrancy check
+        since that's the easiest way I could think of to prevent infinite
+        recursion in the case where recomputeCaretRect ends up triggering
+        a layout. As a side effect, fixed theoretical problems in
+        TEXT_CARET builds by improving the ifdef.
+        (WebCore::Frame::caretBlinkTimerFired): Loosen assertions a
+        bit. Later we might want to decouple caret rect from caret state
+        a bit more and add these assertions back.
+        (WebCore::Frame::selectionBounds): Call Document::updateLayout.
+        This function is for external clients and they do not currently
+        do anything to make sure layout is up to date.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout): Add a new clause, since
+        we need a call to layout if needsDisplayUpdate is true.
+
+2010-01-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Correct debug assertion (and possible runtime errors) by
+        checking validity of bitmap settings used to create
+        the Windows Cairo contexts.
+        https://bugs.webkit.org/show_bug.cgi?id=33164.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::createCairoContextWithHDC): Check validity of selected
+          OBJ_BITMAP retrieved, and only create 32-bit context when
+          a valid bitmap is provided.
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, revert r52745 and r52746 on behalf of Nikolas Zimmermann, as discussed on IRC.
+        Patch produced by 'git revert' and then reverting back ChangeLog files.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::path):
+        (WebCore::RenderPath::paint):
+        (WebCore::):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::markerBoundingBox):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerData.h: Removed.
+        * rendering/SVGMarkerLayoutInfo.cpp: Removed.
+        * rendering/SVGMarkerLayoutInfo.h: Removed.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::ResourceSet::ResourceSet):
+        (WebCore::clientMap):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::setMarker):
+        (WebCore::SVGResourceMarker::setRef):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::cachedBounds):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::refX):
+        (WebCore::SVGResourceMarker::refY):
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2010-01-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: any DIV with an aria role should not be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=33090
+
+        Test: platform/mac/accessibility/aria-divs-not-ignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2010-01-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate declarations for V8 runtime enablers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate runtime enabler declarations.
+        * bindings/v8/custom/V8CustomBinding.h: Remove manual declarations of runtime enablers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Remove closeCallback(), which isn't actually being used.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+
+2010-01-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Forgot to add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to Chromium build.
+
+        * WebCore.gypi:
+
+2010-01-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it had many issues:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Filed bug 33115 (PathElementAddQuadCurveToPoint not handled for <marker>), which was just a TODO in the code before.
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+              svg/custom/marker-opacity.svg
+
+        * Android.mk: Add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * page/FrameView.cpp: Notify RenderSVGRoot children about viewport size changes, just like it's handled for <body> in HTML.
+        (WebCore::FrameView::layout): This is important, as marker bounding boxes may depend on the current viewport size through relative coordinates used in <svg>.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::markerBoundingBox): Calculates and caches marker boundaries in the layout() phase.
+        (WebCore::RenderPath::repaintRectInLocalCoordinates): Use the cached marker bounding box during paint() time.
+        (WebCore::RenderPath::setPath): Clear marker boundaries upon path changes.
+        (WebCore::RenderPath::paint): Use SVGMarkerLayoutInfo::drawMarkers() instead of the local drawMarkersIfNeeded() function, which is gone now.
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded): Utilized by markerBoundingBox() to request SVGResourceMarker objects and calculate their boundaries.
+        * rendering/RenderPath.h: Store SVGMarkerLayoutInfo objects, and rename m_markerBounds to m_cachedLocalMarkerBBox for consistency.
+        (WebCore::RenderPath::path): Inline this accessor.
+        * rendering/RenderSVGContainer.h: Make paint() public (to be used from SVGResourceMarker), all other methods protected (to be used from RenderSVGViewportContainer).
+        * rendering/RenderSVGViewportContainer.cpp: Remove useless paint() override, as the comment in the code indicated.
+        (WebCore::RenderSVGViewportContainer::markerBoundaries): Maps the marker contents repaintRectInLocalCoordinates() into the final coordinate system (see code).
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation): Add marker-specific helper method, allowing to make viewportTransform() private again.
+        * rendering/RenderSVGViewportContainer.h: Marking viewportTransform() private, it's never meant to be used outside this renderer.
+        * rendering/SVGMarkerData.h: Added. Refactored from existing RenderPath code, preserving original copyrights.
+        (WebCore::SVGMarkerData::): Helper struct for SVGMarkerLayoutInfo.
+        (WebCore::SVGMarkerData::origin): Holds the final computed destination of a marker.
+        (WebCore::SVGMarkerData::marker): Holds a pointer to the associated SVGResourceMarker object, which we're aiming to layout.
+        (WebCore::SVGMarkerData::currentAngle): Calculates the current angle for a certain marker type (start/mid/end) based upon the computed inslope/outslope values.
+        (WebCore::SVGMarkerData::updateTypeAndMarker): Helper method.
+        (WebCore::SVGMarkerData::updateOutslope): Ditto.
+        (WebCore::SVGMarkerData::updateMarkerDataForPathElement): Does the actual inslope/outslope calculation.
+        (WebCore::SVGMarkerData::updateInslope): Helper method.
+        * rendering/SVGMarkerLayoutInfo.cpp: Added. New approach to build marker layout info, this time correct during layout() time instead of paint() time.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::processStartAndMidMarkers): Static helper method used to visit each path element in order to calculate inslopes/outslopes (-> orientation angles)
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries): Build list of MarkerLayout objects, used to query boundaries, and to paint markers during drawMarkers().
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers): Cheap method walking existing MarkerLayout vector, drawing the individual RenderSVGViewportContainer of the markers.
+        (WebCore::SVGMarkerLayoutInfo::addLayoutedMarker): Helper method.
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerLayout::MarkerLayout): Helper struct storing a pair of SVGResourceMarker* and a TranformationMatrix.
+        (WebCore::SVGMarkerLayoutInfo::markerData): Public helper methods returning references to private member variables, used from processStartAndMidMarkers.
+        (WebCore::SVGMarkerLayoutInfo::midMarker): Ditto.
+        (WebCore::SVGMarkerLayoutInfo::elementIndex): Ditto.
+        * svg/SVGMarkerElement.cpp: Adopt to name change: setRef() -> setReferencePoint(). setMarker() -> setRenderer()
+        (WebCore::SVGMarkerElement::canvasResource): Add ASSERT(renderer()) to clarify that canvasResource() is only meant to used after renderer creation.
+        * svg/graphics/SVGResource.cpp: Instead of maintaining a global hashmap between SVGStyledElements and an array of possible SVGResources, use a HashSet of SVGResources
+                                        and directly scan the already existing list of clients for a certain SVGResource. This wrong approach has been introduced over two years
+                                        ago, making the assumption that there's only one resource type per element. Though markers can provide three resources of the same type
+                                        per element (all SVGResourceMarker objects, but in different rules: start/mid/end marker). That information is only available while painting.
+        (WebCore::resourceSet): Add global static HashSet<SVGResource*>.
+        (WebCore::SVGResource::SVGResource): Add us to the resourceSet.
+        (WebCore::SVGResource::~SVGResource): Remove us from resourceSet.
+        (WebCore::SVGResource::removeClient): Traverse all SVGResource clients and remove the passed SVGStyledElement from the client list (invoked by SVGStyledElement destructor).
+        (WebCore::SVGResource::addClient): Remove the offending part of the old approach, making the wrong assumption regarding resource types.
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerTransformation): Create TransformationMatrix in the local marker content (RenderSVGViewportContainer) coordinate system, to position a marker.
+        (WebCore::SVGResourceMarker::draw): Simplify marker drawing a lot: used the passing TransformationMatrix (cached in SVGMarkerLayoutInfo) to draw the marker content renderer.
+        (WebCore::SVGResourceMarker::externalRepresentation): Adopt to refX/refY -> referencePoint changes.
+        * svg/graphics/SVGResourceMarker.h: Store a FloatPoint m_referecePoint instead of two refX/refY float values.
+        (WebCore::SVGResourceMarker::setRenderer): Renamed from setMarker().
+        (WebCore::SVGResourceMarker::setReferencePoint): Renamed from setRef().
+        (WebCore::SVGResourceMarker::referencePoint): New accessor replacing refX() / refY().
+
+2010-01-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix standalone package builds.
+
+        * WebCore.pro: Moved logic for detecting standalone builds to WebKit.pri. Set DESTDIR for package builds.
+
+2010-01-04  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29048
+        [Qt] make RenderStyle.h compile in winscw compiler.
+
+        Change compareEqual to a macro in Winscw compiler to get around "illegal operand" 
+        error when compareEqual is defined as template.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=10447
+
+        * rendering/style/RenderStyle.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+
+        * page/NavigatorBase.cpp:
+        * platform/text/AtomicString.cpp:
+        (WebCore::equal):
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-12-22  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] G_OBJECT() cast is not necessary for signals connection and properties access
+        https://bugs.webkit.org/show_bug.cgi?id=32661
+
+        Reverted the SENTINEL / NULL crap :) Hopefully the style-bot won't
+        complain about NULL usage in g_object_{get,set} anymore.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2010-01-04  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Eric Seidel.
+
+        Updated license to match recommended header license.
+
+        * mathml/MathMLElement.cpp:
+        * mathml/MathMLElement.h:
+        * mathml/MathMLInlineContainerElement.cpp:
+        * mathml/MathMLInlineContainerElement.h:
+        * mathml/MathMLMathElement.cpp:
+        * mathml/MathMLMathElement.h:
+
+2010-01-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGResources don't invalidate if target object changes attributes
+        https://bugs.webkit.org/show_bug.cgi?id=33091
+
+        It's neccessary to invalidate all resources of an object, if the attributes of this
+        target change. Otherwise the saved resource data (like ImageBuffers) don't match
+        to the new object properties. 
+
+        Test: svg/custom/resource-invalidate-on-target-update.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::svgAttributeChanged):
+        (WebCore::SVGStyledElement::invalidateResources):
+        * svg/SVGStyledElement.h:
+
+2010-01-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Index validation code must always copy client data
+        https://bugs.webkit.org/show_bug.cgi?id=32748
+
+        Client data must always be copied during bufferData and
+        bufferSubData calls, because otherwise the data the GL uses to
+        draw may differ from that checked by the index validation code.
+
+        Test: fast/canvas/webgl/index-validation-copies-indices.html
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        * html/canvas/WebGLBuffer.h:
+
+2010-01-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Implement CookieJarChromium::cookiesEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=33123
+
+        Call out to ChromiumBridge to find out if cookies are enabled.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::cookiesEnabled):
+
+2010-01-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Remove evaluateInNewContext (it's useless)
+        https://bugs.webkit.org/show_bug.cgi?id=33068
+
+        This function has no clients and makes life complicated.  Isolated
+        worlds won out over NewContext and there's not really any going back
+        now.
+
+        No new tests because this is all minus lines.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2010-01-03  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove out of date commented out attributes in IDLs. We have implemented onpopstate.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.idl:
+
+2010-01-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Mark more filter effect as alphaImage if possible
+        https://bugs.webkit.org/show_bug.cgi?id=33111
+
+        Mark more effects as alphaImage if the previous effect is a
+        alphaImage. This can reduce the calculation on the next effect
+        like feGaussianBlur.
+        
+        Test: This changes don't affect any LayoutTests and can't be tested
+              somehow, since the changes are 'invisible'.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2010-01-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Scrollbar of overflow:scroll div in compositing layer fails to render
+        https://bugs.webkit.org/show_bug.cgi?id=32439
+        
+        When deciding whether a RenderLayer needs backing store, check whether it has
+        overflow controls that need painting.
+
+        Test: compositing/overflow/scrollbar-painting.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+
+2009-12-31  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Only show font menu items in rich text areas in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-31  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Don't show spell checking menu items in text areas in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7503279> REGRESSION (r47440): Incomplete repaint at macworldexpo.com
+        https://bugs.webkit.org/show_bug.cgi?id=33067
+
+        Test: fast/repaint/table-cell-overflow.html
+
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::hasVisibleOverflow): Added.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Set m_hasOverflowingCell if
+        any cell has visible overflow, like it was before r47440.
+
+2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not include Frame.h under WebCore/html/canvas
+        https://bugs.webkit.org/show_bug.cgi?id=33082
+
+        No new tests, as there is no new functionality.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+
+2009-12-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Delete ResourceRequest::securityInfo
+        https://bugs.webkit.org/show_bug.cgi?id=26847
+
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove unused code from V8DOMWrapper.
+
+        * bindings/v8/V8DOMWrapper.cpp: Removed code that I added but it's no longer used.
+        * bindings/v8/V8DOMWrapper.h: Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring undetectable collection.
+        https://bugs.webkit.org/show_bug.cgi?id=33063
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateImplementationMasqueradeAsUndefined.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Touched to keep IB-based builds happy.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed hand-configuring.
+
+2009-12-30  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added ability for PopupMenuClient to signal when
+        a) selection changed, and
+        b) weather suggested value should be accepted when popup menu closes
+
+        No new tests since this new functionality (autocomplete suggestions)
+        is intentionally hidden from everything else than renderer.
+
+        * platform/PopupMenuClient.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::selectionChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::selectionChanged):
+
+2009-12-30  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Auto-generate V8 bindings header declarations for
+        property accessor getter/setters, and remove a couple of
+        unnecessarily custom bindings that weren't properly declared
+        custom anyway.
+
+        * Android.v8bindings.mk: Remove V8NavigatorCustom.cpp.
+        * WebCore.gypi: Remove V8NavigatorCustom.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Removed.
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Touch DerivedSourcesAllInOne to avoid clobbering IB-based builds.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added a line-break.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of call-as-function callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=33061
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateHeaderCustomCall and
+            GenerateImplementationCustomCall.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed all hand-configuring of call-as-function
+            callbacks.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::V8HTMLAppletElement::callAsFunctionCallback): Added.
+        (WebCore::V8HTMLEmbedElement::callAsFunctionCallback): Added.
+        (WebCore::V8HTMLObjectElement::callAsFunctionCallback): Added.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.h: Removed.
+
+2009-12-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Move world-specific state out of V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=33034
+
+        This is the first step towards unifying the V8 implementation of
+        isolated worlds with the JSC implementation.  We need an object to
+        encapulate all the world-specific bindings state.  Previoulsy, we used
+        V8Proxy for this purpose (along with a million other things), but
+        there's a one-to-one mapping between V8Proxy objects and Frame objects.
+
+        This patch takes the world-specific state and moves it to a new object,
+        affectionately called V8DOMWindowShell.  This object is the moral
+        equivalent of JSDOMWindowShell but with more data members because life
+        is more complicated in V8-land.
+
+        This patch is almost entirely code motion.  Future patches will clean
+        up this class as we use it to represent window shells in isolated
+        worlds as well as the main world.
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/V8DOMWindowShell.cpp: Added.
+        (WebCore::handleFatalErrorInV8):
+        (WebCore::reportFatalErrorInV8):
+        (WebCore::reportUnsafeJavaScriptAccess):
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::isContextInitialized):
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+        (WebCore::V8DOMWindowShell::destroyGlobal):
+        (WebCore::V8DOMWindowShell::clearForClose):
+        (WebCore::V8DOMWindowShell::clearForNavigation):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        (WebCore::V8DOMWindowShell::createNewContext):
+        (WebCore::V8DOMWindowShell::installDOMWindow):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapper):
+        (WebCore::V8DOMWindowShell::clearDocumentWrapper):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        (WebCore::V8DOMWindowShell::clearDocumentWrapperCache):
+        (WebCore::V8DOMWindowShell::setSecurityToken):
+        (WebCore::V8DOMWindowShell::updateDocument):
+        (WebCore::V8DOMWindowShell::updateSecurityOrigin):
+        (WebCore::V8DOMWindowShell::getHiddenObjectPrototype):
+        (WebCore::V8DOMWindowShell::installHiddenObjectPrototype):
+        (WebCore::V8DOMWindowShell::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8DOMWindowShell.h: Added.
+        (WebCore::V8DOMWindowShell::context):
+        (WebCore::V8DOMWindowShell::createWrapperFromCache):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::windowShell):
+        (WebCore::V8Proxy::extensions):
+
+2009-12-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVGResourceClipper needs to invalidate content
+        https://bugs.webkit.org/show_bug.cgi?id=33054
+
+        Added invalidate() to SVGResourceClipper to reset clipData
+        and drawing area after attribute changes.
+
+        This fixes two LayoutTests.
+
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::resetClipData):
+        (WebCore::SVGResourceClipper::invalidate):
+        * svg/graphics/SVGResourceClipper.h:
+
+2009-12-30  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+         [Qt] RenderThemeQt::applyTheme is a misnomer and is suboptimally coded.
+        https://bugs.webkit.org/show_bug.cgi?id=33035
+
+        This patch:
+        - renames RenderThemeQt::applyTheme to initializeCommonQStyleOptions,
+        - extracts the palette initialization code to a separate function in order to
+        provide for readable pointer checking and moves this code up in the function to
+        allow for future changes to the palette brushes needed for bug 30173,
+        - optimizes some of the code in the function for readability, speed and size.
+        - fixes some minor style issues
+
+        No new tests because code behavior is not changed.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::initPaletteFromPageClientIfExists):
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+        * platform/qt/RenderThemeQt.h:
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] It should be possible to disable inspector
+        https://bugs.webkit.org/show_bug.cgi?id=32724
+
+        This makes the r48430 available for other ports as well.
+        No new tests, as there is no new functionality.
+
+        * inspector/InjectedScriptHost.idl: Guard the interface with
+        INSPECTOR guard.
+
+        * inspector/InspectorBackend.idl: Ditto.
+
+        * inspector/InspectorFrontendHost.idl: Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of all indexers.
+        https://bugs.webkit.org/show_bug.cgi?id=33031
+
+        Refactorig, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of indexers for
+            special cases.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed custom tempalte configuration of
+            indexers.
+        * bindings/v8/custom/V8CustomBinding.h: Added decls for Applet, Embed, and Object
+            elements (these will be generated, too -- later.)
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectIndexedGetter): Moved common code to a separate method.
+        (WebCore::npObjectIndexedSetter): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Added custom handlers for Applet, Embed, and Object
+          all calling the common method.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of all named property getters/setters/enumerators.
+        https://bugs.webkit.org/show_bug.cgi?id=32996
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of named property handlers
+            for special cases (See bug for more info).
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed custom template configuration of named
+            property handlers.
+        * bindings/v8/custom/V8CustomBinding.h: Added decls for Applet, Embed, and Object
+            elements (these will be generated, too -- later.)
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectNamedGetter): Moved common code to a separate method.
+        (WebCore::npObjectNamedSetter): Ditto.
+        (WebCore::NAMED_PROPERTY_GETTER): Added custom handlers for Applet, Embed, and Object
+          all calling the common method.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+
+2009-12-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix PluginView::handlePostReadFile().
+        https://bugs.webkit.org/show_bug.cgi?id=33052
+
+        The function should actually rewrite the given file to the buffer.
+
+        This change fixes http/tests/plugins/post-url-file.html, which can be unskipped
+        now along with other passing http/plugins tests.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handlePostReadFile):
+
+2009-12-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32121
+        [Qt] Revert "Implement ImageDecoderQt::clearFrameBufferCache()" from r52516.
+
+        The implementation appears to either run into an ASSERT
+        or leak memory at runtime as the m_buffer, m_reader may
+        already exist. The bug was reopened and we do have a plan now.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for Symbian def files
+
+        * WebCore.pro:
+
+2009-12-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt/Symbian build fix.
+
+        Don't build network state notifier support when building inside of Qt.
+        Otherwise the Qt build depends on an external module that itself depends
+        on Qt again.
+
+        * WebCore.pro:
+
+2009-12-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Use current isolated world's context for ScriptCallStack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33016
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        (WebCore::ScriptController::currentScriptState):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::scriptState):
+        * bindings/v8/V8IsolatedWorld.h:
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Turn off DataGrid support by default.
+
+        No new tests, as there is no new functionality.
+
+        * WebCore.pro:
+
+2009-12-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Detailed boundingBoxes in SVG Renderer
+        https://bugs.webkit.org/show_bug.cgi?id=32815
+
+        Add new bounding boxes for strokes, filters, masker and clipper in SVG.
+        These new bounding boxes help to fix repaintRectInLocalCoordinates.
+        We calculate the smallest repaint rect considering the new bounding boxes
+        now, filters get the correct paint area, masker clip the mask image size
+        to the visible area of the target.
+
+        Tests: Many tests need an update. The changes in repaintRectInLocalCoordinates
+               affect the LayoutTests.     
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::strokeBoundingBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toSVGRenderBase):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeBoundingBox):
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::markerBoundingBox):
+        * rendering/RenderSVGBlock.h:
+        (WebCore::RenderSVGBlock::toSVGRenderBase):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::strokeBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::objectBoundingBox):
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGModelObject.h:
+        (WebCore::RenderSVGModelObject::toSVGRenderBase):
+        * rendering/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::strokeBoundingBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::strokeBoundingBox):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::toSVGRenderBase):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::~SVGRenderBase):
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::clipperBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::toSVGRenderBase):
+        (WebCore::SVGRootInlineBox::objectBoundingBox):
+        (WebCore::SVGRootInlineBox::repaintRectInLocalCoordinates):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::filterBoundingBox):
+        * svg/SVGFilterElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::clipperBoundingBox):
+        * svg/graphics/SVGResourceClipper.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::filterBoundingBox):
+        (WebCore::shouldProcessFilter):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::maskerBoundingBox):
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-29  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        Add Android hook to NetworkStateNotifier class
+        so that the Java side can notify WebCore when the
+        network state changes.
+        https://bugs.webkit.org/show_bug.cgi?id=32871
+
+        No new tests required, this is platform code.
+
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/android/NetworkStateNotifierAndroid.cpp: Added.
+        (WebCore::NetworkStateNotifier::networkStateChange):
+
+2009-12-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52630.
+        http://trac.webkit.org/changeset/52630
+
+        Change caused layout tests failures and crashes.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::path):
+        (WebCore::RenderPath::paint):
+        (WebCore::):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerLayoutInfo.cpp: Removed.
+        * rendering/SVGMarkerLayoutInfo.h: Removed.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::ResourceSet::ResourceSet):
+        (WebCore::clientMap):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::setMarker):
+        (WebCore::SVGResourceMarker::setRef):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::cachedBounds):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::refX):
+        (WebCore::SVGResourceMarker::refY):
+
+2009-12-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move the focus ring rect array, width and offset out of GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=33028
+
+        * platform/graphics/GraphicsContext.cpp: Removed initFocusRing(),
+        clearFocusRing(), focusRingBoundingRect(), addFocusRingRect(),
+        focusRingWidth(), focusRingOffset(), and focusRingRects().
+        * platform/graphics/GraphicsContext.h: Ditto. Added the focus ring rect
+        vector, width and offset as parameters to drawFocusRing().
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState): Cleaned up style.
+        (WebCore::GraphicsContextPrivate::GraphicsContextPrivate): Removed
+        m_focusRingRects, m_focusRingWidth and m_focusRingOffset.
+        * platform/graphics/IntRect.cpp:
+        (WebCore::unionRect): Added this helper function.
+        * platform/graphics/IntRect.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): 
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects): Updated for new prototype.
+        Added empty rect checks that were previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::addFocusRingRects): Ditto.
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects): Ditto.
+        (WebCore::RenderInline::paintOutline): Collect focus ring rects into a
+        vector and pass it to drawFocusRing(). Use unionRect() instead of
+        focusRingBoundingRect().
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline): Ditto.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::addFocusRingRects): Changed to take a
+        Vector<IntRect> to which the rects are added.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderTextControl.h:
+
+2009-12-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        1. Changes the order in which some functions are called to match
+        the pre-r52536 order. Namely, when a new Database object is
+        created, DatabaseTracker::addOpenDatabase() is called in the
+        constructor, before doing anything else related to that database
+        (like trying to get a file handle to the database
+        file). Chromium's implementation depends on this ordering.
+        2. Changes Database::performOpenAndVerify() to close the open
+        handle to the database file immediately if the database version
+        does not match the expected one. The current behavior is to add
+        the Database object to a DatabaseThread collection and let the
+        database thread close the handle when it's destroyed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33005
+
+        All LayoutTests/storage tests pass in clean WebKit and Chromium
+        clients.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Notify DatabaseTracker and
+        Document that a Database object is about to be destroyed (when a
+        database file cannot be opened, or its version doesn't match the
+        expected one).
+        (WebCore::Database::Database): Notify DatabaseTracker and Document
+        that a new Database object was created.
+        (WebCore::Database::performOpenAndVerify): If a database version
+        does not match the expected one, immediately close the open file
+        handle to the database file.
+
+2009-12-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it was buggy:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::path):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerLayoutInfo.cpp: Added.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::initialize):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::recordMarkerData):
+        (WebCore::processStartAndMidMarkers):
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries):
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers):
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerData::):
+        (WebCore::MarkerData::MarkerData):
+        (WebCore::MarkerLayout::MarkerLayout):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::resourceSet):
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerBoundaries):
+        (WebCore::SVGResourceMarker::markerTransformation):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::setRenderer):
+        (WebCore::SVGResourceMarker::setReferencePoint):
+        (WebCore::SVGResourceMarker::referencePoint):
+
+2009-12-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix UI nits in the Audits panel.
+        https://bugs.webkit.org/show_bug.cgi?id=32932
+
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype._selectAllClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI.handleSelectAllClick):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditRuleResultPane):
+        * inspector/front-end/audits.css:
+
+2009-12-29  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32863
+        Make NodeList support call-as-function
+
+        Test: fast/dom/NodeList/nodelist-item-call-as-function.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::callAsFunctionCallback):
+
+2009-12-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Typed text in table not correctly redrawn on page with compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=32874
+        
+        Use the same test in RenderTableCell::computeRectForRepaint() that we use elsewhere
+        to decide when to use layoutState, which is to test for layoutStateEnabled()
+        and no repaint container.
+
+        Not possible to make a repaint test that exercises the problem, so no test.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeRectForRepaint):
+
+2009-12-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Discard port from cookie domain when matching cookies.
+
+        WebKit cookies do not hold the port information, so we should match only hostnames.
+        https://bugs.webkit.org/show_bug.cgi?id=31787
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix warnings in MediaPlayerPrivatePhonon.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33019
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::totalTimeChanged):
+
+2009-12-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <aside> element.
+        https://bugs.webkit.org/show_bug.cgi?id=32943
+
+        <aside> should behave the same as <nav>, <section>, and <article>.
+
+        Test: fast/html/aside-element.html
+
+        * css/html.css: Add aside as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add asideTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for asideTag.
+        (WebCore::blockTagList): Add asideTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add asideTag.
+        * html/HTMLTagNames.in: Add aside.
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=33003
+
+        No new tests as there is no new functionality.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::toRenderSVGContainer):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-28  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        On Android, ResourceHandle instances make use of a pointer to a
+        ResourceLoaderAndroid pointer. This needs to be stored in order to later cancel
+        the load, if necessary. Since this pointer is an internal implementation
+        details of ResourceHandle on Android, it needs to be stored in the
+        ResourceHandleInternal class. This patch adds this pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=32873
+
+        No new tests needed, this is platform-specific code.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+
+2009-12-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove the macro ENABLE(XHTMLMP) for noscriptAreateErrorCheck in HTMLParser,
+        since with XHTMLMP enabled, it's not checking create Errors,  and then contents inside 
+        <noscript> are always parsed and rendered.
+        https://bugs.webkit.org/show_bug.cgi?id=32706
+
+        Tests: fast/parser/noscript-with-javascript-disabled.html
+               fast/parser/noscript-with-javascript-enabled.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+
+2009-12-28  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixed isKeypadEvent behavior for Mac to correctly report keyLocation
+        as DOM_KEY_LOCATION_NUMPAD for numeric pad key events.
+        https://bugs.webkit.org/show_bug.cgi?id=28247
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::isKeypadEvent):
+
+2009-12-28  Mike Moretti  <webkit9@mordent.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug 28245 - problem with inserting a span into a long text block causing a crash because of a null string
+
+        Test: fast/dom/insert-span-into-long-text-bug-28245.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-12-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Follow Apple's decision to disable HTML DataGrid by default.
+
+        * GNUmakefile.am:
+
+2009-12-28  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix warnings when generating files using gperf. The warnings are
+        currently harmless, but some changes in the build system may make
+        them fatal.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2009-12-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Fix build break for Qt 4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30327
+
+        No new tests, as there is no new functionality.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut): Use intersected() instead of
+        operator &, which was only introduced in Qt version 4.5.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paintScrollCorner): Pass ColorSpace
+        argument to fillColor() introduced in r50760
+
+2009-12-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <article> element.
+        https://bugs.webkit.org/show_bug.cgi?id=32936
+
+        <article> should behave the same as <nav> and <section>.
+
+        Test: fast/html/article-element.html
+
+        * css/html.css: Add article as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add articleTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for articleTag.
+        (WebCore::blockTagList): Add articleTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add articleTag.
+        * html/HTMLTagNames.in: Add article.
+
+2009-12-27  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Support upload progress events in XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=32969
+
+        Make QNetworkReplyHandler report the upload progress to the client.
+
+        Already covered by tests:
+        http/tests/xmlhttprequest/upload-onload-event.html
+        http/tests/xmlhttprequest/upload-onloadstart-event.html
+        http/tests/xmlhttprequest/upload-progress-events.html
+        http/tests/xmlhttprequest/upload-onprogress-event.html
+
+        which have been unskipped.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::uploadProgress):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-12-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG: Stop rendering of objects with empty mask and filter content
+        https://bugs.webkit.org/show_bug.cgi?id=32968
+
+        It's not neccessary to continue rendering of an object and its' childs
+        if the mask clips the complete content away.
+        The same for filters, if the filter rendering is discontinued or either
+        width or height are zero.
+        We might also stop rendering if repaintRectInLocalCoordinates is empty.
+        But it needs to be fixed first.
+
+        Test: svg/custom/empty-mask.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::SVGResourceMasker):
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-27  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Spell Check Suggestions (Do not work)
+        https://bugs.webkit.org/show_bug.cgi?id=30908
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::setTitle): Implement the 'title' member
+        and set the title from the native menu item.
+
+2009-12-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Mask result wrong, if two different objects call the same mask id
+        https://bugs.webkit.org/show_bug.cgi?id=32787
+
+        At the moment we create one resource per maskId. Some resources (like mask)
+        create ImageBuffers and depends on the properties of the RenderObject,
+        thus we can't use it for a second object.
+        This patch stores multiple mask resources for one maskId and different
+        RenderObject can use the same maskId.
+        Clipper, Filter and Patterns also need to store multiple resources later.
+
+        Test: svg/custom/mask-on-multiple-objects.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::selfWillPaint):
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::styleDidChange):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderResources):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::canvasResource):
+        * svg/SVGGradientElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::canvasResource):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::canvasResource):
+        * svg/SVGPatternElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGStyledElement.h:
+        (WebCore::SVGStyledElement::canvasResource):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::getPaintServerById):
+        (WebCore::SVGPaintServer::fillPaintServer):
+        (WebCore::SVGPaintServer::strokePaintServer):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::getResourceById):
+        * svg/graphics/SVGResource.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::getClipperById):
+        * svg/graphics/SVGResourceClipper.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::getFilterById):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::getMarkerById):
+        * svg/graphics/SVGResourceMarker.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::getMaskerById):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-27  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Cleanup RenderPath code, related to markers. Pass around
+        PaintInfo objects instead of GraphicsContext directly, to
+        avoid having to recreate a new PaintInfo object in
+        SVGResourceMarker::draw().
+
+        No layout test changes.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+        * svg/graphics/SVGResourceMarker.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix (added missing header)
+
+        * platform/text/wince/TextBreakIteratorWince.cpp:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r50760 and some style fixes.
+
+        * rendering/RenderThemeWince.cpp:
+        (WebCore::RenderThemeWince::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWince::paintSliderTrack):
+        (WebCore::RenderThemeWince::paintSliderThumb):
+        (WebCore::RenderThemeWince::paintMediaMuteButton):
+        (WebCore::RenderThemeWince::paintMediaPlayButton):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfixes (missing headers and unsupported HWND_MESSAGE)
+
+        * platform/wince/MIMETypeRegistryWince.cpp:
+        * platform/wince/SearchPopupMenuWince.cpp:
+        * platform/wince/SharedTimerWince.cpp:
+        (WebCore::initializeOffScreenTimerWindow):
+
+2009-12-26  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52554.
+        http://trac.webkit.org/changeset/52554
+
+        https://bugs.webkit.org/show_bug.cgi?id=32955
+        The original change was covered under
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        r52554 was itself a rollout of r52536.
+        However it caused two layout tests to fail on Leopard:
+        storage/open-database-while-transaction-in-progress.html
+        svg/W3C-SVG-1.1/filters-conv-01-f.svg (no clue why?)
+
+        So I'm rolling out the rollout in an attempt to get the bots green.
+        r52554 did not explain why it was rolled out, so I do not know
+        what might fail for Chromium after this change.  I warned the folks
+        in #chromium that it was coming.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7483622> REGRESSION (r47255): Extra Large Amount of Empty Space
+        https://bugs.webkit.org/show_bug.cgi?id=32690
+
+        Test: fast/block/float/clear-to-fit.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Only clear floats as needed to
+        fit the child on the line.
+
+2009-12-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 section element.
+        https://bugs.webkit.org/show_bug.cgi?id=32936
+
+        <section> should behave the same as <nav>.
+
+        Test: fast/html/section-element.html
+
+        * css/html.css: Add section as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add sectionTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for sectionTag.
+        (WebCore::blockTagList): Add sectionTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add sectionTag.
+        * html/HTMLTagNames.in: Add section.
+
+2009-12-25  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32938
+
+        Cleans up XSSAuditor.
+
+        Currently, we pass various parameters through to XSSAuditor::findInRequest
+        that are used to determine how to decode the HTTP input parameters so that
+        we can perform a match against the script source. Instead, we have defined
+        a structure XSSAuditor::FindTask that can hold all of these parameters.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate): Modified to use struct
+        XSSAuditor::FindTask.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Ditto.
+        (WebCore::XSSAuditor::canCreateInlineEventListener): Ditto.
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Ditto.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::FindTask::FindTask): Added.
+
+2009-12-25  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        DOMWindow is missing lots of SVG* constructor objects
+        https://bugs.webkit.org/show_bug.cgi?id=20430
+
+        Expose all implemented SVG 1.1 constructors.
+
+        Test: svg/custom/global-constructors.js
+
+        * bindings/v8/V8Index.cpp: Add missing includes for SVGFontFaceElement & SVGMissingGlyphElement
+        * bindings/v8/V8Index.h: Add misisng SVGFontFaceElement & SVGMissingGlyphElement declarations.
+        * page/DOMWindow.idl: Add a bunch of new SVG object ctors.
+        * svg/SVGAnimatedPathData.idl: Add OmitConstructor flag, as this is a SVG MI class, which is not exposable at the moment.
+        * svg/SVGAnimatedPoints.idl: Ditto.
+
+2009-12-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        AuditsPanel for Web Inspector (hidden, no preset audits).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31665
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditLauncherView.js: Added.
+        (WebInspector.AuditLauncherView.categorySortFunction):
+        (WebInspector.AuditLauncherView):
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype._setAuditRunning):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked.profilingFinishedCallback):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked):
+        (WebInspector.AuditLauncherView.prototype._selectAllClicked):
+        (WebInspector.AuditLauncherView.prototype._categoryClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype._updateButton):
+        (WebInspector.AuditLauncherView.prototype.resize):
+        * inspector/front-end/AuditResultView.js: Added.
+        (WebInspector.AuditResultView.entrySortFunction):
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditCategoryResultPane):
+        (WebInspector.AuditRuleResultPane):
+        (WebInspector.AuditRuleResultPane.prototype._decorateRuleResult):
+        (WebInspector.AuditRuleResultChildSection):
+        (WebInspector.AuditRuleResultChildSection.prototype.set title):
+        (WebInspector.AuditRuleResultChildSection.prototype.expand):
+        * inspector/front-end/AuditsPanel.js: Added.
+        (WebInspector.AuditsPanel):
+        (WebInspector.AuditsPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.AuditsPanel.prototype.get statusBarItems):
+        (WebInspector.AuditsPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.AuditsPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.AuditsPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.AuditsPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.AuditsPanel.prototype.get categoriesById):
+        (WebInspector.AuditsPanel.prototype.get visibleView):
+        (WebInspector.AuditsPanel.prototype._constructCategories):
+        (WebInspector.AuditsPanel.prototype._executeAudit.ruleResultReadyCallback):
+        (WebInspector.AuditsPanel.prototype._executeAudit):
+        (WebInspector.AuditsPanel.prototype._auditFinishedCallback):
+        (WebInspector.AuditsPanel.prototype.initiateAudit.initiateAuditCallback):
+        (WebInspector.AuditsPanel.prototype.initiateAudit):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype._didMainResourceLoad):
+        (WebInspector.AuditsPanel.prototype.showResults):
+        (WebInspector.AuditsPanel.prototype.showLauncherView):
+        (WebInspector.AuditsPanel.prototype.showView):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype.attach):
+        (WebInspector.AuditsPanel.prototype.resize):
+        (WebInspector.AuditsPanel.prototype.updateMainViewWidth):
+        (WebInspector.AuditsPanel.prototype._updateLauncherViewControls):
+        (WebInspector.AuditsPanel.prototype._clearButtonClicked):
+        (WebInspector.AuditsPanel.prototype._closeVisibleView):
+        (WebInspector.AuditCategory):
+        (WebInspector.AuditCategory.prototype.get id):
+        (WebInspector.AuditCategory.prototype.get displayName):
+        (WebInspector.AuditCategory.prototype.get ruleCount):
+        (WebInspector.AuditCategory.prototype.addRule):
+        (WebInspector.AuditCategory.prototype.runRules):
+        (WebInspector.AuditRule):
+        (WebInspector.AuditRule.prototype.get id):
+        (WebInspector.AuditRule.prototype.get displayName):
+        (WebInspector.AuditRule.prototype.run):
+        (WebInspector.AuditRule.prototype.doRun):
+        (WebInspector.AuditRule.prototype.getValue):
+        (WebInspector.AuditCategoryResult):
+        (WebInspector.AuditCategoryResult.prototype.addEntry):
+        (WebInspector.AuditRuleResult):
+        (WebInspector.AuditRuleResult.prototype.appendChild):
+        (WebInspector.AuditRuleResult.prototype.set type):
+        (WebInspector.AuditRuleResult.prototype.get type):
+        (WebInspector.AuditsSidebarTreeElement):
+        (WebInspector.AuditsSidebarTreeElement.prototype.onattach):
+        (WebInspector.AuditsSidebarTreeElement.prototype.onselect):
+        (WebInspector.AuditsSidebarTreeElement.prototype.get selectable):
+        (WebInspector.AuditsSidebarTreeElement.prototype.refresh):
+        (WebInspector.AuditResultSidebarTreeElement):
+        (WebInspector.AuditResultSidebarTreeElement.prototype.onselect):
+        (WebInspector.AuditResultSidebarTreeElement.prototype.get selectable):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/audits.css: Added.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.updateResource):
+
+2009-12-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Edit Inner HTML action.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32924
+
+        * English.lproj/localizedStrings.js:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::pushNodePathToFrontendCallback):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.show):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodesSoon):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML.commit):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML.dispose):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML):
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getNodePropertyValue):
+        (InjectedScript.setOuterHTML):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript.pushNodeToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.windowUnloading):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.keyDownEventListener):
+        (WebInspector.startEditing):
+
+2009-12-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console should force long URLs to wrap
+        https://bugs.webkit.org/show_bug.cgi?id=32927
+
+        * inspector/front-end/inspector.css: Added "word-wrap: break-word;" to
+        the #console-messages rule.
+
+2009-12-24  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r52536.
+
+        Do not a new Database pointer to any structure until its version has been verified
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for WebKit bug 29968 - Selecting text with text-overflow ellipsis
+        should not show cut off text
+        https://bugs.webkit.org/show_bug.cgi?id=29968
+
+        Also fixes the issue on both Mac OS X and Windows where the highlight
+        would extend only partway into the ellipsis based on the size of the
+        characters being truncated.
+
+        Test: editing/selection/select-text-overflow-ellipsis.html
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        When the ellipsis have been selected, paints them with the color for
+        selected text.
+        (WebCore::EllipsisBox::selectionRect):
+        Returns the selection rect for the ellipsis text.
+        (WebCore::EllipsisBox::paintSelection):
+        Paints the selection highlight around the ellipsis text.
+
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        Default the selection state of the EllipsisBox to SelectionNone.
+        (WebCore::EllipsisBox::setSelectionState):
+        Allow the selection state to be explicitly set by the InlineTextBox
+        that it is associated with, since the selection state depends on the
+        position of the selection within the truncated text.
+        (WebCore::EllipsisBox::selectionState):
+        Return the cached selection state.
+        
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionState):
+        If the text is truncated and the selection extends into the truncation
+        where there are ellipsis, set the selection state on the EllipsisBox.
+        (WebCore::paintTextWithShadows):
+        Allow for an upper bound to be specified on the maximum length of the
+        text to be painted.
+        (WebCore::InlineTextBox::paint):
+        Make sure the text that is drawn gets appropriately truncated. This was
+        not an issue before on Mac OS X because it wasn't necessary to draw the
+        selected text separately (the selected text had the same color as the
+        non-selected text).
+        (WebCore::InlineTextBox::paintSelection):
+        If the text is being truncated, let whatever is being painted in the
+        space after the truncated text paint its own highlight. 
+        
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::truncation):
+        Allow RenderText to access the truncation status.
+        
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::selectionRectForRepaint):
+        Make sure that any ellipsis box that falls within the selection also
+        gets repainted.
+
+2009-12-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add Settings.js class that would manage
+        frontend settings.
+
+        This change:
+        - Splits preferences and settings
+        - Pushes settings to the frontend on load
+        - Stores settings on each change
+        - Stores showInheritedStyles as setting.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32832
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::saveFrontendSettings):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::populateFrontendSettings):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype._settingsLoaded):
+        (WebInspector.EventListenersSidebarPane.prototype):
+        ():
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.saveFrontendSettings):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype._settingsLoaded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._setLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/Settings.js: Added.
+        (WebInspector.populateFrontendSettings):
+        (WebInspector.Settings):
+        (WebInspector.Settings.prototype._load):
+        (WebInspector.Settings.prototype._installSetting):
+        (WebInspector.Settings.prototype._get):
+        (WebInspector.Settings.prototype._set):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._settingsLoaded):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._changeSetting):
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        (WebInspector.StylePropertiesSection.showInheritedToggleFunction):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype._settingsLoaded):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-12-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] console's clear command does not work.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32897
+
+        Test: inspector/console-clear.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype.requestClearConsoleMessages):
+        (WebInspector.ConsoleView.prototype.clearConsoleMessages):
+        (WebInspector.ConsoleView.prototype._clearButtonClicked):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.clearConsoleMessages):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.reset):
+
+2009-12-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console dumps strings in escaped form.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32488
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue):
+
+2009-12-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32905
+        With Pinyin Simplified IM, a wrong character is deleted from google.com suggestion
+
+        Test: platform/mac/editing/input/selection-change-closes-typing.html
+
+        * editing/Editor.cpp: (WebCore::Editor::confirmComposition): If this function wasn't allowed
+        to change selection, it needs to close the current typing command - otherwise, its idea of
+        selection would be used for future typing.
+
+2009-12-23  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        PlatformContextSkia::beginLayerClippedToImage() needs to clip outside of the image.
+        
+        This method should limit the current painting window to the bounds of the given
+        image, but it did not. Due to this bug, unnecessary contents were rendered in
+        some (limited) situations.
+
+        [Skia] PlatformContextSkia::beginLayerClippedToImage does not clip outside of the image
+        https://bugs.webkit.org/show_bug.cgi?id=32817
+        
+        No new tests, because this is a fix of an existing test which is currently failing in
+        Chromium.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::beginLayerClippedToImage): Add clipRect() call.
+
+2009-12-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Eric Seidel.
+
+        Remove all references to "GenerateConstructor", as this is the default behaviour now.
+
+        * css/CSSCharsetRule.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRule.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSValue.idl:
+        * css/CSSValueList.idl:
+        * css/CSSVariablesDeclaration.idl:
+        * css/CSSVariablesRule.idl:
+        * css/Counter.idl:
+        * css/Media.idl:
+        * css/MediaList.idl:
+        * css/RGBColor.idl:
+        * css/Rect.idl:
+        * css/StyleSheet.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframeRule.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/Attr.idl:
+        * dom/BeforeLoadEvent.idl:
+        * dom/CDATASection.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRect.idl:
+        * dom/ClientRectList.idl:
+        * dom/Clipboard.idl:
+        * dom/Comment.idl:
+        * dom/CompositionEvent.idl:
+        * dom/DOMCoreException.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/EntityReference.idl:
+        * dom/ErrorEvent.idl:
+        * dom/Event.idl:
+        * dom/EventException.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeIterator.idl:
+        * dom/NodeList.idl:
+        * dom/Notation.idl:
+        * dom/OverflowEvent.idl:
+        * dom/PageTransitionEvent.idl:
+        * dom/PopStateEvent.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/ProgressEvent.idl:
+        * dom/Range.idl:
+        * dom/RangeException.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/Touch.idl:
+        * dom/TouchEvent.idl:
+        * dom/TouchList.idl:
+        * dom/TreeWalker.idl:
+        * dom/UIEvent.idl:
+        * dom/WebKitAnimationEvent.idl:
+        * dom/WebKitTransitionEvent.idl:
+        * dom/WheelEvent.idl:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.idl:
+        * html/File.idl:
+        * html/FileList.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDListElement.idl:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLDataListElement.idl:
+        * html/HTMLDirectoryElement.idl:
+        * html/HTMLDivElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFontElement.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLHRElement.idl:
+        * html/HTMLHeadElement.idl:
+        * html/HTMLHeadingElement.idl:
+        * html/HTMLHtmlElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLIsIndexElement.idl:
+        * html/HTMLLIElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLMapElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLMenuElement.idl:
+        * html/HTMLMetaElement.idl:
+        * html/HTMLModElement.idl:
+        * html/HTMLOListElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptGroupElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLParagraphElement.idl:
+        * html/HTMLParamElement.idl:
+        * html/HTMLPreElement.idl:
+        * html/HTMLQuoteElement.idl:
+        * html/HTMLScriptElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLSourceElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/HTMLTableCaptionElement.idl:
+        * html/HTMLTableCellElement.idl:
+        * html/HTMLTableColElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLTitleElement.idl:
+        * html/HTMLUListElement.idl:
+        * html/HTMLVideoElement.idl:
+        * html/ImageData.idl:
+        * html/MediaError.idl:
+        * html/TextMetrics.idl:
+        * html/canvas/CanvasNumberArray.idl:
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontendHost.idl:
+        * page/PositionError.idl:
+        * plugins/MimeType.idl:
+        * plugins/MimeTypeArray.idl:
+        * plugins/Plugin.idl:
+        * plugins/PluginArray.idl:
+        * storage/Storage.idl:
+        * storage/StorageEvent.idl:
+        * svg/SVGAngle.idl:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.idl:
+        * svg/SVGException.idl:
+        * svg/SVGFEBlendElement.idl:
+        * svg/SVGFEColorMatrixElement.idl:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEDisplacementMapElement.idl:
+        * svg/SVGFEFloodElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFETurbulenceElement.idl:
+        * svg/SVGGradientElement.idl:
+        * svg/SVGLength.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGPaint.idl:
+        * svg/SVGPathSeg.idl:
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGRenderingIntent.idl:
+        * svg/SVGTextContentElement.idl:
+        * svg/SVGTextPathElement.idl:
+        * svg/SVGTransform.idl:
+        * svg/SVGUnitTypes.idl:
+        * svg/SVGZoomAndPan.idl:
+        * workers/AbstractWorker.idl:
+        * workers/WorkerLocation.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XMLHttpRequestProgressEvent.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathException.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathResult.idl:
+
+2009-12-23  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A new database should be registered with the Document,
+        DatabaseTracker and DatabaseThread only after it was successfully
+        opened and its version was successfully verified.
+
+        Fixes a regression introduced by
+        http://trac.webkit.org/changeset/52530.
+
+        LayoutTests/storage/open-database-while-transaction-in-progress.html
+        should pass again (or rather, it should pass again when run after
+        open-database-set-empty-version.html).
+
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-23  David Levin  <levin@chromium.org>
+
+        REGRESSION (r52494): Assertion failure in Frame::caretBlinkTimerFired() (selection()->isCaret())
+        https://bugs.webkit.org/show_bug.cgi?id=32903
+
+        No review but ok'ed by Darin Adler. Rolling out r52494 due to above regression.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2009-12-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Reverse JS GenerateConstructor logic
+        https://bugs.webkit.org/show_bug.cgi?id=32910
+
+        Make 'GenerateConstructor' the default setting for all classes, defined in IDL files. The flag is now obsolete and
+        can be removed from all IDL files in a follow-up patch. Add new 'OmitConstructor' flag, that allows to restore the
+        old default behaviour: do not generate JSFoobarConstructor class.
+
+        No change in functionality, despite the fact that we're generating a lot more constructors now, as they have to
+        be exposed through DOMWindow.idl -- this can be done per affected class in follow-up patches. Especially the SVG
+        classes have to be exposed, most of them are missing JS constructors so far.
+
+        As side effect HTMLOptionsCollection is now correctly exposing its constructor, thus fixing a test in fast/dom/wrapper-classes.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * css/CSSUnknownRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/MessageChannel.idl:
+        * html/TimeRanges.idl:
+        * html/ValidityState.idl:
+        * html/VoidCallback.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasPattern.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/WebGLActiveInfo.idl:
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.idl:
+        * html/canvas/WebGLBuffer.idl:
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLFramebuffer.idl:
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLProgram.idl:
+        * html/canvas/WebGLRenderbuffer.idl:
+        * html/canvas/WebGLShader.idl:
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLTexture.idl:
+        * html/canvas/WebGLUniformLocation.idl:
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * inspector/JavaScriptCallFrame.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * notifications/Notification.idl:
+        * notifications/NotificationCenter.idl:
+        * page/AbstractView.idl:
+        * page/BarInfo.idl:
+        * page/Console.idl:
+        * page/Coordinates.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/EventSource.idl:
+        * page/Geolocation.idl:
+        * page/Geoposition.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * page/Screen.idl:
+        * page/WebKitPoint.idl:
+        * page/WorkerNavigator.idl:
+        * storage/Database.idl:
+        * storage/SQLError.idl:
+        * storage/SQLResultSet.idl:
+        * storage/SQLResultSetRowList.idl:
+        * storage/SQLTransaction.idl:
+        * websockets/WebSocket.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XSLTProcessor.idl:
+
+2009-12-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        "Refused to execute a JavaScript script" error when embedding SWF with
+        a URL that is also a query parameter
+        https://bugs.webkit.org/show_bug.cgi?id=32908
+
+        Don't block direct injections into the object src attribute unless
+        there's an illegal character (like < or ") in the URL.  This change
+        lets some very unusual vulnerabilities through the filter but removes a
+        false positive that we've seen several times.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject):
+
+2009-12-23  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Remove pointers to a database that failed to open from the
+        DatabaseTracker and Document.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32885
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+
+2009-12-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7487164> First line of text cannot be selected
+        https://bugs.webkit.org/show_bug.cgi?id=32749
+
+        Test: fast/text/remove-zero-length-run.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
+            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
+            text boxes.
+        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
+
+2009-12-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for newlines turning into missing-gyphs when using SVG fonts
+
+        https://bugs.webkit.org/show_bug.cgi?id=32710
+
+        Font::drawText() has three code paths:
+
+          - drawTextUsingSVGFont()
+          - drawSimpleText()
+          - drawComplexText()
+
+        The latter two both have logic to replace newlines and tabs, as well
+        as a few other control characters that are considered spaces, with
+        spaces, before actually drawing the text. Previously the SVG font
+        path did not have this kind of logic.
+
+        This change introduces two helper functions in Font to do this space
+        replacement, which are then used for the simple path, the SVG path,
+        and the Qt implementation of the complex path.
+
+        Test: svg/custom/svg-fonts-in-html-linebreaks.html
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces): Helper function
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): Use helper
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::fromRawDataWithoutRef): Rename from "qstring"
+        (WebCore::Font::drawComplexText): Use helper
+        (WebCore::Font::floatWidthForComplexText): Use helper
+        (WebCore::Font::offsetForPositionForComplexText): Use helper
+        (WebCore::Font::selectionRectForComplexText): Use helper
+        * platform/text/CharacterNames.h: Add enum for 0x0020
+        * svg/SVGFont.cpp: Use helper to fix bug
+        (WebCore::SVGTextRunWalker::walk):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        To implement the valueAsDate getter,
+        - Add a method to calculate milliseconds from 1970-01-01 to ISODateTime.
+        - Introduce m_type field to ISODateTime.
+
+        Tests: fast/forms/input-valueasdate-date.html
+               fast/forms/input-valueasdate-datetime.html
+               fast/forms/input-valueasdate-datetimelocal.html
+               fast/forms/input-valueasdate-month.html
+               fast/forms/input-valueasdate-time.html
+               fast/forms/input-valueasdate-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate):
+          Implement it with ISODateTime::millisecondsSinceEpoch().
+        (WebCore::HTMLInputElement::formStringToISODateTime):
+          Early exit for a null String. This avoids assertion failures in ISODateTime::parse*().
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::parseMonth): Sets m_type.
+        (WebCore::ISODateTime::parseDate): ditto.
+        (WebCore::ISODateTime::parseWeek): ditto.
+        (WebCore::ISODateTime::parseTime): ditto.
+        (WebCore::ISODateTime::parseDateTimeLocal): ditto.
+        (WebCore::ISODateTime::parseDateTime): ditto.
+        (WebCore::ISODateTime::millisecondsSinceEpochForTime): Added.
+        (WebCore::ISODateTime::millisecondsSinceEpoch): Added.
+        * html/ISODateTime.h:
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::invalidMilliseconds):
+
+2009-12-22  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32799
+
+        Renames enums in RenderStyleConstants::EListStyleType to conform to
+        the WebKit Code Style Guidelines.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EListStyleType):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::calcPrefWidths):
+        (WebCore::RenderListMarker::updateMargins):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialListStyleType):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-12-22  James Su  <suzhe@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Keyboard shortcut in dropdown not working.
+        https://bugs.webkit.org/show_bug.cgi?id=32008
+
+        Consider PlatformKeyboardEvent::Char type event as character type
+        event on all platforms. It fixes the "type ahead find" feature
+        of the popup listbox on Linux and Mac platforms.
+
+        Merge the case-sensitive type ahead find fix from
+        WebCore/dom/SelectElement.cpp. See
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent):
+
+2009-12-22  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] The "Search" input type is not rendered correctly when styled.
+        https://bugs.webkit.org/show_bug.cgi?id=32417
+
+        There are no new tests because only pixel tests may be affected by
+        this change and those changes can only be done on the build bot.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSearchField):
+        Since currently we paint the Search control as a QLineEdit, I have
+        deferred painting to WebCore, as in the case of the text input so 
+        that the painting is consistent.
+
+2009-12-22  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32121
+        [Qt] implement ImageDecoderQt::clearFrameBufferCache().
+       
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::initializeDecoder):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-12-22  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix assert failure with WML pages having 'Refresh' task in
+        'onenterforward' event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30989
+
+        Writing Layout test is not possible. Please refer to the discussion
+        in bug id #30989. A sample test case is attached in BugZilla.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        ASSERTION FAILED: m_numNodeListCaches
+        https://bugs.webkit.org/show_bug.cgi?id=19526
+        <rdar://problem/7431572>
+
+        Test: fast/dom/NodeList/adoptNode-node-list-cache.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Call removeNodeListCache on the old
+        document and addNodeListCache on the new one if moving a node that
+        has node lists.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        First cut at fixing Windows build.
+
+        * WebCorePrefix.cpp: Touch it.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Ditto.
+        * WebCore.vcproj/build-generated-files.sh: Ditto.
+        * page/DOMWindow.idl: Sorted things here to touch the file to give
+        the Windows build a slightly better chance of success.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Dan Bernstein.
+
+        * page/FrameView.h: Removed incorrect comment.
+
+2009-12-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: simplify highlighter definition.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32869
+
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js:
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+        * inspector/front-end/SourceSyntaxHighlighter.js:
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reentrancy problem with selection in some edge cases.
+        https://bugs.webkit.org/show_bug.cgi?id=32842
+        rdar://problem/7449974
+
+        Test: fast/forms/selection-layout-reentry-strange-case.html
+
+        Move the selection display update process done in the
+        selectionLayoutChanged function into the layout timer
+        instead of doing it immediately when selection changes occur.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Initialize m_needsDisplayUpdate to false.
+        (WebCore::SelectionController::setSelection): Call
+        the new setNeedsDisplayUpdate function instead of the old
+        badly named Frame::selectionLayoutChanged function.
+        (WebCore::SelectionController::setNeedsDisplayUpdate):
+        Set m_needsDisplayUpdate. If it is just becoming true, then
+        call FrameView::scheduleRelayout.
+
+        * editing/SelectionController.h: Added setNeedsDisplayUpdate,
+        needsDisplayUpdate, and m_needsDisplayUpdate.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible): Call setNeedsDisplayUpdate.
+        (WebCore::Frame::selectionLayoutChanged): Call
+        setNeedsDisplayUpdate to set it to false, since this is the
+        function that performs "selection display update". Later I want
+        to rename this function.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout): Add a new clause, since
+        we need a call to layout if needsDisplayUpdate is true.
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Allocate RemoteFontStream on the heap
+        https://bugs.webkit.org/show_bug.cgi?id=32850
+
+        RemoteFontStream is allocated on the stack, so its memory is freed
+        immediately when FontCustomPlatformData::createFontCustomPlatformData
+        returns. 
+
+        SkTypeface::CreateFromStream increments the reference count, but it keeps
+        the pointer to the memory allocated on the stack which is not valid
+        anymore.
+
+        RemoteFontStream is a descendant of SkRefCount and SkRefCount::unref
+        invokes SkDELETE(this) internally once the reference count reaches zero.
+        This means that SkRefCount-ed instances must be allocated on the heap.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        when condition COMPILER(RVCT) is fulfilled, we are trying to free a pointer to array allocated on the stack
+        https://bugs.webkit.org/show_bug.cgi?id=32861
+
+        Don't free the pointer for COMPILER(RVCT).
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-12-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove no longer necessary experimental single view #ifdefs from Widget and
+        ScrollView.
+
+        * page/Chrome.h:
+        * page/mac/ChromeMac.mm:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+
+2009-12-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not lose original request for non-main resource redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32678
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::appendRedirect):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2009-12-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Use ASSERT instead of assert in image-decoders
+        https://bugs.webkit.org/show_bug.cgi?id=32852
+
+        Other decoders use WTF's ASSERT macro.
+        Follow this convention.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+
+2009-12-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Use vsnprintf instead of vasprintf for RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=32851
+
+        RVCT does not support vasprint, so use vsnprintf instead.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-12-21  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Invalid url should raise SYNTAX_ERR exception.
+        https://bugs.webkit.org/show_bug.cgi?id=32700
+
+        Check url is valid in WebSocket::connect.
+        Also log the detailed reason of websocket failures to console.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::encodeProtocolString):
+        (WebCore::WebSocket::connect):
+
+2009-12-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make sure that we check for the right thread.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-21  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION(4.0.4-ToT): Indent deletes non highlighted text in gmail.
+        <rdar://problem/7489326>
+        https://bugs.webkit.org/show_bug.cgi?id=32843
+        
+        The fix for 7442387 did not handle the case where the end of paragraph
+        is not a descendant of the computed outer block.
+        Updated editing/execCommand/indent-with-style2.html to cover this case too.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): 
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+        * ForwardingHeaders/runtime/UStringImpl.h: Added.
+            - add forwarding header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring):
+            - order of arguments to UString::Rep constructor for shared strings changed.
+
+2009-12-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam barth.
+
+        Generate V8 bindings non-constructor callback declarations 
+        in CodeGeneratorV8.pm instead of manually declaring them in
+        V8CustomBinding.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32638
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.h: Added.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeFilterCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2009-12-21  Nate Chapin  <japhet@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Revert r52446 due to crashiness.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32839
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::pageHidden):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame):
+        * loader/Request.cpp:
+        (WebCore::Request::Request):
+        (WebCore::Request::~Request):
+        * loader/Request.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::cancelRequests):
+        (WebCore::Loader::Host::servePendingRequests):
+        (WebCore::Loader::Host::cancelPendingRequests):
+        (WebCore::Loader::Host::cancelRequests):
+
+2009-12-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for V8 Date binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32699
+
+        This implements the same behavior as the recent change of
+        CodeGeneratorJS.pm and JSDOMBinding.cpp.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+          Produce toWebCoreDate() or v8DateOrNull() for Date type.
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toWebCoreDate):
+          Converts a JavaScript object to a double representing Date.
+        (WebCore::v8DateOrNull):
+          Converts a double representing Date to a JavaScript Date object or null.
+        * bindings/v8/V8Binding.h: Declare toWebCoreDate() and v8DateOrNull().
+        * html/HTMLInputElement.idl: Delete V8_BINGIN exclusion for valueAsDate.
+
+2009-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Renamed m_sel to m_selection. Used do-webcore-rename.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::willBeModified):
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingRight):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingLeft):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingLeft):
+        (WebCore::SelectionController::modifyMovingBackward):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::expandUsingGranularity):
+        (WebCore::SelectionController::xPosForVerticalArrowNavigation):
+        (WebCore::SelectionController::setBase):
+        (WebCore::SelectionController::setExtent):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::caretRenderer):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        (WebCore::SelectionController::debugRenderer):
+        (WebCore::SelectionController::contains):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::formatForDebugger):
+        (WebCore::SelectionController::showTreeForThis):
+        * editing/SelectionController.h:
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        Let the script do its thing. Made sure no tests broke.
+
+2009-12-21  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Inconsistent use of counterName and identifier in CSS counter code and loss of information about the counter type.
+        https://bugs.webkit.org/show_bug.cgi?id=31814
+
+        No new tests because there are no functional changes in this patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+        (WebCore::CounterNode::computeCountInParent):
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+        Changed to use identifier instead of counterName and actsAsReset or hasResetType, as appropriate instead of isReset.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::actsAsReset):
+        (WebCore::CounterNode::hasResetType):
+
+2009-12-21  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler and Nikolas Zimmermann.
+
+        Speed-up SVG Masking
+        https://bugs.webkit.org/show_bug.cgi?id=32738
+
+        This patch makes SVG Masking faster. The luminance calculaton of the ImageBuffer,
+        that is created by pixel manipulation, got optimized. The ImageBuffer and it's
+        luminance is created once now, not on every call of applyMask.
+        The size of the intermediate ImageBuffer depends on the visible area now and is
+        clipped by the mask rect.
+        
+        The patch doesn't change functionality so no new tests needed.
+        The new ImageBuffer handling in Mask causes two updates of test results. The pixel
+        tests and LayoutTests pass, but the checksum doesn't match.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-12-21  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure when dragging an SVG image.
+        https://bugs.webkit.org/show_bug.cgi?id=32511
+
+        Test: fast/images/drag-svg-as-image.html
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::filenameExtension): Return "svg"
+        * svg/graphics/SVGImage.h:
+
+2009-12-17  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] G_OBJECT() cast is not necessary for signals connection and properties access
+        https://bugs.webkit.org/show_bug.cgi?id=32661
+
+        Removed useless calls to the G_OBJECT() macro and replaced NULL
+        occurences with a SENTINEL macro.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-12-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        If an image load is started during an unload or beforeunload event, run it
+        asynchronously (and allow it to outlive its page) so navigation can continue 
+        while the load completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30457
+
+        Tests: http/tests/navigation/image-load-in-beforeunload-handler.html
+               http/tests/navigation/image-load-in-unload-handler.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest): 
+        * loader/FrameLoader.cpp: Rename m_unloadEventBeingDispatched to m_isDispatchingUnloadEvent.
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Set m_isDispatchingBeforeUnloadEvent.
+        (WebCore::FrameLoader::pageHidden):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isDispatchingUnloadFamilyEvent): Added.
+        * loader/Request.cpp:
+        (WebCore::Request::Request): Add OutlivePagePolicy to constructor parameters
+        * loader/Request.h:
+        (WebCore::): Add OutlivePagePolicy enum.
+        (WebCore::Request::shouldOutlivePage): Added.
+        (WebCore::Request::frame): Added.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create): Change one of the security checks to an outlive page check.
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load): Add OutlivePagePolicy to Request constructor call,
+             ensure requests that should outlive page are done asynchronously.
+        (WebCore::Loader::cancelRequests): Remove ending ASSERT since it will now be hard to predict how
+             many requests might possibly outlive a cancel in every case.
+        (WebCore::Loader::Host::servePendingRequests): Use the correct frame in the case of a request outliving its page.
+        (WebCore::Loader::Host::cancelPendingRequests): Ensure we don't cancel request that should outlive their page.
+        (WebCore::Loader::Host::cancelRequests): Ensure we don't cancel request that should outlive their page.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Fix Windows build warnings
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude SVG files from the build that
+        are compiled via SVGAllInOne.cpp.
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Can’t copy outer html of selected node.
+        Also adds "Copy as HTML" context menu item.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32802
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentCanCopy):
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Web Inspector: extract syntax highlighters into separate files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32803
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js: Added.
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js: Added.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.):
+        * inspector/front-end/SourceFrame.js:
+        * inspector/front-end/SourceSyntaxHighlighter.js: Added.
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-12-18  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Darin Adler.
+
+        defersLoading is disabled in current libcURL.
+        https://bugs.webkit.org/show_bug.cgi?id=32707
+
+        Basically this change reverts r49577 that was totally wrong.
+        According to curlver.h, LIBCURL_VERSION_NUM is a
+        "6-digit (24 bits) hexadecimal number".
+
+        The check should be against 0x071200 (7.18) as it was originally the case.
+
+       * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle): Use the right check.
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading): Ditto. Also removed a print
+        to use a LOG_ERROR instead.
+ 
+2009-12-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for JavaScriptCore Date binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32698
+
+        This is needed for HTMLInputElement::valueAsDate and
+        HTMLTimeElement::valueAsDate.
+
+        A Date instance is mapped to a double value in C++.
+        - If null or undefined is set to a JavaScript property, C++ setter
+          function receives NaN.
+        - If a getter C++ function returns NaN or infinity, a JavaScript
+          property returns null.
+
+        Test: fast/forms/input-valueasdate.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsDateOrNull): Implement the above.
+        (WebCore::valueToDate): ditto.
+        * bindings/js/JSDOMBinding.h: Declare them.
+        * bindings/scripts/CodeGeneratorJS.pm: Produce jsDateOrNull() or
+          valueToDate() for Date type.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate): Temporal implementation.
+        (WebCore::HTMLInputElement::setValueAsDate): ditto.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Declare valueAsDate.
+
+2009-12-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Introduce the followings:
+          - ::-webkit-inner-spin-button pseudo CSS selector
+          - ::-webkit-outer-spin-button pseudo CSS selector
+          - new appearance type: inner-spin-button
+          - new appearance type: outer-spin-button
+        They're going to be used for <input type=number> UI.
+        https://bugs.webkit.org/show_bug.cgi?id=31821
+
+        Inner-spin-button will be used for Windows, and outer-spin-button
+        will be used for Mac. A spin-button will represent a pair of an
+        increasing button part and a decreasing button part. SpinUpState,
+        which is defined in ThemeTypes.h, will be used to distinguish
+        these two parts.
+
+        The outer-spin-button implementation will use NSStepperCell.
+        NSStepperCell represents the pair of the parts and we can't draw them
+        independently. So a spin-button also represents the pair of the parts.
+
+        This change has no tests.  The following changes with tests will cover.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * platform/ThemeTypes.h:
+        (WebCore::ControlState): Add SpinUpState.
+        (WebCore::ControlPart): Add InnerSpinButtonPart and OuterSpinButtonPart.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::adjustInnerSpinButtonStyle): Add an empty implementation.
+        (WebCore::RenderTheme::adjustOuterSpinButtonStyle): Add an empty implementation.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintInnerSpinButton): Add an empty implementation.
+        (WebCore::RenderTheme::paintOuterSpinButton): Add an empty implementation.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::PseudoId): Add INNER_SPIN_BUTTON and OUTER_SPIN_BUTTON.
+
+2009-12-20  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for compilation errors in WML module, due to the changeset #52314.
+        https://bugs.webkit.org/show_bug.cgi?id=32786
+
+        No new tests, this is compilation error fix.
+
+        * wml/WMLDocument.cpp:
+        * wml/WMLPageState.cpp:
+        * wml/WMLPageState.h:
+
+2009-12-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7487689> REGRESSION (r52203): Inspector console uses
+        Monaco on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=32775
+
+        * inspector/front-end/inspector.css: Use the default monospace family
+        and size.
+
+2009-12-20  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove more GTK+ and GLib headers from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=32795
+
+        Remove most GTK+ and GLib includes from WebCore headers.
+
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/gtk/PasteboardHelper.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/ScrollbarGtk.cpp:
+        * platform/gtk/ScrollbarThemeGtk.h:
+        * platform/gtk/gtk2drawing.c:
+        * platform/gtk/gtkdrawing.h:
+
+2009-12-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] build fixes after recent changes.
+
+        * bindings/BindingSecurityBase.cpp: Removed V8 header in common code.
+        * platform/wx/ContextMenuWx.cpp: Added missing header.
+        * plugins/mac/PluginViewMac.cpp: Added missing header.
+
+2009-12-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Hopefully fix the assertion we are hitting by not forcing updating
+        the state of scrollbars when setting the adjustments. This was
+        leading to a premature layout.
+
+        fast/dom/open-and-close-by-DOM.html
+        fast/dom/Window/closure-access-after-navigation-window.html
+        fast/harness/use-page-cache.html
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setGtkAdjustments):
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Web Inspector: Constrain the number of messages the inspector shows.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20919
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::updateConsoleMessageExpiredCount):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateConsoleMessageExpiredCount):
+
+2009-12-20  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Android needs implementation of setCookies, cookies and cookiesEnabled functions.
+        https://bugs.webkit.org/show_bug.cgi?id=32559
+
+        Add implementation of the cookie functions.
+        Fix a crash caused by dereferencing a 0 MainResourceLoader pointer
+        in ResourceHandle::start().
+
+        No new tests, this is platform code.
+
+        * platform/android/PlatformBridge.h:
+        * platform/network/android/AuthenticationChallenge.h: Added.
+        * platform/network/android/CookieJarAndroid.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/network/android/ResourceHandleAndroid.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-12-19  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52395.
+        http://trac.webkit.org/changeset/52395
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52399.
+        http://trac.webkit.org/changeset/52399
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Added a missing "not".
+
+        Test: http/tests/security/xss-DENIED-window-open-javascript-url.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-19  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Invalid url should raise SYNTAX_ERR exception.
+        https://bugs.webkit.org/show_bug.cgi?id=32700
+
+        Check url is valid in WebSocket::connect.
+        Also log the detailed reason of websocket failures to console.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Up/down arrow keys do not step numeric CSS property values
+        https://bugs.webkit.org/show_bug.cgi?id=32776
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown): Call the focused element’s
+        handleKeyEvent method.
+
+2009-12-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Speed-up SVG Masking
+        https://bugs.webkit.org/show_bug.cgi?id=32738
+
+        This patch makes SVG Masking faster. At the moment we create a new ImageBuffer
+        and copy the complete pixel array. That is rather inefficient. This patch
+        uses the mask image directly.
+        It also bounds the direct pixel manipultation to the viewable area to minimize
+        the calculation of the mask.
+
+        No change in functionality. So no new test.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add tests to check filter, mask, clip, opacity and marker ordering
+        https://bugs.webkit.org/show_bug.cgi?id=14010
+
+        The right ordering for applying effects on objects in SVG is filters,
+        clipper/masker and opacity. This patch fixes the order of filter and
+        clipper/masker. Opacity and marker need another test.
+        This change is according to the SVG Specification:
+        http://www.w3.org/TR/SVG11/render.html#Elements
+
+        Test: svg/filters/filter-clip.svg
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Revert my attempt at making --disable-geolocation work; it is
+        more complicated than I anticipated.  (It passed on the build bots
+        because they build with --enable-geolocation.)
+
+        * GNUmakefile.am:
+
+2009-12-19  MORITA Hajime  <morrita@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore::Range::surroundContents NULL pointer crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31684
+
+        Test: fast/dom/Range/31684.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::surroundContents):
+        throw exception when parentOfNewParent->parentNode() is NULL.
+
+2009-12-19  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Don't use an icon for all spelling guess menu items.
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::gtkStockIDFromContextMenuAction):
+
+2009-12-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Missing \.
+
+        * GNUmakefile.am:
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Make --disable-geolocation and --disable-svg work, by conditionally
+        building the relevant files.
+
+        * GNUmakefile.am:
+
+2009-12-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Add a comment about some confusing code that otherwise would look like
+        it might be a bug.
+        https://bugs.webkit.org/show_bug.cgi?id=32534
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Messed up the XCode file, trying to fix.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed, fix typos in WebCore.xcodeproj.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        SVGAngle / SVGPreserveAspectRatio should be POD types
+        https://bugs.webkit.org/show_bug.cgi?id=32758
+
+        Convert SVGAngle / SVGPreserveAspectRatio to be non-refcounted types, just
+        like it has been done for SVGMatrix / SVGLength before.
+
+        This patch prepares removing the special DOMObjectWithSVGContext hack.
+        No change in functionality, thus no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add SVGNames.h to the 'Copy Generated Headers' phase, and set SVGAngle/SVGPreserveAspectRatio role to 'Private', so WebKit can access it.
+        * bindings/scripts/CodeGenerator.pm: Recognize SVGAngle / SVGPreserveAspectRatio as new POD-types (similar to SVGLength)
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto. 
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * rendering/RenderSVGImage.cpp: All following changes, modify SVGAngle/SVGPreserveAspectRatio access, as they are non-refcounted now.
+        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGImage.h:
+        * svg/SVGAngle.h:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimatedTemplate.h:
+        (WebCore::):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::parseMappedAttribute):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        (WebCore::SVGFitToViewBox::parseMappedAttribute):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        (WebCore::SVGImageElement::parseMappedAttribute):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::parseMappedAttribute):
+        (WebCore::SVGMarkerElement::setOrientToAuto):
+        (WebCore::SVGMarkerElement::setOrientToAngle):
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        * svg/SVGPreserveAspectRatio.h:
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::createSVGAngle):
+        (WebCore::SVGSVGElement::inheritViewAttributes):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::setPreserveAspectRatioString):
+        (WebCore::SVGViewSpec::parseViewSpec):
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Chromium build fix, no review.
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+
+2009-12-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Correct my typo
+          on the CG build.
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make DatabaseTrackerChromium::removeOpenDatabase() send and IPC on
+        the main thread when a database is being closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32627
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::removeOpenDatabaseOnMainThread):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+
+2009-12-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        * page/win/FrameCairoWin.cpp: Add missing include.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Conditionalize
+          Safari-only call.
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Move some code related to database closing from the destructor to
+        the close() method. This would allow us to do things such as post
+        tasks to other threads when a database closes, which cannot be
+        done now, because we cannot increment the ref count to a database
+        object when we're in its destructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32626
+
+        * storage/Database.cpp:
+        (WebCore::Database::~Database):
+        (WebCore::Database::close):
+
+2009-12-18  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        REGRESSION(r52233): MSAA: Accessibility role of lists is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32736
+
+        Reviewed by Adam Roben.
+
+        Test: platform/win/accessibility/list-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::roleValueForMSAA):
+        Return roleValue(), rather than m_role, as subclasses may override it.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        Fallback to roleValue(), rather than m_role, as it may be overriden.
+
+2009-12-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility role of list items is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32688
+
+        Reviewed by Adam Roben.
+
+        Test: platform/win/accessibility/list-item-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add a ListItemRole to the enum.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::msaaRoleForRenderer):
+        Return the role for the RenderObject, or UnknownRole if unknown.
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        Call msaaRoleForRenderer() to get the role. If it is UnknownRole, fall
+        back to m_role.
+
+2009-12-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash when accessing webkitTransition property after setting webkitTransitionProperty with invalid value.
+        https://bugs.webkit.org/show_bug.cgi?id=31559
+        
+        Fix an array bounds error when accessing the CSS value for a shorthand property that takes
+        a comma-separated list, after the list for one of the component properties has been set to a different length.
+
+        Test: fast/css/shorthand-mismatched-list-crash.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+
+2009-12-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Remove WebCore.ClientBasedGeolocation.exp from Sources, and remove two IDL files from Resources.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Fix mac Geolocation build.
+
+        * DerivedSources.make:
+        * WebCore.ClientBasedGeolocation.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Geolocation.h:
+        * page/GeolocationError.h:
+        (WebCore::GeolocationError::GeolocationError):
+        * page/GeolocationPosition.h:
+
+2009-12-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/32613>.
+        REGRESSION (r52008): Middle-clicking on a linked image starts a pan scroll,
+        but should follow the link instead.
+
+        The node itself isn't the only possible node that can be a link (that was the
+        original check), any of its ancestors could be links as well, we need to climb
+        up the tree to see. Created a new function (enclosingAnchorNode), that finds a
+        node's enclosing anchor element (if it exists), that we can share between RenderLayer
+        and Node, and also added tests that test pan scrolling behavior in image maps.
+
+        Tests: platform/win/fast/events/panScroll-image-no-scroll.html
+               platform/win/fast/events/panScroll-imageMap-href-no-scroll.html
+               platform/win/fast/events/panScroll-imageMap-noHref-scroll.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::enclosingAnchorNode):
+        (WebCore::Node::defaultEventHandler):
+        * dom/Node.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-12-18  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] RemoveDashboard support. It's useless.
+
+        * GNUmakefile.am:
+
+2009-12-18  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Omit SearchWeb from the context menu in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add export the new symbol in WebCoreSystemInterface.
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Forward declare NSMutableArray when not compiling for Objective-C.
+
+        * platform/mac/WebCoreSystemInterface.h:
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+        Replace UString addition/append with use of JSC::StringBuilder.
+
+        * ForwardingHeaders/runtime/StringBuilder.h: Added.
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator+=):
+        * bridge/jni/jni_runtime.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+
+2009-12-18  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Index validation for drawElements examines too many indices
+        https://bugs.webkit.org/show_bug.cgi?id=32692
+
+        Test: fast/canvas/webgl/bug-32692.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Update WebKitSystemInterface for <rdar://problem/7237059>.        
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        GTK build fix
+
+        * plugins/gtk/PluginViewGtk.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * platform/chromium/PopupMenuChromium.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * html/HTMLLinkElement.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Qt build fix
+
+        * platform/qt/RenderThemeQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        Added #includes.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        V8 build fix
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        GTK (and others?) build fix
+
+        * platform/text/StringImpl.h: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Reduce #includes in a few high-use headers
+
+        Removed unnecessary #includes in these headers:
+          - Frame.h
+          - FrameWin.h
+          - Node.h
+          - Page.h
+          - StringImpl.h
+
+        The rest of the patch is all adding #includes to source files that now
+        require them.
+
+        Fixes <http://webkit.org/b/32718>.
+
+        Rubber-stamped by Anders Carlsson.
+
+        * dom/Node.h:
+        * page/Frame.h:
+        * page/Page.h:
+        * page/win/FrameWin.h:
+        * platform/text/StringImpl.h:
+        Removed unnecessary #includes.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * dom/Document.cpp:
+        * dom/InputElement.cpp:
+        * dom/Node.cpp:
+        * dom/SelectElement.cpp:
+        * editing/EditorCommand.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormElement.cpp:
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLParser.cpp:
+        * html/HTMLTextAreaElement.cpp:
+        * html/HTMLVideoElement.cpp:
+        * inspector/InspectorController.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/HistoryController.cpp:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * page/Console.cpp:
+        * page/EventHandler.cpp:
+        * page/Frame.cpp:
+        * page/FrameView.cpp:
+        * page/Navigator.cpp:
+        * page/PageGroup.cpp:
+        * page/Settings.cpp:
+        * page/mac/EventHandlerMac.mm:
+        * platform/KURL.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        * platform/cf/BinaryPropertyList.cpp:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/mac/PopupMenuMac.mm:
+        * platform/mac/WidgetMac.mm:
+        * platform/network/cf/DNSCFNet.cpp:
+        * platform/text/StringImpl.cpp:
+        * platform/win/FileSystemWin.cpp:
+        * platform/win/PlatformScreenWin.cpp:
+        * platform/win/PopupMenuWin.cpp:
+        * platform/win/WidgetWin.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderLayerCompositor.cpp:
+        * rendering/RenderObject.cpp:
+        * rendering/RootInlineBox.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransactionClient.cpp:
+        * svg/graphics/SVGImage.cpp:
+        Added now-needed #includes.
+
+2009-12-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Implemented isId as specified by DOM Level 3. See detailed description below.
+        https://bugs.webkit.org/show_bug.cgi?id=5578
+
+        Added isId property and implementation:
+        Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+               fast/dom/Element/attrisid-extra01.html
+        * dom/Attr.cpp:
+        (WebCore::Attr::isId):
+        * dom/Attr.h:
+        * dom/Attr.idl:
+
+        Replaced instances of HTMLNames::idAttr with Element::idAttributeName()
+        for the reason that id attribute name could be customized to a different
+        string other than "id". A test case is associated to each code change.
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById): Test: fast/dom/Element/id-in-getelement01.html
+        * dom/Element.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeMap):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::formatForDebugger):
+        (WebCore::Element::rareIDAttributeName):
+        * dom/Element.h: Added function idAttributeName().
+        (WebCore::Element::idAttributeName):
+        * dom/ElementRareData.h: Added member variable to store customized id name in ElementRareData.
+        (WebCore::ElementRareData::ElementRareData):
+        * dom/NamedAttrMap.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::setAttributes):
+        * dom/Node.cpp: Removed ASSERT as it may not hold any more.
+        (WebCore::Node::querySelector):
+        * dom/SelectorNodeList.cpp: Removed ASSERT as it may not hold any more.
+        (WebCore::createSelectorNodeList):
+        * dom/StyledElement.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::StyledElement::parseMappedAttribute):
+        * editing/DeleteButtonController.cpp: Test: fast/dom/Element/id-in-deletebutton.html
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * editing/EditorCommand.cpp: Test: fast/dom/Element/id-in-insert-hr.html
+        (WebCore::executeInsertHorizontalRule):
+        * html/HTMLAppletElement.cpp: Test: fast/dom/Element/id-in-applet.html
+        (WebCore::HTMLAppletElement::parseMappedAttribute):
+        (WebCore::HTMLAppletElement::createRenderer):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch): Test: fast/forms/select-namedItem.html
+        (WebCore::HTMLCollection::updateNameCache): Test: fast/dom/collection-namedItem-via-item.html
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::ensureColumn): Test: fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
+        (WebCore::HTMLDataGridColElement::parseMappedAttribute): Test: fast/dom/HTMLDataGridElement/DataGridColumns-dom-attributes.html
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormCollection.cpp: Test: fast/dom/Element/id-in-formcollection.html
+        (WebCore::HTMLFormCollection::getNamedFormItem):
+        (WebCore::HTMLFormCollection::nextNamedItem):
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLFrameElementBase.cpp: Test: fast/dom/Element/id-in-frame.html
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        * html/HTMLImageElement.cpp: Test: fast/dom/Element/id-in-deletebutton.html
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLMapElement.cpp: Test: fast/dom/Element/id-in-map.html
+        (WebCore::HTMLMapElement::parseMappedAttribute):
+        * html/HTMLNameCollection.cpp: Test: fast/dom/Element/id-in-frameset.html
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLObjectElement.cpp: Test: fast/dom/HTMLDocument/object-by-name-or-id.html
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLParamElement.cpp: Test: fast/dom/Element/id-in-param.html
+        (WebCore::HTMLParamElement::parseMappedAttribute):
+        * loader/CachedFont.cpp: Test: svg/custom/acid3-test-77.html
+        (WebCore::CachedFont::getSVGFontById):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Debug-only code
+        * rendering/SVGRenderTreeAsText.cpp: Test: svg/text/text-gradient-positioning.svg
+        (WebCore::writeRenderResources):
+        * svg/SVGElement.cpp: Test: svg/custom/acid3-test-77.html
+        (WebCore::SVGElement::insertedIntoDocument):
+        * svg/SVGStyledElement.cpp: Test: svg/custom/js-update-image-and-display.svg
+        (WebCore::SVGStyledElement::isKnownAttribute):
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::parseMappedAttribute):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        Introduce standalone_package as config that is set when QTDIR_build is set or when
+        the directory for the generated files is present.
+
+        Renamed uses of QTDIR_build that apply to generic package builds to use standalone_package.
+        Others remain as they are specific to building inside Qt.
+
+        * WebCore.pro:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on Symbian.
+
+        Use QFont::lastRestortFamily() instead of QFont::lastRestortFont(),
+        which is a missing symbol in Qt 4.6.0 on Symbian.
+
+        Functionally they should be equivalent, according to the source.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+
+2009-12-18  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault during controls initialization if not GTK theme is present.
+        https://bugs.webkit.org/show_bug.cgi?id=32705
+
+        Create empty images for the controls if no GTK theme is set.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getThemeIconFileName):
+        (WebCore::loadImageFromFile):
+
+2009-12-18  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r38898): Using the up arrow in a textarea gets "stuck"
+        at the beginning.
+        https://bugs.webkit.org/show_bug.cgi?id=31920
+
+        Moving up from a position after the end of the previous lines
+        should use UPSTREAM affinity to render the caret in the previous
+        line.
+
+        Test: editing/selection/wrapped-line-caret-3.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+
+2009-12-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::stepMismatch() uses ambiguous overload of pow()
+        https://bugs.webkit.org/show_bug.cgi?id=32675
+
+        Use the double constant 2.0 instead of static_cast<double>(2).
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+
+2009-12-17  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 32357: SVG test case crashes WebKit (invalid font URL)
+        https://bugs.webkit.org/show_bug.cgi?id=32357
+
+        Added check for NULL return value from DocLoader::requestFont()
+
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::loadFont):
+
+2009-12-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        marquee with display:inline causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=32374
+
+        Test: fast/inline/inline-marquee-crash.html
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::start):
+        (WebCore::HTMLMarqueeElement::stop):
+        (WebCore::HTMLMarqueeElement::suspend):
+        (WebCore::HTMLMarqueeElement::resume):
+        (WebCore::HTMLMarqueeElement::renderMarquee):
+        * html/HTMLMarqueeElement.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+
+2009-12-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for inspector's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32660                               
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:                                           
+
+        class name                  - instantiated at:  WebCore/'location'
+
+        class JavaScriptDebugServer - inspector/JavaScriptDebugServer.cpp:72
+        class ConsoleMessage        - inspector/InspectorController.cpp:329 
+        class InspectorController   - page/Page.cpp:119
+
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.h:
+        * inspector/JavaScriptDebugServer.h:
+
+2009-12-17  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes HTMLInputElement::stepMismatch() to avoid ambiguous overload of pow().
+        https://bugs.webkit.org/show_bug.cgi?id=32675
+
+        Build fix only, no new tests.
+
+        * html/HTMLInputElement.cpp: Modified.
+        (WebCore::HTMLInputElement::stepMismatch): Cast first argument of pow to double to force 'double pow(double, int)'
+
+2009-12-17  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix link failure on LTCG builds on Windows for chromium port.
+
+        Reenable SVGAllInOne.cpp. This required some fixups.
+
+        Namely, there was conflicts in constants between HTMLNames and
+        SVGNames, and conflicts between static functions names.
+
+        No new tests as functionality has not changed.
+
+        * WebCore.gyp/WebCore.gyp:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace):
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::invalidateGlyphCache):
+        (WebCore::SVGGlyphElement::buildGlyphIdentifier):
+        * svg/SVGHKernElement.cpp:
+        (WebCore::SVGHKernElement::insertedIntoDocument):
+        (WebCore::SVGHKernElement::removedFromDocument):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::type):
+        (WebCore::SVGStyleElement::setType):
+        (WebCore::SVGStyleElement::media):
+        (WebCore::SVGStyleElement::setMedia):
+        (WebCore::SVGStyleElement::title):
+        (WebCore::SVGStyleElement::setTitle):
+        (WebCore::SVGStyleElement::parseMappedAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::mapAttributeToCSSProperty):
+        (WebCore::SVGStyledElement::cssPropertyIdForSVGAttributeName):
+        * svg/SVGStyledElement.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix VI
+
+        * svg/animation/SMILTimeContainer.h: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix V
+
+        * platform/KURLGoogle.cpp: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix IV
+
+        * loader/CrossOriginPreflightResultCache.h: Added now-needed
+        #includes.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix III
+
+        * platform/graphics/Font.h: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix II
+
+        * dom/EventTarget.h: Added now-needed #include.
+
+2009-12-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for js bindings
+        https://bugs.webkit.org/show_bug.cgi?id=32655
+
+        Inherits the following classes from Noncopyable because these are instantiated 
+        by 'new' and no need to be copyable:
+
+        class name                  - instantiated at:  WebCore/'location'
+
+        class ScriptCachedFrameData - history/CachedFrame.cpp:117
+        class WebCoreJSClientData   - bindings/js/JSDOMWindowBase.cpp:162
+        class ScheduledAction       - bindings/js/ScheduledAction.cpp:58
+
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCachedFrameData.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * dom/QualifiedName.h: Added now-needed #include of HashTraits.h
+        (which itself #includes HashFunctions.h).
+
+2009-12-17  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Incorrect Doctype.
+
+        REGRESSION(4.0.4-TOT):Web Inspector: Incorrect Doctype
+        https://bugs.webkit.org/show_bug.cgi?id=32671
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+
+2009-12-17  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Adam Roben.
+
+        Don't include all JSC headers everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=32663
+
+        Remove HashMap HashSet and OwnPtr includes from PlatformString.h.
+        Reduces code size of Gtk build by another 5%.
+
+        * platform/text/PlatformString.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Mac/Qt build fixes
+
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        * platform/qt/Localizations.cpp:
+        Added missing #includes.
+
+2009-12-17  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Adam Roben.
+
+        Don't include all JSC headers everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=32663
+
+        PlatformString.h included almost all of JSC via runtime/Identifier.h.
+        This patch gets rid of this include by forward-declaring the required
+        classes instead.
+        This reduces the build size of the object files on a Gtk debug build
+        by 10%. The resulting libwebkit.so gets 5% smaller.
+
+        No new tests as it's just a build improvement.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        include math.h here (it used to be pulled by JSC)
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+
+2009-12-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Xan Lopez.
+
+        Always use all WebCore include paths in GtkWebKit.
+
+        With this patch, I can disable all optional features and still build.
+
+        * GNUmakefile.am:
+
+2009-12-17  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Added WebPageSerializer to WebKit API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31737
+
+        * platform/text/StringBuilder.cpp: Added methods to make StringBuilder even more useful for large scale string concatenation.
+        (WebCore::StringBuilder::clear):
+        (WebCore::StringBuilder::length):
+        * platform/text/StringBuilder.h:
+
+2009-12-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Add controls for playing html5 video.
+        https://bugs.webkit.org/show_bug.cgi?id=26304
+
+        Media controls UI, first step. This patch was written by Zan
+        Dobersek. In addition I fixed the compilation errors and
+        re-enabled some of the media tests involving the controls UI.
+
+        * GNUmakefile.am:
+        * css/mediaControlsGtk.css: Added.
+        * platform/graphics/Image.h:
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getThemeIconFileName):
+        (WebCore::loadResourceSharedBuffer):
+        (WebCore::loadImageFromFile):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::loadPlatformThemeIcon):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::getMediaElementFromRenderObject):
+        (WebCore::getIconNameForTextDirection):
+        (WebCore::RenderThemeGtk::initMediaStyling):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeGtk::baselinePosition):
+        (WebCore::paintMozWidget):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
+        (WebCore::RenderThemeGtk::gtkContainer):
+        (WebCore::RenderThemeGtk::platformColorsDidChange):
+        (WebCore::RenderThemeGtk::extraMediaControlsStyleSheet):
+        (WebCore::paintMediaButton):
+        (WebCore::RenderThemeGtk::paintMediaFullscreenButton):
+        (WebCore::RenderThemeGtk::paintMediaMuteButton):
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekBackButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
+        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-12-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] support navigator.onLine and ononline/onoffline events.
+        https://bugs.webkit.org/show_bug.cgi?id=32555
+
+        Hooked up Bearer Management to NetworkStateNotifier. This solution is available 
+        only if QtMobility's Bearer Management is installed.
+
+        * WebCore.pro:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h: Added.
+        * platform/network/qt/NetworkStateNotifierQt.cpp: Added.
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
+        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Switch to 11px as default for source-code in WebKit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32646
+
+        * inspector/front-end/inspector.css:
+
+2009-12-17  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Symbian build fix: Don't include QtXml/qxmlstream.h but omit the prefix, to
+        make sure we pick up the header file from QtCore. That is where the implementation
+        is compiled.
+
+        * dom/XMLTokenizer.h:
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Add GRefPtr support for GTK types to WebCore, as JSC does not link against
+        GTK+. Also convert PopupMenu::m_poup from a raw pointer to a GRefPtr.
+
+        No new tests as functionality has not changed.
+
+        * GNUmakefile.am:
+        * platform/PopupMenu.h:
+        * platform/gtk/GRefPtrGtk.cpp: Added.
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+        * platform/gtk/GRefPtrGtk.h: Added.
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::menuRemoveItem):
+
+2009-12-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Advice links to source code in CPU profiler to open in debugger,
+        not in resources tab.
+
+        Also work around the case when resources are disabled, but scripts are present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32610
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.updateMainViewWidth):
+        (WebInspector.Panel.prototype.canShowSourceLineForURL):
+        (WebInspector.Panel.prototype.showSourceLineForURL):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLineForURL):
+        (WebInspector.ResourcesPanel.prototype.showSourceLineForURL):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.scriptForURL):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLineForURL):
+        (WebInspector.ScriptsPanel.prototype.showSourceLineForURL):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._choosePanelToShowSourceLineForURL):
+        (WebInspector.canShowSourceLineForURL):
+        (WebInspector.showSourceLineForURL):
+
+2009-12-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] display FPS stats for video element
+        https://bugs.webkit.org/show_bug.cgi?id=32560
+
+        Display FPS statistics if WEBKIT_DEBUG environment variable
+        contains the Media log category. This feature requires a very
+        recent (>= 0.10.18) version of gst-plugins-bad.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-11  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GStreamer] Should emit {networkState,readyState,volume,time,size,rate,duration}Changed signals
+        https://bugs.webkit.org/show_bug.cgi?id=30377
+
+        Emit volumeChanged and durationChanged upon notification from
+        GStreamer.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateVolumeCallback):
+        (WebCore::notify_volume_idle_cb):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-12-16  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] segfault during volume notification
+        https://bugs.webkit.org/show_bug.cgi?id=32603
+
+        Emit volumeChanged and durationChanged upon notification from
+        GStreamer. Also don't reset the volume property on playbin, it is
+        not needed as it is 1.0 by default both on playbin and in the
+        MediaPlayer.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::doGstInit):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-12-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Xan Lopez.
+
+        gtk: always use standard include paths, regardless of settings.
+        WebKit style is to wrap the body of a header in #if ENABLE(FOO),
+        so they're always safe to include whether the features are enabled or
+        not.
+
+        This fixes building with --disable-database and other flags.
+
+        * GNUmakefile.am:
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-17  Philippe Normand  <pnormand@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Trivial WebKit coding style fix.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-12-15 MORITA Hajime <morrita@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28306: double-clicking a word inside <b> beside newline select two words
+        https://bugs.webkit.org/show_bug.cgi?id=28306
+        
+        SimplifiedBackwardsTextIterator missed trailing whitespaces just
+        before folding line-break, which is used to detect word
+        boundaries. This fix checks strings on RenderText and expand text
+        range on SimplifiedBackwardsTextIterator to include trailing
+        whitespaces if availble.
+
+        Test: editing/selection/doubleclick-beside-cr-span.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::collapsedSpaceLength):
+        (WebCore::maxOffsetIncludingCollapsedSpaces):
+        (WebCore::SimplifiedBackwardsTextIterator::advance):
+
+2009-12-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix flakiness in WebSocket handshake console message.
+        https://bugs.webkit.org/show_bug.cgi?id=32598
+
+        In chromium, LayoutTests/websocket/tests/handshake-error.html is
+        flaky, because it outputs the following console message several times:
+          CONSOLE MESSAGE: line 0: Unexpected response code:101
+        Update m_mode in WebSocketHandshake correctly: Once it finds
+        error in handshake message, set m_mode to Failed and don't try
+        reading handshake message again.  If handshake message is not yet
+        fully received, set m_mode to Incomplete, so next didReceiveData()
+        will try to check handshake message again.
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+
+2009-12-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility role of text nodes is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32631
+        <rdar://problem/7369084>
+
+        Reviewed by Alice Liu.
+
+        Test: platform/win/accessibility/text-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add a new role to the enum.
+        (WebCore::AccessibilityObject::roleValueForMSAA):
+        Declare a function to return the accessibility role for MSAA; the base
+        implementation returns the old role value.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        Initialize m_roleForMSAA.
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        If m_roleForMSAA has been set, return it. If the renderer is a
+        RenderText, set the role to EditableTextRole to match IE and Firefox.
+        Otherwise, set the role for MSAA to the old role value.
+
+        * accessibility/AccessibilityRenderObject.h:
+        Add a member to hold the role for MSAA, and declare an override of
+        roleValueForMSAA().
+
+2009-12-16  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52206.
+        http://trac.webkit.org/changeset/52206
+        https://bugs.webkit.org/show_bug.cgi?id=31187
+
+        This broke pixel tests on Mac.  Presumably the code in
+        ImageCG is wrong here.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32637
+        [V8] Generate most named property getters.
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of SetNamedPropertyHandler call.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed now-generated SetNamedPropertyHandler callsites.
+
+2009-12-16  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Implement combobox delegate for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=32550
+
+        Abstract popup menu factory.
+
+        A static method from QtAbstractPopupMenu is used to create its instances. If a factory
+        has been suplied to class QtAbstractPopupMenu the factory will be used to create the
+        objects. If not an instance of QtFallbackPopupMenu will be created.
+
+        The objective is to make it easy to replace the combobox popup at WebCore layer providing
+        support to the combobox popup delegation API. Future patches will make it possible to
+        replace the combobox popup at WebKit layer.
+
+        No behavior changes.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::setFactory):
+        (WebCore::QtAbstractWebPopup::create):
+        * platform/qt/QtAbstractWebPopup.h:
+        * platform/qt/QtFallbackWebPopup.cpp:
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Right clicking in a table cell creates a selection that extends into the next cell.
+        <rdar://problem/5565465>
+        https://bugs.webkit.org/show_bug.cgi?id=32622
+        
+        Avoid extending the selection to the next cell if we start from an empty cell.
+
+        Test: editing/selection/empty-cell-right-click.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Replaced the code that check for empty table cell
+        with a call to the new function.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity): Extends the
+        selection only if we are not starting from an empty table cell.
+        * editing/htmlediting.cpp:
+        (WebCore::isEmptyTableCell): Added a function since this check is performed now in two places.
+        * editing/htmlediting.h: Added isEmptyTableCell declaration.
+
+2009-12-16  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMerge crahses if feMergeNodes attribute in is empty
+        https://bugs.webkit.org/show_bug.cgi?id=32489
+
+        SVGFEMergeElement only stored pointers to all effects of it's nodes
+        in a list. But it should store the RefPtr otherwise the effects get
+        dereferenced and WebKit crashes.
+        I also made a short clean-up in SVGFilterBuilder. No change in
+        functionality.
+
+        Test: I updated svg/custom/empty-merge.svg to cover this problem.
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::FEMerge):
+        (WebCore::FEMerge::create):
+        (WebCore::FEMerge::mergeInputs):
+        (WebCore::FEMerge::setMergeInputs):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::add):
+
+2009-12-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/32568>.
+        Web Inspector: Context Menus should be used in more places.
+        
+        Add a context menu entry in the console to clear the console. This
+        is only shown when there is no user selection of text, because if
+        there is selection of the text, then we want to give the user the Copy +
+        Spell Check context menu that they are used to.
+
+        * English.lproj/localizedStrings.js: Added "Clear Console".
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
+
+2009-12-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=32621>.
+        Web Inspector: [REGRESSION (52095-52100)] Resources filter disappears when switching 
+        from / to resources panel.
+
+        Changed style in sidebar-resizer-vertical, because if the min-height was 100%, we start
+        to cover the scope bar.
+
+        * inspector/front-end/inspector.css:
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Switch all indexers to be generated.
+        https://bugs.webkit.org/show_bug.cgi?id=32569
+
+        Covered by existing tests.
+
+        * WebCore.gypi: Remove V8FileListCustom.cpp and V8ClientRecListCustom.cpp,
+            as they are now generated.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Remove customization of ClientRectList,
+            FileList, and DataGridColumnList templates.
+        * bindings/v8/custom/V8ClientRectListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h: Remove custom indexer getter decls.
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Remove indexer getter definition.
+        * bindings/v8/custom/V8FileListCustom.cpp: Removed.
+
+2009-12-16  anton muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [dom] make dom/Node.cpp compile if DUMP_NODE_STATISTICS is on
+        https://bugs.webkit.org/show_bug.cgi?id=32617
+
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] There is no such thing as HTMLSelectElementCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=32616
+
+        Refactoring, covered by existing tests.
+
+        * WebCore.gypi: Removed V8HTMLSelectElementCollectionCustom.cpp
+        * bindings/v8/V8Collection.h: Removed one-off template.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Renamed all references to HTMLSelectElementCollection
+            to HTMLSelectElement.
+        * bindings/v8/custom/V8CustomBinding.h: Renamed custom indexer decls.
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp: Moved code as-is from
+            V8HTMLSelectElementCollectionCustom.cpp
+
+2009-12-16  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Content-Encoding support
+
+        https://bugs.webkit.org/show_bug.cgi?id=25855
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp): Don't force "Accept-Encoding: identity" any
+        more
+
+2009-12-16  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Darin Adler.
+
+        Get rid of the phase argument to Image::drawPattern.
+        https://bugs.webkit.org/show_bug.cgi?id=31187
+
+        The argument can be expressed equally well as part of the
+        patternTransform. All backends but the Qt one did exactly that
+        manually anyway.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+
+2009-12-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Performance problems with index validation code for drawElements
+        https://bugs.webkit.org/show_bug.cgi?id=32466
+
+        Added a cache of the maximum index for each element type to
+        WebGLBuffer, querying it before iterating through the indices in
+        the client-side copy of the buffer's data. Hoisted checks of the
+        size of the element array itself into validateElementArraySize to
+        avoid duplicating code.
+
+        The performance improvement has been measured with manual tests.
+        Existing layout tests cover the index validation functionality
+        and continue to pass as before.
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::getCachedMaxIndex):
+        (WebCore::WebGLBuffer::setCachedMaxIndex):
+        (WebCore::WebGLBuffer::clearCachedMaxIndices):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateElementArraySize):
+        (WebCore::WebGLRenderingContext::validateIndexArrayConservative):
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawElements):
+        * html/canvas/WebGLRenderingContext.h:
+
+2009-12-16  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32261
+        Added ability to separate the autocomplete suggestion previewing from
+        the actual accepting of the suggested value in HTMLInputElement.
+        This element (it's single line text incarnation) can now
+        be put in suggestion mode where renderer might display the suggested
+        value without making it automatically exposed to JavaScript.
+
+        No new tests. This new methods are not exposed yet. It's use will be
+        platform specific. PopupMenu and Chromium specific changes will be
+        separated based on Darin Adler's comments.
+
+        * dom/InputElement.h:
+        (WebCore::InputElementData::suggestedValue):
+        (WebCore::InputElementData::setSuggestedValue):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::suggestedValue):
+        (WebCore::HTMLInputElement::setSuggestedValue):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::suggestedValue):
+        * wml/WMLInputElement.h:
+
+2009-12-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make Elements tree, properties section and resources
+        view monospace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32609
+
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        * inspector/front-end/inspector.css:
+
+2009-12-16  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        sourceGraphic wrong if positive x,y is >0 and objectBB is selected on Filter
+        https://bugs.webkit.org/show_bug.cgi?id=32575
+
+        On SVG Filters, the rest of the source graphic gets clipped to the filter
+        rest. This helps us to minimize the size of intermediate ImageBuffers. If
+        the position moves to the right or to the bottom, we have to adjust the
+        GraphicContext of this intermediate ImageBuffer.
+        This patch fixes the adjustment of the context, according to the clipping.
+
+        Test: svg/filters/filter-source-position.svg
+
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+
+2009-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        CrashTracer: [USER] 1 crash in Safari at com.apple.WebCore: WebCore::endsOfNodeAreVisuallyDistinctPositions + 115
+        <rdar://problem/7467108>
+        https://bugs.webkit.org/show_bug.cgi?id=32590
+
+        If the element is a button there is no need to look at the children to calculate the caret position.
+        
+        Test: editing/selection/button-right-click.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset): Avoid calling recursively this method,
+        when starting from a button element.
+
+2009-12-16  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Implement combobox delegate for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=32550
+
+        Refactoring of class QWebPopup.
+
+        Class QWebPopup has been split in QtAbstractWebPopup and QtFallbackWebPopup.
+        Both new classes are now in corresponding files and files QWebPopup.* have been removed.
+
+        Custom combo popup classes will inherit from QtAbstractWebPopup. It is not the public API as it is
+        in WebCore and will not be visible by users of QtWebKit. It will be used in implementation of
+        public QtWebKit combobox popup delegation API.
+
+        Class QtFallbackWebPopup inherits from QtAbstractWebPopup and implements the currently used combobox popup.
+        It needs to be improved to provide standard features that are missing like style or indentation.
+
+        No behavior changes.
+
+        * WebCore.pro:
+        * platform/PopupMenu.h:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        * platform/qt/QWebPopup.cpp: Removed.
+        * platform/qt/QWebPopup.h: Removed.
+        * platform/qt/QtAbstractWebPopup.cpp: Added.
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::~QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::client):
+        * platform/qt/QtAbstractWebPopup.h: Added.
+        * platform/qt/QtFallbackWebPopup.cpp: Added.
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::populate):
+        (WebCore::QtFallbackWebPopup::showPopup):
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        (WebCore::QtFallbackWebPopup::activeChanged):
+        * platform/qt/QtFallbackWebPopup.h: Added.
+        (WebCore::QtFallbackWebPopup::hide):
+
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: beautify HTTP info section.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32583
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-12-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix crash when encountering illegal HTML within a continuation inside <ruby>.
+        (https://bugs.webkit.org/show_bug.cgi?id=32316)
+
+        Avoid having the anonymous blocks utilized in the ruby renderers being
+        re-used as continuation blocks.
+        Avoid having ruby runs collected as "leftover blocks".
+
+        Test: fast/ruby/ruby-illegal.html
+
+        * rendering/RenderRuby.h:
+        (WebCore::RenderRubyAsInline::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsInline::isRuby): made private
+        (WebCore::RenderRubyAsInline::renderName): made private
+        (WebCore::RenderRubyAsInline::createsAnonymousWrapper): return true
+        (WebCore::RenderRubyAsBlock::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsBlock::isRuby): made private
+        (WebCore::RenderRubyAsBlock::renderName): made private
+        (WebCore::RenderRubyAsBlock::createsAnonymousWrapper): return true
+        * rendering/RenderRubyRun.h:
+        (WebCore::RenderRubyRun::removeLeftoverAnonymousBlock): avoid
+        (WebCore::RenderRubyRun::isRubyRun): made private
+        (WebCore::RenderRubyRun::renderName): made private
+        (WebCore::RenderRubyRun::createsAnonymousWrapper): return true
+
+2009-12-15  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename skipCanLoadCheck to skipSecurityCheck in a bunch of places in WebCore/loader.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32529
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestUserCSSStyleSheet):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::load):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::load):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        (WebCore::DocumentThreadableLoader::preflightSuccess):
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * loader/Request.cpp:
+        (WebCore::Request::Request):
+        * loader/Request.h:
+        (WebCore::Request::shouldDoSecurityCheck):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7470452> Safari/Chromium crashes on complicated @font-face rule
+        https://bugs.webkit.org/show_bug.cgi?id=32257
+
+        Test: fast/css/font-face-unused-source-loaded.html
+
+        The loading of a font resource caused a CSSFontFace that had the resource in one of its
+        sources, but wasn’t using it (due to using an earlier source) to invalidate its
+        CSSSegmentedFontFaces. This caused FontData for the active source (the one that did not just
+        finish loading) to be deleted, but that went unnoticed by Font::operator==(), since the
+        corresponding FontFallbackLists were not in the loading state. The fix is for CSSFontFace to
+        ignore loads from unused sources.
+
+        * css/CSSFontFace.cpp:
+        (WebCore::CSSFontFace::fontLoaded): Bail out if the loaded source is not the active source.
+        (WebCore::CSSFontFace::getFontData): Set m_activeSource to the source that supplied the
+            FontData.
+        * css/CSSFontFace.h:
+        (WebCore::CSSFontFace::CSSFontFace): Initialize m_activeSource.
+
+2009-12-15  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Cannot load flash files from a local file.
+        https://bugs.webkit.org/show_bug.cgi?id=32572
+
+        When loading the main resource and its mime type is application/octet-stream,
+        use the file extenstion to check if it is a supported plugin.
+
+        No new tests were added since any existing swf file can be used as a manual test.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * loader/MainResourceLoader.h:
+        * plugins/PluginDatabase.h:
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=18498>.
+        REGRESSION: Tips are not shown for resources anymore.
+        
+        As discussed in the bug, Tips are not coming back, and the feature
+        will be moved to the audits panel. This patch is to remove the Tips
+        code and the resources that it needed.
+
+        * WebCore.gypi: Removed tips files.
+        * inspector/front-end/Images/tipBalloon.png: Removed.
+        * inspector/front-end/Images/tipBalloonBottom.png: Removed.
+        * inspector/front-end/Images/tipIcon.png: Removed.
+        * inspector/front-end/Images/tipIconPressed.png: Removed.
+        * inspector/front-end/Resource.js: Removed tips code.
+        (WebInspector.Resource.prototype.set finished): 
+        * inspector/front-end/WebKit.qrc: Removed tips files.
+        * inspector/front-end/inspector.css: Removes tips style rules.
+        
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Display request headers for main resource
+        having redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32577
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::appendRedirect):
+        (WebCore::InspectorResource::createCached):
+        (WebCore::InspectorResource::updateRequest):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::create):
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=32578>.
+        Web Inspector: No Need for ?="" now that we have context menus.
+        
+        Remove the toggleNewAttributeButton function and callers to it, as
+        we don't need this behavior anymore, now that we have context menus.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+
+2009-12-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Generate trivial named property getters.
+        https://bugs.webkit.org/show_bug.cgi?id=32562
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateImplementationNamedPropertyGetter.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedPropertyOfCollection): Fixed a booboo by using AtomicString like we're supposed to.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed code that's now generated.
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/32568>.
+        New Web Inspector: The Context Menu should be used in more places.
+        
+        Add support for context menu entries for editing and deleting elements
+        in the datagrid. This gives support to deleting cookies, and editing and
+        deleting session storage and local storage.
+
+        * English.lproj/localizedStrings.js: Added "Edit" and "Add New" entries (delete was already there)
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid): Added context menu listener.
+        (WebInspector.DataGrid.prototype._contextMenuInDataTable):
+
+2009-12-15  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Don't allow default framebuffer to be mutated
+        https://bugs.webkit.org/show_bug.cgi?id=32391
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for FontPlatformDataCacheKey class
+        https://bugs.webkit.org/show_bug.cgi?id=32552
+
+        Inherits the following struct from FastAllocBase because it is instantiated by 'new':
+
+        struct name                     - instantiated at: WebCore/'location'
+        struct FontPlatformDataCacheKey - platform/graphics/FontCache.cpp:118
+
+        * platform/graphics/FontCache.cpp:
+
+2009-12-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Bug 31090 - [Chromium] Add DownloadURL format to Chromium clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=31090
+
+        The proposal to whatwg can be found here:
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-August/022118.html
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::setData):
+
+2009-12-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement treegrid
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        Test: platform/mac/accessibility/aria-treegrid.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        (WebCore::AccessibilityARIAGrid::supportsSelectedRows):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::isARIATreeGridRow):
+        (WebCore::AccessibilityARIAGridRow::disclosedRows):
+        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isARIATreeGridRow):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelectable):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::supportsSelectedRows):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for EmptyEditorClient and EmptyInspectorClient
+        https://bugs.webkit.org/show_bug.cgi?id=32557
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class name                 - instantiated at: WebCore/'location'
+        class EmptyEditorClient    - svg/graphics/SVGImage.cpp:230
+        class EmptyInspectorClient - svg/graphics/SVGImage.cpp:241
+
+        * loader/EmptyClients.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore/inspector directory's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32556
+
+        Inherits the following class from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class name                   - instantiated at: WebCore/'location'
+        class InspectorFrontend      - inspector/InspectorController.cpp:538
+        class InspectorTimelineAgent - inspector/InspectorController.cpp:1097
+
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore/platform/network directory's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32553
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name                      - instantiated at: WebCore/'location'
+
+        struct CrossThreadResourceResponseData - platform/network/ResourceResponseBase.cpp:109
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class ResourceResponseBase - (its child class) platform/network/ResourceResponseBase.cpp:90
+        class ResourceRequestBase  - (its child class) loader/DocumentThreadableLoader.cpp:88
+
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for AnimationControllerPrivate and FillLayerPropertyWrapperGetter
+        https://bugs.webkit.org/show_bug.cgi?id=32549
+
+        Inherits AnimationControllerPrivate and FillLayerPropertyWrapperGetter
+        classes from Noncopyable because these are instantiated by 'new' and no need to be copyable:
+
+        class/struct name              - instantiated at: WebCore/'location'
+
+        AnimationControllerPrivate     - page/animation/AnimationController.cpp:439
+        FillLayerPropertyWrapperGetter - (its child class) page/animation/AnimationBase.cpp:464
+
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationControllerPrivate.h:
+
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not lose HTTP redirect information, display it
+        in the Resources Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32551
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::appendRedirect):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        (WebCore::InspectorResource::type):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::setAll):
+        * inspector/front-end/inspector.js:
+        (WebInspector._addResource):
+        (WebInspector.updateResource):
+
+2009-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Followup for direct signals and slots connections in QNetworkReplyHandler
+        https://bugs.webkit.org/show_bug.cgi?id=32113
+
+        For Qt versions prior to 4.6.1 we will need to use QueuedConnection
+        for the signal and slot connection to avoid running into a bug in.
+
+        Add a comment that we want to remove one signal to forward
+        queued items when moving our minimum requirements.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add manual test for JavaScript prompt corner case
+        https://bugs.webkit.org/show_bug.cgi?id=30914
+
+        The patch is based on the work done by Gupta Manish.
+
+        Verify behavior of the JavaScript prompt function. Currently
+        Qt is not behaving like other WebKit ports and Firefox in
+        regards to accepting the prompt but not entering a text.
+
+        * manual-tests/qt/java-script-prompt.html: Added.
+
+2009-12-15  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moving list populate methods from PopupMenuQt to QWebPopup.
+        
+        In preparation to future implementation of a delegation API for the combobox.
+
+        * platform/PopupMenu.h:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::show):
+        (WebCore::QWebPopup::populate):
+        * platform/qt/QWebPopup.h:
+        (WebCore::QWebPopup::hide):
+
+2009-12-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Extract WebInspector.Section from WebInspector.PropertiesSection.
+        https://bugs.webkit.org/show_bug.cgi?id=32523
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/Section.js: Added.
+        (WebInspector.Section):
+        (WebInspector.Section.prototype.get title):
+        (WebInspector.Section.prototype.set title):
+        (WebInspector.Section.prototype.get subtitle):
+        (WebInspector.Section.prototype.set subtitle):
+        (WebInspector.Section.prototype.get expanded):
+        (WebInspector.Section.prototype.set expanded):
+        (WebInspector.Section.prototype.get populated):
+        (WebInspector.Section.prototype.set populated):
+        (WebInspector.Section.prototype.expand):
+        (WebInspector.Section.prototype.collapse):
+        (WebInspector.Section.prototype.toggleExpanded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-12-15  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52140.
+        http://trac.webkit.org/changeset/52140
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        The commit broke the Leopard bots and unfortunately
+        Chris wasn't around to fix them, so I'm rolling the change
+        out after 3 hours so that the bots can roll green again. :)
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelect):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove dead code from FontPlatformDataQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32540
+
+        In r51758 the code that used familyNames was removed
+        and we should remove the creation of the familyNames
+        as well.
+
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore part of <rdar://problem/7173515> Use LOGFONT support in Core
+        Graphics when available
+
+        When using a version of Core Graphics with LOGFONT support, this fixes
+        <rdar://problem/5764844> First-time launch is painfully slow due to font
+        plist creation
+        and <rdar://problem/6576281> 12px synthetic-italics Tahoma text is less
+        readable in Safari than in Firefox/IE due to poorly-spaced letters
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): No longer call drawGDIGlyphs for stroked
+        text.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont): Added a synthesizeItalic parameter. When set
+        to true, if italics are desired but the best match lacks italics,
+        creates and returns a synthetic italics font.
+        (WebCore::FontCache::createFontPlatformData): Ask to synthesize italics
+        if needed.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData): Updated an
+        assertion, and changed to create the CGFont from the LOGFONT.
+        (WebCore::createFontCustomPlatformData): Changed cgFont to be a
+        RetainPtr. Do not create a CGFont from the font data if it can be
+        created from the LOGFONT in fontPlatformData().
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabase): Avoid font database work if fonts are
+        not going to be looked up by name.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Create the CGFont from
+        a LOGFONT based on the HFONT.
+
+2009-12-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement treegrid
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        Test: platform/mac/accessibility/aria-treegrid.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        (WebCore::AccessibilityARIAGrid::supportsSelectedRows):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::isARIATreeGridRow):
+        (WebCore::AccessibilityARIAGridRow::disclosedRows):
+        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isARIATreeGridRow):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelectable):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::supportsSelectedRows):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7460655> REGRESSION (r47255): Content shifted down at software.opensuse.org
+        https://bugs.webkit.org/show_bug.cgi?id=32382
+
+        Test: fast/block/float/in-margin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Floats that do not intrude into the line (because
+        they are in the margin) do not need to be cleared.
+
+2009-12-14  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Pressing backspace inside a table cell erases all empty rows below it.
+        <rdar://problem/5565461>
+        https://bugs.webkit.org/show_bug.cgi?id=32526
+
+        No deletion is performed when the caret selection is on an empty table cell.
+        
+        Test: editing/deleting/delete-empty-table.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Added check for empty table cells in
+        case of caret selection.
+
+2009-12-14  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Android needs ResourceHandle implementation
+        https://bugs.webkit.org/show_bug.cgi?id=32515
+
+        Adds implementation of ResourceHandle on Android.
+
+        No new tests needed, this is platform-specific code, so existing
+        tests are sufficient.
+
+        * platform/network/android/ResourceHandleAndroid.cpp: Added.
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::bufferedData):
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (WebCore::ResourceHandle::willLoadFromCache):
+        (WebCore::ResourceHandle::loadsBlocked):
+        (WebCore::SyncLoader::SyncLoader):
+        (WebCore::SyncLoader::~SyncLoader):
+        (WebCore::SyncLoader::didReceiveResponse):
+        (WebCore::SyncLoader::didReceiveData):
+        (WebCore::SyncLoader::didFail):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/android/ResourceLoaderAndroid.h: Added.
+        (WebCore::ResourceLoaderAndroid::~ResourceLoaderAndroid):
+        (WebCore::ResourceLoaderAndroid::ResourceLoaderAndroid):
+
+2009-12-14  Marco Martin  <notmart@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        In the Scrollbar painting of the Qt theme integration,
+        intersects any previous clip rects with the one needed to paint the scrollbar.
+        This fixes the painting in QGraphicsview, when the parent of the widget that 
+        paints the QWebPage has the QGraphicsItem::ItemClipsChildrenToShape set and
+        a piece of the scrollbar should be cipped away
+        https://bugs.webkit.org/show_bug.cgi?id=30366
+
+        No new tests.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+
+2009-12-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Generate bindings for trivial indexers.
+        https://bugs.webkit.org/show_bug.cgi?id=32455
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+            Added detecting indexers and generating code for them.
+        * bindings/v8/V8Collection.h: Removed code that's now generated.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Ditto.
+
+2009-12-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31660
+        REGRESSION (r49394): Image load event fires before the document fragment is attached.
+
+        Test: fast/images/image-load-event-in-fragment.html
+
+        We cannot fire load events immediately after parsing a fragment - an element inserted via
+        innerHTML or equivalent should be reachable via getElementById() by the time its load event
+        fires.
+
+        * dom/Document.cpp: (WebCore::Document::implicitClose): Call dispatchPendingBeforeLoadEvents()
+        and dispatchPendingLoadEvents() individually. I'm not sure why these calls are here, just
+        preserving existing behavior.
+
+        * dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::write):
+        * html/HTMLTokenizer.cpp: (WebCore::HTMLTokenizer::write):
+        Load events for elements that have just been parsed cannot be dispatched yet, we should give
+        the elements a chance to be inserted into a document first. There is no compatibility baggage
+        for beforeload, so it seems OK to dispatch it right away.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvents):
+        (WebCore::ImageLoader::dispatchPendingLoadEvents):
+        * loader/ImageLoader.h:
+        Separated dispatchPendingEvents() into individual functions for each event kind.
+
+2009-12-14  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add FloatQuad::isRectilinear() to check whether it can be represented as FloatRect.
+        https://bugs.webkit.org/show_bug.cgi?id=30442
+
+        This enables optimizations for distinguishing between
+        arbitrary FloatQuads and rectilinear ones.
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::FloatQuad::isRectilinear):
+        * platform/graphics/FloatQuad.h:
+
+2009-12-14  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Add support for keyboard modifiers to TouchEvent
+
+        https://bugs.webkit.org/show_bug.cgi?id=32482
+
+        Similar to other ui events with keyboard state, get the alt, shift,
+        meta and ctrl modifiers straight from the platform event.
+
+        * dom/TouchEvent.cpp:
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::initTouchEvent):
+        * dom/TouchEvent.h:
+        (WebCore::TouchEvent::create):
+        * dom/TouchEvent.idl:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        (WebCore::PlatformTouchEvent::shiftKey):
+        (WebCore::PlatformTouchEvent::ctrlKey):
+        (WebCore::PlatformTouchEvent::altKey):
+        (WebCore::PlatformTouchEvent::metaKey):
+        * platform/qt/PlatformTouchEventQt.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2009-12-14  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] crash when clicking "Sign out" in GMail
+        https://bugs.webkit.org/show_bug.cgi?id=32300
+
+        When the ResourceLoader cancels the handle we have to make sure not to access
+        the resource handle afterwards again.
+        This complete r29515
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-12-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Implement InjectedScript.evaluateOnSelf() that evaluates functions in the InjectedScript context.
+        https://bugs.webkit.org/show_bug.cgi?id=32517
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluateOnSelf):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-14  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for compilation errors in WML enabled builds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32481
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueForUser):
+        * wml/WMLInputElement.h:
+
+2009-12-14  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Android needs ResourceError, ResourceResponse and
+        ResourceRequest implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32522
+
+        Add implementation of ResourceError, ResourceResponse and ResourceRequest.
+        No new tests needed, the existing tests should be sufficient.
+
+        * platform/network/android/ResourceError.h: Added.
+        (WebCore::ResourceError::ResourceError):
+        * platform/network/android/ResourceRequest.h: Added.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::setUserGesture):
+        (WebCore::ResourceRequest::getUserGesture):
+        * platform/network/android/ResourceResponse.h: Added.
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::doUpdateResourceResponse):
+
+2009-12-14  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * page/Geolocation.cpp:
+        * page/Geolocation.h:
+
+2009-12-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32499
+        Add client based Geolocation provider
+
+        Add first cut of a client based Geolocation provider. This is guarded by
+        ENABLE(CLIENT_BASED_GEOLOCATION) and is off by default for now. This adds a
+        GeolocationControllerClient interface that no-one currently implements,
+        but will in a subsequent patch.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Geolocation.cpp:
+        (WebCore::createGeopositionFromGeolocationPosition):
+        (WebCore::createPositionErrorFromGeolocationError):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::startRequest):
+        (WebCore::Geolocation::fatalErrorOccurred):
+        (WebCore::Geolocation::requestTimedOut):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::handleError):
+        (WebCore::Geolocation::positionChanged):
+        (WebCore::Geolocation::makeSuccessCallbacks):
+        (WebCore::Geolocation::errorOccurred):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        (WebCore::Geolocation::geolocationServiceErrorOccurred):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp: Added.
+        (WebCore::GeolocationController::GeolocationController):
+        (WebCore::GeolocationController::~GeolocationController):
+        (WebCore::GeolocationController::addObserver):
+        (WebCore::GeolocationController::removeObserver):
+        (WebCore::GeolocationController::positionChanged):
+        (WebCore::GeolocationController::errorOccurred):
+        (WebCore::GeolocationController::lastPosition):
+        * page/GeolocationController.h: Added.
+        * page/GeolocationControllerClient.h: Added.
+        (WebCore::GeolocationControllerClient::~GeolocationControllerClient):
+        * page/GeolocationError.h: Added.
+        (WebCore::GeolocationError::):
+        (WebCore::GeolocationError::create):
+        (WebCore::GeolocationError::code):
+        (WebCore::GeolocationError::message):
+        * page/GeolocationPosition.h: Added.
+        (WebCore::GeolocationPosition::create):
+        (WebCore::GeolocationPosition::timestamp):
+        (WebCore::GeolocationPosition::latitude):
+        (WebCore::GeolocationPosition::longitude):
+        (WebCore::GeolocationPosition::accuracy):
+        (WebCore::GeolocationPosition::altitude):
+        (WebCore::GeolocationPosition::altitudeAccuracy):
+        (WebCore::GeolocationPosition::heading):
+        (WebCore::GeolocationPosition::speed):
+        (WebCore::GeolocationPosition::canProvideAltitude):
+        (WebCore::GeolocationPosition::canProvideAltitudeAccuracy):
+        (WebCore::GeolocationPosition::canProvideHeading):
+        (WebCore::GeolocationPosition::canProvideSpeed):
+        (WebCore::GeolocationPosition::GeolocationPosition):
+        * page/Geoposition.h:
+        (WebCore::Geoposition::create):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::geolocationController):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-12-14  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Test that an image's size is valid before reading it.
+
+        Previously, an image that failed to load (m_failed == true) would
+        trigger an assertion failure when WebKit tried to get its size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32176
+        http://code.google.com/p/chromium/issues/detail?id=28566
+
+        Test: fast/images/size-failure.html
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+
+2009-12-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7458272> REGRESSION (r50470) Reproducible ASSERT in
+        RenderWidget::setWidgetGeometry()
+
+        Test: fast/forms/defer-updateFromElement.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::updateFromElementCallback): Added this post-attach callback
+        that invokes updateFromElement().
+        (WebCore::HTMLFormControlElement::recalcStyle): Instead of calling
+        updateFromElement(), enqueue a post-attach (in this case, post-style
+        recalc) callback to do it. updateFromElement() can cause the selection
+        to change, and in turn trigger synchronous layout, so it must not be
+        called during style recalc.
+
+2009-12-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [regression] inspector deletes nodes when editing css.
+
+        Now all the treeoutlines are focusable, sections and their titles
+        are also focusable. Change contains couple of drive-by fixes such as
+        canceling of the attribute edit nuking attr info and maintaining proper
+        selection while deleting nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32460
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.handleShortcut):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._keyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.get defaultFocusedElement):
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._keyDown):
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        (WebInspector.Panel.prototype.get defaultFocusedElement):
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get defaultFocusedElement):
+        (WebInspector.ScriptsPanel.prototype.handleShortcut):
+        * inspector/front-end/SidebarPane.js:
+        (WebInspector.SidebarPane):
+        (WebInspector.SidebarPane.prototype.toggleExpanded):
+        (WebInspector.SidebarPane.prototype._onTitleKeyDown):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentCanCopy):
+        (WebInspector.documentCopy):
+        (WebInspector._searchFieldManualFocus):
+        (WebInspector._searchKeyDown):
+        (WebInspector.startEditing.cleanUpAfterEditing):
+        (WebInspector.startEditing.keyDownEventListener):
+        (WebInspector.startEditing):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline):
+        (TreeOutline._removeChildAtIndex):
+        (TreeOutline.prototype._treeKeyDown):
+        (TreeElement.prototype.deselect):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-12-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Guard all of JSC's wrapper cache-related members on Document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache): Widened the guards to the whole method.
+        * dom/Document.h: Added JSC guards to wrapper cache-related members.
+
+2009-12-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        AX: there's an infinite loop going on for some webpages - facebook.com
+        https://bugs.webkit.org/show_bug.cgi?id=32501
+
+        The problem is that parentObjectUnignored() cannot be called
+        while in accessibilityIsIgnored, because it leads to
+        recursiveness. Specifically, there were checks to determine
+        if an object was within a ARIA tree. That check should
+        1) be moved to all platforms, and 2) not call parentObjectUnignored().
+
+        Test: accessibility/hang-in-isignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isAllowedChildOfTree):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-12-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6293979> Adopt shared control drawing for <video> controls on Leopard and Windows
+
+        Use MediaControllerThemeQuickTime on Leopard.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-14  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCore-related build settings into a vsprops file
+
+        Fixes <http://webkit.org/b/32518>
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.vcproj/WebCore.vcproj: Let VS reformat the files list, added
+        WebCoreQuartzCore.vsprops to the non-Cairo configurations, moved all
+        other QuartzCore-related build settings from here...
+        * WebCore.vcproj/WebCoreQuartzCore.vsprops: ...to here.
+
+2009-12-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        handling scripts can block UI
+        https://bugs.webkit.org/show_bug.cgi?id=27612
+
+        Break execution of external scrips to smaller chunks. 
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        (WebCore::HTMLTokenizer::executeExternalScriptsIfReady):
+        (WebCore::HTMLTokenizer::executeExternalScriptsTimerFired):
+        (WebCore::HTMLTokenizer::continueExecutingExternalScripts):
+        * html/HTMLTokenizer.h:
+
+2009-12-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Connect QNetworkReply via direct connections.
+        https://bugs.webkit.org/show_bug.cgi?id=32113
+
+        In the past we have switched from auto connections to queued
+        connections to get some more stability. The problem with the
+        Queued connections is latency. Even when running simple loading
+        tests the time it takes to runs highly varies and by using
+        direct connections these tests produce a stable result.
+
+        We will have to look out for crashes coming from within the
+        QNetworkAccessManager due this patch and address them then.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] QtWebKit should use QImageReader::setQuality(49)
+        https://bugs.webkit.org/show_bug.cgi?id=30740
+
+        Using QImageReader::setQuality(49) will influence the JPEG
+        decoder of Qt to use the JDCT_IFAST routines for decompressing. This
+        is showing a 5% improvement in a reduction that decodes all images
+        used during the page loading test. The libjpeg documentation mentions
+        that the IFAST routine is not as accurate as other routines but in
+        our tests we couldn't see a difference.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+
+        * ForwardingHeaders/runtime/WeakGCMap.h: Added.
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow): Updated for rename.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::hasCachedDOMObjectWrapperUnchecked):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapperUnchecked):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h: Changed DOM wrapper maps to be WeakGCMaps.
+        Don't ASSERT that an item must be in the WeakGCMap when its destructor
+        runs, since it might have been overwritten in the map first.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): Changed Document from a DOM object wrapper to a DOM node
+        wrapper, to simplify some code.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        (WebCore::JSInspectedObjectWrapper::~JSInspectedObjectWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Use a WeakGCMap for these
+        wrappers.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Updated for WeakGCMap and Document using
+        a DOM node wrapper instead of a DOM object wrapper.
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::wrapperMap):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::forgetWrapper):
+        (WebCore::::~JSSVGDynamicPODTypeWrapper): Shined a small beam of sanity light
+        on this code. Use hashtable-based lookup in JSSVGPODTypeWrapper.h instead
+        of linear lookup through iteration, since that's what hashtables were
+        invented for. Make JSSVGPODTypeWrapper.h responsible for reomving itself
+        from the table, instead of its JS wrapper, to decouple these objects from
+        GC, and because these objects are refCounted, not solely owned by their
+        JS wrappers.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.h: Adopted changes above.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed an incorrect #ifdef.
+
+        * bindings/js/GCController.cpp:
+
+2009-12-13  Charles Reis  <creis@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactor some security code out of V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=32326
+
+        No new tests. There should be no functionality changes in this patch,
+        since it is only refactoring code.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/BindingSecurity.h: Added.
+        (WebCore::BindingSecurity::BindingSecurity):
+        (WebCore::::canAccessWindow):
+        (WebCore::::canAccessFrame):
+        (WebCore::::checkNodeSecurity):
+        * bindings/BindingSecurityBase.cpp: Added.
+        (WebCore::BindingSecurityBase::getDOMWindow):
+        (WebCore::BindingSecurityBase::getFrame):
+        (WebCore::BindingSecurityBase::canAccessWindow):
+        * bindings/BindingSecurityBase.h: Added.
+        * bindings/GenericBinding.h: Added.
+        (WebCore::):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8BindingState.cpp: Added.
+        (WebCore::::Only):
+        (WebCore::::getActiveWindow):
+        (WebCore::::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/V8BindingState.h: Added.
+        (WebCore::):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        (WebCore::reportUnsafeJavaScriptAccess):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+
+2009-11-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement initializeMaximumHTTPConnectionCountPerHost.
+        https://bugs.webkit.org/show_bug.cgi?id=31849
+
+        Qt allows to have three connections per host on Symbian, for
+        every other platform the limit is set to six connections per
+        host but the default implementation will only schedule four
+        connections per host.
+        In a manual test we seem to get the best loading speed by
+        going with Qt's limit and schedule two more jobs to allow Qt
+        to prepare them.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-12-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
+        handling misnested residual style tags
+
+        Test: fast/parser/residual-style-close-ref-clone.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
+        block stack a strong reference to the cloned residual style element. 
+
+2009-12-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reverting changes from http://trac.webkit.org/changeset/49585 to fix:
+        <rdar://problem/7382815> REGRESSION (4.0.4-TOT): Home photo slider is too narrow at http://www.ziprealty.com/
+        https://bugs.webkit.org/show_bug.cgi?id=32078
+
+        * css/CSSPrimitiveValue.cpp: (WebCore::CSSPrimitiveValue::cssText):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h:  Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::shouldUseATSUIAPI): Cache decision about which API to use.
+        (WebCore::ComplexTextController::ComplexTextRun::indexAt):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Stub function to call through
+        to ATSUI/Core text variants.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): The actual work for object construction
+        is delegate to createTextRunFromFontDataATSUI/createTextRunFromFontDataCoreText.
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Small style fix.
+        (WebCore::ComplexTextController::ComplexTextRun::createTextRunFromFontDataATSUI):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::createTextRunFromFontDataCoreText):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+
+2009-12-13  Eric Carlson  <eric.carlson@apple.com>
+
+        No review, rolling out r52059 until I can generate new Tiger
+        test results.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the EXPERIMENTAL_SINGLE_VIEW_MODE build.
+
+        * Configurations/WebCore.xcconfig:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clearDragState):
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventActivatedView):
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/mac/WidgetMac.mm:
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the !ENABLE(VIDEO) build.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the !ENABLE(DATABASE) build.
+
+        * storage/SQLTransactionClient.cpp:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        * storage/SQLTransactionCoordinator.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+
+2009-12-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6293979> Adopt shared control drawing for <video> controls on Leopard and Windows
+
+        Use MediaControllerThemeQuickTime on Leopard.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-12  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Errors in WebGL[T]Array set() and get() methods
+        https://bugs.webkit.org/show_bug.cgi?id=32456
+
+        Test: fast/canvas/webgl/bug-32456.html
+
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::setWebGLArray):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.idl:
+
+2009-12-12  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update WebGL tests to released versions
+        https://bugs.webkit.org/show_bug.cgi?id=32457
+
+        * manual-tests/webgl/Earth.html:
+        * manual-tests/webgl/ManyPlanetsDeep.html:
+        * manual-tests/webgl/SpinningBox.html:
+        * manual-tests/webgl/TeapotPerPixel.html:
+        * manual-tests/webgl/TeapotPerVertex.html:
+        * manual-tests/webgl/resources/CanvasMatrix.js:
+        (CanvasMatrix4.prototype.getAsWebGLFloatArray):
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL.gl.console.window.console.log):
+        (initWebGL):
+        (loadShader):
+        (makeBox):
+        (makeSphere):
+        (processLoadObj):
+        (doLoadObj):
+        (doLoadImageTexture):
+
+2009-12-12  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Dirk Schulze.
+
+        Remove the include to SVGFEDisplacementMap.h, it's not needed at all.
+
+        * platform/graphics/filters/FEComponentTransfer.h:
+
+2009-12-12  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Only include SVGFEDisplacementMap.h if SVG is enabled.
+
+        * platform/graphics/filters/FEComponentTransfer.h:
+
+2009-12-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Cairo][Qt] Alpha blending in SVG filters is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=32427
+
+        This patch is a follow-up to:
+        http://trac.webkit.org/changeset/51950
+        It fixes the alpha blending for Cairo and Qt on SVG Filters.
+
+        Covered by: * LayoutTests/svg/filters/feGaussianBlur.svg
+                    * LayoutTests/svg/filters/feComposite.svg
+                     and others.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-11  Eric Roman  <eroman@chromium.org>
+
+        Unreviewed build fix.
+
+        [V8] Add a method on ScriptController to get it compiling after http://trac.webkit.org/changeset/52033.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::anyPageIsProcessingUserGesture):
+        * bindings/v8/ScriptController.h:
+
+2009-12-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Change bindings to catch up with http://trac.webkit.org/changeset/52033.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added retrieval of calling frame and passing
+          to the submit method.
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Put -umbrella linker flag into a variable so that it can be overridden.
+
+        * Configurations/WebCore.xcconfig:
+
+2009-12-11  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        body with display:inline causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=32371
+
+        Tests: fast/inline/inline-body-crash.html
+               fast/inline/inline-body-with-scrollbar-crash.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+
+2009-12-11  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        https://webkit.org/b/22851 - Remove defunct FIXME.
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement): This flag was removed completely
+          from the HTMLFrameOwnerElement chain of classes.
+
+2009-12-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Small refactoring to get rid of some extra unneeded selection-related work
+        in RenderLayer::scrollToOffset and separate caret and range selection
+        logic in FrameView::layout. This may be useful later when changing how
+        the range selection logic works to fix layout reentrancy problems.
+
+        * page/Frame.cpp: Removed invalidateSelection.
+        * page/Frame.h: Ditto.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Call SelectionController::setNeedsLayout
+        and Frame::selectionLayoutChanged instead of calling
+        Frame::invalidateSelection, which was just a function that called
+        both of those others.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): Call
+        SelectionController::setNeedsLayout instead of calling
+        Frame::invalidateSelection. This call site only needs the caret-related
+        work in that first function, not the other work formerly done by
+        Frame::invalidateSelection. The caret works outside the normal
+        painting and rendering system, and the range selection highlight is
+        more or less inside it and doesn't need special handling when scrolling.
+
+2009-12-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7342725> and https://webkit.org/b/32383
+        Selecting article text at sfgate.com results in spurious back/forward entries
+
+        If an iframe had a form and that form is submitted by javascript, IE and Opera don't add back/forward entries.
+        
+        In the case where the frame was added dynamically via createElement(), Firefox would like to add a back entry
+        but has a bug that prevents this.
+
+        Therefore by a bizarre coincidence, WebKit is the loner and the only engine affected by sfgate.com's technique.
+
+        This patch changes us to willfully match IE and Opera and fixes sfgate.com in the process.
+
+        Tests: http/tests/navigation/dynamic-iframe-dynamic-form-back-entry.html
+               http/tests/navigation/parsed-iframe-dynamic-form-back-entry.html
+
+        Capture whether the form was submitted by javascript:
+        * loader/FormState.cpp:
+        (WebCore::FormState::FormState):
+        (WebCore::FormState::create):
+        * loader/FormState.h:
+        (WebCore::FormState::formSubmissionTrigger):
+
+        When deciding the value of the lockBackForwardList variable, take formSubmissionTrigger() into account:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+
+        Rearrange the public HTMLFormElement::submit() method to be called only from DOM or JS bindings,
+        and figure out the rest of the parameters for an internal submit() call including the formSubmissionTrigger:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+
+2009-12-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32445
+        REGRESSION: http://www.mcafee.com/japan/ displays unstyled
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        Add a quirk for mcafee.com/japan (http or https, with or without www).
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make PlatformWheelEvent.h private instead of project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Support reflections on composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=31885
+        
+        First part of supporting composited reflections on compositing layers.
+        
+        Rename the m_transformLayer member variable to m_structuralLayer, since it
+        will get used both for transform layers (for preserve-3d) and to hold a flattening
+        layer related to reflections, both of which have similar requirements, and are
+        mutually exclusive.
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        primaryLayer(), hostLayerForSublayers() and layerForSuperlayer() all now return
+        a CALayer, since m_structuralLayer isn't always a WebLayer.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        updateLayerPreserves3D() renamed to updateStructuralLayer()
+        
+        (WebCore::GraphicsLayerCA::updateLayerNames):
+        New "update" method for updating layer names.
+        
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        m_transformLayer -> m_structuralLayer. Also minor refactor to only
+        allocate newSublayers in one place.
+        
+        (WebCore::GraphicsLayerCA::updateLayerSize):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+        (WebCore::GraphicsLayerCA::hostLayerForSublayers):
+        (WebCore::GraphicsLayerCA::layerForSuperlayer):
+        m_transformLayer -> m_structuralLayer
+        
+        (WebCore::GraphicsLayerCA::updateStructuralLayer):
+        Call ensureStructuralLayer() which handles any deltas to the
+        structural layer type.
+        
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        Handle changes to the structural layer requirements
+        
+        (WebCore::GraphicsLayerCA::structuralLayerPurpose):
+        Return an enum describing the purpose of the structural layer; for now
+        this only returns NoStructuralLayer or StructuralLayerForPreserves3D, but
+        will in future also have a value related to reflections.
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::pauseAnimation):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp: Removed #include of
+        non-existent header.
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::startAnimation):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Negative values for animation-delay are ignored (treated as zero)
+        https://bugs.webkit.org/show_bug.cgi?id=26150
+        
+        When we get the m_startTime for an animation or transition, subtract any negative
+        delay so the animation/transition behaves like it started in the past, per spec.
+
+        Tests: animations/negative-delay.html
+               transitions/negative-delay.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Accelerated transitions broken when mixed with paused animations
+        https://bugs.webkit.org/show_bug.cgi?id=32387
+
+        Synchronization of a mixture of accelerated and software animations occurs via
+        a callback from GraphicsLayerCA, which ends up in
+        AnimationControllerPrivate::receivedStartTimeResponse(). The time passed in is
+        the exact time at which the accelerated animations started, so is used as the
+        start time for all animations and transitions which are marked as waiting.
+
+        The bug was that the callback called when re-starting animations that were
+        paused sent back an old time value, but this was used to start normal
+        transitions. Therefore the transition would start with a stale start time, and
+        thus end prematurely.
+
+        The fix is to change the way that GraphicsLayerCA handles paused animations.
+        Rather than setting the beginTime of the animation, it uses a beginTime of 0
+        and a timeOffset that gets passed down. Thus the callbacks always come with
+        beginTime for 'now'.
+
+        Also clarify the role of AnimationBase::endAnimation() by splitting it into
+        pauseAnimation() and endAnimation(), and pass down timeOffsets, rather than
+        beginTimes when starting and pausing.
+
+        Manual test only, because the bug requires a non-trivial combination of
+        animation pausing and transitions which take time, and the bug only shows in
+        pixel results.
+        
+        * manual-tests/animation/transitions-and-paused-animations.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::startAnimation):
+        (WebCore::AnimationBase::pauseAnimation):
+        (WebCore::AnimationBase::endAnimation):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/ImplicitAnimation.h:
+        (WebCore::ImplicitAnimation::pauseAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::pauseAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::LayerAnimation::LayerAnimation):
+        (WebCore::GraphicsLayerCA::AnimationProcessingAction::AnimationProcessingAction):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayerCA::pauseAnimation):
+        (WebCore::GraphicsLayerCA::updateLayerAnimations):
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer):
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        (WebCore::RenderLayerBacking::animationPaused):
+        * rendering/RenderLayerBacking.h:
+
+2009-12-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/32399>.
+        Pan Scrolling Jumps out of frames if the initial location is in a frame that can't be scrolled.
+        
+        When we initially figure out the layer that we should begin scrolling, don't try to jump out
+        of frames/iFrames to look at the owner document. We don't want to jump out of frames, so we
+        don't need that logic anymore.
+        
+        Added a test to make sure that we don't pan scroll if we start to scroll in an empty
+        iFrame that has a scrollable owner document.
+
+        Test: platform/win/fast/events/panScroll-no-iframe-jump.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler):
+
+2009-12-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/32303>.
+        Middle-mouse button not firing mousedown DOM event when autoscroll happens.
+        
+        This fix moves the pan scrolling code into Node.cpp, as part of the default event handler.
+        We get two wins out of this:
+            1) Mousedown DOM events are now fired before pan scrolling.
+            2) Calling event.preventDefault() on a middle mouse button will now prevent pan scrolling.
+        
+        Added tests to show that middle mousedown DOM events are fired when panscrolling happens, and
+        that when event.preventDefault is called, pan scrolling doesn't happen.
+
+        Tests: platform/win/fast/events/panScroll-event-fired.html
+               platform/win/fast/events/panScroll-preventDefault.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler): Moved pan scrolling starting code to here.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::startPanScrolling): Function to initialize scrolling variables and start timer.
+        (WebCore::EventHandler::handleMousePressEvent): From here.
+        * page/EventHandler.h:
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Change calls that use the data export symbols from
+        QuartzCore to use the functions in QuartzCoreInterface.
+        This allows QuartzCore to be delay loaded.
+
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::GraphicsLayerCACF):
+        (WebCore::GraphicsLayerCACF::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerCACF::updateContentsImage):
+        * platform/graphics/win/WKCACFLayer.cpp:
+        (WebCore::toCACFLayerType):
+        (WebCore::toCACFContentsGravityType):
+        (WebCore::fromCACFContentsGravityType):
+        (WebCore::toCACFFilterType):
+        (WebCore::fromCACFFilterType):
+        (WebCore::WKCACFLayer::create):
+        (WebCore::WKCACFLayer::WKCACFLayer):
+        (WebCore::WKCACFLayer::setContentsGravity):
+        (WebCore::WKCACFLayer::contentsGravity):
+        (WebCore::WKCACFLayer::setMagnificationFilter):
+        (WebCore::WKCACFLayer::magnificationFilter):
+        (WebCore::WKCACFLayer::setMinificationFilter):
+        (WebCore::WKCACFLayer::minificationFilter):
+        * platform/graphics/win/WKCACFLayer.h:
+        (WebCore::WKCACFLayer::):
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+
+2009-12-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds an Android-specific implementation of initializeMaximumHTTPConnectionCountPerHost.
+        https://bugs.webkit.org/show_bug.cgi?id=31810
+
+        * platform/network/ResourceRequestBase.cpp: Modified. Disable default implementation
+            of initializeMaximumHTTPConnectionCountPerHost for Android.
+        * platform/network/android: Added.
+        * platform/network/android/ResourceRequestAndroid.cpp: Added.
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Android-specific implementation.
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add acceptTypes() method to FileChooser.
+        https://bugs.webkit.org/show_bug.cgi?id=32429
+
+        This method returns an 'accept' attribute value of the
+        corresponding INPUT element. A ChromeClient::runOpenPanel()
+        implementation can refer it through a FileChooser instance to
+        support type-restricted file selecting.
+
+        This makes no user-visible changes for now.
+
+        * platform/FileChooser.h:
+        (WebCore::FileChooser::acceptTypes):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::acceptTypes):
+        * rendering/RenderFileUploadControl.h:
+
+2009-12-11  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Changed PopupMenuChromium to keep the value selected from
+        keyboard when popup is closed.
+
+        The problem is Chromium does not fire the onchange event
+        when the popup is closed if an item is selected via
+        keyboard by typing the first char of the item. This makes
+        chromium popup not having consistent behaviours and also
+        behaves differently from other major browsers.
+        Calling popup->hide() instead of popup->hidePopup() in
+        PopupMenu fixes the issues as it does extra step to check
+        whethere there is a keyboard selection changed when closing
+        the popup.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32403
+    
+        TEST: add a manual test as the current layout test shell
+        does not support sending keyboard events to popup list.
+
+        * manual-tests/chromium/select-close-popup-value-change.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupMenu::hide):
+
+2009-12-11  anton muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] refactor WeakReferenceMap.
+        Move common bits of functionality to reduce duplication.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32389
+
+        Should be covered by buildbots.
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::WrapperMapObjectRemover::visitDOMWrapper):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::weakDOMObjectCallback):
+        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
+        (WebCore::DOMDataStore::weakNodeCallback):
+        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
+        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::removeIfPresent):
+        (WebCore::WeakReferenceMap::clear):
+        (WebCore::WeakReferenceMap::visit):
+
+2009-12-11  anton muhin  <antonm@chromium.org>
+        Reviewed by Adam Barth.
+
+        [v8] in Debug builds create an additional handle scope
+        when doing debug build checks.
+        https://bugs.webkit.org/show_bug.cgi?id=32335
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+
+2009-12-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not use ContextMenuItem as value type in custom
+        context menu implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32411
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuProvider::create):
+        (WebCore::InspectorFrontendHost::MenuProvider::~MenuProvider):
+        (WebCore::InspectorFrontendHost::MenuProvider::disconnect):
+        (WebCore::InspectorFrontendHost::MenuProvider::populateContextMenu):
+        (WebCore::InspectorFrontendHost::MenuProvider::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuProvider::MenuProvider):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuProvider.h: Added.
+        (WebCore::ContextMenuProvider::~ContextMenuProvider):
+        * page/ContextMenuSelectionHandler.h: Removed.
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Basic cross-platform implementation of mapping platform touch events
+        to JavaScript touch events.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        Test: fast/events/basic-touch-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2009-12-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's EmptyFrameLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=32110
+
+        Inherits the following class from Noncopyable because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name              - instantiated at: WebCore/'location'
+
+        class EmptyFrameLoaderClient - svg/graphics/SVGImage.cpp:229
+
+        * loader/FrameLoaderClient.h:
+
+2009-12-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for 3 classes in WebCore's svg and loader directory
+        https://bugs.webkit.org/show_bug.cgi?id=32106
+
+        Inherits the following classes from Noncopyable because these are instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name            - instantiated at: WebCore/'location'
+
+        class EmptyContextMenuClient - instantiated at: svg/graphics/SVGImage.cpp:232
+        class EmptyDragClient        - instantiated at: svg/graphics/SVGImage.cpp:237
+        class SVGImageChromeClient   - instantiated at: svg/graphics/SVGImage.cpp:243
+
+        * svg/graphics/SVGImage.cpp:
+        * loader/EmptyClients.h:
+
+2009-12-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The values of RuntimeArray are not enumerable
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-12-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt: Fix retrieval of image file extensions
+
+        QImageReader only allows retrieving the format() before actually reading the image.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32428
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Added interfaces for touch event support in JavaScript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        The Touch, TouchEvent and TouchList interfaces come straight from
+        Android's copy of WebKit (eclaire branch).
+
+        The PlatformTouchEvent and PlatformTouchPoint code was written by
+        us.
+
+        No new tests added, we are just adding interfaces
+        with this patch.
+
+        * WebCore.pro:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/Document.idl:
+        * dom/Element.h:
+        * dom/Element.idl:
+        * dom/Event.cpp:
+        (WebCore::Event::isTouchEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * dom/Touch.cpp: Added.
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        (WebCore::Touch::Touch):
+        (WebCore::Touch::updateLocation):
+        * dom/Touch.h: Added.
+        (WebCore::Touch::create):
+        (WebCore::Touch::frame):
+        (WebCore::Touch::target):
+        (WebCore::Touch::identifier):
+        (WebCore::Touch::clientX):
+        (WebCore::Touch::clientY):
+        (WebCore::Touch::screenX):
+        (WebCore::Touch::screenY):
+        (WebCore::Touch::pageX):
+        (WebCore::Touch::pageY):
+        * dom/Touch.idl: Added.
+        * dom/TouchEvent.cpp: Added.
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::initTouchEvent):
+        * dom/TouchEvent.h: Added.
+        (WebCore::TouchEvent::create):
+        (WebCore::TouchEvent::touches):
+        (WebCore::TouchEvent::targetTouches):
+        (WebCore::TouchEvent::changedTouches):
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::isTouchEvent):
+        * dom/TouchEvent.idl: Added.
+        * dom/TouchList.cpp: Added.
+        (WebCore::TouchList::item):
+        * dom/TouchList.h: Added.
+        (WebCore::TouchList::create):
+        (WebCore::TouchList::length):
+        (WebCore::TouchList::append):
+        (WebCore::TouchList::TouchList):
+        * dom/TouchList.idl: Added.
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * platform/PlatformTouchEvent.h: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        (WebCore::PlatformTouchEvent::touchPoints):
+        * platform/PlatformTouchPoint.h: Added.
+        (WebCore::PlatformTouchPoint::):
+        (WebCore::PlatformTouchPoint::id):
+        (WebCore::PlatformTouchPoint::state):
+        (WebCore::PlatformTouchPoint::screenPos):
+        (WebCore::PlatformTouchPoint::pos):
+        * platform/qt/PlatformTouchEventQt.cpp: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        * platform/qt/PlatformTouchPointQt.cpp: Added.
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint):
+
+2009-12-11  Grace Kloba  <klobag@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Add detachHistoryItem() to AndroidWebHistoryBridge. And the constructor takes
+        HistoryItem* now. As AndroidWebHistoryBridge holds a dumb pointer of HistoryItem and
+        HistoryItem holds a RefPtr of AndroidWebHistoryBridge, the dumb pointer needs to be cleared
+        when HistoryItem is deleted to avoid potential crash.
+        https://bugs.webkit.org/show_bug.cgi?id=32251
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem):
+        * history/android/AndroidWebHistoryBridge.h:
+        (WebCore::AndroidWebHistoryBridge::AndroidWebHistoryBridge):
+        (WebCore::AndroidWebHistoryBridge::detachHistoryItem):
+
+
+2009-12-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Log WebSocket error to Web Inspector console.
+        https://bugs.webkit.org/show_bug.cgi?id=32165
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::appendToBuffer):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+        (WebCore::WebSocketHandshake::readHTTPHeaders):
+        (WebCore::WebSocketHandshake::checkResponseHeaders):
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Mixed content shouldn't trigger for plug-ins without URLs
+        https://bugs.webkit.org/show_bug.cgi?id=32384
+
+        These plug-ins cannot be controlled by active network attackers, so
+        there's no reason to trigger a mixed content warning.
+
+        Test: http/tests/security/mixedContent/empty-url-plugin-in-frame.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+
+2009-12-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32140
+        REGRESSION(r50072): Mailman administrative functionality is broken
+
+        Test: http/tests/misc/percent-sign-in-form-field-name.html
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::appendQuotedString): Don't encode percent
+        sign, we never had a good reason to do that.
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove getPropertyAttributes() from JavaScript bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        The functionality is provided by getOwnPropertyDescriptor().
+
+        * WebCore.order:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Changed WebGLRenderingContext to synthesize GL errors rather than
+        raising JavaScript exceptions. Removed internal getError() calls
+        after each graphics call. The GraphicsContext3D maintains the
+        synthetic exceptions because only it has complete information
+        about certain conditions requiring them to be raised.
+
+        Based on idea from Ilmari Heikkinen, added create3DDebugContext()
+        to webgl-test.js and changed the WebGL layout tests expecting
+        error conditions to use it. Updated expected.txt files, which now
+        implicitly test the OpenGL error as it is part of the exception's
+        message.
+
+        Added new targeted test covering aspects of synthetic errors as
+        well as regression tests for bugs uncovered during its development.
+
+        Test: fast/canvas/webgl/error-reporting.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::attachShader):
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::compileShader):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::detachShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        (WebCore::WebGLRenderingContext::getActiveAttrib):
+        (WebCore::WebGLRenderingContext::getActiveUniform):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::shaderSource):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for assert on Chrome/skia with SVG Filters enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32394
+
+        Covered by LayoutTests/svg/W3C-SVG-1.1/filters-tile-01-b.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): With 2 highlighted lines of text in gmail/hotmail selecting Bold selects other 2 edit buttons automatically.
+        <rdar://problem/7442065>
+        https://bugs.webkit.org/show_bug.cgi?id=32285
+
+        When examining the styles of the nodes after the first in a range selection, we take into
+        cosideration differences in style of txt nodes only.
+        
+        Test: editing/execCommand/queryCommandState-02.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionHasStyle):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: debugger shortcuts don't work when
+        Search field or Console drawer has focus.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32392
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentKeyUp):
+        (WebInspector.searchKeyDown):
+
+2009-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Events created in isolated worlds may fire in main world.
+        https://bugs.webkit.org/show_bug.cgi?id=32386
+
+        Test: http/tests/security/isolatedWorld/events.html
+
+        * WebCore.gypi: Added WorldContextHandle.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Added WorldContextHandle params.
+        * bindings/v8/SharedPersistent.h: Fixed a few style/include issues.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Added WorldContextHandle params.
+        (WebCore::V8AbstractEventListener::handleEvent): Adjusted context retrieval to use WorldContextHandle.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::worldContext): Added WorldContextHandle params.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Ditto.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Ditto.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Adjusted context retrieval to use WorldContextHandle.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context): Refactored to use mainWorldContext();
+        (WebCore::V8Proxy::mainWorldContext): Added.
+        (WebCore::toV8Context): Changed to use WorldContextHandle.
+        * bindings/v8/V8Proxy.h: Added mainWorldContext decl.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException): Added an extra check to avoid crashes during frame teardown.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Added WorldContextHandle params.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/WorldContextHandle.cpp: Added.
+        * bindings/v8/WorldContextHandle.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Added WorldContextHandle params.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Added WorldContextHandle params.
+
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * loader/EmptyClients.h:
+        Remove this unused class.
+
+        * page/HaltablePlugin.h:
+        Add new functions to return the plug-in's name and whether it is
+        windowed.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::timerFired):
+        Pass new arguments to the client.
+
+        * page/PluginHalterClient.h:
+        Add new parameters.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::pluginName):
+        Return the name from the PluginPackage.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isWindowed):
+
+2009-12-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31738>.
+        Web Inspector: Console Scope Bar should be on top of console when Console is a Panel.
+        
+        When the console is set to be shown as a full panel, move the scope bar to the top
+        where it looks best. When it is only shown as a drawer, move it to the bottom, where
+        it originally was. This takes up less space as a drawer, and makes it more discoverable
+        and usable when it is the full panel.
+
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.show): Move filter bar to top.
+        (WebInspector.ConsolePanel.prototype.hide): Move filter bar back to bottom.
+        * inspector/front-end/inspector.css:
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Fix for alpha blending in SVG Filters on Chromium/skia.
+        https://bugs.webkit.org/show_bug.cgi?id=32378
+
+        Covered by LayoutTests/svg/filters/feGaussianBlur.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add context menu actions for DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32348
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu):
+        (WebInspector.ContextMenu.prototype.show):
+        (WebInspector.ContextMenu.prototype.appendItem):
+        (WebInspector.ContextMenu.prototype.appendSeparator):
+        (WebInspector.ContextMenu.prototype._itemSelected):
+        (WebInspector.contextMenuItemSelected):
+        (WebInspector.contextMenuCleared):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateTextContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.contextMenuEventFired):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2009-12-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filters contain some leaks in untested code
+        https://bugs.webkit.org/show_bug.cgi?id=32325
+
+        Fix obvious leak in SVGFE*Lighting classes. Implement the create() idiom for 
+        all classes in svg/graphics, that were missing it. The lighting filters aren't
+        implemented so far, but the associated FilterEffect objects are build, which created
+        these leaks.
+
+        This removes the SVG related failures in the leaks bot.
+
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::findLights):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDistantLightElement.cpp:
+        (WebCore::SVGFEDistantLightElement::lightSource):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEPointLightElement.cpp:
+        (WebCore::SVGFEPointLightElement::lightSource):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::findLights):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpotLightElement.cpp:
+        (WebCore::SVGFESpotLightElement::lightSource):
+        * svg/SVGFESpotLightElement.h:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        (WebCore::DistantLightSource::create):
+        (WebCore::DistantLightSource::DistantLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::FEDiffuseLighting):
+        (WebCore::FEDiffuseLighting::create):
+        (WebCore::FEDiffuseLighting::setLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::FESpecularLighting):
+        (WebCore::FESpecularLighting::create):
+        (WebCore::FESpecularLighting::setLightSource):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        (WebCore::PointLightSource::create):
+        (WebCore::PointLightSource::PointLightSource):
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        (WebCore::SpotLightSource::create):
+        (WebCore::SpotLightSource::SpotLightSource):
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Chromium] SporeViewer demo doesn't work in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32364
+
+        Test: fast/canvas/webgl/bug-32364.html
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+
+2009-12-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32346 SVG property 
+        -webkit-shadow should apply shadow on the result after compositing
+        -and corresponding-
+        <rdar://problem/7389404>
+
+        Set a transparency layer when setting a shadow to apply the shadow 
+        to the composite.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32332
+        WebSocket events should be dispatched synchronously
+
+        Updated websocket/tests/simple to test for the new behavior.
+
+        When Web Sockets API says that events should be queued for async dispatch, it means something
+        different. We should keep this in mind when dealing with other HTML5-related specs.
+
+        The model for HTML5 is that code running in response to network events (e.g. WebSocket or
+        XMLHttpRequest algorithms) runs in a separate thread of execution, and thus needs to post
+        async events as its only way to communicate with client code. As long as network events are
+        queued themselves (as they are in WebKit), there is no need to queue JS events for async
+        dispatch.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32355
+        Assertion failure when opening a WebSocket connection
+
+        I couldn't make a reliable test for this. Once the test from bug 32299 is landed, it
+        will provide partial coverage, as I was frequently seeing the assertion failure with it.
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::send):
+        It's not an error if zero is returned from platformSend() - it just means that nothing could
+        be pushed down to the network layer, and all data was queued for later.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): This will no longer happen with SocketStream,
+        but a client can potentially destroy the handle from any callback, so we need to check that
+        this didn't happen.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Ditto.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Roll out 51919 and 51920. They were incorrect and unnecessary right now.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds wtf/StdLibExtras.h include for DEFINE_STATIC_LOCAL in V8 ScriptState.
+        https://bugs.webkit.org/show_bug.cgi?id=32330
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptState.cpp: Modified. Adds wtf/StdLibExtras.h include.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ENABLE(INSPECTOR) guards around script binding methods that use types
+        defined only when INSPECTOR is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32328
+
+        Build fix only, no new tests.
+
+        * bindings/js/ScriptValue.cpp: Modified. Added ENABLE(INSPECTOR) guard to ScriptValue::quarantineValue.
+        * bindings/v8/ScriptObject.cpp: Modified. Added ENABLE(INSPECTOR) guard to some overloads of ScriptGlobalObject::set.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        Also updates existing Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        Build fix only, no new tests.
+
+        * Android.derived.jscbindings.mk: Modified.
+        * Android.derived.mk: Modified.
+        * Android.derived.v8bindings.mk: Added.
+        * Android.jscbindings.mk: Modified.
+        * Android.mk: Modified.
+        * Android.v8bindings.mk: Added.
+
+2009-12-09  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32338 - [Chromium] Fix Chromium builder by including missing GeolocationServiceChromium
+        https://bugs.webkit.org/show_bug.cgi?id=32338
+
+        Fix build break: re-include file dropped out by merge in http://trac.webkit.org/changeset/51681/trunk/WebCore/WebCore.gypi
+
+        * WebCore.gypi: Add missing GeolocationServiceChromium.cpp
+
+2009-12-09  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Brady Eidson.
+
+        Fixed a typo in http://trac.webkit.org/changeset/51644 that broke
+        the QWebPage autotest.
+
+        No new test required.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+
+2009-12-09  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        Exclude JSSVG*.cpp generated files from --minimal and --no-svg builds.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32286
+
+        * WebCore.pro:
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        Ogg mimetypes are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=27113
+
+        The ogg extension is handled by audio/ogg instead of
+        application/ogg. See
+        http://wiki.xiph.org/MIME_Types_and_File_Extensions
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::TypeExtensionPair::):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use the current run loop instead of the main runloop for the NetworkStateNotifier.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use isMainThread() helper instead of pthread_main_np() != 0.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some #ifdefs to allow us to experiment with a single NSView mac WebKit.
+
+        * page/Chrome.h:
+        * page/EventHandler.h:
+        * page/mac/ChromeMac.mm:
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::dragOperation):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+
+2009-12-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        No new tests.
+
+        * bindings/v8/DOMData.cpp
+        * bindings/v8/V8DOMWrapper.cpp
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+
+2009-12-09  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Isolated world reuse failure
+        https://bugs.webkit.org/show_bug.cgi?id=32306
+
+        Fixed bug introduced in r51407: (http://trac.webkit.org/changeset/51407) which caused layout test
+        LayoutTests/http/tests/security/isolatedWorld/world-reuse.html to fail.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-12-09  Patrick Scott  <phanna@email.unc.edu>
+
+        Fix the build with ENABLE_ORIENTATION_EVENTS
+        https://bugs.webkit.org/show_bug.cgi?id=32321
+
+        * page/Frame.cpp:
+        (WebCore::Frame::sendOrientationChangeEvent):
+
+2009-12-09  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium tickmarks in scrollbar now UX approved.
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+
+2009-12-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Add logic to turn off accelerated compositing if d3d9 or QuartzCore
+        DLLs are not present.
+        
+        This patch also changes the WKCACFLayerRenderer to be a pointer.
+        This allows me to have a create() method which will not create it when
+        accelerated compositing is disabled because of missing DLLs. It 
+        avoids having to do so many checks. I also made WebViewWndProc 
+        a member function to allow several methods to be made protected, which
+        allows me to avoid doing availability checks there as well.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        * rendering/RenderLayerBacking.cpp:
+
+2009-12-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename dom/ClassNames to SpaceSplitString and update build files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32250
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRules):
+        * dom/ClassNames.cpp: Removed.
+        * dom/ClassNames.h: Removed.
+        * dom/ClassNodeList.h:
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::classNames):
+        * dom/SpaceSplitString.cpp: Copied from WebCore/dom/ClassNames.cpp.
+        (WebCore::SpaceSplitStringData::createVector):
+        (WebCore::SpaceSplitStringData::containsAll):
+        * dom/SpaceSplitString.h: Copied from WebCore/dom/ClassNames.h.
+        (WebCore::SpaceSplitStringData::SpaceSplitStringData):
+        (WebCore::SpaceSplitString::SpaceSplitString):
+        (WebCore::SpaceSplitString::set):
+        (WebCore::SpaceSplitString::containsAll):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::classNames):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setRel):
+
+2009-12-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Enable SVG filters in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=32323
+
+        Covered by SVG filter layout tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::functionForUniform):
+
+2009-12-08  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebSocket allow space (U+0020) in sub protocol name.
+        https://bugs.webkit.org/show_bug.cgi?id=32266
+
+        Test: websocket/tests/sub-protocol-with-space.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::isValidProtocolString):
+
+2009-12-08  Peterson Trethewey  <petersont@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement WebGLUniformLocation and change API to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31173
+
+        Test: fast/canvas/webgl/uniform-location.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::functionForUniform):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toWebGLUniformLocation):
+        (WebCore::):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::isFunctionToCallForAttribute):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLUniformLocation.cpp: Added.
+        (WebCore::WebGLUniformLocation::create):
+        (WebCore::WebGLUniformLocation::WebGLUniformLocation):
+        * html/canvas/WebGLUniformLocation.h: Added.
+        (WebCore::WebGLUniformLocation::~WebGLUniformLocation):
+        (WebCore::WebGLUniformLocation::program):
+        (WebCore::WebGLUniformLocation::location):
+        * html/canvas/WebGLUniformLocation.idl: Added.
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure in WebCore::RenderBlock::startDelayUpdateScrollInfo
+
+        startDelayUpdateScrollInfo calls a function that can end up calling
+        startDelayUpdateScrollInfo again. However, it's static state is
+        inconsistent when this happens leading to an assertion failure (or
+        probably a memory leak if assertions are off).
+
+        Thanks to Robert Swiecki for the test case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32172
+        http://code.google.com/p/chromium/issues/detail?id=28880
+
+        Test: fast/css/recursive-delay-update-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+
+2009-12-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore source level debugging on Windows not reliable in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=32297
+
+        Customized pdb file name/location for WebCore static library.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add ProgramDataBaseFileName.
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * platform/FileSystem.h:
+        * platform/cf/BinaryPropertyList.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::unloadModule):
+        (WebCore::wxDirTraverserNonRecursive::wxDirTraverserNonRecursive):
+        (WebCore::wxDirTraverserNonRecursive::OnFile):
+        (WebCore::wxDirTraverserNonRecursive::OnDir):
+        (WebCore::listDirectory):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::globalMousePosForPlugin):
+        * plugins/wx/PluginDataWx.cpp: Added.
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * wscript:
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+
+2009-12-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: support custom WebCore context menu items in Chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32277
+
+        * platform/ContextMenu.h:
+        * platform/ContextMenuItem.h:
+        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
+        * platform/chromium/ContextMenuChromium.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::platformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::checked):
+        (WebCore::ContextMenuItem::enabled):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Linux: set default scrollbar colours.
+
+        This is so that layout tests have sane defaults for the scrollbar
+        colours, even if the API user doesn't set any.
+
+        This is a fix due to r51827.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32287
+
+        This is very well covered by existing layout tests.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+
+2009-12-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/7397808> Crash occurs at 
+        RenderObject::containingBlock() as I type in the Google Search 
+        field (during page load)
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): ownerRenderer() needs to be 
+        null checked.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord): Disable thread verification for this class because of its cross-thread use in IconDatabase.
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Disable thread verification for this class, add FIXME to enforce proper usage via crossThreadString.
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Adam Barth.
+
+        Inform the NotificationCenter when its window goes away in the same
+        manner as other DOMWindow fields, and prevent invalid operations on
+        it after that happens.
+
+        As part of this, change the V8 bindings for notifications to call
+        through the NotificationCenter rather than doing those operations
+        itself.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31886
+
+        Test: fast/notifications/notification-after-close.html
+
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed block selection gap repainting in table cells
+
+        Test: fast/repaint/block-selection-gap-in-table-cell.html
+
+        This recently-introduced regression exposed the fact that
+        RenderTableCell did not override offsetFromContainer() to adjust for
+        the fact that table cells’ coordinates are relative to the table
+        section, not the table row. With this fixed, RenderTableCell no longer
+        needs to override mapLocalToContainer() and mapAbsoluteToLocalPoint(),
+        since the base class implementations of those use offsetFromContainer().
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer):
+        * rendering/RenderTableCell.h:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sane way to force a rebuild on all win slaves, according to Adam Roben.
+
+        * WebCorePrefix.h:
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * loader/loader.cpp:
+        (WebCore::cachedResourceTypeToTargetType):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in to eventually fix the win debug build.
+
+        * svg/svgtags.in:
+
+2009-12-08  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32167
+        Update the ResourceRequest::RequestType.  This previously
+        was specific to Chromium.  Moved into ResourceRequestBase, enabling
+        more specificity about the type (which is otherwise only known to the
+        loader), and also making this information available to all platforms.
+        Any platform with a network layer which can utilize this information
+        may want to use it for prioritization.
+
+        Note to Chromium glue: TargetIsSubResource renamed to TargetIsSubresource.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::CachedResourceTypeToTargetType):
+        (WebCore::Loader::Host::servePendingRequests):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::):
+        (WebCore::ResourceRequestBase::targetType):
+        (WebCore::ResourceRequestBase::setTargetType):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        Build system change only. No tests possible.
+
+        * Android.derived.jscbindings.mk: Added.
+        * Android.derived.mk: Added.
+        * Android.jscbindings.mk: Added.
+        * Android.mk: Added.
+        * WebCorePrefix.h: Modified. Sets up some flags and adds a header required for building on Android.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): Conditionalize prefetching on
+        the libSoup version.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * bindings/scripts/CodeGeneratorCOM.pm: Touch file to assure a world rebuild. Hopefully.
+
+2009-12-08  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS Counter Nesting still does not work according to the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=31723
+
+        Test: fast/css/counters/nesting.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Replaced the faulty counter insertion algorithm with one that works.
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Add isAutofilled getter to match existing setter.
+
+        Reviewed by Ada Chan.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isAutofilled]):
+        Implemented new cover function.
+        
+        * bindings/objc/DOMPrivate.h:
+        Declared new cover function.
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Added a TextBreakIterator implementation based on GLib and pango,
+        which allows compiling WebCore without ICU.
+
+        * GNUmakefile.am:
+        * platform/text/gtk/TextBreakIteratorGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::setUpIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::cursorMovementIterator):
+        (WebCore::wordBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
+        (WebCore::textBreakFirst):
+        (WebCore::textBreakLast):
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPrevious):
+        (WebCore::textBreakPreceding):
+        (WebCore::textBreakFollowing):
+        (WebCore::textBreakCurrent):
+        (WebCore::isTextBreak):
+
+2009-12-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Change the way cookies are retrieved in the WebInspector frontend.
+
+        Moved the cookie filtering from the native code into the frontend so that
+        all cookies can be retrieved regardless of the associated domain
+        (required for certain audits to run.)
+        https://bugs.webkit.org/show_bug.cgi?id=32160
+
+        Test: inspector/cookie-resource-match.html
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorController.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get documentURL):
+        (WebInspector.Resource.prototype.set documentURL):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in, in order to force SVGNames.* regeneration. Praying for gtk bot to be fixed :-)
+
+        * svg/svgtags.in:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Trying to force a rebuild on the Gtk slave. If that doesn't work, someone must force a rebuild from scratch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: provide custom context menu in the front-end window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32200
+
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::contextMenuCleared):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::create):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::~MenuSelectionHandler):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::disconnect):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::MenuSelectionHandler):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/ContextMenu.js: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentContextMenu):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::createContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuSelectionHandler.h: Added.
+        (WebCore::ContextMenuSelectionHandler::ContextMenuSelectionHandler):
+        (WebCore::ContextMenuSelectionHandler::~ContextMenuSelectionHandler):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+
+2009-12-08  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] Build fix of duplicated platform/graphics/filters/FEGaussianBlur.cpp in WebCore.pro after enabled svg filters.
+
+        No new tests needed.
+        * WebCore.pro:
+
+2009-12-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a function to show render tree for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=31288
+
+        No new tests because this just adds a function for debugging.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::showRenderObject):
+        (WebCore::RenderObject::showRenderTreeAndMark):
+        (showRenderTree):
+        * rendering/RenderObject.h:
+
+2009-12-07  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement NamedPropertyEnumerator and IndexedPropertyEnumerator for
+        V8 NPObject. This should make the object enumerable and fix the
+        enumeration issue in layout test plugins/netscape-enumerate.html.
+
+        Also fix some existing style issues per webkit style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32254
+
+        Test: plugins/netscape-enumerate.html
+
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectInvokeDefaultHandler):
+        (npObjectGetProperty):
+        (npObjectPropertyEnumerator):
+        (npObjectNamedPropertyEnumerator):
+        (npObjectIndexedPropertyEnumerator):
+        (createV8ObjectForNPObject):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fragments now make WebSocket URL parsing fail.
+        https://bugs.webkit.org/show_bug.cgi?id=32144
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix wrong length parsing in WebSocket.
+        https://bugs.webkit.org/show_bug.cgi?id=32203
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.pro:
+
+2009-12-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: theme scrollbars to match GTK theme.
+        Add functions to RenderThemeChromiumLinux to change the scrollbar
+        color.
+
+        Since the change is to the Chromium WebKit API layer, testing will
+        be in Chromium's test shell.
+        http://bugs.webkit.org/show_bug.cgi?id=32048
+
+        Patch from Markus Gutschke <markus@chromium.org>.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::saturateAndBrighten):
+        (WebCore::outlineColor):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setScrollbarColors):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::thumbInactiveColor):
+        (WebCore::RenderThemeChromiumLinux::thumbActiveColor):
+        (WebCore::RenderThemeChromiumLinux::trackColor):
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Doesn't respect Content-Disposition for downloads, and provides no way for apps to do that
+        https://bugs.webkit.org/show_bug.cgi?id=32247
+
+        Allow creating a ResourceResponse from a SoupMessage.
+
+        Covered by API test.
+
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Reverting problematic patch, causing errors.
+
+        Revert r51789 (Avoid zero division during SVGPaintServerPattern::setup()). Crashes on all Windows slaves.
+        Reopen bug https://bugs.webkit.org/show_bug.cgi?id=29912.
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for HTMLInputElement::stepUp() and stepDown() for
+        type=number and type=range.
+        https://bugs.webkit.org/show_bug.cgi?id=27451
+
+        Our implementation of stepUp() and stepDown() rounds the resultant
+        value to conform to the step value.
+        Change the number-string conversion method for RenderSlider to be
+        consistent with type=number.
+
+        Tests: fast/forms/input-step-number.html
+               fast/forms/input-step-range.html
+               fast/forms/input-step-unsupported.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::rangeOverflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::minimum): Renamed from rangeMinimum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::maximum): Renamed from rangeMaximum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch): Use stepBase().
+        (WebCore::HTMLInputElement::applyStepForNumberOrRange):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::formStringFromDouble):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        * html/HTMLInputElement.idl: Add stepUp() and stepDown().
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange): Sync with rangeMinimum()/rangeMaximum() renaming.
+        (WebCore::RenderSlider::updateFromElement): Use formStringFromDouble().
+        (WebCore::RenderSlider::setValueForPosition): Use formStringFromDouble().
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix try 2 (dumb error).
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix.
+
+        Fix Chromium build break caused by an added dependency from
+        ScriptControllerBase to JSDOMWindowShell, and an API change in
+        ScriptValue.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): Indent does not work for twice modified with background text in gmail.
+        <rdar://problem/7442387>
+        https://bugs.webkit.org/show_bug.cgi?id=32233
+        
+        Fixes problem in re-creating the correct hierarchy under the new block.
+        Added extensive testing to cover all the cases.
+
+        Test: editing/execCommand/indent-with-style2.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Force JS binding regeneration, eventually fixing the broken tests on the bots.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix mac builds by touching svgtags.in - I only tried from-scratch builds.
+
+        * svg/svgtags.in:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        Only enable filters on mac for now, skipped all affected tests on the other platforms.
+        Will enable them one after another, to minimize breakage.
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that KURL rejects a host name which has an IPv4 address
+        inside an IPv6 form like [::127.0.0.1].
+        https://bugs.webkit.org/show_bug.cgi?id=29913
+
+        * platform/KURL.cpp:
+        (WebCore::characterClassTable): Add IPv6Char to '.'.
+
+2009-12-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7443417> - Closing a window opened with "New windows open with: Same Page" results in crash in ::~HistoryItem
+
+        The HistoryItem copy constructor has one very specific use case - to support the feature of a WebView copying another WebView's
+        BackForwardList.  That constructor wasn't initializing its m_document pointer, leading to this crash in the destructor.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem): Change the setDocument(0) to an ASSERT that the document is already 0. A HistoryItem cannot
+          outlive its Document and Documents will always clear the back-pointer in their ::detach() method.
+        (WebCore::HistoryItem::HistoryItem): Missed the m_document initializer in the copy constructor. Also remove an invalid assertion
+          about the original items m_cachedPage object (which is irrelevant to the copy).
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove partial SharedScript implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32237
+        The patch was obtained by running "git revert" command and then un-reverting WebCore/ChangeLog.
+
+        * DerivedSources.make:
+        * SharedScript/SharedScriptContext.cpp: Removed.
+        * SharedScript/SharedScriptContext.h: Removed.
+        * SharedScript/SharedScriptContext.idl: Removed.
+        * SharedScript/SharedScriptController.h: Removed.
+        * SharedScript/WebKitSharedScript.cpp: Removed.
+        * SharedScript/WebKitSharedScript.h: Removed.
+        * SharedScript/WebKitSharedScript.idl: Removed.
+        * SharedScript/WebKitSharedScriptRepository.cpp: Removed.
+        * SharedScript/WebKitSharedScriptRepository.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * dom/ScriptExecutionContext.h:
+
+2009-12-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32226
+        Random crashes in WebSocket tests on Leopard Debug builbot
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::close):
+        Make sure the object still exists when setting m_state.
+
+2009-12-07  Shiki Okasaka  <shiki@google.com>
+
+        Reviewed by Dirk Schulze.
+
+        Avoid zero division during SVGPaintServerPattern::setup()
+        https://bugs.webkit.org/show_bug.cgi?id=29912
+
+        Fix zero division bugs in SVGPaintServerPattern::setup() that occurred
+        if the tile of a pattern was bigger than the pattern and the pattern
+        size was < 0.5, and if the attribute overflow was set to visible.
+
+        Test: svg/custom/small-pattern.html
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32024
+        [GTK] WebKit does not compile without JAVASCRIPT_DEBUGGER
+
+        Fix build errors when javascript-debugger is disabled on GTK
+
+        * GNUmakefile.am:
+
+2009-12-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7437820> Weird selection artifacts
+
+        Tests: fast/repaint/block-selection-gap-stale-cache-2.html
+               fast/repaint/block-selection-gap-stale-cache.html
+
+        Instead of caching the block selection gaps’ bounds in the RenderView at setSelection()
+        time, cache them in each RenderLayer at paint time. This prevents the cache from getting
+        stale due to layout changes and overflow scrolling.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Account for overflow scroll.
+        (WebCore::RenderBlock::paintSelection): Update the enclosing layer’s selection gaps bounds.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::addBlockSelectionGapsBounds): Added. Updates the selection gaps
+        bounds to include the given rect.
+        (WebCore::RenderLayer::clearBlockSelectionGapsBounds): Added. Recursively clears the cached
+        selection gaps bounds.
+        (WebCore::RenderLayer::repaintBlockSelectionGaps): Added. Recursively invalidates the
+        selection gaps bounds.
+        * rendering/RenderLayer.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Clear the layer-level selection gaps bounds instead
+        of the view-level cache.
+        (WebCore::RenderView::clearSelection): Changed to call repaintBlockSelectionGaps().
+        * rendering/RenderView.h:
+
+2009-12-07  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixed whitelist comment and removed useless (tags, sdp) mimetypes
+        from it. Also, GStreamer doesn't handle directly SMIL.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Eliminate the segfaults which occur when accessing the text interface now
+        implemented by text controls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-12-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Turn the MediaPlayer supported types blacklist into a whitelist
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        Covered by API test.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25524
+        [Gtk] Expose the title attribute to assistive technologies
+
+        Expose 'alt' attribute from images as accessible name.
+        Expose the 'title' core HTML attribute as accessible description.
+        This is a modified version of the original fix submitted by Mario Sanchez Prada,
+        adjusted so that it doesn't impact other platforms.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_get_description):
+
+2009-12-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for generic font families
+
+        By not propagating the resolved font family in FontCacheQt and
+        only concidering the font description we ended up passing the
+        generic font families to Qt directly. Since most systems don't
+        have a mapping for these font families we ended up using the
+        default font in most cases.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.getOwnPropertyDescriptor() allows cross-frame access
+        https://bugs.webkit.org/show_bug.cgi?id=32119
+
+        Make all implementations of getOwnPropertyDescriptor that have
+        cross domain restrictions simply fail immediately on cross domain
+        access, rather than trying to mimic the behaviour of normal
+        property access.
+
+        Test: http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific functions from jni_utility and moves them to new jsc/jni_utility_private files.
+        https://bugs.webkit.org/show_bug.cgi?id=32157
+
+        Build fix only, no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Add jni_utility_private.[cpp|h].
+        * bridge/jni/jni_instance.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_jsobject.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_objc.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_runtime.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_utility.cpp: Modified. Removed convertValueToJValue and convertArrayInstanceToJavaArray.
+        * bridge/jni/jni_utility.h: Modified. Removed convertValueToJValue and dispatchJNICall.
+        * bridge/jni/jsc: Added.
+        * bridge/jni/jsc/jni_utility_private.cpp: Added.
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/jni_utility_private.h: Added. Header for convertValueToJValue and dispatchJNICall.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Include jni_utility_private.h for JSC.
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        texImage2D pixel junk for transparency
+        https://bugs.webkit.org/show_bug.cgi?id=32188
+
+        Use kCGBlendModeCopy when drawing an image to the intermediate context
+        used to create a GL texture.
+
+        No test as we don't currently have any mechanism to retrieve pixel data
+        from the webgl context.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+
+2009-12-03  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Advertize audio/ogg correctly and refactored mime-type cache
+        building.
+
+        [GTK] Recognize oga as audio/ogg
+        https://bugs.webkit.org/show_bug.cgi?id=31990
+
+        Test: media/media-can-play-ogg.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32175
+        REGRESSION: websocket/tests/url-parsing.html is crashing on Leopard Bot
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): Call platformClose() to unschedule both
+        streams, guaranteeing that there will be no callbacks after SocketStreamHandle is destroyed.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Edited a comment a bit.
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
+2009-12-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: make rounded borders heavier.
+
+        Skia draws its rounded corners differently from the other ports.
+        Whereas they have anti-aliased clipping regions, Skia only has 1-bit
+        regions. (Which is technically more correct, but somewhat unhelpful
+        for us.) Instead, with Skia we use a layer and collect all the
+        clipping paths in effect. When the state is popped, we paint
+        transparency outside the clipping paths and merge the layer down.
+
+        This appears to cause rounded borders to look a little thin, which is
+        addressed in this patch.
+
+        This is well covered by existing tests but will require new baselines
+        in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31778
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-12-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441571> Hardware-backed layers are skipped when printing
+        
+        When printing, set the PaintBehaviorFlattenCompositingLayers flag so that compositing layers
+        paint. This also causes 3D transforms to be flattened to 2D.
+
+        Test: printing/compositing-layer-printing.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix up some issues in my SVGListTraits change from yesterday.
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: chromium build fix.
+
+        Fix Chromium build break caused by moving of isDefaultPortForProtocol() and
+        portAllowed() into KURL.h/KURL.cpp.  Cloning code.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isDefaultPortForProtocol):
+        (WebCore::portAllowed):
+
+2009-12-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Remove suppress highlight when restoring selected node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32152
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+
+2009-12-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Gradient SVG animation demonstrates tearing at animation extremes
+        https://bugs.webkit.org/show_bug.cgi?id=11929
+
+        The focalPoint of a radial gradient is temporarly substracted by
+        the centralPoint, if the focalPoint is not in the radius of the
+        gradient. This is needed to calculate a new postion of the focalPoint
+        according to the specification. But the new focalPoint needs to be
+        moved by the centralPoint after this calculation, which is not the case
+        at the moment. This patch fixes this issue. It was also introduced a
+        deviation of maximal 0.2% for Cairo to get around the fixed point numbers
+        in Cairo.
+
+        W3C-SVG-1.1/pservers-grad-13-b needed an update. The missing adjustment
+        of the new focalPoint caused wrong results for the last three tests.
+
+        Test: svg/custom/radial-gradient-with-outstanding-focalPoint.svg
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2009-12-04  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Do not use WebCore::String::String(const UChar*, int length) to convert
+        short v8 strings.
+
+        Plus added string traits.
+        https://bugs.webkit.org/show_bug.cgi?id=31415
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+
+2009-12-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: AX: buttons now extremely repetitive
+        https://bugs.webkit.org/show_bug.cgi?id=32164
+
+        Test: platform/mac/accessibility/button-shouldnot-have-axvalue.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isButton):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-12-04  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Check whether the right side of a string append is non-empty
+        https://bugs.webkit.org/show_bug.cgi?id=32151
+
+        Especially beneficial for CachedScript::script() method
+        which usually appends an empty string returned by flush()
+        to its m_script member. m_script is often hundreds of kbytes
+        which is duplated without reason.
+
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        Test: LayoutTests/editing/execCommand/indent-partial-table.html
+        
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
+        after the selection has not been moved.
+
+2009-12-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32085
+        WebSocket should block the same ports that are blocked for resource loading
+
+        Test: websocket/tests/url-parsing.html
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+        Move isDefaultPortForProtocol() to KURL, because that's a better place for it (SecurityOrigin
+        is not even in WebCore/platform directory).
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setPort):
+        Updated for the new location of isDefaultPortForProtocol().
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::protocolIs): In an assertion, compare to "javascript" case-insensitively,
+        since the function doesn't require lower case input.
+        (WebCore::isDefaultPortForProtocol): Moved from SecurityOrigin.
+        (WebCore::portAllowed): Moved from ResourceHandle.
+        * platform/KURL.h:
+
+        * platform/network/ResourceHandle.cpp: (WebCore::ResourceHandle::create): Updated for the
+        new location of portAllowed().
+
+        * websockets/WebSocket.cpp: (WebCore::WebSocket::connect): Per the spec, raise a SECURITY_ERR
+        if trying to connect to a blocked port.
+
+2009-12-04  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebKit crashes when loading certain SVG images
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        Existing tests cover the change.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::family):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::italic):
+        (WebCore::FontPlatformData::smallCaps):
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+
+2009-12-04  Adam Treat  <atreat@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix wrong assert that was only working through sheer luck.
+        https://bugs.webkit.org/show_bug.cgi?id=32162
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create):
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * page/SecurityOrigin.cpp:
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CollectionCache
+        https://bugs.webkit.org/show_bug.cgi?id=32109
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        struct name            - instantiated at: WebCore/'location'
+
+        struct CollectionCache - dom/Document.cpp:4029
+
+        * html/CollectionCache.h:
+
+2009-12-04  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a crashing bug in Geolocation when a watch is cleared from some callbacks. 
+        https://bugs.webkit.org/show_bug.cgi?id=32111
+
+        In Geolocation::GeoNotifier::timerFired, a JS callback may be invoked if a
+        fatal error was registered on this GeoNotifier or if this request has timed
+        out. If the request is a watch, and is cleared by a call to clearWatch in the
+        callback, the GeoNotifier object will be destroyed. We must therefore cache the
+        m_geolocation member to allow us to call Geolocation::fatalErrorOccurred or
+        Geolocation::requestTimedOut.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-clear-watch.html
+               fast/dom/Geolocation/timeout-clear-watch.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Cache the m_geolocation member before invoking the JS callback.
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for 2 classes of the platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name         - instantiated at: WebCore/'location'
+
+        class SharedTimer         - (its child class) workers/WorkerRunLoop.cpp:91
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        class TransformOperations - rendering/style/RenderStyle.h:1175
+
+        Noncopyable.h's include added to SharedTimer.h.
+
+        * platform/SharedTimer.h:
+        * platform/graphics/transforms/TransformOperations.h:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Enable DNS prefetching.
+
+        Based on a patch by José Millán.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the svg directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name           - instantiated at: WebCore/'location'
+
+        struct ResourceSet          - svg/graphics/SVGResource.cpp:148
+        class SVGFontData           - css/CSSFontFaceSource.cpp:156
+        class SVGDocumentExtensions - dom/Document.cpp:3962
+        class SVGViewSpec           - svg/SVGSVGElement.cpp:191
+
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGFontData.h:
+        * svg/SVGViewSpec.h:
+        * svg/graphics/SVGResource.cpp:
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: aria-activedescendant doesn't work as intended
+        https://bugs.webkit.org/show_bug.cgi?id=32100
+
+        Fixes a number of issues regarding the "tree" role and aria-activedescendant.
+        1. The indexes were being reported incorrectly by treeitems.
+        2. aria-activedescendant changes were not being sent to the containing item.
+        3. The tree's selected rows need to consult aria-activedescendant.
+        4. Since a tree changes what it returns as its children (it returns its rows)
+           the mac-specific array indexing methods need to correctly handle the tree case.
+
+        Tests: platform/mac/accessibility/aria-tree-activedescendant.html
+               platform/mac/accessibility/aria-tree-index-of-items.html
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::shouldFocusActiveDescendant):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-12-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the xml directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        struct XMLHttpRequestStaticData - xml/XMLHttpRequest.cpp:134
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        class NodeTest                  - xml/XPathGrammar.y:258
+        class NodeSet                   - xml/XPathValue.cpp:52
+        struct EvaluationContext        - xml/XPathExpressionNode.cpp:40
+
+        * xml/XMLHttpRequest.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathNodeSet.h:
+        * xml/XPathStep.h:
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        New History changes do not compile for Chromium/V8
+        https://bugs.webkit.org/show_bug.cgi?id=32148
+
+        Existing tests suffice (just trying to get code to compile).
+
+        * WebCore.gypi:
+        Added V8HistoryCustom.cpp and other missing files.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom handlers for History.pushState()/replaceState().
+        * bindings/v8/custom/V8HistoryCustom.cpp: Added.
+        Added custom handlers for History.pushState()/replaceState().
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        Stubbed out this routine for now - will implement in the future.
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<XBLBindingManager> Document::m_bindingManager;
+        https://bugs.webkit.org/show_bug.cgi?id=32147
+
+        The document actually owns the bindingManager.  That's what the code
+        should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::bindingManager):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<Tokenizer> Document::m_tokenizer;
+        https://bugs.webkit.org/show_bug.cgi?id=32145
+
+        The document actually owns the tokenizer.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        (WebCore::Document::~Document):
+        (WebCore::Document::cancelParsing):
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::implicitClose):
+        * dom/Document.h:
+        (WebCore::Document::tokenizer):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<RenderArena> Document::m_renderArena;
+        https://bugs.webkit.org/show_bug.cgi?id=32146
+
+        The document owns the renderArena.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Also, removed a redundant initialization
+        of the tokenizer that I missed in my previous patch.
+        (WebCore::Document::~Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        (WebCore::Document::renderArena):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolling back r51633 because it causes a chromium perf regression.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The code should say that Document owns DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=32143
+
+        It's the truth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::docLoader):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: VO just says "term" on many web sites
+        https://bugs.webkit.org/show_bug.cgi?id=32139
+
+        Test: platform/mac/accessibility/definition-list-term.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Implement WAI-ARIA scrollbar role and related property aria-orientation
+        https://bugs.webkit.org/show_bug.cgi?id=32126
+
+        Test: accessibility/aria-scrollbar-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isScrollbar):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueForRange):
+        (WebCore::AccessibilityRenderObject::orientation):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7401617> Selection painting issue in hardware-
+        accelerated layers
+        which is another part of https://bugs.webkit.org/show_bug.cgi?id=23628
+        Fix selection painting to do container-relative repaints
+
+        Test: fast/repaint/block-selection-gap-in-composited-layer.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Compute and paint
+        gap rects in the coordinate space of the repaint container.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Added a
+        FIXME.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Map block selection gap rects from
+        the repaint container’s coordinate space to the view’s coordinate space
+        before adding them to the cached selection bounds.
+        (WebCore::RenderView::clearSelection): Changed to use
+        repaintRectangleInViewAndCompositedLayers() so that the selection rect
+        is invalidated in composited layers as well.
+
+2009-12-03  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32066 - Add enable geolocation flag to WebCore::Settings for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32066
+
+        Adds geolocationEnabled in Settings for runtime control of geolocaiton features. This defaults to ON
+        as it is intended as a development and testing aid, not a user control. To completely remove geolocation
+        from a given port, the compile time ENABLE_GEOLOCATION should still be used.
+        Adding placeholder GeolocationServiceChromium implementation, as this is required to allows
+        ENABLE_GEOLOCATION to be defined (in turn required for testing), even though this patch does not
+        make that the default just yet.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Add new m_geolocationEnabled flag default value
+        (WebCore::Settings::setGeolocationEnabled): Setter for  m_geolocationEnabled flag
+        * page/Settings.h:
+        (WebCore::Settings::geolocationEnabled):  Add m_geolocationEnabled flag
+        * platform/chromium/GeolocationServiceChromium.cpp: Added.
+        (WebCore::GeolocationServiceChromium::GeolocationServiceChromium): Place holder GeolocationServiceChromium)
+        (WebCore::createGeolocationService): factory function, only required when ENABLED(GEOLOCATION) is true
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        SpinTracer: 349 spins in Mail at WebCore::Editor::advanceToNextMisspelling(bool)
+        <rdar://problem/7198592>
+        https://bugs.webkit.org/show_bug.cgi?id=32129
+
+        Fixed the way the next paragraph is calculated.
+        I've added a repro case in Safari and attached it to the Bugzilla bug.
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange): Changed the way we move to the
+        next paragraph in the loop.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No wonder editing WebCore.exp repeatedly while I worked on this patch never seemed to stick.
+
+        Long live our auto-generated overlords that I didn't know about...  
+
+        * WebCore.base.exp:
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r51627): 3 SVG tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=32117
+
+        Null checking Items in the SVGList is insufficient as items may
+        be floats, etc so add SVGListTraits::isNull and add appropriate
+        specializations.
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGListTypeOperations::isNull):
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState):
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Multiple Undos removes the last posted comment and/or the ones before it.
+        <rdar://problem/6557066>
+        https://bugs.webkit.org/show_bug.cgi?id=32079
+        
+        The fix consists in preventing Undos and Redos to be applied to elements that
+        are no longer editable. We do not attempt to remove the commands from the queue.
+        It is a relatively simple fix that comes with a little extra overhead for the apply
+        and unapply methods where we are now performing the editability check.
+
+        Test: editing/undo/undo-indent-noneditable.html
+
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
+               fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
+               fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
+               fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
+               fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
+               fast/loader/stateobjects/pushstate-object-types.html
+               fast/loader/stateobjects/pushstate-then-replacestate.html
+               fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+               fast/loader/stateobjects/replacestate-then-pushstate.html
+               http/tests/loading/state-object-security-exception.html
+
+        Derived sources and project file changes:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am
+        * WebCore.pro
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Add the new PopStateEvent:
+        * dom/PopStateEvent.cpp: Added.
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h: Added.
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::isPopStateEvent):
+        (WebCore::PopStateEvent::state):
+        * dom/PopStateEvent.idl: Added.
+        * bindings/js/JSPopStateEventCustom.cpp: Added.
+        (WebCore::JSPopStateEvent::initPopStateEvent):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Event.cpp:
+        (WebCore::Event::isPopStateEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+
+        Add the "onpopstate" attribute:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+        Add pushState and replaceState management to the loader and history machinery:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from "scrollToAnchor()", combining
+          both the same-document fragment scroll case with the new same-document state object activation case.
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/HistoryController.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
+        (WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
+          list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
+          meant to remain.
+        (WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
+          insert the new item.
+        (WebCore::BackForwardList::removeItem):
+        * history/BackForwardList.h:
+        * page/History.cpp:
+        (WebCore::History::urlForState):
+        (WebCore::History::stateObjectAdded):
+        * page/History.h:
+        * page/History.idl:
+
+        Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::stateObject):
+        (WebCore::HistoryItem::document):
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
+          is going away.
+        (WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
+        (WebCore::Document::unregisterHistoryItem): Ditto.
+        * dom/Document.h:
+
+        Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
+        URL changes as the result of pushState(), replaceState(), or a popstate navigation:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        (WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
+          the pending state object.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):
+
+        Change handling of "loading a HistoryItem" to distinguish between new-Document navigations and same-Document
+        navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix.
+        r51621 changed JS bindings only, broke v8's.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+
+2009-12-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Attributes and NamedNodeMaps aren't tracked correctly and may be prematurely garbage-collected.
+        https://bugs.webkit.org/show_bug.cgi?id=32094
+
+        Covered by existing test: LayoutTests/fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Chromium: Add support for settings containing ":"
+
+        https://bugs.webkit.org/show_bug.cgi?id=32118
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection):
+
+2009-12-03  Rafael Antognolli  <antognolli@profusion.mobi>, Kenneth Christiansen <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        repaint events from outside the viewport aren't received
+        https://bugs.webkit.org/show_bug.cgi?id=32081
+
+        When using a tiled backing store for painting, you need to receive
+        event from outside the viewport. Setting the viewport to the size
+        of the contents is not an option if you want to make use of WebCore's
+        infrastructure for drawing scrollbars etc.
+
+        A new property, paintsEntireContents, has been introduced for the
+        above use-case. It is settable, as tiling will be optional for Qt,
+        and for the not yet upstreamed EFL port, there will be two different
+        views, where only one of them are tiled.
+
+        No change in behavior, so no new tests added.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setPaintsEntireContents):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::paintsEntireContents):
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h: Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Provide forward declarations
+        of Core Text functions that are public on 10.6 but SPI on 10.5.
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        Test: inspector/settings-set-get.html
+
+        * WebCore.Inspector.exp:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setting):
+        (WebCore::InspectorController::setSetting):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::attachWindow):
+        (WebCore::InspectorController::setAttachedWindowHeight):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showWindow):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setting):
+        (WebCore::InspectorFrontendHost::setSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::populateSetting):
+        (WebCore::EmptyInspectorClient::storeSetting):
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] notifyHistoryItemChanged() should pass a pointer to the HistoryItem that changed.
+        https://bugs.webkit.org/show_bug.cgi?id=31915
+
+        No change in functionality so no new tests required.
+
+        * history/HistoryItem.cpp:
+        (WebCore::defaultNotifyHistoryItemChanged): Update this function to pass the HistoryItem that is being changed.
+        (WebCore::HistoryItem::setAlternateTitle): Update call to notifyHistoryItemChanged to include the new parameter.
+        (WebCore::HistoryItem::setURLString): ditto.
+        (WebCore::HistoryItem::setOriginalURLString): ditto.
+        (WebCore::HistoryItem::setReferrer): ditto.
+        (WebCore::HistoryItem::setTitle): ditto.
+        (WebCore::HistoryItem::setTarget): ditto.
+        (WebCore::HistoryItem::setDocumentState): On Android, add a call to notifyHistoryItemChanged. See bug for a discussion of why this is needed.
+        (WebCore::HistoryItem::clearDocumentState): ditto.
+        (WebCore::HistoryItem::setIsTargetItem): ditto.
+        (WebCore::HistoryItem::addChildItem): ditto.
+        (WebCore::HistoryItem::setFormInfoFromRequest): ditto.
+        * history/HistoryItem.h: Update signature of notifyHistoryItemChanged.
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        This change adds three new methods on the FrameLoaderClient interface to receive notifications when the BackForwardList changes.
+
+        No new tests required. Functionality on all platforms upstream remains the same. Android is the first platform to make use of these callbacks.
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Execute the callback.
+        (WebCore::BackForwardList::goBack): ditto.
+        (WebCore::BackForwardList::goForward): ditto.
+        (WebCore::BackForwardList::goToItem): ditto.
+        (WebCore::BackForwardList::setCapacity): dito.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation for the callback that does nothing.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * loader/FrameLoaderClient.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] Upstream WebCore/history/android: Require some platform specific state attached to HistoryItem.
+        https://bugs.webkit.org/show_bug.cgi?id=31913
+
+        Android stores information such as the zoom scale factor and bridge back to the Java counterpart with HistoryItem.
+
+        No new tests required as this is Android specific code.
+
+        * history/HistoryItem.h: Add Android specific member data to HistoryItem.
+        * history/android: Added.
+        * history/android/AndroidWebHistoryBridge.h: Added.
+        * history/android/HistoryItemAndroid.cpp: Added, provides implementation for Android specific member functions in HistoryItem.
+        (WebCore::HistoryItem::bridge): Added.
+        (WebCore::HistoryItem::setBridge): Added.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
+        Add null checks to SVGList's content manipulation functions to prevent
+        null values from entering the list in the first place.
+
+        Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::getPathSegAtLength):
+        (WebCore::SVGPathSegList::toPathData):
+        (WebCore::SVGPathSegList::createAnimated):
+        * svg/SVGPathSegList.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sanitize web fonts using the OTS library 
+        https://bugs.webkit.org/show_bug.cgi?id=31106
+
+        Add support for OpenType sanitizer (OTS). It parses OpenType files (from @font-face)
+        and attempts to validate and sanitize them. We hope this reduces the attack surface
+        of the system font libraries.
+
+        * WebCore.gyp/WebCore.gyp: Added dependency to (chromium_src_dir)/third_party/ots/ library.
+        * WebCore.gypi: Added new files below.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Validate and transcode a web font.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp: Ditto.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/opentype/OpenTypeSanitizer.cpp: Added.
+        (WebCore::OpenTypeSanitizer::sanitize):
+        * platform/graphics/opentype/OpenTypeSanitizer.h: Added.
+        (WebCore::OpenTypeSanitizer::OpenTypeSanitizer):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Web Inspector frontend heap allocates ScriptFunctionCall which is unsafe
+        https://bugs.webkit.org/show_bug.cgi?id=32098
+
+        Fix is simply to make the ScriptFunctionCall stack allocated as nature intended.
+        Doing this required adding an appendArgument(char*) to ScriptFunctionCall so
+        that an explicit String cast would not be necessary.
+
+        To prevent something like this happening again in future i've added private
+        operator new implementations to ScriptFunctionCall making this type of mistake
+        produce errors when compiling.
+
+        Test case: Inspector tests now pass with GC on every alloc enabled.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        (WebCore::ScriptFunctionCall::operator new):
+        (WebCore::ScriptFunctionCall::operator new[]):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+
+2009-12-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32072, clean up invalid @-rule error handling so that we
+        pass more CSS test suite stuff.  Make the grammar stop enforcing the ordering of @namespace vs.
+        @variables vs. @import.  Just let the parser handle that instead.  This simplifies the grammar and
+        makes error handling deal with more cases correctly.
+
+        Added fast/css/namespaces/namespaces-invalid-at-rules.xml
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseRule):
+        (WebCore::CSSParser::createCharsetRule):
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::addNamespace):
+        (WebCore::CSSParser::createVariablesRule):
+        * css/CSSParser.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Safari/Chromium for Windows fails to load CJK WebFonts
+        https://bugs.webkit.org/show_bug.cgi?id=31804
+        
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameAndActivateFont): Load a remote font even if the font has 2 or more faces.
+
+2009-12-02  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: Need tickmarks in scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumMac.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm: Added.
+
+2009-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Expose a function to set the value of an input element on behalf of the user.
+        This function will dispatch the change event so the page is notified when autofill
+        happens. Also dispatch a change event when a select element is changed by autofill.
+
+        <rdar://problem/6760590> Would like a way to detect a login form AutoFill from JavaScript
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Added the DOMHTMLInputElementPrivate.h header.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Call setSelectedIndexByUser instead so
+        a change event is fired. This method is called by Safari autofill.
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Use dispatchFormControlChangeEvent instead
+        of dispatching the change event directly to be consistent.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLInputElement::setValueForUser): Added. Calls setValue with the sendChangeEvent
+        (WebCore::HTMLInputElement::setValue): Added the optional sendChangeEvent argument. Mimics setChecked.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Added setValueForUser for non-JS languages.
+        * html/InputElement.h: Added setValueForUser.
+
+2009-12-02  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM tree selection disappears upon page refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31142
+
+        Test: inspector/elements-panel-selection-on-refresh.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodeByPathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::resetScriptObjects):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForPath):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectDefaultNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeByPathToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32045, make sure escape sequences work with
+        all the @-rules we support.  When escape sequences are present, the lexical scanner
+        just returns a generic token name: ATKEYWORD.  We have to process the escape sequences
+        and then recheck against the rules we support with the final processed name.  If we
+        find a match, we mutate the token value to the appropriate rule name token, e.g.,
+        NAMESPACE_SYM.
+
+        Added fast/css/namespaces/namespaces-escapes.xml
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::recheckAtKeyword):
+        (WebCore::CSSParser::text):
+        * css/CSSParser.h:
+
+2009-12-02  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.:w
+
+        Allow to skip thread checks when accessing DOMDataStore for processes
+        which run V8 in single thread mode.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMDataStore):
+        (WebCore::enableFasterDOMStoreAccess):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        * bindings/v8/V8DOMMap.h:
+
+2009-12-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Code clean up: remove ScriptObjectQuarantine.* as a whole.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32060
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/js/ScriptObjectQuarantine.h: Removed.
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/v8/ScriptObjectQuarantine.h: Removed.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+
+2009-12-02  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket handshake check query component of URL
+        https://bugs.webkit.org/show_bug.cgi?id=31617
+
+        Tests: websocket/tests/url-with-credential.html
+               websocket/tests/url-with-empty-query.html
+               websocket/tests/url-with-fragment.html
+               websocket/tests/url-with-query-for-no-query.html
+               websocket/tests/url-with-query.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): returns a null if query is not specified and returns an empty if query is specified but empty.
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName): added. add query component to path if specified.
+        (WebCore::WebSocketHandshake::clientLocation):
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+
+2009-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Incorrect code in WebGLRenderingContext.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32046
+
+        Fix incorrect code that happened to work. != has higher precendence than &.
+        The simplest fix is to remove the "!= 0" which violates WebKit style
+        guidelines anyway.
+
+        Also added periods to few comments in the same function.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+
+2009-12-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change [Reflect] to [ConvertNullToNullString, Reflect] for min, max,
+        pattern and step attributes of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=31708
+
+        * html/HTMLInputElement.idl:
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        Test: platform/mac/accessibility/aria-drag-drop.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        (WebCore::AccessibilityObject::isARIAGrabbed):
+        (WebCore::AccessibilityObject::setARIAGrabbed):
+        (WebCore::AccessibilityObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::isARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::setARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-01  Adam Barth  <abarth@webkit.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Unreviewed port of @sandbox to V8.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-01  Patrik Persson  <patrik.j.persson@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 sandbox attribute for iframes.
+        http://www.w3.org/TR/html5/text-level-semantics.html#attr-iframe-sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Tests: fast/frames/sandboxed-iframe-attribute-parsing.html
+               fast/frames/sandboxed-iframe-forms.html
+               fast/frames/sandboxed-iframe-navigation-allowed.html
+               fast/frames/sandboxed-iframe-navigation-parent.html
+               fast/frames/sandboxed-iframe-navigation-targetlink.html
+               fast/frames/sandboxed-iframe-navigation-windowopen.html
+               fast/frames/sandboxed-iframe-plugins.html
+               fast/frames/sandboxed-iframe-scripting.html
+               fast/frames/sandboxed-iframe-storage.html
+               http/tests/security/sandboxed-iframe-document-cookie.html
+               http/tests/security/sandboxed-iframe-modify-self.html
+               http/tests/security/xss-DENIED-sandboxed-iframe.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied.html
+
+        * bindings/js/JSDOMWindowCustom.cpp: sandboxing navigation
+        (WebCore::createWindow):
+        * bindings/js/ScriptController.cpp: sandboxing scripts
+        (WebCore::ScriptController::isEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::cookie): raise exception when accessed from sandbox
+        (WebCore::Document::setCookie): raise exception when accessed from sandbox
+        (WebCore::Document::initSecurityContext): updae sandbox status
+        (WebCore::Document::updateSandboxFlags):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * html/HTMLAppletElement.cpp: sandboxing applets
+        (WebCore::HTMLAppletElement::createRenderer):
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        (WebCore::HTMLAppletElement::canEmbedJava):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLFrameOwnerElement.cpp: management of sandbox flags as stated in attribute
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::sandboxFlags):
+        * html/HTMLIFrameElement.cpp: sandbox attribute parsing
+        (WebCore::parseSandboxAttribute):
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
+        * html/HTMLIFrameElement.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::submitForm): sandboxing forms
+        (WebCore::FrameLoader::requestObject): sandboxing plugins
+        (WebCore::FrameLoader::shouldAllowNavigation): sandboxing navigation
+        (WebCore::FrameLoader::updateSandboxFlags): propagation of sandbox flags
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::ownerElementSandboxFlagsChanged):
+        (WebCore::FrameLoader::isSandboxed):
+        (WebCore::FrameLoader::sandboxFlags):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/DOMWindow.cpp: disable storage and databases in sandboxed frames
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        (WebCore::DOMWindow::openDatabase):
+        * page/SecurityOrigin.cpp: added sandboxing status
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::toString):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Kilzer.
+
+        ARIA: support a way to create a static text object
+        https://bugs.webkit.org/show_bug.cgi?id=32030
+
+        Test: accessibility/aria-text-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::isDescendantOfBarrenParent):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector crashes when collecting on every allocation
+        https://bugs.webkit.org/show_bug.cgi?id=32044
+
+        The crash is caused by the prototype wrapper object getting collected
+        when allocating the object that is going to use it as a prototype.
+        Because the only reference to the prototype wrapper is through the
+        new object's Structure it does not get marked automatically.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add 'sampleSVGAnimationForElementAtTime' method to the LayoutTestController,
+        for the use within the new SVG animation test framework (LayoutTests/svg/animations/)
+
+        layoutTestController.sampleAnimationAtTime(<svg animation id>, <absolute time>, <svg element id>);
+        to sample a svg animateMotion/animateColor/animate/set element at certain times.
+
+        After the desired SVG animation starts and calling the method above, it's immediately forwarded to
+        the desired sampling time. After JS returns from the 'sampleSVGAnimationForElementAtTime' method
+        a callback is fired used to sample the animation value at the target time. It's modelled similar
+        to the CSS animation/transition testing framework, inspired by
+        LayoutTests/animations/animation-test-helpers.js.
+
+        Though it has been extended to integrate within the fast/js/js-test-* framework, that's used for
+        the SVG dynamic-updates tests, to simplify test creation, by utilizing script-tests/* only.
+
+        Adding a simple testcase testing the DRT methods, it will soon be extended to test animVal/baseVal
+        interaction, while animating.
+
+        Test: svg/animations/animVal-basics.html
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::sampleAnimationAtTime):
+        * svg/SVGDocumentExtensions.h:
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::SMILTimeContainer):
+        (WebCore::SMILTimeContainer::sampleAnimationAtTime):
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * svg/animation/SMILTimeContainer.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add convenience methods to Element and QualifiedName that take
+        char* instead of AtomicString, in preparation for removing the
+        implicit conversion between the two types (30187).
+        https://bugs.webkit.org/show_bug.cgi?id=31749
+
+        * dom/Element.cpp:
+        (WebCore::Element::setCStringAttribute):  Equivalent to setAttribute.
+        * dom/Element.h:
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::init):  Shared impl of both constructors
+        (WebCore::QualifiedName::QualifiedName):  New c'tor taking char*.
+        * dom/QualifiedName.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::CaseFoldingCStringTranslator):  Enables lookup by C string
+        (WebCore::HTTPHeaderMap::get):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::contains):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::add):  New variant that takes C string
+        * platform/network/HTTPHeaderMap.h:
+        (WebCore::HTTPHeaderMap::get):
+        (WebCore::HTTPHeaderMap::add):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):  Use symbolic names for headers
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp: Include RetainPtr.h.
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32036
+        Implement CredentialStorage::getFromPersistentStorage for CFNetwork
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32001
+
+        Added missing localized strings (that I left out of the patch for bug #21554):
+        %d × %d pixels
+        %d × %d pixels (Natural: %d × %d pixels)
+
+        Also, changed formatting of these stings to conform with existing ones (added
+        a space on both sides of the multiply sign).
+
+        * English.lproj/localizedStrings.js: Added stings.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 32032, empty namespaces should be allowed in @namespace directives in CSS.
+
+        Added fast/css/namespaces/namespaces-empty.xml
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addNamespace):
+        (WebCore::CSSStyleSheet::determineNamespace):
+
+2009-12-01  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Escape key in the Search Field should be more User Friendly
+        https://bugs.webkit.org/show_bug.cgi?id=32005
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): add mousedown listener on the search field
+        (WebInspector.searchFieldManualFocus): user clicked to focus on the search field
+        (WebInspector.searchKeyDown): handle escape
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by David Kilzer.
+
+        @namespace directives need to use "maybe_space" in the "maybe_ns_prefix" portion of the grammar to match
+        the spec.  Not doing so prevent comments from being used immmediately after the namespace prefix.
+
+        Added fast/css/namespaces-comments.xml
+
+        * css/CSSGrammar.y:
+
+2009-12-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Reloading WebInspector from context menu is closing it instead of reloading.
+        https://bugs.webkit.org/show_bug.cgi?id=32004
+
+        When reloading WebInspector, don't delete its m_page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+
+2009-12-01  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds V8 bindings for Geolocation.
+        https://bugs.webkit.org/show_bug.cgi?id=30206
+
+        Also adds Geolocation files to Chrome build files.
+
+        * WebCore.gyp/WebCore.gyp: Modified. Corrects list of Geolocation IDL files.
+        * WebCore.gypi: Modified. Adds Geolocation files.
+        * bindings/v8/DOMObjectsInclude.h: Modified. Adds Geolocation includes.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified. Adds Geolocation files.
+        * bindings/v8/V8Index.cpp: Modified. Includes Geolocation generated headers.
+        * bindings/v8/V8Index.h: Modified. Adds Geolocation types to DOM_OBJECT_TYPES.
+        * bindings/v8/custom/V8CoordinatesCustom.cpp: Added. Handles optional properties.
+        * bindings/v8/custom/V8CustomBinding.h: Modified. Declares callbacks and getters.
+        * bindings/v8/custom/V8CustomPositionCallback.cpp: Added.
+        (WebCore::V8CustomPositionCallback::V8CustomPositionCallback): Added. Constructor.
+        (WebCore::V8CustomPositionCallback::~V8CustomPositionCallback): Added. Destructor.
+        (WebCore::V8CustomPositionCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionCallback.h: Added.
+        (WebCore::V8CustomPositionCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp: Added.
+        (WebCore::V8CustomPositionErrorCallback::V8CustomPositionErrorCallback): Added. Constructor.
+        (WebCore::V8CustomPositionErrorCallback::~V8CustomPositionErrorCallback): Added. Destructor.
+        (WebCore::V8CustomPositionErrorCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.h: Added.
+        (WebCore::V8CustomPositionErrorCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8GeolocationCustom.cpp: Added.
+        (WebCore::throwTypeMismatchException): Added. Throws a type mismatch error.
+        (WebCore::createPositionCallback): Added. Handles type checking for successCallback argument.
+        (WebCore::createPositionErrorCallback): Added. Handles type checking for errorCallback argument.
+        (WebCore::createPositionOptions): Added. Handles type checking for positionOptions argument.
+
+2009-12-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Provide a way to get ScriptState for the inspected page.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32020
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromPage):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Changed mallocs to fastMallocs and frees to fastFrees in GraphicsContext3D. Also added error returns
+        https://bugs.webkit.org/show_bug.cgi?id=30778
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::imageToTexture):
+
+2009-12-01  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Don't crash in DOMWindow event getter in OOM situations
+        https://bugs.webkit.org/show_bug.cgi?id=32017
+
+        Add missing null handle checks in DOMWindow event property
+        accessors.  V8Proxy::context(frame) can return a null handle in
+        OOM situations either if failing to initialize a context or if an
+        OOM is handled gracefully and javascript is disabled.
+
+        No new tests because we don't have a good way to test
+        out-of-memory bugs.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Updated HTMLCanvasElement to accept "experimental-webgl" as the context name.
+        https://bugs.webkit.org/show_bug.cgi?id=31672
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+
+2009-12-01  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Not reviewed: chromium build fix, added missing import.
+
+        * inspector/InspectorFrontendHost.cpp:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix windows build via unexcluding generated files from
+        project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying IDL files in to the WebCore framework wrapper.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build by making the Xcode project compatible with Xcode 2.4.
+
+        This was probably broken by hand-editing the project file as Xcode itself
+        knows how to keep project files to a backwards-compatible subset of its format.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: windows build fix (bad vcproj in r51528).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-27  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorBackend into three parts: backend,
+        injected script host and frontend host.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31888
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectorBackendCustom.cpp: Removed.
+        * bindings/js/JSInspectorFrontendHostCustom.cpp: Added.
+        (WebCore::JSInspectorFrontendHost::search):
+        (WebCore::JSInspectorFrontendHost::setting):
+        (WebCore::JSInspectorFrontendHost::setSetting):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Removed.
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InjectedScriptHost.cpp: Added.
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::copyText):
+        (WebCore::InjectedScriptHost::nodeForId):
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::InjectedScriptHost::addNodesToSearchResult):
+        (WebCore::InjectedScriptHost::currentCallFrame):
+        (WebCore::InjectedScriptHost::databaseForId):
+        (WebCore::InjectedScriptHost::selectDatabase):
+        (WebCore::InjectedScriptHost::selectDOMStorage):
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        (WebCore::InjectedScriptHost::inspectorDOMAgent):
+        (WebCore::InjectedScriptHost::inspectorFrontend):
+        * inspector/InjectedScriptHost.h: Added.
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorController):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptHost.idl: Added.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::InspectorBackend):
+        (WebCore::InspectorBackend::storeLastActivePanel):
+        (WebCore::InspectorBackend::toggleNodeSearch):
+        (WebCore::InspectorBackend::resourceTrackingEnabled):
+        (WebCore::InspectorBackend::debuggerEnabled):
+        (WebCore::InspectorBackend::enableDebugger):
+        (WebCore::InspectorBackend::disableDebugger):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::resumeDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptions):
+        (WebCore::InspectorBackend::setPauseOnExceptions):
+        (WebCore::InspectorBackend::profilerEnabled):
+        (WebCore::InspectorBackend::enableProfiler):
+        (WebCore::InspectorBackend::disableProfiler):
+        (WebCore::InspectorBackend::startProfiling):
+        (WebCore::InspectorBackend::stopProfiling):
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::highlightDOMNode):
+        (WebCore::InspectorBackend::hideDOMNodeHighlight):
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        (WebCore::InspectorBackend::nodeForId):
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::create):
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorFrontendHost):
+        (WebCore::InspectorController::injectedScriptHost):
+        * inspector/InspectorFrontendHost.cpp: Added.
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::windowUnloading):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::localizedStringsURL):
+        (WebCore::InspectorFrontendHost::hiddenPanels):
+        (WebCore::InspectorFrontendHost::platform):
+        (WebCore::InspectorFrontendHost::port):
+        (WebCore::InspectorFrontendHost::addResourceSourceToFrame):
+        (WebCore::InspectorFrontendHost::addSourceToFrame):
+        * inspector/InspectorFrontendHost.h: Added.
+        (WebCore::InspectorFrontendHost::create):
+        (WebCore::InspectorFrontendHost::inspectorController):
+        (WebCore::InspectorFrontendHost::disconnectController):
+        * inspector/InspectorFrontendHost.idl: Added.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._window):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/InspectorBackendStub.js: Added.
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.wrapCallback):
+        (.WebInspector.InspectorBackendStub.prototype.platform):
+        (.WebInspector.InspectorBackendStub.prototype.port):
+        (.WebInspector.InspectorBackendStub.prototype.closeWindow):
+        (.WebInspector.InspectorBackendStub.prototype.attach):
+        (.WebInspector.InspectorBackendStub.prototype.detach):
+        (.WebInspector.InspectorBackendStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorBackendStub.prototype.clearMessages):
+        (.WebInspector.InspectorBackendStub.prototype.searchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.search):
+        (.WebInspector.InspectorBackendStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorBackendStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorBackendStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorBackendStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorBackendStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorBackendStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorBackendStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorBackendStub.prototype.loaded):
+        (.WebInspector.InspectorBackendStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorBackendStub.prototype.windowUnloading):
+        (.WebInspector.InspectorBackendStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorBackendStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.startProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.stopProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorBackendStub.prototype.getProfile):
+        (.WebInspector.InspectorBackendStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorBackendStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorBackendStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.setSetting):
+        (.WebInspector.InspectorBackendStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setting):
+        * inspector/front-end/InspectorControllerStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js: Added.
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        (.WebInspector.InspectorFrontendHostStub.prototype.port):
+        (.WebInspector.InspectorFrontendHostStub.prototype.closeWindow):
+        (.WebInspector.InspectorFrontendHostStub.prototype.attach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.detach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.search):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorFrontendHostStub.prototype.moveWindowBy):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loaded):
+        (.WebInspector.InspectorFrontendHostStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setSetting):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setting):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        (WebInspector.ScriptsPanel.prototype._togglePause):
+        (WebInspector.ScriptsPanel.prototype._stepOverClicked):
+        (WebInspector.ScriptsPanel.prototype._stepIntoClicked):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.get platform):
+        (WebInspector.get port):
+        (WebInspector.set currentPanel):
+        (WebInspector._createPanels):
+        (WebInspector._loadPreferences):
+        (WebInspector.set attached):
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (windowLoaded):
+        (WebInspector.windowUnload):
+        (WebInspector.close):
+        (WebInspector.toolbarDrag):
+        (WebInspector.UIString):
+
+2009-11-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        css2.1/t1205-c566-list-stl-00-e-ag.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23264
+        css2.1/t1205-c565-list-pos-00-b.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23263
+
+        Ignore whitespaces after list markers.
+        Rendering of this was already done for the case where inside=false.
+        This fixes the rendering of inside=true case and calcInlinePrefWidths.
+
+        Test: fast/lists/calc-width-with-space.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-11-30  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51212
+
+        Fix scriptStateFromNode and ScriptStateFromPage to take DOMWrapperWorld
+        as the first argument.
+        Move mainThreadNormalWorld() to ScriptState.{h,cpp}.
+        Add debuggerWorld() and pluginWorld() in ScriptState.h.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptState.h:
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+
+2009-11-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Can focus but not type into content editable block that contains only non-editable content.
+        <rdar://problem/5982901>
+        https://bugs.webkit.org/show_bug.cgi?id=31750
+        
+        The goal is to change the way we choose a visible position
+        after hit detection, by preferring a visually equivalent editable
+        position if available. By doing this, it is possible to add content
+        to an editable block that initially contains only non editable elements.
+
+        Test: editing/selection/mixed-editability-10.html
+
+        * WebCore.base.exp: Changed to match the new signature of downstream
+        and upstream in the Position class.
+        * dom/Position.cpp:
+        (WebCore::Position::atEditingBoundary): Added.
+        (WebCore::Position::upstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::downstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to retrieve the inline box
+        to be used in calculating the caret rectangle.
+        * dom/Position.h:
+        (WebCore::Position::):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atEditingBoundary): Added.
+        (WebCore::PositionIterator::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        * dom/PositionIterator.h:
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        (WebCore::lastEditablePositionBeforePositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Added logic to prefer an editable position,
+        if available.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::isAllCollapsibleWhitespace): Added.
+        * rendering/RenderText.h:
+
+2009-11-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add header needed for wx build.
+
+        * css/CSSFontFaceSrcValue.cpp:
+
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7424387> WebCore binary missing symbols when built for x86_64 from a machine that cannot run x86_64 binaries
+
+        The check for whether WTF_USE_PLUGIN_HOST_PROCESS is defined occurs under the native architecture of the build machine.
+        If that is 32-bit then WTF_USE_PLUGIN_HOST_PROCESS will not be defined.  We work around this by forcing the check to
+        be performed against the x86_64 architecture.
+
+        * DerivedSources.make:
+
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        Prevent desiredColumnCount from being less than 1 since it is used 
+        as a divisor.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2009-11-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31659
+        Connection must be closed in case of Web Socket handshake error
+
+        The network connection was closed, but the close event wasn't dispatched.
+
+        Tested by websocket/tests/handshake-error.html, which is un-skipped now.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::platformClose):
+        Call client didHandle() method. This looks strange in CFNetwork implementation, because
+        it's the client that asked to close the stream, so it shouldn't need the callback. It makes
+        more sense in cross-process implementation, because closing is async there.
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+
+        Remove the last uses of mainThreadCurrentWorld(), so the world is always obtained via
+        currentWorld().  Switch this to obtain the world from the ExecsState's lexical global
+        object instead.  Remove the call/construct/evaluate 'InWorld' methods, since these
+        are no longer necessary.
+
+        * WebCore.base.exp:
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeIterator.h:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/TreeWalker.h:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+
+2009-11-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        All HTML5 media element events should be regular events
+        https://bugs.webkit.org/show_bug.cgi?id=30513
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::noneSupported):
+        (WebCore::HTMLMediaElement::mediaEngineError):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Call scheduleEvent instead of scheduleProgressEvent.
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+            Call scheduleEvent instead of scheduleProgressEvent. Call renderer->updateFromElement
+            after scheduling a 'progress' event so the controller will update download
+            progress indicator.
+        * html/HTMLMediaElement.h:
+            Remove scheduleProgressEvent prototype.
+
+2009-11-30  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Wrong console output for Regexp escape sequence
+        https://bugs.webkit.org/show_bug.cgi?id=31538
+
+        Updated inspector/console-format.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement): style issues.
+        (WebInspector.ConsoleView.createFilterElement): style issues.
+        (WebInspector.ConsoleView): added _customFormatters table.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): style isses.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): style issues.
+        (WebInspector.ConsoleView.prototype._format): simplified delegation to formatter logic.
+        (WebInspector.ConsoleView.prototype._formatobject):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._format): commented and broke down the algorithm into parts.
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString.append): handle substitution string formatting.
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue): handling individual value formatting.
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js: simplified regex formatting.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyStringAsFragment): converted new RegExp to literal for performance benefits.
+        * inspector/front-end/utilities.js: 
+        (Element.prototype.hasStyleClass): update inaccurate comment.
+        (String.prototype.trimURL): converted new RegExp to literal for performance benefits.
+
+2009-11-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Clean up V8 bindings for CSSStyleDeclaration and CSSVariableDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=31895
+
+        No new tests. This is already covered by:
+                fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+                fast/dom/CSSStyleDeclaration/css-style-item.html
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds include of wtf/StdLibExtras.h for DEFINE_STATIC_LOCAL in V8 ScriptController.
+        https://bugs.webkit.org/show_bug.cgi?id=31932
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptController.cpp: Modified. Adds include of wtf/StdLibExtras.h.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PassOwnPtr include to ScriptExecutionContext.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31929
+
+        Build fix only, no new tests.
+
+        * dom/ScriptExecutionContext.h: Modified. Adds PassOwnPtr include.
+
+2009-11-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION (r49757): masking-mask-01-b.svg rendered incorrectly
+        [https://bugs.webkit.org/show_bug.cgi?id=31980]
+
+        It turns out, that we did not handle maskUnits="userSpaceOnUse"
+        correctly. We just need to move the context of the maskImage
+        if maskContentUnits="objectBoundingBox". The context gets scaled
+        on this unit combination, so we have to substract the position of
+        the targetRect. On userSpaceOnUse the position just depends on the
+        position of the mask element.
+        I added a test with some senseless and reasonable values for size
+        and postion of the mask and it's contents. I also used every
+        combination of maskUnits and maskContentUnits to be sure, that it
+        is fixed this time.
+
+        Test: svg/custom/mask-with-all-units.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31928
+
+        Build fix only, no new tests.
+
+        * page/DOMWindow.cpp: Modified. Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds SHARED_WORKERS guards to V8 WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=31926
+
+        Build fix only, no new tests.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+
+2009-11-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Chrome::contentsSizeChanged() is called when the content size has not changed
+        https://bugs.webkit.org/show_bug.cgi?id=31978
+
+        Do not trigger contentsSizeChaned() is the new size is the same as the old one.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix some compiler warnings seen on QtWebKit/Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31962
+
+        No new tests as there is no functional change.
+
+        * platform/network/ResourceHandle.h: Make destructor virtual as 
+        after r50772 ResourceHandle has virtual functions.
+
+        * plugins/mac/PluginPackageMac.cpp: 
+        (WebCore::PluginPackage::fetchInfo): Fix typo WTF is a namespace
+        not a label
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Add l to the format
+        specifier
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add new headers to sources list.
+
+        * GNUmakefile.am:
+
+2009-11-30  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Get context menu to work in QGraphicsView
+        
+        Flash expects the value in record.where to be the global position for
+        displaying the context menu.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31979
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PLATFORM(CHROMIUM) guards around memory usage code in V8GCController.
+        https://bugs.webkit.org/show_bug.cgi?id=31925
+
+        This code uses ChromiumBridge and Chromium-specific constant values not
+        appropriate for other platforms such as Android.
+
+        Build fix only, no new tests.
+
+        * bindings/v8/V8GCController.cpp: Modified. Adds PLATFORM(CHROMIUM) around Chromium-specific code.
+
+2009-11-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix.
+
+        Correct draw signature used in ImageCairoWin.cpp.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        postMessage should serialize File objects
+        https://bugs.webkit.org/show_bug.cgi?id=31955
+
+        Update SerializedScriptValue to include support for
+        File objects in the serialized object graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asString):
+
+2009-11-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Optimize the hierarchy rebuilding of compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31879
+        
+        When updating the compositing layer hierarchy, instead of removing all
+        child layers and then re-adding them one by one, build a vector of child
+        layers, and set them in one go.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setChildren): New method that takes a Vector of child
+        GraphicsLayers.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h: Override setChildren().
+        * platform/graphics/win/GraphicsLayerCACF.h: Ditto.
+        * platform/graphics/mac/GraphicsLayerCA.mm: 
+        (WebCore::GraphicsLayerCA::setChildren): Implement setChildren() to 
+        set the bit that notes that sublayers changed.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::setChildren): Implement setChildren() to 
+        udpate sublayers, with a note that this is not efficient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        When updating compositing layers, use the faster updateLayerTreeGeometry() if
+        we know that no layer hierarchy changes are needed, and, at the root, use
+        the vector returned from rebuildCompositingLayerTree() to attach the root
+        layer.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Changed to
+        collect child layers into Vectors of GraphicsLayers, which can be set as
+        layer children in one go.
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Split out from
+        rebuildCompositingLayerTree() for simplicity, and called when we just need to
+        update layer geometry, without doing any reparenting.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31971
+
+        Updated comment to reflect latest XSSAuditor bindings.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31969
+
+        Removes unnecessary #include files.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed include CachedImage.h, and
+        Pair.h
+        * css/CSSCursorImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSFontFaceSrcValue.cpp: Removed include Node.h
+        * css/CSSFontSelector.cpp: Removed include NodeList.h
+        * css/CSSGradientValue.cpp: Removed include GraphicsContext.h, ImageBuffer.h
+        * css/CSSImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSImportRule.cpp: Removed include MediaList.h
+        * css/CSSMutableStyleDeclaration.cpp: Removed include CSSProperty.h
+        * css/CSSRule.cpp: Removed include CSSStyleSheet.h
+        * css/CSSStyleSelector.cpp: Removed include CSSFontFace.h,
+        CSSFontFaceSource.h, and CSSProperty.h
+        * page/EventSource.h: Removed include EventListener.h
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31965
+
+        Removed #include KeyframeList.h from CSSStyleSelector.h. Instead,
+        forward declared it.
+
+        As a side effect, we need to #include KeyframeList.h in
+        RenderLayerBacking.cpp.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h: Removed #include KeyframeList.h
+        * rendering/RenderLayerBacking.cpp: Added #include KeyframeList.h
+
+2009-11-29  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Continue to search for matching node in the case where multiple nodes
+        have the same id.
+        https://bugs.webkit.org/show_bug.cgi?id=31428
+
+        Test: fast/dom/Element/id-in-node-list-index01.html
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::itemWithName):
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31966
+
+        Removed #include RenderStyle.h from file KeyframeAnimation.h. Instead,
+        forward declared it.
+
+        No functionality was changed. So, no new tests.
+
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix change log entry date.
+
+        For some reason, bugzilla-tool did not update the date in the change
+        log entry for my last commit (r51468). So, this commit fixes the date
+        of that entry.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31964
+
+        Removed #include StringImpl, StyleImage. Instead, forward declared them.
+        Also, we can substitute #include <wtf/PassRefPtr.h> for #include PlatformString.h,
+        since it seems we only really used it to include PassRefPtr.h.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/ContentData.h:
+
+2009-11-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the rendering and storage directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31906
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class SQLTransactionClient      - storage/DatabaseThread.cpp:45
+        class SQLTransactionCoordinator - storage/DatabaseThread.cpp:46
+        class OriginUsageRecord         - storage/OriginQuotaManager.cpp:66
+        class DatabaseTracker           - storage/DatabaseTracker.cpp:62
+        class ScrollbarTheme            - (its child class) rendering/RenderScrollbarTheme.cpp:35
+        class RenderSelectionInfoBase   - (its child class) rendering/RenderView.cpp:310
+        class RenderOverflow            - rendering/RenderBox.cpp:2846
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        struct FillLayer                - css/CSSStyleSelector.cpp:197
+        struct ShadowData               - rendering/style/ShadowData.cpp:35
+        class CounterContent            - css/CSSStyleSelector.cpp:4111
+
+        * platform/ScrollbarTheme.h:
+        * rendering/RenderOverflow.h:
+        * rendering/RenderSelectionInfo.h:
+        * rendering/style/CounterContent.h:
+        * rendering/style/FillLayer.h:
+        * rendering/style/ShadowData.h:
+        * storage/DatabaseTracker.h:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.h:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51428.
+
+        [Chromium] Ignore line-height CSS property for PushButton
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustButtonStyle):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r51413.
+
+        [v8] Do not check the thread when accessing DOMDataStore
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, comment fix.
+
+        Corrected misspelling of the word "implemented".
+
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31940
+
+        Makes the error messages more descriptive when we refuse to load an object/embed or
+        refuse to load from the document base URL.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject): Changed console message to be more descriptive.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Instead of generating negative identifiers for cached resources in
+        InspectorController and extending identifier type from 'unsigned long' to 'long
+        long' reuse progress tracker from the inspected page to generate those
+        identifiers. It guarantees that InspectorResources have unique ids since
+        all of them are generated by that progress tracker.
+
+        Added a couple new overloaded methods to Script* objects that accept
+        long and unsigned long arguments. These types of argumens have already
+        been passed as long long.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31921
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Use inspected page's ProgressTracker to generate unique identifiers for cached resources in InspectorController.
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::createCached):
+        * inspector/InspectorResource.h: Change InspectorResource identifier type from 'long long' to 'unsigned long'.
+        (WebCore::InspectorResource::create):
+        (WebCore::InspectorResource::identifier):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+
+2009-11-26  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Assertion failure in RenderBlock::positionForPointWithInlineChildren when running fast/inline/relative-positioned-overflow.html
+        https://bugs.webkit.org/show_bug.cgi?id=29966
+
+        When an empty inline element is clicked, the root inline box has
+        no leaf children. Use the renderer of a normal child instead.
+
+        This change resolves Windows port's assertion failure in a layout test.
+        Also, this fixes the behavior when a user drags the mouse from an
+        empty inline element to above texts.
+
+        Test: editing/selection/last-empty-inline.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+
+2009-11-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to push buttons on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=button> issue with Chromium/Windows
+        and Chromium/Linux.
+        
+        * rendering/RenderThemeChromiumSkia.cpp: Implement adjustButtonStyle() to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustButtonStyle().
+
+2009-11-26  Kinuko Yasuda  <kinuko@chromium.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove the special charset meta tag in the clipboard so that
+        copy-and-paste with interchange breaklines/spaces works correctly
+        within WebKit.
+
+        No new tests.  Layout tests that involve copy-and-paste with
+        interchange breaklines (like editing/pasteboard/paste-line-endings-00?)
+        should pass on Mac/Chromium with this fix.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-11-26  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Compile with QT_NO_WHEELEVENT defined.
+
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        No new tests as there is no functional change.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: Change the
+          path for GOwnPtr.h.
+        * platform/text/TextEncoding.cpp: Ditto.
+        * platform/text/gtk/TextCodecGtk.cpp: Ditto.
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Not reviewed. Build fix: revert r51421.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h: Remove unused DocumentLoader parameters from inspector methods.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength): Update loading end time when new data are received.
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad): Notify InspectorController about the failure.
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21554
+
+        Implements support for hovering over <img> src to display the height and width of that image
+        in a tooltip. Displays both the displayable and natural dimensions of the image.
+
+        Test: inspector/elements-img-tooltip.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode): Added.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.getPropertiesAsync): Added.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyURLAsNode): Added tooltipText argument.
+        (WebInspector.linkifyURL): Ditto.
+
+2009-11-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after drawPattern API change.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use an internal field instead of hidden property to speedup lookup
+        of entered isolated world.
+
+        Plus some inlinings.
+        https://bugs.webkit.org/show_bug.cgi?id=31884
+
+        Covered by layout tests + manual running of some benchmarks as
+        content scripts.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+        (WebCore::V8IsolatedWorld::getGlobalObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects build break on Windows.
+
+        Rename platform/text/qt/TextBoundaries.cpp to TextBoundariesQt.cpp since
+        platform/text/TextBoundaries.cpp was compiled instead when compiling with nmake.
+
+        * WebCore.pro:
+        * platform/text/qt/TextBoundariesQt.cpp: Renamed from WebCore/platform/text/qt/TextBoundaries.cpp.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not check if the thread is main or not when accessing DOMDataStore as currently in Chromium WebKit is used in main thread only.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Covered by layout tests and buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Pass mouse position relative to the fake window
+        
+        When using off-screen rendering, we need to pass mouse events relative
+        to the fake window instead of the global position.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31794
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use QNetworkReply::rawHeaderPairs
+        https://bugs.webkit.org/show_bug.cgi?id=31826
+
+        The QNetworkReply is internally storing the HTTP headers
+        as a list of pairs. Currently we have to ask the QNetworkReply
+        to put all header names into a QStringList. Afterwards we will
+        iterate over this QStringList and ask the QNetworkReply to
+        give us the value for this header name. The current Qt implementation
+        is doing a linear to find the header value.
+
+        Use a new API to directly access the list of pairs and push
+        this into WebCore. This avoids doing some allocations and doing
+        linear searches from within a loop.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add Qt specific information of RenderPart
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The WebCore::Widget of the RenderPart (RenderWidget) might be
+        backed with a platform widget. Print both the WebCore::Widget
+        and platform widget state. In the above bug we had a problem
+        that the WebCore::Widget was invisible but the QWidget was
+        visible.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Add special case for RenderPart
+
+2009-11-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Call Widget::setSelfVisible from hide/show
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        Call Widget::setSelfVisible from Widget::show and
+        Widget::hide and use isParentVisible to decide
+        if the widget should be shown. This way client
+        code can rely on isVisible.
+
+        Change PluginViewQt::show, PluginViewQt::hide to
+        call the base class as it is doing the right thing
+        now. Add an assert verify that platfomWidget and
+        platformPluginWidget are the same.
+
+        * manual-tests/qt/qtplugin.html: Modify manual test
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix compilation of REQUEST_DEBUG debug code
+        https://bugs.webkit.org/show_bug.cgi?id=31850
+
+        In r47907 the single parameter KURL constructor to parse
+        from a WebCore::String was replaced with a two parameter
+        constructor. I think in this debug case parsing the urls
+        again is no problem and I have changed the code to use the
+        two parameter version.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+
+2009-11-26  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Avoid using JavaScript objects as context data
+        https://bugs.webkit.org/show_bug.cgi?id=31873
+
+        Change the context "data" from a JavaScript object holding the two properties type and value to
+        a string holding type and value separated by a comma.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::setContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Implement canSetValueAttribute in the API, the clean-up part.
+        https://bugs.webkit.org/show_bug.cgi?id=31894
+
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Added RefCounted decl.
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Removed mis-refcountingness.
+
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+
+2009-11-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update SharedScript to use eventNames() instead of EventNames()
+        https://bugs.webkit.org/show_bug.cgi?id=31890
+
+        * SharedScript/WebKitSharedScript.cpp:
+        (WebCore::LoadEventTask::performTask):
+
+2009-11-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, all through to m_qtMovie.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            Make all but the destructor private since MediaPlayer call through the media
+            engine interface.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+            Use handy new constants for QuickTime track types.
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+            New, closed caption support.
+        * platform/graphics/win/QTMovieWin.h:
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+            Deal with closed caption buttons.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::shouldRenderMediaControlPart):
+            New, don't ask the media engine if it has closed captions unless the Safari theme will
+            be able to render the button.
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+            New.
+        * rendering/RenderThemeWin.h:
+
+2009-11-25  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        MessagePorts always look remotely entangled even when closed.
+        https://bugs.webkit.org/show_bug.cgi?id=31698
+
+        Tests: Existing tests suffice, Chromium soak test passes now.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Removed kMessagePortEntangledPortIndex which is no longer used.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        Simplified GC code to reflect the Chromium MessagePort implementation
+        (locallyEntangledPort() always returns false).
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        Cleaned up epilogue code to handle the case where the port gets closed
+        in mid-GC (due to the parent context being freed).
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::close):
+        Now sets the closed flag.
+        (WebCore::MessagePort::disentanglePorts):
+        Updated to use new isCloned() API instead of relying on isEntangled(), which was incorrect.
+        * dom/MessagePort.h:
+        Added a m_closed flag and updated isEntangled() to check it.
+        (WebCore::MessagePort::isEntangled):
+        Now returns false if the port has been closed.
+        (WebCore::MessagePort::isCloned):
+        Added new API to differentiate between cloned and closed ports (closed ports can still be passed to postMessage).
+
+2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
+
+        Fix inline assembly, don't dereference the function pointer twice.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove the Referer header when redirecting to a non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31785
+
+        This makes Qt pass two tests introduced in r50226.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        The select elements do not reflect the actual choice the user makes.
+        https://bugs.webkit.org/show_bug.cgi?id=31831
+
+        Handle the drawing of the listboxes in Android code.
+
+        No new features, just fixing an Android problem. Existing layout tests are sufficient.
+
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::theme):
+        (WebCore::RenderThemeAndroid::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::adjustButtonStyle):
+        (WebCore::RenderThemeAndroid::paintTextArea):
+        (WebCore::RenderThemeAndroid::adjustListboxStyle):
+        * platform/android/RenderThemeAndroid.h:
+
+2009-11-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Load InspectorResource mime type from CachedResource for 304 responses
+
+        For network libraries that do not merge cache data into 304 ResourceResponses,
+        the mime type for cached resources is unknown.
+        https://bugs.webkit.org/show_bug.cgi?id=31868
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::type):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android is missing implementation of SSL Key generator functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31825
+
+        This change adds the PlatformBridge class to platform/android.
+        PlarformBridge is used to access the embedding layer for things
+        such as key generator, cookies, plugins, etc.
+
+        No new tests required, this is platform code.
+
+        * platform/android/PlatformBridge.h: Added.
+        * platform/android/SSLKeyGeneratorAndroid.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+
+2009-11-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] use gst_init_check() instead of gst_init()
+        https://bugs.webkit.org/show_bug.cgi?id=31864
+
+        Use gst_init_check() instead of gst_init() to prevent eventual
+        unexpected exit of the application.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+2009-11-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Some tests are crashing from time to time
+        https://bugs.webkit.org/show_bug.cgi?id=31866
+
+        Make sure we do not notify the client of a finished load, if the
+        load has been cancelled, or the client is gone.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-24  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Upstream Android changes to WebCore/bridge/jni
+        https://bugs.webkit.org/show_bug.cgi?id=31824
+
+        No new tests required as no new functionality.
+
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass): Add calls to delete allocated references, to avoid potential leaks.
+        * bridge/jni/jni_instance.cpp: Add an Android include path.
+        * bridge/jni/jni_instance.h: Add getter/setter for JObjectWrapper::_instance and make the JavaInstance ctor and member variables protected. Both needed for the Android port, see bug for discussion.
+        (JSC::Bindings::JObjectWrapper::instance): Added.
+        (JSC::Bindings::JObjectWrapper::setInstance): Added.
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod): Delete an allocated reference to avoid a potential leak.
+        * bridge/jni/jni_utility.h:
+        (JSC::Bindings::callJNIMethodV): Delete an allocated reference to avoid a potential leak.
+
+2009-11-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the plugins and rendering directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31827
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class PluginRequest             - plugins/PluginView.cpp:521
+        class PluginMainThreadScheduler - plugins/PluginMainThreadScheduler.cpp:34
+        class PluginDatabase            - plugins/PluginDatabase.cpp:50
+        struct MimeClassInfo            - plugins/PluginInfoStore.cpp:50
+        struct PluginInfo               - plugins/PluginInfoStore.cpp:40
+        class RenderArena               - dom/Document.cpp:1401
+        class RenderImageScaleData      - rendering/RenderImage.cpp:149
+        class TableLayout               - (its child class) rendering/RenderTable.cpp:82
+        struct ColumnInfo               - rendering/RenderBlock.cpp:3590
+        struct FloatingObject           - rendering/RenderBlock.cpp:2300
+        struct MaxMargin                - rendering/RenderBlock.cpp:4794
+        class RenderMarquee             - rendering/RenderLayer.cpp:3277
+
+        * plugins/PluginData.h:
+        * plugins/PluginDatabase.h:
+        * plugins/PluginMainThreadScheduler.h:
+        * plugins/PluginView.h:
+        * rendering/RenderArena.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMarquee.h:
+        * rendering/TableLayout.h:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Initial implementation of WebKitSharedScript and SharedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=31569
+
+        No new tests since there are no bindings yet (soon to come).
+
+        * DerivedSources.make: Add WebKitSharedScript and SharedScriptContext to a list of idl files.
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify WebKitSharedScriptRepository that document is detaching.
+        * dom/EventTarget.cpp: Add new casting methods, since the new types are EventTargets.
+        (WebCore::EventTarget::toWebKitSharedScript):
+        (WebCore::EventTarget::toSharedScriptContext):
+        * dom/EventTarget.h: Ditto
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::isSharedScriptContext): New virtual method, since there is a new type of context.
+
+        * SharedScript/SharedScriptContext.cpp: Added. Similar to WorkerContext, but w/o threading.
+        (WebCore::SharedScriptContext::SharedScriptContext):
+        (WebCore::SharedScriptContext::~SharedScriptContext):
+        (WebCore::SharedScriptContext::clearScript):
+        (WebCore::SharedScriptContext::virtualURL):
+        (WebCore::SharedScriptContext::virtualCompleteURL):
+        (WebCore::SharedScriptContext::reportException):
+        (WebCore::SharedScriptContext::addMessage):
+        (WebCore::SharedScriptContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::SharedScriptContext::scriptImported):
+        (WebCore::SharedScriptContext::matches):
+        (WebCore::SharedScriptContext::addToDocumentsList):
+        (WebCore::SharedScriptContext::destructionTimerFired):
+        (WebCore::SharedScriptContext::removeFromDocumentList):
+        (WebCore::SharedScriptContext::load):
+        (WebCore::SharedScriptContext::postTask):
+        (WebCore::SharedScriptContext::eventTargetData):
+        (WebCore::SharedScriptContext::ensureEventTargetData):
+        (WebCore::SharedScriptContext::scriptExecutionContext):
+        * SharedScript/SharedScriptContext.h: Added.
+        (WebCore::SharedScriptContext::create):
+        (WebCore::SharedScriptContext::isSharedScriptContext):
+        (WebCore::SharedScriptContext::userAgent):
+        (WebCore::SharedScriptContext::toSharedScriptContext):
+        (WebCore::SharedScriptContext::self):
+        (WebCore::SharedScriptContext::script):
+        (WebCore::SharedScriptContext::loaded):
+        (WebCore::SharedScriptContext::name):
+        (WebCore::SharedScriptContext::refEventTarget):
+        (WebCore::SharedScriptContext::derefEventTarget):
+        (WebCore::SharedScriptContext::refScriptExecutionContext):
+        (WebCore::SharedScriptContext::derefScriptExecutionContext):
+        * SharedScript/SharedScriptContext.idl: Added.
+
+        * SharedScript/SharedScriptController.h: 
+        Added. Empty implementation of a ScriptController, will come later as part of bindings. Needed to compile.
+
+        * SharedScript/WebKitSharedScript.cpp: Added. EventTarget-based DOM object.
+        (WebCore::WebKitSharedScript::WebKitSharedScript):
+        (WebCore::WebKitSharedScript::~WebKitSharedScript):
+        (WebCore::WebKitSharedScript::setContext):
+        (WebCore::LoadEventTask::create): Fires asynchronous 'load' event when underlying SharedScriptContext is initialized.
+        (WebCore::LoadEventTask::performTask):
+        (WebCore::LoadEventTask::LoadEventTask):
+        (WebCore::WebKitSharedScript::scheduleLoadEvent):
+        * SharedScript/WebKitSharedScript.h: Added.
+        (WebCore::WebKitSharedScript::create):
+        (WebCore::WebKitSharedScript::scriptExecutionContext):
+        (WebCore::WebKitSharedScript::toWebKitSharedScript):
+        (WebCore::WebKitSharedScript::context):
+        (WebCore::WebKitSharedScript::refEventTarget):
+        (WebCore::WebKitSharedScript::derefEventTarget):
+        (WebCore::WebKitSharedScript::eventTargetData):
+        (WebCore::WebKitSharedScript::ensureEventTargetData):
+        * SharedScript/WebKitSharedScript.idl: Added.
+
+        * SharedScript/WebKitSharedScriptRepository.cpp: Added. Implements a list of running SharedScriptContexts.
+        (WebCore::ScriptLoader::ScriptLoader): The helper class to load an initial script of SharedScriptContext.
+        (WebCore::ScriptLoader::load):
+        (WebCore::ScriptLoader::notifyFinished):
+        (WebCore::WebKitSharedScriptRepository::instance): Repository has a static global instance.
+        (WebCore::WebKitSharedScriptRepository::connect):
+        (WebCore::WebKitSharedScriptRepository::documentDetached): Called from Document::detach().
+        (WebCore::WebKitSharedScriptRepository::removeSharedScriptContext): Called from ~SharedScriptContext().
+        (WebCore::WebKitSharedScriptRepository::connectToSharedScript):
+        (WebCore::WebKitSharedScriptRepository::getSharedScriptContext):
+        * SharedScript/WebKitSharedScriptRepository.h: Added.
+        (WebCore::WebKitSharedScriptRepository::WebKitSharedScriptRepository):
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        This part of the checkin adds the Windows specific GraphicsLayer support files.
+        It provides the interface between GraphicsLayer and CACF. It also deals with
+        the compositing loop, and provides the plumbing to pass the root layer up to
+        WebView.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/win/GraphicsLayerCACF.cpp: Added.
+        * platform/graphics/win/GraphicsLayerCACF.h: Added.
+        * platform/graphics/win/WKCACFContextFlusher.cpp: Added.
+        * platform/graphics/win/WKCACFContextFlusher.h: Added.
+        * platform/graphics/win/WKCACFContextFlusherWin.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.h: Added.
+        * platform/graphics/win/WKCACFLayerWindow.cpp: Added.
+        * platform/graphics/win/WKCACFLayerWindow.h: Added.
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Do error checking of parameter to createShader
+        https://bugs.webkit.org/show_bug.cgi?id=31808
+
+        Test: fast/canvas/webgl/invalidPassedParams.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::createShader):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+
+2009-11-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to a search field on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31820
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=search> issue with Chromium/Windows
+        and Chromium/Linux.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldStyle): Implement this to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustSearchFieldStyle().
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Stylistic fix: indent the member var initialisation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31848 - Remove uses of mainThreadCurrentWorld, and of currentWorld using a globalData.
+
+        These methods get the world from the global data rather than from an execstate.
+        If the current world is always read from an exec state then it can be read
+        from the global object, and world entry can become automagical, rather than
+        being explicitly set by an EnterDOMWrapperWorld.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::DOMObjectWrapperMapFor):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapper):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        (WebCore::createWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Also, don't include the wrong one!
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Include the proper WKSI header.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGUseElement::toClipPath can crash
+        <rdar://problem/7385270>
+
+        Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
+        actually initialize it.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Windows build fix.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed. Revert r51351 until a new WebKitSupportLibrary is available.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/CredentialStorage.h:
+        * platform/network/mac/CredentialStorageMac.mm: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        * platform/network/cf/CredentialStorageCFNet.cpp: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        Add support for fetching credentials from persistent storage (CFNet version is currently
+        a stub).
+
+        * bindings/js/JSWebSocketCustom.cpp: Removed an unneeded include.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::getStoredCONNECTProxyCredentials):
+        (WebCore::authenticationSchemeFromAuthenticationMethod):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        Check if connection attempt was resulted in 407, and try stored credentials if it did.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.base.exp:
+        Updated WKSI.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 2: Add a new bit to the PaintBehavior flags, PaintBehaviorFlattenCompositingLayers,
+        and pass that down when painting into an image.
+        
+        When set, it forces painting of compositing layers to go down a software paint path
+        when all layers are painted, irrespective of compositing status, and where
+        3d transforms are flattened to 2d. When doing this, we also need to use temporary
+        clip rects for layers which are normally composited.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::paintBehavior):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::renderableTransform):
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.h:
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 1: Rename PaintRestriction to PaintBehavior, and make it a bitmask, in
+        preparation for adding a new flag related to painting into an image.
+        
+        PaintBehaviorSelectionOnly and PaintBehaviorForceBlackText are now separate flags.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintBehavior):
+        * page/FrameView.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::selectionImage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Renderer hang when using www.expedia.com
+        https://bugs.webkit.org/show_bug.cgi?id=31822
+
+        Test: http/tests/cache/subresource-failover-to-network.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously): Use the originalRequest
+        when inheriting cache policy.  This matches SubresourceLoader::create.
+
+2009-11-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Change get... calls to latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=30091
+
+        Removed old versions of get calls on WebGLRenderingContext and
+        added new ones per spec returning "any". New code simplifies
+        GraphicsContext3D and fixes previously unimplemented routines.
+        Added custom JS and V8 bindings. Added exhaustive test case
+        exercising all new code paths. Updated preexisting test cases for
+        new APIs. Fixed preexisting bugs in WebKit's and Chrome's WebGL
+        implementations.
+
+        Ran WebGL layout tests in WebKit (clean) and Chrome (couple of
+        preexisting known failures) and manual WebGL tests in both
+        browsers.
+
+        Test: fast/canvas/webgl/gl-object-get-calls.html
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameterHelper):
+        (WebCore::JSWebGLRenderingContext::getBufferParameter):
+        (WebCore::JSWebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::JSWebGLRenderingContext::getParameter):
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::JSWebGLRenderingContext::getShaderParameter):
+        (WebCore::JSWebGLRenderingContext::getTexParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::JSWebGLRenderingContext::getVertexAttrib):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameter):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::setObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::create):
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLGetInfo.cpp: Added.
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::~WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getType):
+        (WebCore::WebGLGetInfo::getBool):
+        (WebCore::WebGLGetInfo::getFloat):
+        (WebCore::WebGLGetInfo::getLong):
+        (WebCore::WebGLGetInfo::getString):
+        (WebCore::WebGLGetInfo::getUnsignedLong):
+        (WebCore::WebGLGetInfo::getWebGLBuffer):
+        (WebCore::WebGLGetInfo::getWebGLFloatArray):
+        (WebCore::WebGLGetInfo::getWebGLFramebuffer):
+        (WebCore::WebGLGetInfo::getWebGLIntArray):
+        (WebCore::WebGLGetInfo::getWebGLProgram):
+        (WebCore::WebGLGetInfo::getWebGLRenderbuffer):
+        (WebCore::WebGLGetInfo::getWebGLTexture):
+        (WebCore::WebGLGetInfo::getWebGLUnsignedByteArray):
+        * html/canvas/WebGLGetInfo.h: Added.
+        (WebCore::WebGLGetInfo::):
+        * html/canvas/WebGLRenderbuffer.cpp:
+        (WebCore::WebGLRenderbuffer::create):
+        (WebCore::WebGLRenderbuffer::WebGLRenderbuffer):
+        * html/canvas/WebGLRenderbuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLStateRestorer::WebGLStateRestorer):
+        (WebCore::WebGLStateRestorer::~WebGLStateRestorer):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getString):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::getBooleanParameter):
+        (WebCore::WebGLRenderingContext::getFloatParameter):
+        (WebCore::WebGLRenderingContext::getIntParameter):
+        (WebCore::WebGLRenderingContext::getLongParameter):
+        (WebCore::WebGLRenderingContext::getUnsignedLongParameter):
+        (WebCore::WebGLRenderingContext::getWebGLFloatArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLIntArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLUnsignedByteArrayParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLTexture.cpp:
+        (WebCore::WebGLTexture::create):
+        (WebCore::WebGLTexture::WebGLTexture):
+        * html/canvas/WebGLTexture.h:
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL):
+        (loadShader):
+        (Framerate.prototype.snapshot):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+
+2009-11-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add additional search path for QuickTime SDK.
+
+2009-11-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] GStreamer-CRITICAL's (and other warnings) on <video>
+        https://bugs.webkit.org/show_bug.cgi?id=26354
+
+        Implemented MediaPlayerPrivate::isAvailable by checking the
+        presence of the playbin2 GStreamer element.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-24  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        When building up the pango layout from text boxes, only append a
+        newline char after verifying there are no more boxes on this line.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-11-24  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Keyboard Shortcut to Clear Console Messages
+        https://bugs.webkit.org/show_bug.cgi?id=31780
+
+        All Platforms:  Ctrl+L  = Clear Console Messages
+        Mac Only:       Cmd+K   = Clear Console Messages
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView): create shortcuts
+        (WebInspector.ConsoleView.prototype._promptKeyDown): handle shortcuts
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut.makeKey): convenience conversion of "a-z" character to keyCode
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel): style fixes for keyboard shortcuts
+
+2009-11-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touch inspector controller in order to
+        kick win bot inspector deploy. rs=aroben.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement expandable compartments on timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31796
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype.dispose):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelineRecordGraphRow.prototype.dispose):
+        * inspector/front-end/inspector.css:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/win/IntPointWin.cpp:
+        * platform/graphics/win/IntRectWin.cpp:
+        * platform/graphics/win/IntSizeWin.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+        * platform/win/PlatformMouseEventWin.cpp:
+
+2009-11-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium build fix).
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-11-23  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Prevent ResourceHandleMac's version of ResourceHandle::receivedCredential from stripping
+        identity and certificate information from a WebCore::Credential when receivedCredential
+        needs to modify the credential's persistence.
+
+        Adding a new constructor Credential(const Credential& original, CredentialPersistence)
+        that copies every field from original except for persistence.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):
+        * platform/network/Credential.h:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 2/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Add references from the JSDOMWindowShell and the JSDOMGlobalObject to the world that owns them,
+        so that we can get to the world from the lexical global object of an ExecState.  In the long-term
+        we should switch over to using this approach for all cases we want to get a world from an exec state.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::WebCoreJSClientData::beginningExecution):
+        (WebCore::WebCoreJSClientData::completedExecution):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::world):
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::world):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::initScript):
+
+2009-11-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add range checks to rendering calls in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        I am now tracking the size of the data in each CanvasBuffer object
+        and keeping track of the buffer size of each active vertex attrib.
+        In drawArrays and drawElements I make sure no attempt is made to
+        access elements outside the valid buffer ranges. The test at:
+
+            http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
+
+        no longer crashes.
+
+        I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
+
+        Tests: fast/canvas/webgl/drawArraysOutOfBounds.html
+               fast/canvas/webgl/drawElementssOutOfBounds.html
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::bufferData):
+        (WebCore::JSWebGLRenderingContext::bufferSubData):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::data):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::byteLength):
+        * html/canvas/WebGLBuffer.h:
+        (WebCore::WebGLBuffer::elementArrayBuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        (WebCore::WebGLShader::create):
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
+2009-11-23  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        JSC bindings for HasIndexGetter generates incorrect code (affects
+        MediaList and CSSStyleDeclaration).
+        This cleans up the edge cases for indexing out of range for style and
+        computed style objects to return an empty string according to the spec.
+        MediaList now returns null when indexed out of range.
+        https://bugs.webkit.org/show_bug.cgi?id=31683
+
+        Tests: fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+               fast/dom/CSSStyleDeclaration/css-style-item.html
+               fast/dom/StyleSheet/css-medialist-item.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: If IndexGetterReturnsString then
+                we do not check the length before calling the item function.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::item):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::item):
+        * css/CSSStyleDeclaration.idl:
+
+2009-11-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DocumentMarkers need to be educated about transforms
+        https://bugs.webkit.org/show_bug.cgi?id=31751
+        
+        Find highlight is incorrect with transforms
+        <rdar://problem/6358394>
+
+        Allow callers to specify that Frame::selectionTextRects() takes transforms into account
+        when computing the set of rects that encompass a selection. For transformed elemenets, the
+        selection rect will be the bounding box of the selected content.
+        
+        Fix DocumentMarkers to cache rects in absolute coordinates, rather than painting coordinates.
+        
+        Test: editing/selection/transformed-selection-rects.html
+        
+        * WebCore.base.exp:
+        Frame::selectionTextRects() has a new parameter.
+        
+        * dom/Document.cpp:
+        (WebCore::Document::setRenderedRectForMarker):
+        * dom/Document.h:
+        Pass the marker as a const reference.
+        
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::Range::textQuads):
+        Add a new method, textQuads(), which returns a list of quads, respecting transforms.
+        
+        * page/Frame.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects):
+        Add a new parameter, respectTransforms, and when that is RespectTransforms, use the quad
+        method to get quads for ranges, and then take their bounding boxes.
+
+        * rendering/InlineTextBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        
+        Pass DocumentMarkers as a const references.
+        Convert the argument to setRenderedRectForMarker() into absolute coordinates.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Cairo] support blurred test-shadow
+        [https://bugs.webkit.org/show_bug.cgi?id=31797]
+
+        Support for blurred text-shadows on Cairo. This patch
+        reuses the code of blurred box-shadows, introduced in
+        bug 26102. For a full textshadow support, a filters enabled
+        build is needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change incorrect calls to the constructor "EventNames()" to the correct accessor
+        "eventNames()". This saves ~100 AtomicString lookups each time.
+        https://bugs.webkit.org/show_bug.cgi?id=31811
+
+        * dom/EventNames.h:  Make constructor private to prevent this from happening again.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):  EventNames() --> eventNames()
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity):  EventNames() --> eventNames()
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):  EventNames() --> eventNames()
+        (WebCore::FrameLoader::pageHidden):  EventNames() --> eventNames()
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):  EventNames() --> eventNames()
+
+2009-11-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Chromium Linux: Limit the stroke width and mitre limit.
+
+        Limit the stroke width and mitre limit that we'll pass into Skia to
+        avoid overflowing Skia's uint16_t glyph widths.
+
+        http://code.google.com/p/chromium/issues/detail?id=28250
+        https://bugs.webkit.org/show_bug.cgi?id=31747
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (scalarBound):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31812
+        WebSocket code uses RefPtr::get() where it shouldn't
+
+        No change in funcitonality, just coding style correction.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::close):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        (WebCore::WebSocketChannel::didFail):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): pacExecutionCallbackMainThread
+        is static, so it can't use member variables directly.
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * platform/network/cf/SocketStreamHandle.h: Removed names from some void* arguments, since
+        they didn't carry useful information.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): When we need an http-style URL, we actually
+        always need https.
+        (WebCore::SocketStreamHandle::scheduleStreams): Factored out from constructor, since streams
+        only get scheduled after PAC is fetched and executed asynchronously.
+        (WebCore::SocketStreamHandle::copyPACExecutionDescription): Return a description for event
+        source.
+        (WebCore::MainThreadPACCallbackInfo::MainThreadPACCallbackInfo): Forward callback to main thread.
+        (WebCore::SocketStreamHandle::pacExecutionCallback): Ditto.
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): Ditto. To avoid code duplication,
+        we make the call even on Mac.
+        (WebCore::SocketStreamHandle::executePACFileURL): Make an async call to CFNetworkExecuteProxyAutoConfigurationURL.
+        (WebCore::SocketStreamHandle::removePACRunLoopSource): Once PAC execution is done or aborted,
+        we need to get rid of the event source.
+        (WebCore::SocketStreamHandle::chooseProxy): Use stored m_httpsURL.get.
+        (WebCore::SocketStreamHandle::chooseProxyFromArray): Factored out from chooseProxy - the
+        array may come directly from system configuration, or from PAC.
+        (WebCore::SocketStreamHandle::chooseProxy): Tiger version of this function is now completely
+        separate.
+        (WebCore::SocketStreamHandle::~SocketStreamHandle): Run loop source should be destroyed
+        before we get to the destructor.
+        (WebCore::SocketStreamHandle::platformClose): Destroy the run loop source, if PAC execution
+        is still in progress.
+
+2009-11-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't leak the CGImage we create when drawing a sub image.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-11-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Don't crash when OOM in creating isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=31805
+
+        We need to add some more null checks to avoid crashing.  No new tests
+        because we don't have a good way to test out-of-memory bugs.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the implementation of the filterRes attribute. It
+        helps the SVG developer to set the quality of a filter by
+        giving the width or height of filter.
+        This patch also sets the filter resolution to lower values
+        if a intermediate ImageBuffer size is bigger than the given
+        maximal size.
+        The maximal size is set to 5000x5000 by default. This is a
+        subjectiv decission. Everthing greater than this values gets
+        sensible slower. Values of 10000x10000 crashed on WebKitGtk.
+        For mobil devices a maximum size of 100x100 or 200x200 seems
+        to be reasonable.
+        The important fact on filter resolution is, that the output
+        size is still the size given by the <filter> element.
+
+        Tests: svg/filters/big-sized-filter-2.svg
+               svg/filters/big-sized-filter.svg
+               svg/filters/filterRes.svg
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::createPlatformShadow): Use scaledSubRegion for
+        calculation.
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply): Use scaledSubRegion for effect intern
+        calculations.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/Filter.h: Add the abbility to change the quality
+        of a filter output.
+        (WebCore::Filter::filterResolution):
+        (WebCore::Filter::setFilterResolution):
+        (WebCore::Filter::calculateEffectSubRegion): Calculates the correct subRegion
+        as well as the scaledSubRegion. It also searches for the biggest effect size.
+        We have to change the filter resolution, if one intermediate ImageBuffer size
+        doesn't fit in the maximal image size.
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::calculateDrawingRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::getEffectContext): Use scaledSubRegion to create
+        a new intermediate ImageBuffer for the result of the current effect.
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::scaledSubRegion): The scaled subRegion of a the
+        filter effect.
+        (WebCore::FilterEffect::setScaledSubRegion):
+        (WebCore::FilterEffect::effectBoundaries): The original values of the
+        EffectElement for a second subRegion calculation.
+        (WebCore::FilterEffect::setEffectBoundaries):
+        * platform/graphics/filters/ImageBufferFilter.cpp:
+        (WebCore::ImageBufferFilter::ImageBufferFilter): Set the scale factor to one.
+        * platform/graphics/filters/ImageBufferFilter.h:
+        (WebCore::ImageBufferFilter::maxImageSize):
+        (WebCore::ImageBufferFilter::calculateEffectSubRegion):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::parseMappedAttribute): Parse filterRes attribute.
+        (WebCore::SVGFilterElement::buildFilter): Give SVGResourceFilter the current
+        filterResolution.
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes): Save
+        values to effectBoundaries of the filter effect
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::shouldProcessFilter): Return signal if a neccessary value is zero.
+        (WebCore::SVGResourceFilter::fitsInMaximumImageSize): Checks if the given size
+        fits into the maximal image size, modifys scale factors if not and return a
+        bool: fits.
+        (WebCore::SVGResourceFilter::prepareFilter): Scale the SourceImage to
+        filterResolution (given by FilterElement or calculated on to big image sizes).
+        Set the scale level to SVGFilter.
+        (WebCore::SVGResourceFilter::applyFilter): Don't apply filters if shouldProcessFilter
+        is wrong.
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::setFilterResolution): FilterResolution of FilterElement.
+        (WebCore::SVGResourceFilter::setHasFilterResolution): Does FilterElement provides
+        a FilterResolution?
+        (WebCore::SVGResourceFilter::scaleX): Current scale factor for horizontal.
+        (WebCore::SVGResourceFilter::scaleY): Current scale factor for vertical.
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::calculateEffectSubRegion): Calculate subRegion for LayoutTests,
+        scaledSubRegion according to the current filterResolution and get the maximal image size.
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode): Original values of the FilterElement. 
+        (WebCore::SVGFilter::filterRegion): Use virtual for clarification.
+        (WebCore::SVGFilter::sourceImageRect): Use virtual for clarification.
+        (WebCore::SVGFilter::maxImageSize): Get the maximal image size.
+
+2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
+        the wrapped object died before the gc removed the instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31681
+
+        Before using a cached instance, verify that its wrapped QObject is
+        still alive.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getQtInstance):
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::hashKey):
+
+2009-11-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARIA: support aria-flowto
+        https://bugs.webkit.org/show_bug.cgi?id=31762
+
+        Test: platform/mac/accessibility/aria-flowto.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        (WebCore::AccessibilityObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::linkedUIElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityRenderObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-11-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Build fix for WML enabled builds.
+        Adopt WebCore API changes.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce sidebar background on timeline panel in order
+        to prevent it from flickering on scroll.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31789
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement TimelinePanel to make it fast:
+        - Extract grid and overview into separate files
+        - Make timeline create only divs for visible rows
+
+        https://bugs.webkit.org/show_bug.cgi?id=31784
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        * inspector/front-end/TimelineGrid.js: Added.
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addEventDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js: Added.
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCheckboxClicked):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.setSidebarWidth):
+        (WebInspector.TimelineOverviewPane.prototype.updateMainViewWidth):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewPane.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowDragging):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowLeft):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewCalculator):
+        (WebInspector.TimelineOverviewCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineOverviewCalculator.prototype.reset):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineOverviewCalculator.prototype.formatValue):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable access to file:/// directory listings
+        https://bugs.webkit.org/show_bug.cgi?id=31329
+
+        Deny access to directory listings. This needs doing in WebKit for
+        WebKit clients that do permit top-level navigation to file:///dir.
+        This matches Firefox, plus the existing Safari implementation (which
+        does not support any directory access at all). It will fix the
+        LayoutTest named below for Chromium.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+
+        * page/SecurityOrigin.cpp: Deny access to directory listings.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canRequest):
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Support Ctrl+P and Ctrl+N, Readline keyboard shortcuts in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=31400
+
+        Handle the following when on a Mac:
+
+          Ctrl+P = Previous (like Up arrow)
+          Ctrl+N = Next (like Down arrow)
+
+        No longer rerun autocompletion when just pushing a modifier key
+        like Control, Alt, Shift, or Meta.
+
+        Improved arrow key behavior with Multiline code in the Console, with the following behavior:
+
+          Up   = Previous Command if on First Line (caret moves to the end of the first line)
+                 otherwise default caret movement in text.
+          Down = Next Command if on Last Line (caret naturally moves to the end)
+                 otherwise default caret movement in text.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent): handle new keyboard shortcuts
+        (WebInspector.TextPrompt.prototype.isCaretOnFirstLine): check if the caret is on the top line
+        (WebInspector.TextPrompt.prototype.isCaretOnLastLine): check if the caret is on the bottom line
+        (WebInspector.TextPrompt.prototype._upKeyPressed):
+        (WebInspector.TextPrompt.prototype._downKeyPressed):
+        (WebInspector.TextPrompt.prototype._moveBackInHistory):
+        (WebInspector.TextPrompt.prototype._moveForwardInHistory):
+
+2009-11-21  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a tooltip containing the full url of the resource to each element
+        in the Resources panel so that it is possible to quickly see the query
+        parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=19103
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.refresh):
+        Set the tooltip to be the resource's url.
+
+2009-11-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSKeyframesRule::findRule() and deleteRule() should accept 'from' and 'to' as well as percentages
+        https://bugs.webkit.org/show_bug.cgi?id=31588
+        
+        In WebKitCSSKeyframesRule::findRuleIndex(), map 'from' to 0% an 'to' to 100%
+        so that findRule() and deleteRule() work with these keywords.
+
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
+
+2009-11-21  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31647
+
+        Changed KeyboardEvent::m_keyEvent from a raw pointer to an OwnPtr.
+
+        No functionality was changed. So, no new tests.
+
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::~KeyboardEvent):
+        * dom/KeyboardEvent.h: Changed m_keyEvent to OwnPtr.
+        (WebCore::KeyboardEvent::keyEvent):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for aria-owns
+        https://bugs.webkit.org/show_bug.cgi?id=31702
+
+        Re-organized how accessibilityAttributeNames are returned so 
+        that it's possible for an element to add an attribute based on 
+        a dynamic value. In this case, we only want to add AXOwn if the 
+        element actually supports aria-owns.
+  
+        Test: platform/mac/accessibility/aria-owns.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIAOwns):
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaOwnsElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAOwns):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7414396> Leopard & Tiger: Support closed caption in <video> element
+
+        * css/mediaControls.css:
+            Define closed caption toggle button.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create closed caption toggle button in display order.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't require MediaControllerThemeQuickTime theme for captions toggle button.
+            No need to check if the movie has video, a closed captions track is a video
+            track.
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Running code in the Console that ends with a
+        single line comment no longer produces a parse error.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NPN_ReloadPlugins does not reload the page even if reloadPages is true.
+        https://bugs.webkit.org/show_bug.cgi?id=30460
+
+        Replace call to PluginDatabase::installedPlugins()->refresh() with Page::refreshPlugins().
+        It already refreshes plugins and reloads pages when necessary.
+
+        Tests: plugins/reloadplugins-and-pages.html
+               plugins/reloadplugins-no-pages.html
+
+        * plugins/PluginInfoStore.cpp:
+        (WebCore::refreshPlugins):
+
+2009-11-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://7409188> WebKit needs to be able to serialize and deserialize objects.
+
+        Expose WebCore object serialization to WebKit.
+
+        * WebCore.base.exp:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31741>.
+        Web Inspector: User Entered Data on the console should show up no matter what filters.
+        
+        Always show .console-user-command-result, no matter what the filter say
+        we should do with the other classes.
+
+        * inspector/front-end/inspector.css:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31700>.
+        Web Inspector: isMac should be in one central location + Cached.
+        
+        We should cache the value of isMac, and make the indexOf call in one
+        single location, because we are calling it from multiple places, and saving
+        the result can save us time, and make the call sites simpler.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.isMac):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Removed .DS_Store accidentally added in last (r51245).
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add Console Only Layout Mode
+        https://bugs.webkit.org/show_bug.cgi?id=30282
+
+        Adds a Console Panel, which allows for a Full size Console. This
+        extends the Drawer to the size of a Panel. This also fixes previous
+        resize issues with the Drawer.
+
+        * inspector/front-end/ConsolePanel.js: added.
+        (WebInspector.ConsolePanel):
+        (WebInspector.ConsolePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ConsolePanel.prototype.show):
+        (WebInspector.ConsolePanel.prototype.hide):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.get savedHeight): access the saved height of the variable console.
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize): resize appropriately if full/non-full
+        (WebInspector.Drawer.prototype.enterPanelMode):
+        (WebInspector.Drawer.prototype.exitPanelMode):
+        (WebInspector.Drawer.prototype.immediatelyExitPanelMode):
+        (WebInspector.Drawer.prototype._cancelAnimationIfNeeded):
+        (WebInspector.Drawer.prototype._animateDrawerHeight.animationFinished):
+        (WebInspector.Drawer.prototype._animateDrawerHeight):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+        Miscellaneous changes and cleanup.
+
+        * English.lproj/localizedStrings.js: "Console" toolbar title.
+        * inspector/front-end/ConsoleView.js: removed unnecessary element reordering  
+        * inspector/front-end/Images/consoleIcon.png: added.
+        * inspector/front-end/inspector.css: added icon.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): create console panel
+        (WebInspector.windowResize): resize drawer if necessary
+        (WebInspector.documentKeyDown): esc should not toggle the console when in panel mode
+        (WebInspector.animateStyle): start animation interval, returns the interval key
+        (WebInspector.toggleAttach): resize drawer if necessary
+        (WebInspector.showConsolePanel): restore the panel when the inspector restarts
+        (WebInspector.showProfileForURL): style fix
+
+        Restore the panel when the inspector restarts.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+        Build files.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31699>.
+        Web Inspector: Should Cache Values of InspectorController.platform() and port().
+
+        Refactor the Inspector to cache the value of InspectorController.platform
+        and InspectorController.port, because those need to call into C++, they are
+        being called more and more as we add platform specific keyboard shortcuts, and
+        they shouldn't change in the lifecycle of the Web Inspector.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.get platform):
+        (WebInspector.get port):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.toolbarDragStart):
+
+2009-11-20  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build fix for filters enabled builds.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7389945> QTKit based media engine should not claim to support 
+        fullscreen on Leopard
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+            Only return true on SnowLeopard for now.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            No need to special case MediaFullscreenButtonPart as the default implementation 
+            asks the media engine if it supports fullscreen.
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Patch by Yongjun Zhang <yongjun.zhang@nokia.com> and
+                 Girish Ramakrishnan <girish@forwardbias.in>
+        
+        [Qt] Implement support for rendering plugins on Qt/Mac when a page is used
+        without a QWebView or when inside QGraphicsWebView.
+        
+        Currently, the code provides the cgcontext of the PlatformPluginWidget to
+        the plugin. This approach does not work when we are printing, or using
+        QWebFrame::render() to render to a QImage/QPixmap since the plugin ends
+        up drawing on the QWebView (i.e platformPluginWidget's cgcontext) instead
+        of the QPaintDevice's context.
+        
+        To solve all cases and keep the code simple, we render the plugin to an
+        offscreen pixmap in all cases. This way, the plugin always renders to the
+        CGContext of the pixmap and we then use QPainter to blit the pixmap into
+        the QPaintDevice. We also create a fake window and set it's WindowRef in
+        NPWindow. Only with this WindowRef does Flash paint correctly to the QPixmap.
+        
+        Now, that's the theory. In practice, ATM, mouse events do not work when using
+        the fake window. So, setPlatformPluginWidget() is still called when using QWebView
+        so that there are no regressions after this patch. Once we get mouse events
+        working, setPlatformPluginWidget will be removed.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31183
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Resync Resources Backend and Frontend
+        https://bugs.webkit.org/show_bug.cgi?id=31705
+
+        * inspector/front-end/Resource.js: resync enum values with backend
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType): return false if all else fails, not true in all cases
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        Build change only. No new tests possible.
+
+        * config.h: Modified. Added Android-specific configuration.
+
+2009-11-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change default stylesheet to reset text indentation for ruby elements by default.
+        (https://bugs.webkit.org/show_bug.cgi?id=31247)
+
+        Test: fast/ruby/ruby-text-indent.html
+
+        * css/html.css: reset text-indent on <ruby> and <rt> elements
+
+2009-11-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/22754>.
+        Web Inspector: Keyboard shortcut for Element finder.
+
+        Use Command + Shift + C as a shortcut for Node Search, to 
+        match the Firebug shortcut to do the same thing.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Added LoaderRunLoopCF.
+
+        * platform/network/ResourceHandle.h: Removed loaderRunLoop().
+
+        * platform/network/cf/LoaderRunLoopCF.cpp: Added.
+        (WebCore::emptyPerform):
+        (WebCore::runLoaderThread):
+        (WebCore::loaderRunLoop):
+        * platform/network/cf/LoaderRunLoopCF.h: Added.
+        Moved the run loop that we use for CFNetwork from ResourceHandle to its own file, because
+        it's needed for more than just resource loading.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Use loaderRunLoop() from its new location.
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::DNSResolveQueue::resolve): Ditto.
+
+        * platform/network/cf/SocketStreamHandle.h: Added static callbacks for forwarding events to
+        main thread.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Use loaderRunLoop() on Windows instead of
+        inoperable main run loop.
+
+        (WebCore::MainThreadEventCallbackInfo::MainThreadEventCallbackInfo): 
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::readStreamCallbackMainThread):
+        (WebCore::SocketStreamHandle::writeStreamCallbackMainThread):
+        Forward stream events to main thread on Windows.
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Quick style fix.
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+      
+       Build fix. No review needed.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
+        * platform/graphics/qt/StillImageQt.h:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31321 Make -webkit-
+        color-correction work with untagged images
+
+        Image's draw(), drawPattern(), and fillWithSolidColor() functions 
+        now take a ColorSpace. A bunch of classes inherit from Image, so 
+        draw() and drawPattern() functions there must also take a 
+        ColorSpace.
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::draw):
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::draw):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+
+        All of the drawImage() functions and drawTiled() functions of 
+        GraphicsContext now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+
+        This is where the actual work is done.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::imageWithColorSpace): New static function that returns a 
+        copy of the given image in the given ColorSpace *IF* we should use 
+        the given ColorSpace. We will ignore the color space if the image 
+        is tagged and return 0. 
+        (WebCore::BitmapImage::draw): Now takes a ColorSpace and uses it to 
+        call imageWithColorSpace(). 
+        (WebCore::Image::drawPattern): Same.
+
+        Attempt to keep all ports building. 
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+        Callers of GraphicsContext's drawImage() and drawTiled() functions 
+        now need to send a ColorSpace.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Properly create a CGImageRef on non-PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::sharedBufferGetBytesAtPosition):
+        (WebCore::sharedBufferRelease):
+        (WebCore::ImageSource::setData):
+        * platform/graphics/cg/ImageSourceCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        -webkit-user-drag: element Drag images include overflow decorations from incorrect nodes
+        https://bugs.webkit.org/show_bug.cgi?id=31656
+
+        Make sure we're a child of the painting root before drawing overflow features.
+
+        * manual-tests/user-drag-with-decorations.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Chromium build.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Add new enum values for Show/HideClosedCaptionButton to make it compile.
+
+2009-11-19  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Do not assert when a high number is used for roman numerals in lists.
+        https://bugs.webkit.org/show_bug.cgi?id=31652
+
+        Test: fast/lists/ol-start-roman.html
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toRoman): Increase the char array size.
+
+2009-11-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Add translatable strings to cover validationMessage, after
+        r51172. Already covered by existing test.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        WebCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        No new tests as there is no functional change.
+
+        * html/HTMLInputElement.cpp: Remove include directive
+        for float.h as it is included in MathExtras.h already.
+
+2009-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Instrumentation should account for painting in compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31674
+
+        Add calls to InspectorTimelineAgent for painting into compositing layers,
+        which is not accounted for in FrameView::paintContents().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Avoid fetching the FrameView multiple times.
+        
+        (WebCore::inspectorTimelineAgent):
+        (WebCore::RenderLayerBacking::paintContents):
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        Test: media/media-captions.html
+
+        * WebCore.base.exp:
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+            Define ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+            Define and match mediaControlsToggleClosedCaptionsButton.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+            Define and match PseudoMediaControlsToggleClosedCaptions.
+
+        * css/CSSValueKeywords.in:
+            Define and use media-toggle-closed-captions-button.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQuickTime.css:
+            Add webkit-media-controls-toggle-closed-captions-button.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): 
+            Initialize m_closedCaptionsVisible.
+        (WebCore::HTMLMediaElement::loadInternal): 
+            Set m_closedCaptionsVisible to false.
+        (WebCore::HTMLMediaElement::hasClosedCaptions): 
+        (WebCore::HTMLMediaElement::closedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): 
+            New, captions internal methods.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitHasClosedCaptions): 
+            New, captions DOM API.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for captions API.
+
+        * platform/ThemeTypes.h:
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+            Add empty implmentations.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::NullMediaPlayerPrivate::setClosedCaptionsVisible):
+            New, empty implementations of media engine closed caption functions.
+        (WebCore::MediaPlayer::hasClosedCaptions):
+        (WebCore::MediaPlayer::setClosedCaptionsVisible):
+            New, call media engine closed caption functions.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivateInterface::setClosedCaptionsVisible):
+            Declare new media engine methods.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, QTKit implementation of closed caption methods.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+            Add help text for ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Declare and initialize wkQTMovieHasClosedCaptions and wkQTMovieSetShowClosedCaptions.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Deal with MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::updateDisplayType):
+            New, implement the closed caption toggle button,
+
+        * rendering/MediaControlElements.h:
+            Define MediaShowClosedCaptionsButton and MediaHideClosedCaptionsButton,
+            declare MediaControlToggleClosedCaptionsButtonElement.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        (WebCore::RenderMedia::createToggleClosedCaptionsButton):
+        (WebCore::RenderMedia::createStatusDisplay):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::forwardEvent):
+        * rendering/RenderMedia.h:
+            Deal with m_toggleClosedCaptionsButton.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint):
+            Deal with MediaToggleClosedCaptionsButtonPart.
+
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+            Declare paintMediaToggleClosedCaptionsButton.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaToggleClosedCaptionsButton):
+            New.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't render captions toggle button unless we are using the new theme, the
+            movie has captions, and the movie is in a <video> element since we currently
+            rely on QTKit to render the captions.
+
+        * rendering/style/RenderStyleConstants.h:
+            Define MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+
+2009-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing header.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31634
+        Ignore realm for proxy protection spaces
+
+        Only affects WebSocket proxy authentication, cannot be tested in DRT.
+
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::operator==):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+
+2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Normalize signal and slot signatures.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2009-11-19  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Store cookie domains in the WebInspector object
+
+        The cookie domains have been moved from StoragePanel into WebInspector.
+        Also, the document URLs are now passed inside the WebInspector.addResource()
+        payload rather than pushed directly from InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=31627
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.addCookieDomain):
+        (WebInspector.reset):
+
+2009-11-19  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the other part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31585
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class RegularExpression    - instantiated at: WebCore/page/Frame.cpp:415
+        class TransformationMatrix - instantiated at: WebCore/rendering/TransformState.cpp:62
+        class Path                 - instantiated at: WebCore/html/HTMLAreaElement.cpp:73
+        class FontPlatformData     - instantiated at: WebCore/platform/graphics/qt/FontCacheQt.cpp:188
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class Cursors                         - instantiated at: WebCore/platform/qt/CursorQt.cpp:146
+        class NetworkStateNotifier            - instantiated at: WebCore/platform/network/NetworkStateNotifier.cpp:37
+        struct CrossThreadResourceRequestData - instantiated at: WebCore/platform/network/ResourceRequestBase.cpp:71
+
+        class ImageDecoder - its child class is instantiated at: WebCore/platform/graphics/qt/ImageDecoderQt.cpp:46
+        class MediaPlayerPrivateInterface - its child class is instantiated at: WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:119
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/qt/CursorQt.cpp:
+        * platform/text/RegularExpression.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51172.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed <rdar://problem/7398987> Assertion failure in
+        RenderLayer::updateClipRects when a plug-in’s enclosing layer is
+        enclosed by a transformed layer
+
+        Tests: fast/layers/clip-rects-transformed-2.html
+               fast/layers/clip-rects-transformed.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot): Added. Finds the nearest ancestor
+        that is either transformed or composited. During painting and hit
+        testing, when a transformed or composited layer is hit, it becomes the
+        new root layer, which ultimately gets passed to calculateRects().
+        (WebCore::RenderLayer::childrenClipRect): Pass the clipping root as the
+        root layer to calculateRects(), and return the bounding box of the
+        transformed rectangle.
+        (WebCore::RenderLayer::selfClipRect): Ditto.
+        * rendering/RenderLayer.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        No new tests as there is no change if compiled with 
+        Qt v4.4 or later version.
+
+        * WebCore.pro:
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::EntityResolver::resolveUndeclaredEntity):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::startDocument):
+        (WebCore::XMLTokenizer::parseDtd):
+        * platform/graphics/qt/FontQt.cpp:
+        * platform/graphics/qt/FontQt43.cpp: Removed.
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::clearData):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        (WebCore::PluginData::initPlugins):
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        Test: fast/forms/validationMessage.html
+
+        * html/HTMLButtonElement.idl: validationMessage attribute
+        * html/HTMLFieldSetElement.idl: validationMessage attribute
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.idl: validationMessage attribute
+        * html/HTMLSelectElement.idl: validationMessage attribute
+        * html/HTMLTextAreaElement.idl: validationMessage attribute
+        * html/ValidityState.cpp: new method to retrieve pertinent localized text
+        * html/ValidityState.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        * platform/mac/LocalizedStringsMac.mm:
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Fix a typo. Remove the trailing semicolon
+        from an include directive after r51137.
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51159.
+
+        Include float.h for DBL_MANT_DIG. Not sure why this
+        is not a problem for other ports.
+
+        * html/HTMLInputElement.cpp:
+
+2009-11-19  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 31574 -  Crashing bug when removing <ruby> element
+        (https://bugs.webkit.org/show_bug.cgi?id=31574)
+
+        Cause of the bug:
+        1.) RenderBlock::destroy() of the RenderRubyRun called destroyLeftoverChildren()
+        2.) that called destroy() of the RenderRubyBase(), which in RenderObject::destroy() calls remove()
+        3.) remove() is being redirected as parent()->removeChild() in RenderObject.h
+        4.) this triggers the special handling of child removal in RenderRubyRun that
+            causes it to destroy itself
+        5.) On returning from all this the renderer crashes when accessing a member
+            or virtual function on this now illegal object.
+
+        I therefore added a flag that tracks if the ruby run is being destroyed.
+        If so, avoid doing the special handling in removeChild that caused this.
+        It's not the most elegant solution, but the easiest to implement without
+        touching unrelated code. Also, it's self-documenting.
+
+        Test: fast/ruby/ruby-remove.html
+
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::destroy):
+        (WebCore::RenderRubyRun::removeChild):
+        * rendering/RenderRubyRun.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        No new tests as there is no functional change.
+
+        * WebCore.pro:
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBoundaries for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBoundariesWince.cpp: Added.
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBreakIterator for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBreakIteratorWince.cpp: Added.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for ValidityState.typeMismatch for the following INPUT types:
+          date datetime datetime-local month time week
+        https://bugs.webkit.org/show_bug.cgi?id=31342
+
+        Tests: fast/forms/ValidityState-typeMismatch-date.html
+               fast/forms/ValidityState-typeMismatch-datetime.html
+               fast/forms/ValidityState-typeMismatch-datetimelocal.html
+               fast/forms/ValidityState-typeMismatch-month.html
+               fast/forms/ValidityState-typeMismatch-time.html
+               fast/forms/ValidityState-typeMismatch-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToISODateTime): Check the type
+          validity of the specified type and string using the ISODateTime class.
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): Check the type validity
+          for date, datetime, datetime-local, month, time and week with
+          HTMLInputElemtn::formStringToISODateTime()
+
+2009-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix REGRESSION (r47022): Performance of DocumentFragment.appendChild is 1000x slower sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=31237
+        
+        Also speeds up Dromaeo DOM Core tests by 1.31x.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Change marking algorithm to avoid O(N^2) behavior. The subtree
+        mark bit was no longer effective; instead I changed things so only a node that has no ancestors
+        with wrappers would do marking; there should be only one in the typical case (the root of the
+        detached subtree).
+        * dom/Node.cpp:
+        (WebCore::Node::Node): Remove now useless m_inSubtreeMark bit and related functions.
+        * dom/Node.h: ditto
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get rid of the redundant strokeType and fillType data members on
+        a GraphicsContext as well as the FillOrStrokeType enum. Use
+        null pointers instead.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor): Null out the pattern
+        and gradient.
+        (WebCore::GraphicsContext::setFillColor): Ditto.
+        (WebCore::GraphicsContext::setStrokePattern): Null out the graident.
+        (WebCore::GraphicsContext::setFillPattern): Ditto.
+        (WebCore::GraphicsContext::setStrokeGradient): Null out the pattern.
+        (WebCore::GraphicsContext::setFillGradient): Ditto.
+
+        * platform/graphics/GraphicsContextPrivate.h: Remove all that stuff.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::setPlatformStroke): Ditto.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern): Removed unneeded get.
+        (WebCore::GraphicsContext::applyFillPattern): Ditto.
+        (WebCore::calculateDrawingMode): Use fillPattern and strokePattern
+        to see if there is a pattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::drawPath): Use fillGradient, strokeGradient,
+        fillPattern, and strokePattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::fillPath): Added FIXME about color space that
+        is used in the pattern and gradient case probably erroneously. Moved
+        gradient code inside an if statement. Streamlined pattern code and
+        use an if statement. No switch any more.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath): Removed unneeded check of fillType.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Support for step attribute and ValidityStae.stepMismatch for
+        type=number and range.  stepMismatch will be false if the
+        difference between the current value and a multiple of the step
+        value is very small.
+
+        Change the behavior of RenderSlider so that it always has a value
+        rounded to the step attribute value.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31331
+
+        Tests: fast/forms/ValidityState-stepMismatch-number.html
+               fast/forms/ValidityState-stepMismatch-range.html
+               fast/forms/ValidityState-stepMismatch-unsupported.html
+               fast/forms/input-step.html
+
+        * html/HTMLAttributeNames.in: Add "step".
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Add "step".
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::stepMismatch): Forward to HTMLInputElement::stepMismatch().
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::clampValue):
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ASSERT(isMainThread()) in ThreadShared methods.
+        https://bugs.webkit.org/show_bug.cgi?id=31637
+
+        Added ASSERT(IsMainThread()) to all following methods:
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared):
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::ref):
+        (WebCore::TreeShared::deref):
+        (WebCore::TreeShared::setParent):
+        (WebCore::TreeShared::parent):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        Add plugin visibility manual test
+
+        https://bugs.webkit.org/show_bug.cgi?id=31542
+
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+
+2009-11-18  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector - remember last script displayed in Scripts panel
+        https://bugs.webkit.org/show_bug.cgi?id=27552
+
+        Manual test added
+        
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.showScript):
+        (WebInspector.ScriptsPanel.prototype.showResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.ScriptsPanel.prototype._goBack):
+        (WebInspector.ScriptsPanel.prototype._goForward):
+        * manual-tests/inspector/remember-last-script.html: Added.
+
+2009-11-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Create bounded transparency layers instead of just clipping.
+
+        No new tests because this is just a performance improvement.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * WebCore.qrc:
+        * platform/graphics/qt/ImageQt.cpp:
+        (loadResourcePixmap):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt build without JavaScript debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31575
+
+        * page/Console.idl:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24971
+        And
+        <rdar://problem/7138265>
+
+        Fixes an issue where setting the height of a table row programmatically
+        (via JavaScript) causes the table to be improperly rendered because the
+        height of each row in the table is not recalculated with respect to the
+        CSS height property.
+
+        In particular, programmatically setting the height of some table row causes
+        the rows of that table to be rendered with a height equal to the minimum
+        height required by the cells in that row, regardless of any specified cell
+        heights. Instead, when RenderTableSection::recalcCells is called, the height
+        of each row should be set to the CSS height property just as we do in
+        RenderTableSection::addChild.
+
+        Test: fast/table/row-height-recalc2.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowHeightToRowStyleHeightIfNotRelative): Added.
+        (WebCore::RenderTableSection::addChild): Moved code that set row height into
+        method WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+        (WebCore::RenderTableSection::recalcCells): Modified to call
+        WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+
+2009-11-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31473
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class  AnimationList         - instantiated at WebCore/rendering/style/StyleRareNonInheritedData.cpp:85
+        class  Color                 - instantiated at WebCore/rendering/RenderTheme.cpp:48
+        struct Length                - instantiated at WebCore/platform/Length.cpp:103
+        class  PlatformKeyboardEvent - instantiated at WebCore/dom/KeyboardEvent.cpp:63
+        class  ContextMenuItem       - instantiated at WebCore/platform/ContextMenu.cpp:70
+        class  DeprecatedPtrList     - instantiated at WebCore/rendering/RenderBlock.cpp:2284
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class  GraphicsContextPrivate - instantiated at WebCore/platform/graphics/GraphicsContext.cpp:78
+        class  FontCache              - instantiated at WebCore/platform/graphics/qt/FontCacheQt.cpp:43
+        struct MediaPlayerFactory     - instantiated at WebCore/platform/graphics/MediaPlayer.cpp:163
+        class  DeprecatedPtrListNode  - instantiated at WebCore/platform/DeprecatedPtrListImpl.cpp:53
+
+        * platform/ContextMenuItem.h:
+        * platform/DeprecatedPtrList.h:
+        * platform/DeprecatedPtrListImpl.cpp:
+        * platform/Length.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/animation/AnimationList.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/MediaPlayer.cpp:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-18  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove V8CanvasPixelArrayCustom.cpp because it is no longer used by V8.
+        https://bugs.webkit.org/show_bug.cgi?id=31499
+
+        No new tests, just a build cleanup.
+
+        * WebCore.gypi:
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+        * wscript:
+
+2009-11-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Add shared timer and sound utilities to platform/android
+        https://bugs.webkit.org/show_bug.cgi?id=31584
+
+        No new tests required, this is platform specific code.
+
+        * platform/android/SharedTimerAndroid.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/android/SoundAndroid.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix profile tree nodes loss after focus / restore actions.
+
+        Focusing on a node is currently implemented via nodes reattaching
+        with some caching involved. It seems that not all code was updated
+        to handle this scenario correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31553
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._restore):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._willHaveChildren):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGridNode.prototype._detach):
+        (WebInspector.DataGridNode.prototype.savePosition):
+        (WebInspector.DataGridNode.prototype.restorePosition):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.restore):
+
+2009-11-18  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPageClient.h needs in some cases QCursor, but it does not
+        include it 
+        https://bugs.webkit.org/show_bug.cgi?id=31527
+
+        No new tests as this is just a coding style fix that affects the 
+        build of some not yet submitted patches (i.e. for bug 30173).
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Nicolas Roard   <nicolas@roard.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        InspectorTimelineAgent.h should be guarded by ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=31504
+
+        * inspector/InspectorTimelineAgent.h:Added the guard.
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Build fix to my previous checkin, for Windows Chromium
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::PropertySynchronizer::synchronize): Fix implicit-conversion error on AtomicString.
+
+2009-11-18  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Directly Access <head> Instead of Searching for It
+        https://bugs.webkit.org/show_bug.cgi?id=31641
+        
+        Changed old access of the head element (document.getElementsByTagName)
+        to just use the document.head accessor.
+
+        * inspector/front-end/FontView.js:
+        (WebInspector.FontView):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (windowLoaded):
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix two Geolocation assertions.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame): No need to use PageGroupLoadDeferrer since this
+        is not called from JS. 
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Watchers::set): The PassRefPtr was getting nulled out, so we need to put it in
+        a RefPtr first.
+
+2009-11-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Case sensitive file system build fix.
+
+        * platform/network/Credential.h: It's not WTF, just wtf.
+
+2009-11-18  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for certificates to WebCore::Credential so we can convert between NSURLCredential
+        objects and WebCore::Credential objects without losing certificate information.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):  Adding a constructor that takes an identity argument and a certificate chain argument
+        (WebCore::Credential::isEmpty):  Modifying isEmpty to support certificate based credentials (which don't have a username or password)
+        (WebCore::Credential::identity): Accessor for the m_identity property
+        (WebCore::Credential::certificates): Accessor for the m_certificates property
+        (WebCore::Credential::type):  Accessor for the m_type property
+        (WebCore::operator==):  Modifying == to compare the identity and certificate chains of certificate based credentials.
+        * platform/network/Credential.h:  Adding new fields to WebCore::Credential to support certificate based credentials.
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):  Modifying the mac() conversion method to correctly convert certificate based WebCore::Credential objects.
+        (WebCore::core):  Modifying the core() conversion method to correctly convert certificate based NSURLCredential objects.
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Reverting r50919 that has introduced a non-thread-safe refcounting in ScriptExecutionContext::postTaskToMainThread.
+        https://bugs.webkit.org/show_bug.cgi?id=31615
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate unnecessary String-->AtomicString conversions from generated V8 bindings,
+        by causing the right v8-to-WebCore conversion function to be called for every parameter.
+        This no longer requires any IDL metadata, so I've removed the [HintAtomic] annotations.
+        To enforce correctness, I added a mode that disables implicit
+        String-->AtomicString conversions while compiling the generated bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31168
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Generate usage of V8Parameter class.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Enable NO_IMPLICIT_ATOMICSTRING.
+        * bindings/v8/V8Binding.h:  Add V8Parameter class.
+        * css/WebKitCSSKeyframesRule.h:  Make AtomicString conversions explicit.
+        * dom/Document.idl:  Remove obsolete [HintAtomic] annotation.
+        * platform/text/AtomicString.h:  Added NO_IMPLICIT_ATOMICSTRING option.
+        * svg/SVGAnimatedTemplate.h:  Change some return types to String to avoid implicit conversion.
+        * svg/SVGAnimatedProperty.h: Adapt to changed return types in SVGAnimatedTemplate.
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move FillOrStrokeType out of public header.
+
+        * platform/graphics/GraphicsContext.h: Updated copyright date to cover
+        some years we published Apple changes, sorted forward declarations,
+        removed FillOrStrokeType enum.
+        * platform/graphics/GraphicsContextPrivate.h: Updated copyright date
+        to cover some years we published Apple changes, sorted includes,
+        moved FillOrStrokeType enum here.
+
+2009-11-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add Settings for WebKitShowDebugBorders and WebKitShowRepaintCounter
+        https://bugs.webkit.org/show_bug.cgi?id=31601
+
+        These are used to debug accelerated compositing layers. I removed
+        the platform specific code from GraphicsLayerCA.mm and added calls
+        to GraphicsLayerClient to get it from the higher levels. The values 
+        now get cached in RenderLayerCompositing and are queried from there
+        by RenderLayerBacking (which implements the GraphicsLayerClient interface).
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * page/Settings.h:
+        (WebCore::Settings::showDebugBorders):
+        (WebCore::Settings::showRepaintCounter):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::showDebugBorders):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::showDebugBorders):
+        (WebCore::RenderLayerBacking::showRepaintCounter):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::showDebugBorders):
+        (WebCore::RenderLayerCompositor::showRepaintCounter):
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of metrics and properties sidebars'
+        flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31629
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+
+2009-11-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31606>.
+        Web Inspector: Enter/Return key should enter edit mode for Editable Fields.
+        
+        This implements Enter starting editing mode in an editable DataGrid. If the
+        DataGrid is editable and the user hits return, startEditing the first child
+        of the selected node. Also refactored some editing functions to take an 
+        event target instead of the event itself, because the functions only needed
+        the target. Lastly, added had return in editing mode stop propogation, because
+        when enter was hit to confirm text, it would propagate back to the datagrid
+        and try to start editing again.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._ondblclick):
+        (WebInspector.DataGrid.prototype._startEditing):
+        (WebInspector.DataGrid.prototype.handleKeyEvent):
+        (WebInspector.DataGrid.prototype.dataGridNodeFromEvent):
+        (WebInspector.DataGrid.prototype._mouseDownInDataTable):
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+
+2009-11-18  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        HTMLAnchorElement is inconsistent with its internal handling of the value returned for the href attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=31593
+
+        Test: fast/dom/HTMLAnchorElement/set-href-attribute-whitespace.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::href): Add call to deprecatedParseURL.
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Touch InspectorController so that frontend
+        JS files are deployed on Windows.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clone timeline records array instead of
+        copying reference on invalidate all.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31596
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+
+2009-11-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements don't drop out of compositing layers when animation ends
+        https://bugs.webkit.org/show_bug.cgi?id=31613
+        <rdar://problem/7402913>
+
+        Avoid setting the mustOverlapCompositedLayers flag on RenderLayers which
+        are compositing anyway for other reasons. Doing so can cause those layers
+        to stay in compositing mode even after animations finish, because needsToBeComposited()
+        continues to return true.
+        
+        No new tests because it's not possible to determine which elements are in
+        compositing layers from DRT output.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Mac Plugins: Remove null timer
+        
+        A null timer was used to send mouse move events. Instead, we now use
+        move events to send nullEvent. This brings down CPU usage by 20-30%.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31624
+
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] WebKit crashes when loading certain SVG images
+
+        Check if the familly exist before creating the PlatformData from it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Test: svg/text/text-font-invalid.html
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-11-17  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix crash in Chromium/Mac where dropdowns weren't dismissed correctly
+        after navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=31609
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal): Set parent for external
+        dropdowns, so that |PopupListBox::hidePopup()| can successfully notify
+        its parent's client.
+
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        Test: fast/parser/block-nesting-cap-table.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::tagPriorityOfNode):
+        (WebCore::HTMLParser::limitBlockDepth):
+        (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth):
+        (WebCore::HTMLParser::insertNode):
+        * html/HTMLParser.h:
+
+2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Final clean-ups for minor coding standard violations.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+
+2009-11-17  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        In all valid script tags for JavaScript, the event handler in <script...for> should not get executed.
+        https://bugs.webkit.org/show_bug.cgi?id=31567
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * WebCore.Inspector.exp:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+
+2009-11-17  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android is missing the implementation of the GeolocationService iface.
+        https://bugs.webkit.org/show_bug.cgi?id=31554
+
+        No new tests required as this is platform specific code.
+
+        * platform/android/GeolocationServiceAndroid.cpp: Added.
+        (WebCore::GeolocationServiceAndroid::create):
+        (WebCore::GeolocationServiceAndroid::GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::startUpdating):
+        (WebCore::GeolocationServiceAndroid::stopUpdating):
+        (WebCore::GeolocationServiceAndroid::suspend):
+        (WebCore::GeolocationServiceAndroid::resume):
+        (WebCore::GeolocationServiceAndroid::newPositionAvailable):
+        (WebCore::GeolocationServiceAndroid::newErrorAvailable):
+        (WebCore::GeolocationServiceAndroid::timerFired):
+        (WebCore::GeolocationServiceAndroid::isPositionMovement):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreAccurate):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreTimely):
+        * platform/android/GeolocationServiceAndroid.h: Added.
+        (WebCore::GeolocationServiceAndroid::~GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::lastPosition):
+        (WebCore::GeolocationServiceAndroid::lastError):
+        * platform/android/GeolocationServiceBridge.cpp: Added.
+        (WebCore::):
+        (WebCore::GeolocationServiceBridge::GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::~GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::start):
+        (WebCore::GeolocationServiceBridge::stop):
+        (WebCore::GeolocationServiceBridge::setEnableGps):
+        (WebCore::GeolocationServiceBridge::newLocationAvailable):
+        (WebCore::GeolocationServiceBridge::newErrorAvailable):
+        (WebCore::GeolocationServiceBridge::toGeoposition):
+        (WebCore::GeolocationServiceBridge::startJavaImplementation):
+        (WebCore::GeolocationServiceBridge::stopJavaImplementation):
+        * platform/android/GeolocationServiceBridge.h: Added.
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewd build fix.
+
+        - Fix typo in WebCore.vcproj.
+        - Intlude limits.h for INT_MAX.
+        - Enclose with parenthesis to suspress warning.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::addDay):
+
+2009-11-16  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure wx scrollbar drawing code factors in transforms when switching backends,
+        fix calcs for scrollbar length, and tweak the Mac scrollbar tracking rects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31570
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        * platform/wx/ScrollbarThemeWx.h:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h:
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Introduce WebCore::ISODateTime class.
+        https://bugs.webkit.org/show_bug.cgi?id=31340
+
+        This class represents a value of date/time types of the HTML5 INPUT
+        element, and has some parsing methods for ISO 8601.
+
+        This change has no tests because the class is not used yet.
+
+        * GNUmakefile.am: Add ISODateTime.cpp and ISODateTime.h.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * WebCoreSources.bkl: ditto.
+        * html/ISODateTime.cpp: Added. Implementation of WebCore::ISODateTime class.
+        (WebCore::isLeapYear):
+        (WebCore::maxDayOfMonth):
+        (WebCore::dayOfWeek):
+        (WebCore::ISODateTime::maxWeekNumberInYear):
+        (WebCore::countDigits):
+        (WebCore::toInt):
+        (WebCore::ISODateTime::parseYear): Private helper for parseDate() and parseWeek().
+        (WebCore::ISODateTime::addDay): Private helper for parseTimeZone().
+        (WebCore::ISODateTime::addMinute): ditto.
+        (WebCore::ISODateTime::parseTimeZone): Private helper for parseDateTime().
+        (WebCore::ISODateTime::parseMonth): Parser for <input type=month>.
+        (WebCore::ISODateTime::parseDate): Parser for <input type=date>.
+        (WebCore::ISODateTime::parseWeek): Parser for <input type=week>.
+        (WebCore::ISODateTime::parseTime): Parser for <input type=time>.
+        (WebCore::ISODateTime::parseDateTimeLocal): Parser for <input type=datetime-local>.
+        (WebCore::ISODateTime::parseDateTime): Parser for <input type=datetime>.
+        * html/ISODateTime.h: Added.  Declare WebCore::ISODateTime class.
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::millisecond):
+        (WebCore::ISODateTime::second):
+        (WebCore::ISODateTime::minute):
+        (WebCore::ISODateTime::hour):
+        (WebCore::ISODateTime::monthDay):
+        (WebCore::ISODateTime::month):
+        (WebCore::ISODateTime::fullYear):
+        (WebCore::ISODateTime::week):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: #ifdef, not #if.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Tiger build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Define CFN_EXPORT, as this macro was named
+        differently in Tiger CFNetwork.
+
+2009-11-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [KURLGoogle] setHostAndPort doesn't handle arguments without port correctly.
+
+        Fix a bug in the code that was dormant until http://trac.webkit.org/changeset/50784.
+
+        Covered by existing test: LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setHostAndPort): Added handling of arguments without port specified.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        A better Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Use a macro that inserts __declspec(dllimport) when appropriate for CFNetwork imports.
+
+2009-11-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Rename protocolIsValid to isValidProtocol.
+        https://bugs.webkit.org/show_bug.cgi?id=31503
+
+        This name change was suggested in https://bugs.webkit.org/show_bug.cgi?id=29972#c19.
+
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setProtocol):
+        * platform/KURL.cpp:
+        (WebCore::isValidProtocol):
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2009-11-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: aria-labelledby duplicates some of its WAI-ARIA label
+        https://bugs.webkit.org/show_bug.cgi?id=31565
+
+        Test: accessibility/aria-labelledby-overrides-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasTextAlternative):
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-11-16  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle the case of a null NPObject* in NPN_SetException in
+        the V8 bindings.  This allow out of process plugins calling
+        NPN_SetException to just send null instead of sending an
+        NPObject* that would be an address in a different 
+        process's memory space.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31561
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_SetException): Allow null NPObject* and just throw a general error.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Disable CONNECT proxies on Windows until WebKitSupportLibrary includes support for those.
+
+2009-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] ASSERT failure while running DRT
+        https://bugs.webkit.org/show_bug.cgi?id=30978
+
+        Add needed Structure typeInfo flags to QtRuntimeObjectImpl and QtRuntimeMethod.
+        These flags are needed after r49649, where HasDefaultmark was changed to OverrideMarkChildren.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the build.  Land a file that was missing from r51049.
+
+        * bindings/js/JSWebGLArrayHelper.h: Copied from WebCore/html/canvas/WebGLByteArray.idl.
+        (WebCore::setWebGLArrayFromArray):
+
+2009-11-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update API of WebGLArray and friends
+        https://bugs.webkit.org/show_bug.cgi?id=31175
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLArrayHelper.h: Added.
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayCustom.cpp:
+        (WebCore::JSWebGLByteArray::set):
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::WebGLArray):
+        (WebCore::WebGLArray::~WebGLArray):
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::isByteArray):
+        (WebCore::WebGLArray::isUnsignedByteArray):
+        (WebCore::WebGLArray::isShortArray):
+        (WebCore::WebGLArray::isUnsignedShortArray):
+        (WebCore::WebGLArray::isIntArray):
+        (WebCore::WebGLArray::isUnsignedIntArray):
+        (WebCore::WebGLArray::isFloatArray):
+        (WebCore::WebGLArray::buffer):
+        (WebCore::WebGLArray::baseAddress):
+        (WebCore::WebGLArray::byteOffset):
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::data):
+        (WebCore::WebGLArrayBuffer::byteLength):
+        (WebCore::WebGLArrayBuffer::~WebGLArrayBuffer):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::byteLength):
+        (WebCore::WebGLByteArray::slice):
+        (WebCore::WebGLByteArray::set):
+        * html/canvas/WebGLByteArray.h:
+        (WebCore::WebGLByteArray::isByteArray):
+        (WebCore::WebGLByteArray::data):
+        (WebCore::WebGLByteArray::set):
+        (WebCore::WebGLByteArray::get):
+        (WebCore::WebGLByteArray::item):
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::length):
+        (WebCore::WebGLFloatArray::byteLength):
+        (WebCore::WebGLFloatArray::slice):
+        (WebCore::WebGLFloatArray::set):
+        * html/canvas/WebGLFloatArray.h:
+        (WebCore::WebGLFloatArray::isFloatArray):
+        (WebCore::WebGLFloatArray::data):
+        (WebCore::WebGLFloatArray::set):
+        (WebCore::WebGLFloatArray::get):
+        (WebCore::WebGLFloatArray::item):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::length):
+        (WebCore::WebGLIntArray::byteLength):
+        (WebCore::WebGLIntArray::slice):
+        (WebCore::WebGLIntArray::set):
+        * html/canvas/WebGLIntArray.h:
+        (WebCore::WebGLIntArray::isIntArray):
+        (WebCore::WebGLIntArray::data):
+        (WebCore::WebGLIntArray::set):
+        (WebCore::WebGLIntArray::get):
+        (WebCore::WebGLIntArray::item):
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::length):
+        (WebCore::WebGLShortArray::byteLength):
+        (WebCore::WebGLShortArray::slice):
+        (WebCore::WebGLShortArray::set):
+        * html/canvas/WebGLShortArray.h:
+        (WebCore::WebGLShortArray::isShortArray):
+        (WebCore::WebGLShortArray::data):
+        (WebCore::WebGLShortArray::set):
+        (WebCore::WebGLShortArray::get):
+        (WebCore::WebGLShortArray::item):
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::length):
+        (WebCore::WebGLUnsignedByteArray::byteLength):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        (WebCore::WebGLUnsignedByteArray::set):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        (WebCore::WebGLUnsignedByteArray::isUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::data):
+        (WebCore::WebGLUnsignedByteArray::set):
+        (WebCore::WebGLUnsignedByteArray::get):
+        (WebCore::WebGLUnsignedByteArray::item):
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::length):
+        (WebCore::WebGLUnsignedIntArray::byteLength):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        (WebCore::WebGLUnsignedIntArray::set):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        (WebCore::WebGLUnsignedIntArray::isUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::data):
+        (WebCore::WebGLUnsignedIntArray::set):
+        (WebCore::WebGLUnsignedIntArray::get):
+        (WebCore::WebGLUnsignedIntArray::item):
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::length):
+        (WebCore::WebGLUnsignedShortArray::byteLength):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        (WebCore::WebGLUnsignedShortArray::set):
+        * html/canvas/WebGLUnsignedShortArray.h:
+        (WebCore::WebGLUnsignedShortArray::isUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::data):
+        (WebCore::WebGLUnsignedShortArray::set):
+        (WebCore::WebGLUnsignedShortArray::get):
+        (WebCore::WebGLUnsignedShortArray::item):
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Declare constants as extern "C".
+
+2009-11-15  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Enable support for webkit-box-shadow in Cairo builds.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        Covered by existing fast/box-shadow tests.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:  Add
+          support for fillRect shadows.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Don't try to include a file that's not
+        in WebKitSupportLibrary.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31494
+        Add unauthenticated proxy support to SocketStreamHandleCFNet
+
+        Cannot be tested in DRT.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::chooseProxy): Fetch proxy information from OS.
+        (WebCore::SocketStreamHandle::createStreams): Apply it to the newly created streams.
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Broken back/forward after using ErrorPageExtension to set error page
+        https://bugs.webkit.org/show_bug.cgi?id=30573
+
+        Make FrameLoader::checkLoadCompleteForThisFrame method
+        to check for any working DocumentLoader instance (through
+        activeDocumentLoader()) instead of only checking for
+        'm_provisionalDocumentLoader' in order to decide to if
+        it is going to reset of not the back and forward history.
+        after an error page has been loaded.
+
+        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2009-11-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="directory"
+        https://bugs.webkit.org/show_bug.cgi?id=31516
+
+        Test: platform/mac/accessibility/aria-directory.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isOrderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):
+
+2009-11-15  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by George Staikos.
+        
+        Compare UChars single unit at a time as opposed to the uint32_t
+        approach as casting to unaligned addresses may cause a bus failure
+        on ARMv5 and below. This change replicates the same defines that
+        exists in AtomicString.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=31475
+        
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-11-15  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Wrap some SVG code in V8DOMWrapper with an ENABLE(SVG) test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31490
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. The FileChooser constructor doesn't need to be redefined.
+
+        * platform/haiku/FileChooserHaiku.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. ColorSpace name had a wrong CamelCase.
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r50999.
+        http://trac.webkit.org/changeset/50999
+
+        Need to fix some issues in the Windows build. Missed some places where
+        RenderTextControl::isEdited is called.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setUserEdited):
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+        (WebCore::RenderTextControl::isUserEdited):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6946165> Would like to be able to specify the number of visible lines when using -webkit-line-clamp
+
+        Test: fast/overflow/line-clamp.html
+
+        * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Updated to handle different types of values.
+        * css/CSSParser.cpp: (WebCore::CSSParser::parseValue): ditto.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): ditto.
+
+        * rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        Use the line count value if available.  Otherwise, convert the percentage to the line count, as we did before.  Also,
+        if there is anchor as the last child box, still allow adding the ellipsis.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively): Call isNone on the LineClampValue to see if the line-clamp property has been set.
+        (WebCore::RenderLayer::scrollRectToVisible): ditto.
+
+        * WebCore.xcodeproj/project.pbxproj: Added LineClampValue.h
+        * rendering/style/LineClampValue.h: Added.
+        (WebCore::LineClampValue::LineClampValue):
+        (WebCore::LineClampValue::value):
+        (WebCore::LineClampValue::isPercentage):
+        (WebCore::LineClampValue::isNone):
+        (WebCore::LineClampValue::operator==):
+        (WebCore::LineClampValue::operator!=):
+        * rendering/style/RenderStyleConstants.h: (WebCore::): Define ELineClampType enum for percentage or line count.
+
+        * rendering/style/RenderStyle.h: Use LineClampValue.
+        (WebCore::InheritedFlags::lineClamp):
+        (WebCore::InheritedFlags::setLineClamp):
+        (WebCore::InheritedFlags::initialLineClamp):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-11-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7287487> 
+        Do not use QuickTime version to detect media controller theme
+
+        * WebCore.base.exp: Export wkMediaControllerThemeAvailable
+        * platform/mac/WebCoreSystemInterface.h: Ditto.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme): Use wkMediaControllerThemeAvailable instead of the
+        QuickTime version to see if it is possible to use MediaControllerThemeQuickTime.
+
+2009-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Recognizes date/datetime/datetime-local/month/time/week types of INPUT element.
+          They have no dedicated UI and no type validation for now.
+        - Clean up setInputType() and formControlType() of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29004
+
+        Test: fast/forms/input-type-change3.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::createTypeMap):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::createFormControlTypes):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+
+2009-11-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: checkbox does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=31456
+
+        Test: accessibility/aria-checkbox-text.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Fix build to catch up with http://trac.webkit.org/changeset/50973.
+        This is just enough changes to unbreak the port.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/FrameLoaderClient.h:
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Provide an empty implementation of this method because I don't know
+        what it is supposed to do on Chromium.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoader.h: Make dispatchDidClearWindowObjectsInAllWorlds()
+        public, as Chromium's V8Proxy calls it.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix to Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): 
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * platform/text/TextBoundaries.cpp: Use longer path to refer to Unicode.h.
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.  Should fix failure #4.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::getAllWorlds):
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Windows and Chromium builds after http://trac.webkit.org/changeset/50977.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        * WebCore.gypi: Rename TextBoundariesICU -> TextBoundaries
+        * WebCore.vcproj/WebCore.vcproj: Rename TextBoundariesICU -> TextBoundaries
+
+2009-11-12  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        LocalStorage quota should include key sizes in its count
+        https://bugs.webkit.org/show_bug.cgi?id=31451
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setItem):
+            Count keys in the quota when adding a new item.
+        (WebCore::StorageMap::removeItem):
+            Remove the key's length from the quota if we're removing the item.
+        (WebCore::StorageMap::importItem):
+            Assume that we're adding things for the first time.
+            Count keys in the quota.
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Moving TextBoundariesICU.cpp to TextBoundaries.cpp
+        by removing the direct ICU dependency and replacing it
+        with WTF functions and WebCore's own TextBreakIterator
+        abstractions.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/text/TextBoundaries.cpp: Added.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+        * platform/text/TextBoundariesICU.cpp: Removed.
+        * platform/text/TextBreakIterator.h:
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::textBreakLast):
+        (WebCore::textBreakPrevious):
+
+2009-11-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebCore::externalRepresentation should update layout before getting render object
+        https://bugs.webkit.org/show_bug.cgi?id=31459
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell FrameLoaderClient when window objects in isolated worlds are
+        cleared
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Test: http/tests/security/isolatedWorld/didClearWindowObject.html
+
+        Reviewed by Dave Hyatt.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::getAllWorlds): Added. Copies all the
+        worlds in m_worldSet to the passed-in Vector.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): Added. Calls through to
+        WebCoreJSClientData.
+        (WebCore::ScriptController::initScript): Changed to call
+        FrameLoader::dispatchDidClearWindowObjectInWorld.
+
+        * bindings/js/ScriptController.h: Added getAllWorlds.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Updated for FrameLoaderClient change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::begin):
+        Changed to call dispatchDidClearWindowObjectsInAllWorlds.
+
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        Added. Retrieves all the worlds, then calls through to
+        dispatchDidClearWindowObjectInWorld for each one.
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld): Replaces
+        dispatchWindowObjectAvailable. Calls up to the client, then, if the
+        world is the mainThreadNormalWorld(), tells the Inspector about it,
+        too.
+
+        * loader/FrameLoader.h: Replaced dispatchWindowObjectAvailable with
+        dispatchDidClearWindowObjectInWorld. Added
+        dispatchDidClearWindowObjectsInAllWorlds.
+
+        * loader/FrameLoaderClient.h: Replaced windowObjectCleared with
+        dispatchDidClearWindowObjectForWorld.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix SVG context assignment for pod types.
+        https://bugs.webkit.org/show_bug.cgi?id=31497
+
+        I broke this in r50958.
+
+        Tested by svg/custom/viewport-update2.svg.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-11-13  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Bring the platform/android files inline with Android 2.0
+        https://bugs.webkit.org/show_bug.cgi?id=31423
+
+        No new tests required: these are all Android-specific files.
+
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::files):
+        * platform/android/ClipboardAndroid.h:
+        * platform/android/FileChooserAndroid.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        (WebCore::fileButtonChooseFileLabel):
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeAndroid::baselinePosition):
+        (WebCore::RenderThemeAndroid::paintButton):
+        (WebCore::adjustMenuListStyleCommon):
+        (WebCore::RenderThemeAndroid::paintCombo):
+        * platform/android/ScreenAndroid.cpp:
+        * platform/android/ScrollViewAndroid.cpp:
+        (WebCore::ScrollView::platformOffscreenContentRectangle):
+        * platform/android/TemporaryLinkStubs.cpp:
+        (JSC::Bindings::dispatchJNICall):
+        * platform/android/WidgetAndroid.cpp:
+        (WebCore::Widget::setFrameRect):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * WebCore.pro:
+
+2009-11-13  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement composition events introduced in DOM Level 3.
+        This change adds a new IDL which defines the composition events, adds a class which
+        implements the composition events, and sends the composition events according to
+        the specification.
+        https://bugs.webkit.org/show_bug.cgi?id=26310
+
+        Test: fast/events/ime-composition-events-001.html
+
+        * DerivedSources.make: Added CompositionEvent so we can compile "CompositionEvent.idl".
+        * GNUmakefile.am: Added "CompositionEvent.{cpp,h,idl}".
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: Added "CompositionEvent.{cpp,h,idl}" and "JSCompositionEvent.{cpp,h}".
+        * WebCoreSources.bkl: Added "JSCompositionEvent.{cpp,h}".
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): Call isCompositionEvent() to create the CompositionEvent wrapper.
+        * bindings/v8/DOMObjectsInclude.h: Added "JSCompositionEvent.h".
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added "JSCompositionEvent.cpp".
+        * bindings/v8/V8DOMWrapper.cpp: Call isCompositionEvent() to identify an event as a CompositionEvent.
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp: Added "V8CompositionEvent.h".
+        * bindings/v8/V8Index.h: Added V8Index::COMPOSITIONEVENT.
+        * dom/CompositionEvent.cpp: Implements the CompositionEvent class.
+        (WebCore::CompositionEvent::CompositionEvent):
+        (WebCore::CompositionEvent::~CompositionEvent):
+        (WebCore::CompositionEvent::initCompositionEvent):
+        (WebCore::CompositionEvent::isCompositionEvent):
+        * dom/CompositionEvent.h: Declares the CompositionEvent class.
+        (WebCore::CompositionEvent::create):
+        (WebCore::CompositionEvent::data):
+        * dom/CompositionEvent.idl: Added the IDL of DOM CompositionEvent.
+        * dom/Event.cpp:
+        (WebCore::Event::isCompositionEvent): Added a method to identify an event is a CompositionEvent.
+        * dom/Event.h:
+        * dom/EventNames.h: Added composition{start,update,end} to eventNames.
+        * editing/Editor.cpp:
+        (WebCore::Editor::confirmComposition): Sent a CompositionEnd event.
+        (WebCore::Editor::setComposition): Sent a Composition{Start,Update,End} event.
+
+2009-11-13  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a link error in unofficial GCC 4.4 builds on Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31477
+
+        * bindings/v8/V8Binding.cpp:  Add explicit instantiations of v8StringToWebCoreString template.
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Debug build after http://trac.webkit.org/changeset/50960.
+
+        The CounterNode class does not support all methods necessary to efficiently update the counter tree as needed per CSS2.1
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        We currently fill a path with solid color instead of filling
+        a clipping path. This causes problems on some composite operators,
+        since Cairo modifies the area outside the path.
+        This fixes the behavior of WebKitGtk on fast/canvas/canvas-composite-alpha.html
+
+        Thanks to Benjamin Otte for tracking the bug down.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31440
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/QuotaTracker.cpp:
+        (WebCore::QuotaTracker::updateDatabaseSize):
+        * storage/chromium/QuotaTracker.h:
+
+2009-11-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The CounterNode class is missing some basic tree navigation methods common in other WebKit trees such as the rendering tree
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+        Added tree navigation methods that permit full implementation of CSS2.1
+        counter feature without using recursion proportional to the counter
+        tree depth.
+        No new tests because I did not find any bug that is fixed by this
+        commit yet, this just reduces the size of the patch for 11031 and
+        helps respond to some concerns regarding that patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+        (WebCore::CounterNode::nextInPreOrder):
+        Added to support non-recursive tree traversal necessary for
+        efficient full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::lastDescendant):
+        (WebCore::CounterNode::previousInPreOrder):
+        Moved this methods such that they occupy a place similar to that of
+        identically named methods on the render tree. This allows for their
+        broader use needed in full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        Changed such that insertion/removal of a counter, triggers not only
+        recalculation of PrefixWidths, but also reassesment of values in
+        counter nodes. This is the basis full implementation of CSS2.1
+        counters. It does not change current behavior by much because of
+        changes needed to the recalculation algorithm, but those are comming
+        in the patch for 11031.
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::counter):
+        Only changed argument type to prepare for implementation of Darin
+        Adler's recommendation for the patch to 11031.
+
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeChildren):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+        Added the ability to restrict invalidation to counters with a given
+        identifier.
+        Also invalidated counters that are on the child container itself
+        which were missed by the previous algorithm, but were a valid case.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Protect SVG animated properties from destruction in bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31474
+
+        See http://crbug.com/26719.
+
+        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
+        under Valgrind.
+
+        Made sure we keep a reference to SVG properties while setting a
+        context:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::withSVGContext):
+
+2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Incorporate Benjamin Otte's recommendations to avoid
+        a buffer overrun, and small performance improvement.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::copyContextProperties): Correctly size output
+         storage for cairo_get_dash to avoid buffer overrun.
+        (WebCore::drawPathShadow): Prefer cairo_fill_extents
+         to slower cairo_stroke_extents when not drawing shadows.
+
+2009-11-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not register Chromium's HTML5 DB VFS as the default
+        VFS. Otherwise, other sqlite DB users in the same process will
+        stop working.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31462
+
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Explicitly cast "-1" to CFOptionFlags,
+        avoiding a sign mismatch warning.
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Release build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        Use ASSERT_UNUSED for unused stream parameter.
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31441
+        Implement SocketStreamHandleCFNet
+
+        Existing WebSocket tests now pass on Mac. No proxy support yet.
+
+        * platform/network/SocketStreamHandleClient.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::shouldUseSSL):
+        (WebCore::SocketStreamHandle::refAuthenticationClient):
+        (WebCore::SocketStreamHandle::derefAuthenticationClient):
+        (WebCore::SocketStreamHandle::):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::chooseProxy):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+        (WebCore::SocketStreamHandle::receivedCredential):
+        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::SocketStreamHandle::receivedCancellation):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering (take 2).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Chromium: [REGRESSION] Crash while stopping on a breakpoint.
+        Rolling back r50890.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31467
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+        
+        This is the fix of a regression, caused by the shadow patch
+        from the bug above. Reinserted the save and restore calls
+        that were accidently removed by the previous patch.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Reverting r50908 since it makes inspector tests
+        time out.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+
+2009-11-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable 'console.profile()' and 'console.profileEnd()'
+        regardless of JAVASCRIPT_DEBUGGER.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31293
+
+        * WebCore.gypi:
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profile):
+        (WebCore::JSConsole::profileEnd):
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * page/Console.idl:
+
+2009-11-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Chromium build fix.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::evaluateInWorld): Add a dummy
+         method which isn't called in chromium to make things compile.
+
+2009-11-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+        
+        The document-open.html test was flaky at times. The test invokes the layout test plugin
+        which in its destroy stream handler opens a new document. This basically tears down the
+        stream and the associated plugin instance, which causes a crash when the plugin stream
+        dereferences an invalid m_client pointer which points to the PluginView instance which
+        is invalid at this time. Fix is to set the m_client pointer to NULL in the stop function
+        and check for the same.
+       
+        https://bugs.webkit.org/show_bug.cgi?id=31067
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::stop):
+        (WebCore::PluginStream::destroyStream):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Renaming some parameters passed to DB-related methods to better
+        indicate their purpose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31449
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transformed reflected elements are clipped inside element with opacity
+        https://bugs.webkit.org/show_bug.cgi?id=30957
+        
+        transparencyClipBox() attemped to minimize the size of the transparency layer by mapping
+        each clip rect into painting space before taking the unions. This, however, did not work
+        correctly with combinations of reflections and transforms. Fixed by unioning the
+        clipRect and mapping through transforms along the way.
+        
+        Also leave some #ifdeffed code in beginTransparencyLayers() that makes it easy to see
+        where the transparency layers are.
+
+        Test: fast/reflections/opacity-reflection-transform.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        Improve SecurityOrigin::toString comment
+        https://bugs.webkit.org/show_bug.cgi?id=31041
+
+        * page/SecurityOrigin.h:
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/RenderTreeAsText.h:
+
+2009-11-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] The Android specific files in page/Android are out of date.
+        https://bugs.webkit.org/show_bug.cgi?id=31437
+
+        No tests required.
+
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation): Added.
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Added.
+        * page/android/InspectorControllerAndroid.cpp: Removed.
+
+2009-11-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Implement Canvas/SVG shadow support for Cairo.  This patch
+        uses the filter code from SVG Filters.  That means that it is
+        necessary to activate filters to see the shadows.
+
+        Test: fast/canvas/canvas-shadow.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj: Add new ImageBufferFilter files.
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (GraphicsContext::calculateShadowBufferDimensions): New helper routine.
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::copyContextProperties):
+        (WebCore::drawPathShadow):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::createPlatformShadow):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Add filter effect.
+        * platform/graphics/filters/Filter.h: Correct 'const' signatures.
+        * platform/graphics/filters/ImageBufferFilter.cpp: Added.
+        * platform/graphics/filters/ImageBufferFilter.h: Added.
+        * svg/graphics/filters/SVGFilter.cpp: Correct 'const' signatures.
+        * svg/graphics/filters/SVGFilter.h: Correct 'const' signatures.
+
+2009-11-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add postTaskToMainThread to ScriptExecutionContext.
+        Move the code to post task to the main thread into a new method on ScriptExecutionContext,
+        to use as a helper implementation of the virtual ScriptExecutionContext::postTask(Task) in
+        contexts that live on the main thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31427
+
+        No new tests - simply moving the code.
+
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskData::PerformTaskData):
+        (WebCore::PerformTaskData::performTask):
+        (WebCore::ScriptExecutionContext::postTaskToMainThread):
+        * dom/ScriptExecutionContext.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix crash when removing compositing layers when GC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=31429
+
+        Workaround <rdar://problem/7390716> by special-casing the removal
+        of all sublayers when GC is enabled.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::safeSetSublayers):
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The last of the V8 binding optimizations.
+        - Replace string-valued element accessors with a shared getter/setter function.
+        - Change error handling flow of control to avoid extra branches and function calls.
+        https://bugs.webkit.org/show_bug.cgi?id=31443
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getElementStringAttr):  Body of string-valued Element getter function.
+        (WebCore::setElementStringAttr):  Body of string-valued Element setter function.
+        * bindings/v8/V8Binding.h:
+
+2009-11-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/7267951>
+        Canvas methods should reject uses of NaN and Infinity.
+
+        Test: fast/canvas/canvas-with-illegal-args.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: profile timeline panel, fix obvious problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31432
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.hasStyleClass):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        Covered by existing tests.
+
+        * WebCore.base.exp: Update exported symbols to match what now exists
+        and is needed by WebKit.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Updated for function rename.
+
+        * bindings/js/ScriptController.cpp: Removed code that dealt with
+        worldIDs.
+        (WebCore::ScriptController::createWorld): Added. Returns a new world
+        suitable for use on the main thread.
+        (WebCore::ScriptController::executeScriptInWorld): Renamed from
+        executeScriptInIsolatedWorld, since this works just fine with a
+        "normal" world.
+
+        * bindings/js/ScriptController.h: Added createWorld, removed functions
+        that took worldIDs, renamed executeScriptInIsolatedWorld to
+        executeScriptInWorld.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        Updated for changes to UserScriptMap and ScriptController.
+
+        * page/Frame.h: Changed injectUserScriptsForWorld to take a
+        DOMWrapperWorld* instead of a worldID.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        Changed these functions to take a DOMWrapperWorld* instead of a
+        worldID. Also updated for changes to UserScript and UserStyleSheet.
+
+        * page/UserScript.h:
+        * page/UserStyleSheet.h: Changed not to hold a worldID, since it was
+        never used.
+
+        * page/UserScriptTypes.h:
+        * page/UserStyleSheetTypes.h: Changed UserScriptMap and
+        UserStyleSheetMap to use a RefPtr<DOMWrapperWorld> instead of a
+        worldID as their key type.
+
+
+2009-11-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31260>.
+        Web Inspector: Main Resources Other than HTML are mis-detected.
+        
+        Even if the resource is a main resource, look at its CachedResource type, 
+        because it might be an image, stylesheet, or JavaScript file, and we
+        want to show them all correctly.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResourceType): Move this method out so it can be called in multiple places.
+        (WebCore::InspectorResource::type): 
+        * inspector/InspectorResource.h:
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Table-driven setup for V8 binding template callback functions. 100k in code savings.
+        https://bugs.webkit.org/show_bug.cgi?id=31420
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Change generated ConfigureXXXTemplate fn
+            to call configureTemplate().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):  New function; does all the standard configuration work.
+        (WebCore::createCallback):  De-inlined wrapper for FunctionTemplate creation.
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):  Just wrapped the very long fn parameter list.
+        (WebCore::batchConfigureCallbacks):  New function, used by configureTemplate.
+        (WebCore::batchConfigureConstants):  Just wrapped the very long fn parameter list.
+        * bindings/v8/V8Proxy.h:
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50876.
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7388969> Add DOM API for fullscreen video
+        
+        DOM API for fullscreen <video>.
+
+        Tests: media/media-fullscreen-inline.html
+               media/media-fullscreen-not-in-document.html
+
+        * dom/EventNames.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+        * html/HTMLAttributeNames.in:
+            Add onwebkitbeginfullscreen and onwebkitendfullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onwebkitbeginfullscreen and onwebkitendfullscreen.
+        (WebCore::HTMLMediaElement::enterFullscreen):
+            Schedule webkitbeginfullscreenEvent event, don't set m_isFullscreen unless we
+            actually do enter fullscreen.
+        (WebCore::HTMLMediaElement::exitFullscreen):
+            Schedule webkitendfullscreenEvent event.
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        (WebCore::HTMLMediaElement::webkitExitFullScreen):
+        (WebCore::HTMLMediaElement::webkitSupportsFullscreen):
+        (WebCore::HTMLMediaElement::webkitDisplayingFullscreen):
+            New, access to fullscreen properties and methods.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for fullscreen API.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen):
+            Return false if a movie does not have video.
+
+        * page/DOMWindow.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-12  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30291
+
+        Fixes an issue where the returned drop effect is incorrect when
+        effectAllowed == "uninitialized".
+
+        According to section 7.9.2 of the HTML 5 spec.
+        <http://dev.w3.org/html5/spec/Overview.html#the-dragevent-and-datatransfer-interfaces>
+        when effectAllowed = "uninitialized" the resulting dropEffect should be the
+        user-specified dropEffect (i.e. "copy", "move", "link") and "none" for any
+        other case.
+        
+        No test cases are included because we have an existing test case from
+        bug #24731.
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp): Added case for op == "uninitialized".
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not highlight node on refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31419
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Minor timeline fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31417
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype._updateDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        SnowLeopard build fix.
+
+        Renamed initWithClient to initWithAuthenticationClient.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (-[WebCoreAuthenticationClientAsChallengeSender initWithAuthenticationClient:]):
+        (WebCore::AuthenticationChallenge::setAuthenticationClient):
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        Test: platform/mac/accessibility/aria-alerts.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31386
+        Make Mac AuthenticationChallenge usable from cross-platform code
+
+        No change in behavior, so no tests.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Don't store m_currentCFChallenge, which was only used for a single assertion. Unlike the
+        NSURLConnection case, CF challenge doesn't carry a sender with it, so the copy in web challenge
+        is identical.
+
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Added a setter to match the new
+        Mac interface. Previously, one had to create a new AuthenticationChallenge to replace client.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Fixed assertions after removal
+        of m_currentCFChallenge. Also, there is no need to set client now, as it's guaranteed to
+        be already set.
+
+        * platform/network/mac/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::m_sender): Explained the existence of this member to the
+        best of my understanding.
+        (WebCore::AuthenticationChallenge::m_nsChallenge): Renamed from m_macChallenge to prevent
+        confusion with "mac" and "web" challenges in ResourceHandleInternal.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCoreAuthenticationClientAsChallengeSender): Added a Obj-C wrapper for AuthenticationClient,
+        making it possible to use the latter with NSURLAuthenticationChallenge.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Updated for m_macChallenge ->
+        m_nsChallenge renaming.
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Wrap the client in Obj-C and
+        set it as sender (or unset, if client is null).
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreResourceHandleAsDelegate) WebCoreResourceHandleAsDelegate no longer doubles as
+        authentication challenge sender.
+        (WebCore::ResourceHandle::~ResourceHandle): A navigation can happen underneath an
+        authentication sheet.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Form m_currentWebChallenge
+        using the new setAuthenticationClient() method.
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Fixed an incorrect assertion.
+        Since didCancelAuthenticationChallenge is called by connection, the passed challenge is
+        the original Mac one, not the one we created for use with authentication sheet. I don't
+        know when a connection would cancel authentication in practice, so I haven't tested this.
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoint sidebar entries should allow click over entire list item
+        https://bugs.webkit.org/show_bug.cgi?id=31411
+
+        No new tests; no new functionality, small usability change. 
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoints in named evals are not restored after a reload
+        https://bugs.webkit.org/show_bug.cgi?id=31375
+
+        Manual test added
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        * manual-tests/inspector/bp-in-named-eval-after-reload.html: Added.
+
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Resource errors/warnings not shown in the Resource tree.
+
+        Error/Warning bubbles are not displayed next to the resource in the 
+        Resources panel if those occur before the resource is attached to the tree.
+        https://bugs.webkit.org/show_bug.cgi?id=31404
+
+        Test: manual-tests/inspector/styled-error-bubbles-in-scripts.html
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Follow-up of r50726, don't block the UI thread when calling
+        gst_element_get_state(). Also fixed a compilation warning and some
+        static casts.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::playbackPosition):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        don't pause pipeline if already paused, same for play()
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+
+2009-11-12  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by David Levin.
+
+        Support Gtk scrollwheel behavior for horizontal scrollbars on Linux
+        Chromium too.
+        https://bugs.webkit.org/show_bug.cgi?id=31292
+
+        No new tests. (Corresponding test for Gtk+ is
+        platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html)
+
+        * page/EventHandler.cpp:
+        * page/chromium/EventHandlerChromium.cpp:
+
+2009-11-12  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent text inside a multi-column block from being split into columns.
+        
+        If the tentative height of a multi-column block was too small, we need to
+        expand the block height and try to layout again, in order to prevent text
+        from being split into different columns.
+
+        CSS Multicolumn text is split awkwardly
+        https://bugs.webkit.org/show_bug.cgi?id=22249
+
+        Test: fast/multicol/single-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutColumns):
+        * rendering/RenderBlock.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::setTruncatedAt):
+        (WebCore::RenderView::setMinimumColumnHeight):
+        (WebCore::RenderView::minimumColumnHeight):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that RenderFileUploadControl isn't initialized with multiple files.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        Test: fast/forms/input-file-re-render.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing Chromium's POSIX VFS implementation, by adding the required
+        "used file descriptors" logic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31275
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        need to implement aria tree roles
+        https://bugs.webkit.org/show_bug.cgi?id=31284
+
+        Tests: platform/mac/accessibility/aria-multiselectable.html
+               platform/mac/accessibility/aria-tree.html
+
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::ariaTreeRows):
+        (WebCore::AccessibilityObject::ariaTreeItemContent):
+        (WebCore::AccessibilityObject::ariaTreeItemDisclosedRows):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isTree):
+        (WebCore::AccessibilityObject::isTreeItem):
+        (WebCore::AccessibilityObject::setIsExpanded):
+        (WebCore::AccessibilityObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityObject::hierarchicalLevel):
+        (WebCore::AccessibilityObject::setSelectedRows):
+        (WebCore::AccessibilityObject::performDefaultAction):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hierarchicalLevel):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::AccessibilityRenderObject::setElementAttributeValue):
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::isSelected):
+        (WebCore::AccessibilityRenderObject::setSelected):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::createARIARoleMap):
+        (WebCore::AccessibilityRenderObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (RoleEntry::):
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix after @r50760 with ENABLE_FILTERS.
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply): Supply ColorSpace to fillRect.
+        * svg/graphics/filters/SVGFEFlood.cpp: Supply ColorSpace argument
+          to fillRect.
+
+2009-11-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix WebSocket frame parser of frame_type with high-order bit set.
+        https://bugs.webkit.org/show_bug.cgi?id=30668
+
+        If buffer is smaller than frame's length, it should break the loop
+        instead of reading next byte.
+
+        Tests: websocket/tests/frame-length-longer-than-buffer.html
+               websocket/tests/frame-length-skip.html
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-11-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Remove t2embed.dll functions from FontCustomPlatformData.cpp for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=31345
+
+        Remove dependency on t2embed.dll so that Chromium for Windows can start even if t2embed.dll cannot be accessed.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Remove TTDeleteEmbeddedFont() call. Always use RemoveFontMemResourceEx().
+        (WebCore::FontCustomPlatformData::fontPlatformData): Remove TTGetNewFontName() call.
+        (WebCore::createFontCustomPlatformData): Remove TTLoadEmbeddedFont() call. Always use AddFontMemResourceEx() via renameAndActivateFont() in opentype/OpenTypeUtility.h. Remove EOTStream class as well.
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Windows build fix. No review needed. 
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31382
+        Make -webkit-color-correction work with shadows
+
+        From canvas, just send DeviceColorSpace to setShadow() for now. 
+        Will fix soon when I address https://bugs.webkit.org/show_bug.cgi?id=31319
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+
+        setShadow() and setPlatformShadow() now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShadow):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::createCGColorWithColorSpace): New helper to create a 
+        color in a ColorSpace.
+        (WebCore::setCGFillColor): Call new helper.
+        (WebCore::setCGStrokeColor): Call new helper.
+        (WebCore::GraphicsContext::setPlatformShadow): Call new helper.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Send appropriate ColorSpace to setShadow().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Attempt to keep ports building.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Print the file text of a file upload control in DumpRenderTree for ease of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        (WebCore::RenderFileUploadControl::fileTextValue):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::isFileUploadControl):
+        (WebCore::toRenderFileUploadControl):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFileUploadControl):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM Wrappers for some nodes may not be marked.
+        https://bugs.webkit.org/show_bug.cgi?id=31380
+
+        Some markChildren methods are calling getCachedDOMNodeWrapper, which will find
+        the wrapper for the current world only.  This means that wrappers may be GC'ed
+        prematurely, and properties lost.
+
+        Move to a model more like markDOMObjectWrapper, mark wrappers for all worlds.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+
+2009-11-11  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        bindings/js/ScriptObject.cpp is missing and ENABLE(INSPECTOR) guard.
+        https://bugs.webkit.org/show_bug.cgi?id=31384
+
+        No functionality change so no tests required.
+
+        * bindings/js/ScriptObject.cpp: Add ENABLE(INSPECTOR) guard around the JSInspectorBackend.h include.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The Big De-Inlining. 450k code size reduction (32-bit x86.)
+        - Various inline functions in V8Binding.h made non-inline.
+        - Some renaming for consistency.
+        - New function createRawTemplate().
+        https://bugs.webkit.org/show_bug.cgi?id=31383
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8DOMWrapperToNative):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8ExternalString):
+        (WebCore::createRawTemplate):  New function.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8DOMWrapperTo):
+        (WebCore::v8DOMWrapperToNode):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        More V8 de-inlining (outlining?) Abstracted a chunk of boilerplate code from every
+        event-listener setter into a new subroutine transferHiddenDependency().
+        https://bugs.webkit.org/show_bug.cgi?id=31377
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Replace boilerplate with call to transferHiddenDependency().
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::transferHiddenDependency):  New.
+        * bindings/v8/V8Utilities.h:  Declaration of transferHiddenDependency.
+
+2009-11-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        If we are on Windows, don't try and get the kCGColorSpaceSRGB ColorSpace,
+        because there is a CG bug preventing this from working.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that if Storage panel exists before calling its methods
+
+        https://bugs.webkit.org/show_bug.cgi?id=31343
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+        (WebInspector.addCookieDomain):
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        De-inline convertNodeToV8Object(), which expands to a lot of asm code and is inlined 136
+        times in the generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31368
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):  Moved body here from .h file
+        * bindings/v8/V8DOMWrapper.h:  Removed inline method body.
+
+2009-11-11  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Display the correct summary in the web inspector for the shorthands
+        border-color, border-width, border-style, margin, and padding.
+        https://bugs.webkit.org/show_bug.cgi?id=7987
+
+        Test: fast/css/shorthands-four-values.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::get4Values):
+        Display the summary information in the same way the shorthand would be
+        specified in a css rule.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make V8 bindings return NULL handles instead of calling v8::Undefined(). This has equivalent
+        meaning to the caller, saves code, and appears to save a few cycles at runtime too.
+        https://bugs.webkit.org/show_bug.cgi?id=31367
+
+        * bindings/scripts/CodeGeneratorV8.pm: Change "v8::Undefined()" to "v8::Handle<v8::Value>()"
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Optimize V8 getDOMNodeMap(), a hot function in Dromaeo DOM tests, by increasing inlining.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::getCurrent):  Moved getCurrentMainThread to MainThreadDOMData::getCurrent
+            so it can be inlined by its caller.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getCurrent):  Moved here from DOMData.cpp.
+        (WebCore::MainThreadDOMData::getMainThreadStore):  Added UNLIKELY macro to improve codegen.
+        (WebCore::MainThreadDOMData::getCurrentMainThreadStore):  Combination of getCurrentMainThread
+            and getStore, which inline both calls together.
+        * bindings/v8/MainThreadDOMData.h:
+        (WebCore::MainThreadDOMData::getStore):  Broke out nonvirtual getMainThreadStore for inlineability.
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):  Call new getCurrentMainThreadStore, which is faster.
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add methods to KURLGoogle.cpp declared in http://trac.webkit.org/changeset/50784 but not defined when using KURLGoogle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31357
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isSchemeFirstChar):
+        (WebCore::isSchemeChar):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::removePort):
+        (WebCore::protocolIsValid):
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no reviewed.
+
+        Correct setPlatformFillColor and setPlatformStrokeColor calls
+        to match new ColorSpace-supporting signatures.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:  Add the
+          color space to the set[...]Color calls.
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31327
+        Clean up SocketStreamHandleClient interface
+
+        No change in behavior.
+
+        * platform/network/SocketStreamHandleClient.h: Removed willOpenStream and willSendData.
+        (WebCore::SocketStreamHandleClient::willOpenStream): Removed. This is currently not used by
+        the only client (WebSocketChannel), and it's not clear what this callback's semantics
+        should be.
+        (WebCore::SocketStreamHandleClient::willSendData): Ditto.
+        (WebCore::SocketStreamHandleClient::receivedCancellation): Removed, because it was misplaced.
+        For ResourceHandle, this method is called when the user cancels authentication sheet,
+        not when something happens with the stream.
+
+        * websockets/WebSocketChannel.h: Some WebSocketChannel methods were virtual without any
+        reason. Also, added didReceiveAuthenticationChallenge/didCancelAuthenticationChallenge.
+
+        * websockets/WebSocketChannel.cpp: Adjusted for the above change. Authentication-related
+        callbacks have no real implementation yet.
+
+2009-11-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the part of page directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31350
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class DragController         - instantiated at: WebCore/page/Page.cpp:107
+        class FocusController        - instantiated at: WebCore/page/Page.cpp:109
+        class Settings               - instantiated at: WebCore/page/Page.cpp:116
+        class PluginHalter           - instantiated at: WebCore/page/Page.cpp:160
+        struct ScheduledEvent        - instantiated at: WebCore/page/FrameView.cpp:1275
+        class UserScript             - instantiated at: WebCore/page/PageGroup.cpp:208
+        struct EventHandlerDragState - instantiated at: WebCore/page/EventHandler.cpp:182
+        class XSSAuditor             - instantiated at: WebCore/bindings/js/ScriptController.cpp:70
+        class UserStyleSheet         - instantiated at: WebCore/page/PageGroup.cpp:222
+
+        Inherits PropertyWrapperBase class from Noncopyable because (its child class) 
+        PropertyWrapper is instantiated by 'new' in 
+        WebCore/page/animation/AnimationBase.cpp:564 it is no need to be copyable.
+
+        * page/DragController.h:
+        * page/EventHandler.h:
+        * page/FocusController.h:
+        * page/FrameView.cpp:
+        * page/PluginHalter.h:
+        * page/Settings.h:
+        * page/UserScript.h:
+        * page/UserStyleSheet.h:
+        * page/XSSAuditor.h:
+        * page/animation/AnimationBase.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        No new tests as there is no new functionality.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Use explicit
+        parentheses to silence gcc 4.4 -Wparentheses warnings
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Set m_hasPendingGeometryChange to true by default, so that
+        at least one call to NPP_SetWindow is executed, which is
+        needed by the DRT plugin testing framework.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-11-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31348
+        [Qt] Remove unnecessary LUT creator from WebCore.pro
+
+        * WebCore.pro:
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce a function for querying the input method status
+        in QWebPageClient.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-11  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Black artifacts in youtube.com/html5
+
+        Paint the video to the given size. It's the job of the callers to keep
+        track of aspect ratio. RenderVideo.cpp does it for the <video>
+        element.
+        https://bugs.webkit.org/show_bug.cgi?id=30925
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-11-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Cleaned up some missed capitalization style-guideline violations.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Make the default style background color valid.
+        Currently the color is transparent but invalid, this causes
+        list boxes in QtWebKit to be drawn with a black background
+        since r49242.
+        https://bugs.webkit.org/show_bug.cgi?id=31295
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialBackgroundColor):
+        * rendering/style/StyleBackgroundData.cpp:
+        (WebCore::StyleBackgroundData::StyleBackgroundData):
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Simplify the ownership model for worlds - rather than having a pair of weak references
+        between DOMWrapperWorld and ScriptController/ScriptCachedFrameData, give the latter an
+        ref pointer to the former.  This reduces complexity & cost of the caching entries in the
+        back forward cache.
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rename counter to makeCounterNode in RenderCounter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=31289
+
+        No new test because this is just a small refactoring.
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 2 of 2.
+
+        Removed method EventHandler::dragSourceMovedTo, since it is no longer
+        needed. This method fired a drag event whenever the mouse moved, but
+        section 7.9.4 of the HTML 5 spec. defines the drag-and-drop processing
+        model independent of when the mouse moves. See "Among other changes..."
+        in the change log for patch 1 for more details.
+
+        * WebCore.DragSupport.exp:
+        * page/EventHandler.cpp: Removed method EventHandler::dragSourceMovedTo.
+        (WebCore::EventHandler::handleDrag): Updated comment about reentrancy issue.
+        * page/EventHandler.h:
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 1 of 2.
+
+        As per Section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>,
+        the drag event should always fire before the dragover event.
+
+        In fixing this bug, this patch also makes our drag processing model
+        conform to the HTML 5 spec.
+
+        Among the changes, this patch ensures that the drag event isn't fired outside
+        of the drag-and-drop processing loop, WebCore::EventHandler::updateDragAndDrop.
+        Currently, the drag event is fired whenever the mouse button is down and the OS
+        detects the mouse moved. But, as per the spec, the drag event should
+        fire approx. every 350ms so long as the mouse button is down.
+
+        Test: fast/events/drag-and-drop-fire-drag-dragover.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::canHandleDragAndDropForTarget): Formerly named handleDragAndDropForTarget.
+        Modified to determine when we are in the correct instance of EventHandler to service the drag
+        and drop operation.
+        (WebCore::EventHandler::updateDragAndDrop): Moved code from WebCore::EventHandler::dragSourceMovedTo
+        into this method.
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        (WebCore::EventHandler::clearDragState):
+        * page/EventHandler.h: Added field m_shouldOnlyFireDragOverEvent to determine whether
+        we should fire both drag and dragover events or only the dragover event.
+
+2009-11-10  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix crash in V8CustomXPathNSResolver (http://crbug.com/26726).
+        https://bugs.webkit.org/show_bug.cgi?id=31301
+
+        Tested by new fast/xpath/xpath-detached-iframe-resolver-crash.html.
+
+        Allowed passing V8Proxy for the calling JS context:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        (WebCore::V8CustomXPathNSResolver::V8CustomXPathNSResolver):
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement URL decomposition IDL attributes for HTMLAnchorElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29972.
+
+        Add methods for setting different parts of the URL in href attribute.
+
+        Tests: fast/dom/HTMLAnchorElement/set-href-attribute-hash.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-hostname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-port.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-protocol.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-search.html
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setPort):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::parsePortFromStringPosition):
+        (WebCore::HTMLAnchorElement::setHash):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setHostname):
+        (WebCore::HTMLAnchorElement::setPathname):
+        (WebCore::HTMLAnchorElement::setPort):
+        (WebCore::HTMLAnchorElement::setProtocol):
+        (WebCore::HTMLAnchorElement::setSearch):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAnchorElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        * platform/KURL.cpp:
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::prettyURL):
+        (WebCore::protocolIsValid):
+        * platform/KURL.h:
+        (WebCore::KURL::canSetHostOrPort):
+        (WebCore::KURL::canSetPathname):
+        (WebCore::KURL::hasPort):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50760.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaTimelineContainer):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+
+2009-11-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Repro crash saving pcmag.com article as a webarchive.
+        <rdar://problem/7381219> and https://webkit.org/b/31322
+
+        Test: http/tests/webarchive/cross-origin-stylesheet-crash.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Walk the stylesheet itself instead
+          of creating a CSSRuleList (and subjecting ourselves to the security origin check)
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempt 2 to fix Tiger build. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Changes needed after r50760.
+
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Qt build fix.
+
+        * platform/network/ResourceHandle.h: Only inherit from AuthenticationClient on platforms
+        that use ResourceHandle as a delegate (Mac, CFNetwork, Curl).
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Tiger build fix. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31312
+        Decouple authentication panel callbacks from ResourceHandle
+
+        No change in functionality.
+
+        SocketStreamHandle also needs to request credentials, so it's not appropriate to store
+        ResourceHandle as delegate.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/AuthenticationClient.h: Added.
+        Added a new interface for listening to authentication panel notifications.
+
+        * WebCore.xcodeproj/project.pbxproj: Added AuthenticationClient.h. Let Visual Studio do what
+        it wants with the project file.
+
+        (WebCore::AuthenticationClient::ref): Using our usual method of exposing refcounting on an
+        interface class.
+        (WebCore::AuthenticationClient::deref): Ditto.
+
+        * platform/network/ResourceHandle.h:
+        (WebCore::ResourceHandle::refAuthenticationClient): Ditto.
+        (WebCore::ResourceHandle::derefAuthenticationClient): Ditto.
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/chromium/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/curl/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        Keeping a reference to AuthenticationClient, not to ResourceHandle.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+       Second attempted gtk build fix. No review needed.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix back/forwards cache with JSC isolated worlds.
+        https://bugs.webkit.org/show_bug.cgi?id=31310
+        <rdar://problem/7328111> Cached back navigation doesn't restore global object in extension isolated world
+
+        Store the global object for all worlds, not just the normal world.
+        Also maintain bidirectional weak references between the ScriptCachedFrameData and the DOMWrapperWorld,
+        so we can forget global objects if a world goes away.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::rememberScriptCachedFrameData):
+        (WebCore::DOMWrapperWorld::forgetScriptCachedFrameData):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::forgetWorld):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r50760.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix. (No review needed.)
+
+        * GNUmakefile.am: Adding ColorSpace.h
+
+2009-11-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Updated function calls to take a ColorSpace argument, passing
+        in DeviceColorSpace for now - this should be fixed. Also added
+        ColorSpace.h to WebCore project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::doDrawTextAtPoint):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-11-10  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimizations to Element::getAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=30926
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):  User case-insensitive compare instead of lowercasing the name.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem):  Avoid redundant compares, and do fast/likely compares first.
+        * platform/text/PlatformString.h:
+        (WebCore::equalPossiblyIgnoringCase):  New inline method, used by both of the above.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7059710> 
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=31196 Implement -webkit-
+        color-correction for CSS colors
+
+        New exported symbol for GraphicsContext::fillColor() which now 
+        accepts a ColorSpace as an optional parameter.
+        * WebCore.base.exp:
+
+        Added a new file, ColorSpace.h, to define the ColorSpace enum.
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Computed Style for -webkit-color-correction
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Parse -webkit-color-correction
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+       Map CSS identifiers to the appropriate values of the ColorSpace enum
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColorSpace):
+
+        New property -webkit-color-correction
+        * css/CSSPropertyNames.in:
+
+        Map -webkit-color-correction into the RenderStyle.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add new value sRGB.
+        * css/CSSValueKeywords.in:
+
+        Comment out the reference to sRGB since it will now be inherited as 
+        a value from CSSValueKeywords.
+        * css/SVGCSSValueKeywords.in:
+
+        Definition of the ColorSpace enum.
+        * platform/graphics/ColorSpace.h: Added.
+        (WebCore::):
+
+        These functions all now take a ColorSpace as a parameter.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::drawHighlightForText):
+
+        Return the appropriate ColorSpace.
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+
+        These functions all call other functions which require a ColorSpace 
+        as a parameter.
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+
+        All of the GraphicsContext functions that take a Color should now 
+        also take a ColorSpace.
+        * platform/graphics/GraphicsContext.h:
+
+        Added new member variables stokeColorSpace and fillColorSpace.
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+
+        Attempt to keep the Cairo port building with all of the massive 
+        changes to GraphicsContext.        
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef): New static function that returns a 
+        CGColorSpaceRef for the sRGB color space.
+        (WebCore::deviceRGBColorSpaceRef): New static function that returns 
+        a CGColorSpaceRef for the device RGB color space.
+
+        (WebCore::setCGFillColor): Now takes a ColorSpace parameter and 
+        sets the fill color to the specified color in the given ColorSpace.
+        (WebCore::setCGStrokeColor): Same, but for stroke.
+
+        (WebCore::setCGFillColorSpace): New static to set the 
+        CGFillColorSpace to the given ColorSpace
+        (WebCore::setCGStrokeColorSpace): Same, but for stroke.
+
+        Send ColorSpaces when appropriate, set ColorSpaces when 
+        appropriate, and check ColorSpaces when appropriate.
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Haiku building.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep QT building.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Wince building.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Attempt to keep WX building.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Added functions colorSpace() and setColorSpace()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::colorSpace):
+        (WebCore::InheritedFlags::setColorSpace):
+
+        The ColorSpace is stored here.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+        All of these call sites call GraphicsContext functions which now 
+        require ColorSpaces.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::paintCaret):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintScrollCorner):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::updateGraphicsContext):
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillHorizontalSelectionGap):
+        (WebCore::RenderBlock::fillVerticalSelectionGap):
+        (WebCore::RenderBlock::fillLeftSelectionGap):
+        (WebCore::RenderBlock::fillRightSelectionGap):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2009-11-10  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Speed up syntax highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=31291
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine): Replace the line content node.
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+
+2009-11-09  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove session storage setting
+        https://bugs.webkit.org/show_bug.cgi?id=31279
+
+        Remove session storage from Settings.  It was added temporarily so we could
+        disable it by default at runtime in Chromium.  We now disable these things in a
+        different way, so it's time to remove it.  Qt also depended on this setting for
+        a short period of time, but after talking to them we agreed that it should be
+        removed.
+
+        This bug is the second half of https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson and Darin Adler.
+
+        WebCore part of making full-screen video pause during scrubbing.
+
+        * WebCore.Video.exp: Sorted and added HTMLMediaElement::beginScrubbing()
+        and HTMLMediaElement::endScrubbing().
+
+2009-11-10  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reapply 50562 reverted by 50588 due to issues with sandboxing (should be fine now).
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        WebKit coding style fixes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Remove build failure introduced by earlier build fix.
+
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Is this the last build fix? grep tells me yes.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Hopefully the last one.  Why aren't these autogenerated?
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Another chrome build fix.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Yet another chrome buildfix
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Chrome build fix.
+
+        * bindings/v8/V8Index.h:
+
+2009-11-10  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Removal of various and sundry style-violating nits.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Fix playback rate setter by remembering the rate was changed. Also
+        correctly handle reverse playback by doing a seek from end to
+        beginning of the media.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename 3D Canvas related classes to use WebGL prefix
+        https://bugs.webkit.org/show_bug.cgi?id=29095
+
+        Automatic rename of all WebGL related types from Canvas* to
+        WebGL* per more recent version of the WebGL spec.
+
+        Due to the automatic rename I've removed the 600+ line change list.
+
+2009-11-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feDisplacementMap is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=31255]
+
+        This is the implementation of the SVG filter effect
+        feDisplacementMap. 
+
+        Test: svg/filters/feDisplacementMap.svg
+
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+
+2009-11-09  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a comment about null strings and hash functions.
+        https://bugs.webkit.org/show_bug.cgi?id=29118
+
+        * platform/text/StringHash.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Compiler warnings in InspectorResource.h
+        https://bugs.webkit.org/show_bug.cgi?id=29231
+
+        Fix compilation warnings by removing addition operation on an enum type.
+
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::hasChange):
+        (WebCore::InspectorResource::Changes::set):
+        (WebCore::InspectorResource::Changes::setAll):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
+        since adjustment of RW-section base address will be needed for all new symbian
+        tool chains, specifically for arm and gcc compilation targets.
+        Also, change target address to 0xE00000 to be sufficient for all targets.
+
+        * WebCore.pro:
+
+2009-11-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash when inspecting
+        WebCore\manual-tests\inspector\dom-mutation.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=31259
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
+        https://bugs.webkit.org/show_bug.cgi?id=31140
+
+        QtNetwork interprets null string as request to remove the header, not add it.
+        Replace null values with empty values before passing them to QtNetwork.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-09  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix handling of alpha channel when using wxWidgets 2.9: it was
+        simply ignored before resulting in transparent areas being black in PNG
+        images for example.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30823
+
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        No new tests as there is no functional change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyleSelector):
+        * editing/TextIterator.cpp:
+        (WebCore::pushFullyClippedState):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::parseNumberValueAndUnit):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+
+2009-11-09  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Clip graphics context to reduce calculation.
+
+        No new tests because this change only affects performance.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+
+2009-11-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        showTree(CounterNode*) generates too little info and has too many spaces.
+        https://bugs.webkit.org/show_bug.cgi?id=31212
+
+        No new tests as the change has no functional effect it is just for
+        improved debugging.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        Changed to also show addresses of parent, next and previous
+        siblings.
+
+2009-11-09  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Moves Mac implementation of setUseSecureKeyboardEntry to Frame.cpp and
+        enables it PLATFORM(CHROMIUM) in addition to PLATFORM(MAC).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31083
+
+        No new tests; implementation is unchanged.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/mac/FrameMac.mm:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Make XP_UNIX tests consistent
+        https://bugs.webkit.org/show_bug.cgi?id=31250
+
+        No new tests as there is no functional change.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Test if XP_UNIX is defined
+        instead of the value of the macro
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Test if the XP_UNIX is
+        defined instead of using the PLATFORM macro to be consistent
+        (WebCore::PluginView::getValue): Ditto.
+
+2009-11-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Thunk to the main thread from ~Database to deref Database's m_document.
+
+        If the Database was the Document's last referrer, then ~Document occurs on the
+        Database thread, and ASSERT(!m_styleRecalcTimer.isActive()) hits a main thread
+        ASSERT in debug builds.
+
+        * storage/Database.cpp:
+        (WebCore::derefDocument):
+        (WebCore::Database::~Database):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::updateCanHaveScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+2009-11-09  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: CSS syntax highlighter doesn't recognize negative numbers
+        https://bugs.webkit.org/show_bug.cgi?id=31257
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open
+        https://bugs.webkit.org/show_bug.cgi?id=31252
+
+        Route F1-F12 keypresses in the Console view to the current panel if there is one.
+
+        Test: manual-tests/inspector/debugger-shortcuts-with-console-opened.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/utilities.js:
+        ():
+        * manual-tests/inspector/debugger-shortcuts-with-console-opened.html: Added.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
+        https://bugs.webkit.org/show_bug.cgi?id=31208
+
+        After r42483, the credentials are no longer passed to the network request
+        in the URL of the request.
+        Pass the credentials from XMLHTTPRequest to the network request, the same
+        way that other ports do.
+
+        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Unreviewed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Roll back r50657 because it breaks the MAC builds.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class IconDatabaseClient - WebCore/loader/icon/IconDatabase.cpp:89
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=31163
+
+        Inherits DocLoader class from Noncopyable because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:370 and 
+        it is no need to be copyable.
+
+        * loader/DocLoader.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's Tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=31162
+
+        Inherits Tokenizer class from Noncopyable because (its child class)
+        ImageTokenizer instantiated by 'new' in WebCore/loader/ImageDocument.cpp:178 
+        and it is no need to be copyable.
+
+        * dom/Tokenizer.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DeleteButtonController
+        https://bugs.webkit.org/show_bug.cgi?id=31105
+
+        Inherits DeleteButtonController class from Noncopyable because it is 
+        instantiated by 'new' in WebCore/editing/Editor.cpp:919 and
+        it is no need to be copyable.  
+
+        * editing/DeleteButtonController.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        Expose Page::tabKeyCyclesThroughElements as a property of
+        WebKitWebView.
+
+        No new tests; fast/events/keypress-insert-tab.html is no longer skipped.
+
+        * platform/gtk/KeyEventGtk.cpp: Correct m_text for tab key presses.
+        (WebCore::singleCharacterString):
+
+2009-11-09  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix a crasher that occurred with text which included newline
+        chars in the markup.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
+        https://bugs.webkit.org/show_bug.cgi?id=31144
+
+        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
+        documents that end prematurely but are not considered invalid by QXmlStream.
+        This is to stay compatible with the libxml2 implementation.
+        However, that code path would be also hit in situations when it should not,
+        i.e. the error would have already been caught and handled. As a result, the
+        same error would be reported twice.
+
+        No new tests, because the problem is already covered by
+        fast/parser/xml-declaration-missing-ending-mark.html.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+
+2009-11-08  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector should support copy() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=31238
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyText): Added.
+        * inspector/InspectorBackend.h: Added copyText
+        * inspector/InspectorBackend.idl: Added copyText
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._copy): Added.
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-08  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 WorkerContextExecutionProxy does not handle SharedWorkers
+        https://bugs.webkit.org/show_bug.cgi?id=31226
+
+        Now checks to see what type of context is active and creates the
+        appropriate wrapper (DEDICATEDWORKERCONTEXT vs SHAREDWORKERCONTEXT).
+
+        Added support for converting to SharedWorkers and SharedWorkerContexts.
+
+        Test: Existing layout tests cover this case (start passing in Chrome).
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Now generates the right type of DOMWrapper for SharedWorkerContexts.
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        Added support for SHAREDWORKERCONTEXT.
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        Added support for SharedWorker and SharedWorkerContext.
+
+2009-11-08  Johnny Ding  <johnnyding.webkit@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31224
+        [V8] Return StyleSheet object instead of HTMLStyleElement w/document.styleSheets named property getter.
+
+        Test: fast/dom/StyleSheet/get-stylesheet-byname.html
+
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: "Search again" on scripts panel switches
+        to the script this search started with.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31243
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+
+2009-11-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Simplify Icon interface.
+        https://bugs.webkit.org/show_bug.cgi?id=31154
+
+        - Remove Icon::createIconForFile().  createIconForFiles() covers
+          createIconForFile()'s role.
+        - Remove FileChooser::chooseIcon()
+        - Change the parameter types of FileChooser constructor and the
+          factory method, String -> const Vector<String>&, in order to
+          support initialization with multiple files.
+        - Remove the icon loading code in IconChromiumWin.cpp, which
+          doesn't work because of the sandbox.
+
+        No tests because it's just a refactoring.
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::create):
+        (WebCore::FileChooser::chooseFile):
+        (WebCore::FileChooser::chooseFiles):
+        * platform/FileChooser.h:
+        * platform/graphics/Icon.h:
+        * platform/graphics/chromium/IconChromiumLinux.cpp:
+        * platform/graphics/chromium/IconChromiumMac.cpp:
+        * platform/graphics/chromium/IconChromiumWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/haiku/IconHaiku.cpp:
+        * platform/graphics/mac/IconMac.mm:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/wx/IconWx.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Allows same-origin plugin-based content to load.
+
+        Test: http/tests/security/xssAuditor/object-src-inject.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. 
+        (WebCore::XSSAuditor::isSameOriginResource): Added.
+        * page/XSSAuditor.h:
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Changed this to not
+        use a date parser that needs ExecState passed.
+        
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        Build fix for https://bugs.webkit.org/show_bug.cgi?id=31219
+        Clean up GraphicsContext's current concept of ColorSpace
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] committing style edit
+        clears elements panel selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31242
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-11-08  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Holger Freyther.
+
+        ResourceRequest to be class instead of struct
+        https://bugs.webkit.org/show_bug.cgi?id=30670
+
+        Started as a compilation fix for Symbian where the compiler makes a distinction between
+        class and struct in function argument signatures.
+        Changed all forward declarations of ResourceRequest to have class in the forward
+        declaration instead of struct and changed the definition of ResourceRequest to be class
+        and added access qualifiers where missing. Additionally two references of friend
+        struct ResourceRequestBase changed to class instead.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoadNotifier.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequest.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/curl/ResourceRequest.h:
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/soup/ResourceRequest.h:
+        * xml/XMLHttpRequest.h:
+
+2009-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7363434> Crash inside RenderObject::localToAbsolute
+        below FrameView::layout
+        https://bugs.webkit.org/show_bug.cgi?id=31093
+
+        Test: fast/block/positioning/relative-positioned-inline-container.html
+
+        In <http://trac.webkit.org/changeset/19148>, setStaticY() was changed
+        to mark the object for layout, doing so without marking its ancestors.
+        However, RenderBlock::skipLeadingWhitespace and
+        RenderBlock::skipTrailingWhitespace() call setStaticY() on a relative-
+        positioned inline container, causing it to be marked for layout without
+        ever going back to give it layout, and thus layout could end with a
+        dirty object still in the tree, leading to all sorts of badness.
+
+        The fix is to revert setStaticY() to not marking the object dirty, and
+        instead do it in the call sites that require it, which are in
+        RenderBlock and RenderFlexibleBox.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::setStaticY):
+
+2009-11-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20780
+        
+        Fixes an issue where the onchange event handler is not fired when the 
+        input field is autocompleted.
+        
+        We cannot test this using DRT since DRT cannot emulate autocompletion.
+        So, a manual-test is included.
+
+        Tests: manual-tests/autocompletion-fire-onchange.html
+
+        * manual-tests/autocompletion-fire-onchange.html: Added.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-11-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Mark redrawn areas on image surfaces as dirty.
+
+        This is required to conform to the Cairo API, but is currently only
+        used by debugging tools like cairo-trace.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::putImageData):
+
+2009-11-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30878
+        [Gtk] atk_text_get_text() fails in entries when the end_offset is -1
+
+        If the end_offset is -1, use the String length as the end_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_text):
+
+2009-11-06  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31219 Clean up 
+        GraphicsContext's current concept of ColorSpace
+
+        ColorSpace is now called ColorType. The variables on the state we 
+        appropriately re-named as well. I removed strokeColorSpace() and 
+        fillColorSpace() from GraphicsContext since they were never called. 
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-11-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31177>.
+        Web Inspector: Bind backspace to delete cookies and DOM Storage.
+        
+        Refactor editing code from DOMStorageDataGrid to DataGrid, so other
+        places in the inspector can use editing in DataGrid (added a FIXME for
+        some stuff that needs to be generalized).
+        
+        Also added deleting functionality to DataGrid, and implemented it for
+        Cookies and DOM Storage. The reason this patch is so big is because of
+        the refactoring of editing code, which won't be used yet in a cross-datagrid
+        way, but should be able to.
+        
+        Additionally, moved the callbacks members from DOMStorageDataGrid to
+        DOMStorageItemsView, which allowed us to delete DOMStorageDataGrid, to 
+        make the architecture of DOM Storage look a lot more like the Cookies view.
+        
+        Lastly, added a preventDefault call in ElementsTreeOutline to prevent the 
+        inspector from beeping at you when you delete an element.
+
+        * WebCore.gypi: Removed DOMStorageDataGrid.
+        * WebCore.vcproj/WebCore.vcproj: Removed DOMStorageDataGrid.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMStorageDataGrid.js: Removed.
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._editingCallback):
+        (WebInspector.DOMStorageItemsView.prototype.deleteSelectedRow):
+        (WebInspector.DOMStorageItemsView.prototype._deleteCallback):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype._ondblclick): Moved from DOMStorageDataGrid to DataGrid + Refactoring.
+        (WebInspector.DataGrid.prototype._startEditingColumnOfDataGridNode): Ditto.
+        (WebInspector.DataGrid.prototype._startEditing): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted.moveToNextIfNeeded): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted): Ditto.
+        (WebInspector.DataGrid.prototype._editingCancelled): Ditto.
+        (WebInspector.DataGrid.prototype.handleKeyEvent): Added case for delete/backspace.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): Added preventDefault call.
+        * inspector/front-end/WebKit.qrc: Removed DOMStorageDataGrid.
+        * inspector/front-end/inspector.html: Removed DOMStorageDataGrid.
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added an ExecState parameter.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+
+        Updated for JavaScriptCore internal API change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue): Updated for namespace change.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Pass 0 for ExecState, since we don't have one.
+        (This function probably shouldn't be using a JavaScript date parser
+        to begin with, but oh well.)
+
+2009-11-06  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        The associated webkit bug is https://bugs.webkit.org/show_bug.cgi?id=31067,
+        which affects Chromium only.
+        
+        Changes to V8HTMLDocumentCustom.cpp are as below:-
+        1. The HTMLDocumentOpen function would cause a crash in Chromium if
+           there was no calling javascript context. We now check for this case
+           and pass in NULL to the HTMLDocument::open function which can handle
+           a NULL document parameter.
+        2. The other functions like HTMLDocumentWrite, HTMLDocumentWriteln, etc
+           had ASSERTS for a NULL caller frame, which was bogus as it would crash
+           anyway. We now check for this case and return a failure.
+           
+        Changes to V8DOMWindowCustom.cpp are as below:-
+        1. Instead of failing the window.open call made by NPAPI for lack of a
+           calling javascript context, we now use the entered context as the calling
+           context.
+
+        Tests: plugins/document-open.html
+               plugins/window-open.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation error code UNKNOWN_ERROR is deprecated.
+        https://bugs.webkit.org/show_bug.cgi?id=31184
+
+        Remove this error code from PositionError, both for use from C++ code and from the JS object.
+
+        Updated fast/dom/Geolocation/error.html to test this.
+
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::): Remove ErrorCode::UNKNOWN_ERROR.
+        * page/PositionError.idl: Modified. Remove UNKNOWN_ERROR constant.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::startRequest): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::startUpdating): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+
+2009-11-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        The Implementation of feMorphology.
+        
+        Test: We have allready a test for feMorphology
+              svg/W3C-SVG-1.1/filters-morph-01-f.svg
+
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        V8DOMWindowCustom.cpp is missing WEB_SOCKETS guard on include.
+        https://bugs.webkit.org/show_bug.cgi?id=31209
+
+        Build fix only. No new tests possible.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Modified. Added WEB_SOCKETS guard on inclue of WebSockets.h.
+
+2009-11-06  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        V8 bindings do not support SharedWorkers as event targets
+        https://bugs.webkit.org/show_bug.cgi?id=31199
+
+        No new tests because existing layout tests suffice (they currently
+        crash on Chromium)
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        Added clause to create a DOM wrapper for SharedWorkers.
+
+2009-11-06  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not unnecessarly synchronzie in weak reference callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=31191
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+
+2009-11-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix resource content search.
+        https://bugs.webkit.org/show_bug.cgi?id=31202
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix ASSERT(currentStyle = renderStyle()).
+        https://bugs.webkit.org/show_bug.cgi?id=31152
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Revert 50562 because it broke Chromium. Not reviewed since this is a build fix and revert.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Cross-domain access to stylesheet text should not be allowed
+        https://bugs.webkit.org/show_bug.cgi?id=20527
+
+        Check whether whether the current document can read the cssRules from
+        the style sheet.  Firefox throws a security error here, but we return
+        null instead because that's what we usually do in these cases.
+
+        Test: http/tests/security/cannot-read-cssrules-redirect.html
+              http/tests/security/cannot-read-cssrules.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::cssRules):
+
+2009-11-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        If the Geolocation service fails to start, invoke the error callback asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=28276
+
+        All Geolocation callbacks must be invoked asynchronously.
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface
+
+        No new tests possible with current LayoutTestController.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::getCurrentPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::watchPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::startRequest): Modified. If the Geolocation service fails to start, set a fatal error on the notifier.
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * css/CSSInheritedValue.cpp:
+        * css/CSSInitialValue.cpp:
+        * css/CSSMediaRule.cpp:
+        * css/CSSNamespace.h:
+        * css/CSSProperty.cpp:
+        * css/CSSProperty.h:
+        * css/CSSRuleList.cpp:
+        * css/CSSRuleList.h:
+        * css/CSSSelector.h:
+        * css/CSSValueList.cpp:
+        * css/FontValue.cpp:
+        * css/MediaFeatureNames.cpp:
+        * css/MediaFeatureNames.h:
+        * css/Pair.h:
+        * css/SVGCSSStyleSelector.cpp:
+        * css/ShadowValue.cpp:
+        * css/StyleSheet.cpp:
+        * css/StyleSheetList.cpp:
+        * css/maketokenizer:
+        * dom/BeforeUnloadEvent.cpp:
+        * dom/BeforeUnloadEvent.h:
+        * dom/CSSMappedAttributeDeclaration.cpp:
+        * dom/EventNames.cpp:
+        * dom/EventTarget.cpp:
+        * dom/MappedAttributeEntry.h:
+        * dom/MouseRelatedEvent.h:
+        * dom/RangeException.h:
+        * dom/StyleElement.h:
+        * dom/Tokenizer.h:
+        * html/HTMLHeadElement.h:
+        * html/HTMLHeadingElement.cpp:
+        * html/HTMLHeadingElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageLoader.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.cpp:
+        * html/HTMLModElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLPreElement.cpp:
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTablePartElement.cpp:
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTitleElement.h:
+        * page/MouseEventWithHitTestResults.h:
+        * platform/StaticConstructors.h:
+        * platform/text/AtomicStringImpl.h:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * rendering/AutoTableLayout.h:
+        * rendering/CounterNode.cpp:
+        * rendering/EllipsisBox.cpp:
+        * rendering/EllipsisBox.h:
+        * rendering/FixedTableLayout.cpp:
+        * rendering/FixedTableLayout.h:
+        * rendering/HitTestRequest.h:
+        * rendering/HitTestResult.h:
+        * rendering/InlineRunBox.h:
+        * rendering/PointerEventsHitRules.cpp:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        * rendering/RenderFrameSet.cpp:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.cpp:
+        * rendering/SVGInlineTextBox.h:
+        * rendering/TableLayout.h:
+        * rendering/break_lines.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        * rendering/style/SVGRenderStyleDefs.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAElement.cpp:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimateColorElement.cpp:
+        * svg/SVGAnimateColorElement.h:
+        * svg/SVGAnimateElement.cpp:
+        * svg/SVGAnimateElement.h:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGAnimatedPathData.cpp:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.cpp:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.cpp:
+        * svg/SVGCircleElement.cpp:
+        * svg/SVGClipPathElement.cpp:
+        * svg/SVGColor.cpp:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        * svg/SVGDefsElement.cpp:
+        * svg/SVGDescElement.cpp:
+        * svg/SVGDescElement.h:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * svg/SVGElementInstanceList.cpp:
+        * svg/SVGElementInstanceList.h:
+        * svg/SVGEllipseElement.cpp:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGGElement.cpp:
+        * svg/SVGGradientElement.cpp:
+        * svg/SVGHKernElement.idl:
+        * svg/SVGLangSpace.cpp:
+        * svg/SVGLangSpace.h:
+        * svg/SVGLength.cpp:
+        * svg/SVGLength.h:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.cpp:
+        * svg/SVGLengthList.h:
+        * svg/SVGLineElement.cpp:
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        * svg/SVGLocatable.h:
+        * svg/SVGMaskElement.cpp:
+        * svg/SVGMatrix.idl:
+        * svg/SVGMetadataElement.cpp:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGMetadataElement.idl:
+        * svg/SVGNumber.idl:
+        * svg/SVGNumberList.cpp:
+        * svg/SVGNumberList.h:
+        * svg/SVGPaint.cpp:
+        * svg/SVGPathElement.cpp:
+        * svg/SVGPathSeg.h:
+        * svg/SVGPathSegArc.cpp:
+        * svg/SVGPathSegArc.h:
+        * svg/SVGPathSegClosePath.cpp:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGPathSegCurvetoCubic.cpp:
+        * svg/SVGPathSegCurvetoCubic.h:
+        * svg/SVGPathSegCurvetoCubicSmooth.cpp:
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        * svg/SVGPathSegCurvetoQuadratic.cpp:
+        * svg/SVGPathSegCurvetoQuadratic.h:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.cpp:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.h:
+        * svg/SVGPathSegLineto.cpp:
+        * svg/SVGPathSegLineto.h:
+        * svg/SVGPathSegLinetoHorizontal.cpp:
+        * svg/SVGPathSegLinetoHorizontal.h:
+        * svg/SVGPathSegLinetoVertical.cpp:
+        * svg/SVGPathSegLinetoVertical.h:
+        * svg/SVGPathSegMoveto.cpp:
+        * svg/SVGPathSegMoveto.h:
+        * svg/SVGPatternElement.cpp:
+        * svg/SVGPoint.idl:
+        * svg/SVGPointList.cpp:
+        * svg/SVGPointList.h:
+        * svg/SVGPolyElement.cpp:
+        * svg/SVGPolygonElement.cpp:
+        * svg/SVGPolygonElement.h:
+        * svg/SVGPolylineElement.cpp:
+        * svg/SVGPolylineElement.h:
+        * svg/SVGPreserveAspectRatio.cpp:
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRect.idl:
+        * svg/SVGRectElement.cpp:
+        * svg/SVGRenderingIntent.h:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGSetElement.cpp:
+        * svg/SVGSetElement.h:
+        * svg/SVGStopElement.cpp:
+        * svg/SVGStringList.cpp:
+        * svg/SVGStringList.h:
+        * svg/SVGStylable.cpp:
+        * svg/SVGStylable.h:
+        * svg/SVGStyleElement.cpp:
+        * svg/SVGStyleElement.h:
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        * svg/SVGSymbolElement.cpp:
+        * svg/SVGTRefElement.cpp:
+        * svg/SVGTSpanElement.cpp:
+        * svg/SVGTSpanElement.h:
+        * svg/SVGTests.h:
+        * svg/SVGTextElement.cpp:
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTextPositioningElement.cpp:
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransform.cpp:
+        * svg/SVGTransform.h:
+        * svg/SVGTransform.idl:
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.h:
+        * svg/SVGURIReference.h:
+        * svg/SVGUnitTypes.h:
+        * svg/SVGUseElement.cpp:
+        * svg/SVGViewElement.cpp:
+        * svg/SVGZoomAndPan.cpp:
+        * svg/SVGZoomAndPan.h:
+        * svg/SVGZoomEvent.cpp:
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION Clean up security origin usage in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=31188
+
+        Clean up security origin usage in DOM Storage.  This fixes a bug in my
+        refactoring here: https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Instead of having StorageAreaSync's constructor (which is called in the
+        constructor for StorageAreaImpl) calling a method on StoargeAreaImpl to get the
+        database identifier, simply have StorageAreaImpl pass the identifier into
+        StorageAreaSync.
+
+        No test because there's no change in externally observable behavior.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need notification of scrolling frame
+        https://bugs.webkit.org/show_bug.cgi?id=31145
+
+        Adds FrameLoaderClient::didChangeScrollOffset that is called when
+        the frame scrolls. This will be used to know when history state
+        needs to be updated.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didChangeScrollOffset):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::valueChanged):
+
+2009-11-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Update bindings to use new API for external arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31181
+
+        No new tests; covered by existing WebGL tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/custom/V8CanvasArrayCustom.h:
+        (WebCore::constructCanvasArray):
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        50561 introduces a custom method for SVGMatrix, we need to implement
+        this in V8.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Adding definition for V8SVGMatrixMultiply.
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Implement V8SVGMatrixMultiply according to the same method in JSC.
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50569 since it broke QT.  Build fix and just a revert, so no review.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSessionStorageEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Web Inspector doesn't show CSS rules properly for iframes
+
+        https://bugs.webkit.org/show_bug.cgi?id=30884
+
+        Test: inspector/styles-iframe.html
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getStyles):
+        (InjectedScript.getComputedStyle):
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        (WebInspector.evaluateForTestInFrontend.invokeMethod):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-11-05  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Geoffrey Garen and Dimitri Glazkov.
+
+        Rehashing of EventListenerMap leads to loss of EvenListenerList.
+        https://bugs.webkit.org/show_bug.cgi?id=31027
+
+        Tested by new fast/events/event-listener-map-rehash-crash.html.
+
+        EventListenerMap modified to store pointers to listener vectors:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTargetData::~EventTargetData):
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+
+        Usages updated after interface changes:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
+
+2009-11-05  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Add missing initialization for m_createdByParser.
+        https://bugs.webkit.org/show_bug.cgi?id=31089
+
+        Test: fast/dom/beforeload/pi-before-load.xhtml in Valgrind
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::ProcessingInstruction):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 2/2.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Bug 31108 - [V8] REGRESSION: Pause on exception is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31108
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        We should not bubble up events if we drag something to an iframe that
+        has an invalid source.
+        https://bugs.webkit.org/show_bug.cgi?id=30469
+
+        Test: http/tests/misc/bubble-drag-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDragAndDropForTarget):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        * page/EventHandler.h:
+        (WebCore::EventHandler::):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: speed up Timelines Clear by a factor of thousands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31160
+
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeChildren):
+
+2009-11-05  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If high memory usage is detected, hint to V8 that it might be due
+        to external objects retained by V8 objects.
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GetMemoryUsageInMB):
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Jeff Schiller  <codedread@gmail.com>
+
+        Reviewed by Simon Fraser.
+
+        Correct order of matrix multiplication for SVGMatrix.
+        https://bugs.webkit.org/show_bug.cgi?id=16062
+
+        Test: svg/dom/SVGMatrix-interface.xhtml
+
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        * svg/SVGMatrix.idl:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make resource-related records in timeline
+        actually take some time.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31139
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        This is a re-submit of 50519.  LocalStorageTask should have never been ref
+        counted.  I've removed that and switched a PassRefPtr over to a PassOwnPtr.
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Calling databaseIdentifier on LocalStorage's background thread is not safe.
+        https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Calling SecurityOrigin::databaseIdentifier on LocalStorage's background thread
+        is not safe.  databaseIdentifier does a bunch of string concatenation which
+        ref-counts StringImpls in some cases.  This was caught by valgrind thread
+        sanitizer: http://code.google.com/p/chromium/issues/detail?id=25645
+
+        There's no way to test for such racyness, unfortunately.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        * storage/StorageSyncManager.h:
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Clean up StorageAreaSync
+        https://bugs.webkit.org/show_bug.cgi?id=31100
+
+        Major fixes: Break the ref count cycle for StorageArea on the main
+        thread, not the background thread since the latter is not safe.
+        Length() needs to block on the import completing.
+
+        Small fixes: setItem needs to handle the copy on write case even if it
+        has an exception.  setItem and removeItem should just bail from the
+        the function if the value hasn't changed rather than wrapping the end
+        in an if block.  Clear should only send an event if it wasn't already
+        cleared.  StorageAreaSync should assert that the final sync was
+        scheduled.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::length):
+          Forgot to block on the import.
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::setItem):
+          Handle the copy on write case even when there's an exception.
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::performImport):
+        (WebCore::StorageAreaSync::markImported):
+        (WebCore::StorageAreaSync::blockUntilImportComplete):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResource
+        https://bugs.webkit.org/show_bug.cgi?id=31114
+
+        Inherits CachedResource class from Noncopyable because its (its child
+        class) CachedCSSStyleSheet instantiated by 'new' in WebCore/loader/Cache.cpp:75 
+        and it is no need to be copyable.
+
+        * loader/CachedResource.h:
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Separate the difference between HAVE(CGINTERPOLATION_MEDIUM), which
+        is true when building on 10.6 or later, and USE(CGINTERPOLATION_MEDIUM)
+        which is true when targeting 10.6 or later.
+
+        HAVE(CGINTERPOLATION_MEDIUM) indicates that kCGInterpolationMedium
+        is present in the CGInterpolationQuality enum, and must be handled
+        by a switch that has cases for each enumerated value.
+
+        USE(CGINTERPOLATION_MEDIUM) indicates that the product will only run
+        on 10.6 or later, and that CoreGraphics will understand when
+        InterpolationMedium is mapped to kCGInterpolationMedium at runtime.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2009-11-04  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=31138
+
+        Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-11-04  Timothy Hatcher  <timothy@apple.com>
+
+        Update the Web Inspector Timeline panel to better match the mock-up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31150
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        * inspector/front-end/inspector.css:
+
+2009-11-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25439
+        Deleting when in front of a block image removes character from previous paragraph
+
+        Added editing/deleting/25439-{1,2,3}.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Block images, tables and HRs cannot 
+        be made inline with other content.  Instead of merging, just move the caret to just before 
+        the selection we deleted.
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement): Added a FIXME.  This function begins iterating up from pos.node(), which 
+        doesn't necessarily contain pos (suppose pos was [img, 0]).
+        (WebCore::lastInSpecialElement): Ditto.
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Moved from visible_units.cpp.  Added a check for non-inline images.
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Use moved/renamed function.  Removed FIXME.  The problem causing 
+        5027702 is now squarely in first/lastInSpecialElement
+        (WebCore::endOfParagraph): Ditto.
+        
+2009-11-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Hang in Mail on attempting to change indent level.
+        <rdar://problem/7131805>
+        https://bugs.webkit.org/show_bug.cgi?id=31127
+
+        The hang was caused by an infinite loop inside outdentRegion.
+        The code did not account for the fact that, when a list item
+        contains multiple paragraphs, outdent moves all paragraphs at
+        once, invalidating some of the positions we keep track of in the loop.
+        Some code refactoring has also been done to minimize duplicated code.
+        
+        Test: editing/execCommand/outdent-multiparagraph-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Moved code in common with
+        outdentRegion to doApply.
+        (WebCore::IndentOutdentCommand::outdentRegion): Fixed endless loop.
+        (WebCore::IndentOutdentCommand::doApply): Some code refactoring.
+        * editing/IndentOutdentCommand.h: Added VisiblePosition parameters to
+        indentRegion and outdentRegion.
+
+2009-11-04  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider doesn't have a thumb
+        https://bugs.webkit.org/show_bug.cgi?id=31135
+
+        Fixed an incorrect if statement that prevents volume slider
+        being updated.
+
+        The statement checks if the slider value equals to the current
+        volume value of the media control to avoid updating the volume
+        slider. Updating the volume slider control shouldn't be within
+        this condition because we explicitly set them to be equals
+        during creation of the controls and also when mouse events are
+        received on the volume control.
+
+        No new tests because existing code breaks:
+        LayoutTests/media/video-volume-slider.html
+
+        It should now start passing on Chromium.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Update the volume slider regardless of the current volume value
+        of the media control.
+
+2009-11-04  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by David Levin.
+
+        Need to properly disable applicationCache at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30417
+
+        Adding applicationCacheEnabled bit to V8 RuntimeEnabledFeatures.
+
+        No new exposed functionality, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-11-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31143
+        Assertion failure in CredentialStorage::set() when proxy credentials are being set
+
+        No test, cannot test proxy behavior.
+
+        * platform/network/CredentialStorage.cpp: (WebCore::CredentialStorage::set): Account for the
+        possibility of null url. Release mode changes are likely inconsequential - e.g. we used to
+        add "://" to origin set, which is weird, but safe.
+
+2009-11-04  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Leftover Breakpoints in the Sidebar Pane
+        https://bugs.webkit.org/show_bug.cgi?id=30659
+
+        No new tests.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Use a different method to identify the webkit port in
+        InspectorBackent::platform().
+        This corrects the inspector expected behavior with Qt on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=31116
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::platform):
+        (WebCore::InspectorBackend::port):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/InspectorControllerStub.js:
+        (.WebInspector.InspectorControllerStub.prototype.port):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+
+        Also remove all conditional code and workarounds for older versions of
+        Cairo.
+        In particular, gain image quality by removing the use of
+        CAIRO_FILTER_NEAREST when rendering images and use the default
+        bilinear filter instead.
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::boundingRect):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2009-11-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Restore removed string conversion after cleanup.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Need to implement ARIA role="combobox"
+        https://bugs.webkit.org/show_bug.cgi?id=31096
+
+        Test: accessibility/aria-combobox.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isComboBox):
+        (WebCore::AccessibilityObject::isExpanded):
+        (WebCore::AccessibilityObject::expandObject):
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::expandObject):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes naming inconsistencies in TimelineRecordFactory.
+        https://bugs.webkit.org/show_bug.cgi?id=31132
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadRecord):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptRecord):
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+        (WebCore::TimelineRecordFactory::createPaintRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2009-11-04  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Followon to bug 31080, which protects Timeline
+        instrumentation in the case where InspectorTimelineAgent
+        is enabled or disabled during an event dispatch.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31121
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inspectorTimelineAgent):
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/DOMWindow.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50519 while I work out what went wrong.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThreadStart):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add basic support for resource events and marks.
+        Couple of drive-by fixes. Enabling the panel!
+
+        https://bugs.webkit.org/show_bug.cgi?id=31130
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClicked):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Small cleanup: avoid unnecessary wxString::mb_str() calls.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds lightweight network resources to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31065
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
+        https://bugs.webkit.org/show_bug.cgi?id=31077
+
+        Allow sending the response body under the same conditions that we
+        allow it to finish without reporting an error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Sort WebCore.base.exp
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.base.exp: Sorted.
+
+2009-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert r50496 because it broke all layout tests on QtBuildBot.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        (WebCore::FontCache::getCachedFontData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::releaseFontData):
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::addClient):
+        (WebCore::FontCache::removeClient):
+        (WebCore::FontCache::invalidate):
+        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::determinePitch):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31044
+        [Gtk] assertion when webkit_accessible_get_index_in_parent attempts to get parent of the web view
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkParentOfWebView):
+        (webkit_accessible_get_index_in_parent):
+        (webkit_accessible_get_parent):
+
+2009-11-04  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter and Naiem Shaik.
+        Patch 2/4 - Moving TextCodecs to GLib
+        
+        Added probing for a hard-coded lists of text encodings.
+        The basis of this list is taken from the encodings supported by iconv,
+        then extended by e.g. tis-620, windows-1251, euc-kr, windows-1253 and
+        a number of Chinese ones.
+
+        Probing is necessary with the current design of text codecs
+        as iconv/GLib do not support enumerating available encodings.
+
+        * GNUmakefile.am:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/gtk/TextCodecGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::newTextCodecGtk):
+        (WebCore::TextCodecGtk::isEncodingAvailable):
+        (WebCore::TextCodecGtk::registerEncodingNames):
+        (WebCore::TextCodecGtk::registerCodecs):
+        (WebCore::TextCodecGtk::registerBaseEncodingNames):
+        (WebCore::TextCodecGtk::registerBaseCodecs):
+        (WebCore::TextCodecGtk::registerExtendedEncodingNames):
+        (WebCore::TextCodecGtk::registerExtendedCodecs):
+        (WebCore::TextCodecGtk::TextCodecGtk):
+        (WebCore::TextCodecGtk::~TextCodecGtk):
+        (WebCore::TextCodecGtk::releaseIConv):
+        (WebCore::TextCodecGtk::createIConvDecoder):
+        (WebCore::TextCodecGtk::createIConvEncoder):
+        (WebCore::TextCodecGtk::decode):
+        (WebCore::TextCodecGtk::encode):
+        * platform/text/gtk/TextCodecGtk.h: Added.
+
+2009-11-04  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Unify redudant methods which will always return the same value.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31035
+        [GTK] some accessibility tests hitting assertion in debug builds
+
+        Removes the assertions in webkit_accessible_ref_child; adds sanity checks.
+        Any app or AT can attempt to ref a child at a bogus index.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_ref_child):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Use gst_element_class_set_details_simple()
+
+        Cosmetic change, just code simplification
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_base_init):
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds paint rectangle information to TimelineAgent's didPaint callback.
+        https://bugs.webkit.org/show_bug.cgi?id=31087
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createPaintTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-11-04  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        This patch adds API to the console object for annotating the
+        inspector timeline. This allows developers to mark logical
+        checkpoints in their apps and have them overlaid in the event
+        record tree.
+
+        tests updated: LayoutTests/fast/dom/Window/window-properties.html
+        https://bugs.webkit.org/show_bug.cgi?id=31082
+
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::markTimeline):
+        * inspector/InspectorController.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * page/Console.cpp:
+        (WebCore::Console::markTimeline):
+        * page/Console.h:
+        * page/Console.idl:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed build fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Handle fonts like the other ports
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29856
+
+        Test: svg/text/text-font-invalid.html
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformData::FontPlatformData):
+        Added a boolean to identify deleted value in the hash table.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Leopard build fix
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):
+        (WebCore::core):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix an assertion failure in core(NSURLProtectionSpace *) by handling NTLM
+        authentication in AuthenticationMac
+
+        * platform/network/mac/AuthenticationMac.mm:
+
+2009-11-03  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes a problem where the timeline instrumentation crashes if
+        timeline profiling is enabled or disabled in the middle of an
+        event dispatch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31080
+
+        Test: inspector/timeline-trivial.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::fired):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Allow a frame to go back to copy-on-scroll when it ceases being overlapped
+
+        The code was not testing slow-scrolling frames for overlappedness, thinking the answer
+        would not matter. That is not the case if the only reason for the slow-scrolling is
+        being overlapped.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped): Added. Returns whether there is any
+        reason besides being overlapped that the frame would need to fully repaint on scroll.
+        * page/FrameView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Use useSlowRepaintsIfNotOverlapped().
+
+2009-11-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Qt build fix.
+
+        Need to use right capitalization for include file.
+
+        * page/Navigator.cpp:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate from top bar filters to check boxes in Timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31081
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClick):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clear overview on Clear action and panel reset.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31078
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-03  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Imported action and rules python files that WebCore.gyp depends on. 
+        These files used to live in chromium.org and deal mostly with auto-generation
+        of code by wrapping existing webkit perl scripts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31071
+
+        * WebCore.gyp/WebCore.gyp: Fixed paths in actions and rules.
+        * WebCore.gyp/scripts/action_csspropertynames.py: Added.
+        * WebCore.gyp/scripts/action_cssvaluekeywords.py: Added.
+        * WebCore.gyp/scripts/action_makenames.py: Added.
+        * WebCore.gyp/scripts/action_maketokenizer.py: Added.
+        * WebCore.gyp/scripts/action_useragentstylesheets.py: Added.
+        * WebCore.gyp/scripts/rule_binding.py: Added.
+        * WebCore.gyp/scripts/rule_bison.py: Added.
+        * WebCore.gyp/scripts/rule_gperf.py: Added.
+
+2009-11-03  Bradley Green  <brg@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement window.navigator.registerProtocolHandler in webkit,
+        https://bugs.webkit.org/b/29651
+
+        Also implemented its sister API window.navigator.registerContentHandler.
+
+        These methods are as described in the HTML5 specification which can be
+        found here,
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registercontenthandler
+
+        As specified in the document, the behavior of the browser is determined
+        by the current registered handler.  The state of a registered handler
+        can change at any time, with the user clearing a registered handler,
+        registering a different page as handler, or deferring the hander to the
+        OS.  If webkit was to track the state of the currently registered
+        handlers, it would need more APIs and complexity to keep in sync with
+        user actions reported to webkit from the UA.  For simplicity, the state
+        of protocol handlers should be kept isolated from webkit and webkit only
+        notifies the UA that a page has made the call.  The UA is then
+        responsible for correctly handling the registerProtocolHandler call and
+        the redirects which result from registration.
+
+        We do however follow the specification in insuring that the reserved
+        schemes and mimeTypes are not passed to the UA as custom handler
+        registration tests.  We also insure that the "%s" token is present as
+        required by the specification.
+
+        Updated test expectations for window.clientInformation and navigator
+        objects.
+
+        Tests: fast/dom/registerContentHandler.html
+               fast/dom/registerProtocolHandler.html
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::registerProtocolHandler):
+        (WebCore::Chrome::registerContentHandler):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::registerProtocolHandler):
+        (WebCore::ChromeClient::registerContentHandler):
+        * page/Navigator.cpp:
+        (WebCore::verifyCustomHandlerURL):
+        (WebCore::verifyProtocolHandlerScheme):
+        (WebCore::Navigator::registerProtocolHandler):
+        (WebCore::verifyProtocolHandlerMimeType):
+        (WebCore::Navigator::registerContentHandler):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+
+2009-11-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31079 - Remove #include "Page.h" from Document.h
+
+        No new tests. (No change in functionality)
+
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorTimelineAgent): Moved from Document.h
+        * dom/Document.h:
+
+        Include "Page.h" directly:
+        * html/HTMLVideoElement.cpp:
+        * loader/RedirectScheduler.cpp:
+        * page/History.cpp:
+        * rendering/MediaControlElements.cpp:
+        * storage/StorageAreaImpl.cpp:
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hover over JS "things" in source and see their values
+        https://bugs.webkit.org/show_bug.cgi?id=30913
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: update timeline content boundaries on timer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31072
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31070
+        Fix <rdar://problem/7194735> Crashes at RenderText::RenderText()
+        Fix <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        Tests: plugins/attach-during-destroy.html
+               plugins/destroy-reentry.html
+
+        These crashes were caused by plug-in code running during detach(),
+        causing re-entry into RenderWidget::destroy() in one case and a call
+        into attach() in the other. The fix is to prevent plug-in code from
+        being called at certain unsafe times (during attach(), detach(), and
+        recalcStyle()) by deferring changes to the widget hierarchy.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Suspend widget hierarchy updates
+            during style recalculation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Suspend widget hierarchy updates during
+            attach().
+        (WebCore::Element::detach): Suspend widget hierarchy updates during
+            detach().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::widgetNewParentMap): Returns a static map of pending changes
+            to the widget hierarchy.
+        (WebCore::RenderWidget::suspendWidgetHierarchyUpdates): Increments the
+            suspend count.
+        (WebCore::RenderWidget::resumeWidgetHierarchyUpdates): Decrements the
+            suspend count. If the count is going to be zero, updates the widget
+            hierarchy by executing the pending changes stored in the map.
+        (WebCore::moveWidgetToParentSoon): Updates the widget hierarchy
+            immediately or makes or updates an entry in the map, depending on
+            whether updates are suspended.
+        (WebCore::RenderWidget::destroy): Removed earlier bandaid fix for
+            <rdar://problem/6937089>.
+        (WebCore::RenderWidget::setWidgetGeometry): Assert that widget updates
+            are not suspended, because this function updates the widget’s
+            bounds, which can result in arbitrary native and JavaScript code
+            execution. I think this assertion is true thanks to some deferred-
+            update mechanisms that have already been deployed in other places
+            in the code.
+        (WebCore::RenderWidget::setWidget): Call moveWidgetToParentSoon instead
+            of changing the widget hierarchy directly.
+        * rendering/RenderWidget.h: Declared suspendWidgetHierarchyUpdates()
+            and resumeWidgetHierarchyUpdates().
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: only show timeline records that contribute
+        to the current window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31069
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-03  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Watch expression editor should stay open after Add button was clicked
+        https://bugs.webkit.org/show_bug.cgi?id=31049
+
+        No new tests, was a regression, use existing manual test.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+
+2009-11-03  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix an off-by-one in the CSS lexer that causes memory corruption in
+        hard-to-trigger circumstances.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30827
+
+        Test: fast/css/end-of-buffer-crash.html
+
+        * css/maketokenizer: Add comments, fix off-by-one.
+
+2009-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash due to double-destroy related to CSS run-in property
+        https://bugs.webkit.org/show_bug.cgi?id=31034
+        rdar://problem/7328458
+
+        Test: fast/css/run-in-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy): Reorder destruction so the
+        continuation is destroyed after anonymous children. See comment
+        in the code for more details of why this is right.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy): Ditto.
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix exception in ElementsPanel.js when moving pointer out of crumbs and window
+
+        There might be no new node under mouse if the pointer is moved out of the window
+        in which case we get an exception.
+        https://bugs.webkit.org/show_bug.cgi?id=31061
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
+
+2009-11-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the dom directory of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31053
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and these are no need to be copyable:
+
+        class EventNames - 'new' call: WebCore/platform/ThreadGlobalData.cpp:73
+        struct PerformTaskContext - 'new' call: WebCore/dom/Document.cpp:4581
+        class EventData - 'new' call: WebCore/dom/MessagePortChannel.cpp:38
+        struct NodeListsNodeData - 'new' call: WebCore/dom/NodeRareData.h:51 
+        struct EventTargetData - 'new' call: WebCore/dom/NodeRareData.h:100
+        class NodeRareData - 'new' call: WebCore/dom/Node.cpp:552
+
+        Inherits QualifiedName class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/editing/markup.cpp:319
+
+        * dom/Document.cpp:
+        * dom/EventNames.h:
+        * dom/EventTarget.h:
+        * dom/MessagePortChannel.h:
+        * dom/NodeRareData.h:
+        * dom/QualifiedName.h:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement timeline summary panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31064
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Toggle off 'Search for node' when the Inspector window is closing
+
+        Searching for node should be toggled off when the Inspector window is closed,
+        in a platform-independent manner.
+        https://bugs.webkit.org/show_bug.cgi?id=31059
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-11-03  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Prepare for heap profiles upstreaming:
+        - pass profile type id from InspectorController;
+        - this makes WebInspector.CPUProfile redundant---removed;
+        - support multiple profile types when populating profiles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31052
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-11-03  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        UMR in WebCore::AccessibilityRenderObject::children(); m_childrenDirty uninitialized in constructor
+        https://bugs.webkit.org/show_bug.cgi?id=31063
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Timeline Window, wire it to the bottom timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31056
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.get items):
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._resizeWindow):
+        (WebInspector.TimelinePanel.prototype._windowResizeDragging):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._windowDragging):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelinePanel.prototype._endWindowDragging):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make QWebPluginDatabase private API for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30775
+
+        * WebCore.pro:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Extended the conversion of the WebCore ResourceRequest to the
+        QNetworkRequest with a mandatory originating object argument,
+        which is meant to be the QWebFrame the request belongs to.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: monitorEvent should be monitorEvents
+        https://bugs.webkit.org/show_bug.cgi?id=31042
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Build fix for Windows CE
+
+        * plugins/PluginDatabase.cpp:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Levin.
+
+        fix accessibility webkit-style-check errors
+        https://bugs.webkit.org/show_bug.cgi?id=29672
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        (WebCore::AXObjectCache::removeAXID):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::enableAccessibility):
+        (WebCore::AXObjectCache::enableEnhancedUserInterfaceAccessibility):
+        (WebCore::AXObjectCache::accessibilityEnabled):
+        (WebCore::AXObjectCache::accessibilityEnhancedUserInterfaceEnabled):
+        (WebCore::AXObjectCache::isIDinUse):
+        (WebCore::AXObjectCache::objectFromAXID):
+        (WebCore::AXObjectCache::):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityImageMapLink.cpp:
+        * accessibility/AccessibilityList.h:
+        (WebCore::AccessibilityList::isList):
+        * accessibility/AccessibilityListBox.cpp:
+        * accessibility/AccessibilityListBox.h:
+        (WebCore::AccessibilityListBox::isListBox):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::isListBoxOption):
+        * accessibility/AccessibilityMediaControls.h:
+        (WebCore::AccessibilityMediaControl::~AccessibilityMediaControl):
+        (WebCore::AccessibilityMediaTimeline::~AccessibilityMediaTimeline):
+        (WebCore::AccessibilityMediaTimeline::isMediaTimeline):
+        (WebCore::AccessibilityMediaControlsContainer::~AccessibilityMediaControlsContainer):
+        (WebCore::AccessibilityMediaControlsContainer::roleValue):
+        (WebCore::AccessibilityMediaControlsContainer::accessibilityIsIgnored):
+        (WebCore::AccessibilityMediaTimeDisplay::~AccessibilityMediaTimeDisplay):
+        (WebCore::AccessibilityMediaTimeDisplay::roleValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::parentObjectUnignored):
+        (WebCore::AccessibilityObject::rightLineVisiblePositionRange):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        (WebCore::AccessibilityObject::lengthForVisiblePositionRange):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::PlainTextRange::isNull):
+        (WebCore::AccessibilityObject::isAccessibilityRenderObject):
+        (WebCore::AccessibilityObject::isAnchor):
+        (WebCore::AccessibilityObject::isAttachment):
+        (WebCore::AccessibilityObject::isHeading):
+        (WebCore::AccessibilityObject::isLink):
+        (WebCore::AccessibilityObject::isImage):
+        (WebCore::AccessibilityObject::isNativeImage):
+        (WebCore::AccessibilityObject::isImageButton):
+        (WebCore::AccessibilityObject::isPasswordField):
+        (WebCore::AccessibilityObject::isTextControl):
+        (WebCore::AccessibilityObject::isNativeTextControl):
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isCheckboxOrRadio):
+        (WebCore::AccessibilityObject::isListBox):
+        (WebCore::AccessibilityObject::isFileUploadButton):
+        (WebCore::AccessibilityObject::isProgressIndicator):
+        (WebCore::AccessibilityObject::isSlider):
+        (WebCore::AccessibilityObject::isControl):
+        (WebCore::AccessibilityObject::isList):
+        (WebCore::AccessibilityObject::isDataTable):
+        (WebCore::AccessibilityObject::isTableRow):
+        (WebCore::AccessibilityObject::isTableColumn):
+        (WebCore::AccessibilityObject::isTableCell):
+        (WebCore::AccessibilityObject::isFieldset):
+        (WebCore::AccessibilityObject::isGroup):
+        (WebCore::AccessibilityObject::isChecked):
+        (WebCore::AccessibilityObject::isEnabled):
+        (WebCore::AccessibilityObject::isSelected):
+        (WebCore::AccessibilityObject::isFocused):
+        (WebCore::AccessibilityObject::isHovered):
+        (WebCore::AccessibilityObject::isIndeterminate):
+        (WebCore::AccessibilityObject::isLoaded):
+        (WebCore::AccessibilityObject::isMultiSelect):
+        (WebCore::AccessibilityObject::isOffScreen):
+        (WebCore::AccessibilityObject::isPressed):
+        (WebCore::AccessibilityObject::isReadOnly):
+        (WebCore::AccessibilityObject::isVisited):
+        (WebCore::AccessibilityObject::isRequired):
+        (WebCore::AccessibilityObject::canSetFocusAttribute):
+        (WebCore::AccessibilityObject::canSetTextRangeAttributes):
+        (WebCore::AccessibilityObject::canSetValueAttribute):
+        (WebCore::AccessibilityObject::hasIntValue):
+        (WebCore::AccessibilityObject::accessibilityShouldUseUniqueId):
+        (WebCore::AccessibilityObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isMenuRelated):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        (WebCore::AccessibilityRenderObject::doAXStringForRange):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::actionVerb):
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::isAccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * accessibility/AccessibilityTableColumn.cpp:
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::addChildren):
+        * accessibility/AccessibilityTableRow.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+
+2009-11-02  Darin Fisher  <darin@chromium.org>
+
+        Fixing JSC build bustage.
+
+        * bindings/js/ScriptController.cpp: Added missing #include
+
+2009-10-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Give the FrameLoaderClient the ability to override Settings::isJavaScriptEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30967
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/V8Proxy.cpp: Move implementation of isEnabled to ScriptController
+        * bindings/v8/V8Proxy.h: Ditto
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowJavaScript):
+        * platform/chromium/ChromiumBridge.h: Delete uiResourceProtocol function
+
+2009-11-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        Fix a typo in Mark's last commit.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Re-enable support for web archives on Windows.  It was mistakenly disabled in r50438.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * WebCore.pro: Add SharedBufferCF.cpp and SmartReplaceCF.cpp
+        to the Darwin build.
+        * loader/archive/ArchiveFactory.cpp: Change the support for 
+        legacy WebArchive from all CF platforms to Mac and Chromium 
+        CF platforms.
+        (WebCore::archiveMIMETypes):
+        * platform/text/AtomicString.h: Remove PLATFORM(QT) &&
+        PLATFORM(DARWIN) test as it is redundant now.
+        * platform/text/PlatformString.h: Ditto.
+        * platform/text/StringImpl.h: Ditto.
+        * platform/text/cf/StringCF.cpp: Ditto.
+        * platform/text/cf/StringImplCF.cpp: Ditto.
+
+2009-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Actually declare getPluginMimeTypeFromExtension in a header.
+        https://bugs.webkit.org/show_bug.cgi?id=30985
+
+        Our current code does not conform to our style guide.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        * plugins/chromium/PluginDataChromium.cpp:
+        * plugins/chromium/PluginDataChromium.h: Added.
+
+2009-11-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7038305> REGRESSION (Safari 4.0.2 - ToT): After navigating back to a known phishy page, the "Ignore warning" button appears highlighted (along with the "Go Back" button)
+
+        This bug is timing dependent, and not always reproducible.  I could not think of a way to add a 
+        layout test that would demonstrate the problem and fix.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::checkbox): Update style.
+        (WebCore::paintCheckbox): ditto.
+        (WebCore::radio): ditto.
+        (WebCore::paintRadio): ditto.
+        (WebCore::setupButtonCell): Added convenience method.
+        (WebCore::button): Use a separate NSButtonCell for defaultButtons and regular buttons.
+        (WebCore::paintButton): Don't check for the key window here.  Consider that when deciding if the button should have the default style in RenderTheme.
+        * rendering/RenderTheme.cpp: (WebCore::RenderTheme::isDefault): Only consider a button to be default if the page is active.  This fixes 
+        a problem I noticed where the button would flicker crazily if the page with the default button was in the background.
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Minor RenderWidget clean-up in preparation for deferring widget tree
+        mutation when it is not safe.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_refCount to 1
+        instead of calling ref().
+        (WebCore::RenderWidget::destroy): Call setWidget(0) instead of
+        repeating what it does.
+        (WebCore::RenderWidget::setWidgetGeometry): Now returns a boolean
+        indicating whether the bounds have changed.
+        (WebCore::RenderWidget::setWidget): Replaced all-encompassing if
+        statement with an early return.
+        (WebCore::RenderWidget::updateWidgetPosition): Call setWidgetGeometry().
+        * rendering/RenderWidget.h:
+
+2009-11-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker and SQLTransactionClient
+        implementations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30701
+
+        * storage/chromium: Added.
+        * storage/chromium/DatabaseObserver.h: Added.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Added.
+        * storage/chromium/QuotaTracker.cpp: Added.
+        * storage/chromium/QuotaTracker.h: Added.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Added.
+
+2009-11-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson and Dan Bernstein.
+
+        Safari crashes when calling execCommand on formatted html in special case
+        <rdar://problem/7318656>
+        https://bugs.webkit.org/show_bug.cgi?id=31023
+
+        Test: editing/execCommand/align-in-span.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock): Modified comment on containingBlock returning NULL.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState): Added check for NULL return from containingBlock,
+        since it is possible when dealing with orphaned trees.
+
+2009-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Exception checks were being too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=31005
+
+        Several calls in CanvasRenderingContext3D are allowed to
+        have a null value passed, which indicated that the 
+        object is being unbound. Handle this case and the corresponding
+        null handling in GraphicsContext3DMac.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+
+2009-11-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Each JS execution in console adds extra item into "scripts" combo
+        https://bugs.webkit.org/show_bug.cgi?id=30212
+
+        Added manual test
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * manual-tests/inspector/hidden-evals.html: Added.
+
+2009-11-02  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a missed case for InspectorTimeline, DOMWindow dispatch of DOM events.
+        https://bugs.webkit.org/show_bug.cgi?id=31030
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners): Checks DOMWindow for listeners.
+        (WebCore::Node::dispatchGenericEvent):
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        No new tests since no new functionality. Storage, MessagePorts and Workers tests cover this.
+
+        There are a lot of files but most changes are simply replace RefPtr and PassRefPtr with
+        OwnPtr and PassOwnPtr when dealing with Tasks.
+
+        ScriptExecutionContext::Task, DatabaseTask and WorkerRunLoop::Task are no longer
+        threadsafe refcounted, but simply Noncopyable.
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ProcessMessagesSoonTask::create):
+        * dom/ScriptExecutionContext.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::create):
+        * storage/Database.cpp:
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::tableNames):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::scheduleTask):
+        (WebCore::DatabaseThread::scheduleImmediateTask):
+        (WebCore::SameDatabasePredicate::operator()):
+        * storage/DatabaseThread.h:
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::localStorageThread):
+        * storage/LocalStorageThread.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        (WebCore::SharedWorkerConnectTask::create):
+        * workers/GenericWorkerTask.h:
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * workers/WorkerContext.h:
+        * workers/WorkerLoaderProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerContextDestroyedTask::create):
+        (WebCore::WorkerTerminateTask::create):
+        (WebCore::WorkerThreadActivityReportTask::create):
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::~Task):
+        (WebCore::WorkerRunLoop::Task::mode):
+
+2009-11-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Failing media/video-played-reset.html
+        https://bugs.webkit.org/show_bug.cgi?id=30589
+
+        new m_seekTime attribute to keep track of the seek position
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove Referer when redirecting to non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31021
+
+        Remove referer from HTTP headers when redirecting to a non-secure
+        site.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18539
+        multipart/form-data not being parsed correctly on server due to '+' in boundary string
+
+        No test - the characters that the boundary is made of are not deterministic.
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        Don't ever put a '+' in boundary string, either. Removed a FIXME to bring '/' back once
+        GMail is fixed - I don't think we'll ever want to allow non-alphanumeric characters, as
+        they cause problems on many web sites.
+
+2009-10-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30969
+        A no-prefix XPath node test should not match no-namespace elements in HTML document
+
+        Test: fast/xpath/null-namespace-in-html.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::nodeMatchesBasicTest): Special case non-HTML elements
+        in HTML documents (as these are the ones that can have null namespace).
+
+2009-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] No timeline marks on resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31013
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+
+2009-11-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Possible crash in RenderSlider::layout.
+        https://bugs.webkit.org/show_bug.cgi?id=31016
+
+        Fix out of place line of code.
+
+        Test: scrollbars/overflow-scrollbar-combinations.html
+        This crash only seems to repro when WebKit draws the play controls,
+        so the crash repros in chromium running this test but not WebKit
+        nightlies which use QuickTime to draw the controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+
+2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Qt build on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30905
+
+        * WebCore.pro:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::create):
+
+2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        QWebView crash fix.
+
+        The QWebView should not crash if the stop() method is called from
+        a function triggered by the loadProgress signal.
+
+        A null pointer protection was added in the ProgressTracker::incrementProgress.
+
+        New autotest was created.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29425
+
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::incrementProgress):
+
+2009-11-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leftover from profiles panel generalization.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31010
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+
+2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
+        The implementation was buggy, and will visually break repeating
+        animations anyway.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31009
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+
+2009-11-02  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to the reported content language.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
+
+2009-11-02  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Rewrite CSSSourceSyntaxHighlighter so it shares more code
+        https://bugs.webkit.org/show_bug.cgi?id=30907
+
+        Test: inspector/css-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Implement support for ARIA "tab", "tabpanel" and "tablist".
+        As a consequence, we also needed to implement aria-selected
+        and aria-controls.
+
+        Tests: accessibility/aria-controls-with-tabs.html
+               accessibility/aria-tab-roles.html
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * html/HTMLAttributeNames.in:
+
+2009-10-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        This is the WebKit-side change needed to fix canvas.getImageData() for
+        Chromium.  The unpremultiply code in Skia assumes that unpremultiplied
+        values should be rounded, while CG does not.  In addition, the fixed
+        point inversion used by Skia introduces slight inaccuracies that make
+        us fail this test.  This change brings Chromium in line with
+        the CG path.
+        https://bugs.webkit.org/show_bug.cgi?id=30825
+
+        Covered by LayoutTests/fast/canvas/canvas-getImageData.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds window event dispatches to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31002
+
+        * English.lproj/localizedStrings.js:
+        * dom/Node.cpp: Updated call site to willDispatchEvent and didDispatchEvent.
+        (WebCore::Node::dispatchGenericEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent): Renamed.
+        (WebCore::InspectorTimelineAgent::didDispatchEvent): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchRecord): Renamed.
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+
+2009-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Convert script tag event into a more generic
+        script eval event in timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30999
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEvaluateScriptTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+
+2009-11-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix for loop to use an size_t instead of unsigned and some spacing
+        style fixes.
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Does not send DOM dispatches to the InspectorTimelineAgent if there
+        are no event listeners.
+        https://bugs.webkit.org/show_bug.cgi?id=30995
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::Node::dispatchGenericEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        No review (build fix).
+
+        Add missing files for Ruby implementation to WebCore.vcproj
+        (Fix build break after 50397)
+        https://bugs.webkit.org/show_bug.cgi?id=31001
+
+        No new tests. (No functional change)
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        First rudimentary implementation of HTML5 ruby rendering support.
+
+        Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+        bases with their respective ruby texts looks as follows:
+
+        1 RenderRuby object, corresponding to the whole <ruby> HTML element
+             1+ RenderRubyRun (anonymous)
+                 0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+                     0-n inline object(s)
+                 0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+                     1-n inline object(s)
+
+        Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+        
+        New layout tests will be committed in a follow-up patch under fast/ruby.
+
+        Makefiles, etc.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS
+        * css/html.css: Added <ruby> and <rt>
+
+        Existing render files:
+        * rendering/RenderBlock.cpp: make moveChild a member function moveChildTo
+        (WebCore::RenderBlock::moveChildTo):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): instantiate ruby renderers based on element name
+        * rendering/RenderObject.h: add query methods for ruby renderers
+        (WebCore::RenderObject::isRuby):
+        (WebCore::RenderObject::isRubyBase):
+        (WebCore::RenderObject::isRubyRun):
+        (WebCore::RenderObject::isRubyText):
+
+        New ruby renderers:
+        * rendering/RenderRuby.cpp: Added.
+        (WebCore::lastRubyRun):
+        (WebCore::findRubyRunParent):
+        (WebCore::RenderRubyAsInline::RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::~RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::isChildAllowed):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::~RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::isChildAllowed):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h: Added.
+        (WebCore::RenderRubyAsInline::renderName):
+        (WebCore::RenderRubyAsInline::isRuby):
+        (WebCore::RenderRubyAsBlock::renderName):
+        (WebCore::RenderRubyAsBlock::isRuby):
+        * rendering/RenderRubyBase.cpp: Added.
+        (WebCore::RenderRubyBase::RenderRubyBase):
+        (WebCore::RenderRubyBase::~RenderRubyBase):
+        (WebCore::RenderRubyBase::isChildAllowed):
+        (WebCore::RenderRubyBase::splitToLeft):
+        (WebCore::RenderRubyBase::mergeWithRight):
+        * rendering/RenderRubyBase.h: Added.
+        (WebCore::RenderRubyBase::renderName):
+        (WebCore::RenderRubyBase::isRubyBase):
+        * rendering/RenderRubyRun.cpp: Added.
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::~RenderRubyRun):
+        (WebCore::RenderRubyRun::hasRubyText):
+        (WebCore::RenderRubyRun::hasRubyBase):
+        (WebCore::RenderRubyRun::isEmpty):
+        (WebCore::RenderRubyRun::rubyText):
+        (WebCore::RenderRubyRun::rubyBase):
+        (WebCore::RenderRubyRun::rubyBaseSafe):
+        (WebCore::RenderRubyRun::firstLineBlock):
+        (WebCore::RenderRubyRun::updateFirstLetter):
+        (WebCore::RenderRubyRun::isChildAllowed):
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/RenderRubyRun.h: Added.
+        (WebCore::RenderRubyRun::renderName):
+        (WebCore::RenderRubyRun::isRubyRun):
+        * rendering/RenderRubyText.cpp: Added.
+        (WebCore::RenderRubyText::RenderRubyText):
+        (WebCore::RenderRubyText::~RenderRubyText):
+        (WebCore::RenderRubyText::isChildAllowed):
+        * rendering/RenderRubyText.h: Added.
+        (WebCore::RenderRubyText::renderName):
+        (WebCore::RenderRubyText::isRubyText):
+
+2009-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30992
+        Node.isDefaultNamespace doesn't convert empty strings to null
+
+        Test: fast/dom/Node/default-namespace-empty-argument.html
+
+        * dom/Node.cpp: (WebCore::Node::isDefaultNamespace): Per DOM 3 Core, treat empty input
+        as null.
+
+2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't add '/' to the URL path if the it does not include '/' after the protocol component
+        https://bugs.webkit.org/show_bug.cgi?id=30971
+
+        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix layering violations in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=30986
+
+        Remove uses of HTMLImageElement and HTMLCanvasElement
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2009-11-01  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to expected document attributes.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (documentAttributeValue):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+
+2009-11-03  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Implements what has been implemented in AT-SPI.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+        (atk_document_interface_init):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+        (webkit_accessible_document_get_locale):
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        No new tests as there is no functional change.
+
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Reorder 
+        initialization list to fix compiler warnings.
+
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        [Regression] monitorEvent doesn't work
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Web Inspector: Bug with Message Bubble in Syntax Highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=30990
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-10-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30982
+        createHTMLDocument doesn't escape ampersand and less-than in title
+
+        Test: fast/dom/DOMImplementation/createHTMLDocument-title.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createHTMLDocument):
+        Set document title after creating the document, avoiding parser intricacies.
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Double clicking on a breakpoints should not select text
+        https://bugs.webkit.org/show_bug.cgi?id=30950
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        Test: fast/css/list-item-pseudo-nocrash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2009-11-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30586
+        [GTK] Failing test media/video-src-empty.html
+
+        Correctly set network/ready state depending on GStreamer errors
+        received on the bus.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove obsolete null checks from CanvasRenderingContext3DMac
+        https://bugs.webkit.org/show_bug.cgi?id=30983
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebGL allows objects to be used with the wrong context
+        https://bugs.webkit.org/show_bug.cgi?id=30981
+
+        Simply add null checks and a few context guards to ensure we don't
+        deref null or attempt to use an object from a different context.
+
+        Tests: fast/canvas/webgl/incorrect-context-object-behaviour.html
+               fast/canvas/webgl/null-object-behaviour.html
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::attachShader):
+        (WebCore::CanvasRenderingContext3D::bindAttribLocation):
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::compileShader):
+        (WebCore::CanvasRenderingContext3D::detachShader):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::isBuffer):
+        (WebCore::CanvasRenderingContext3D::linkProgram):
+        (WebCore::CanvasRenderingContext3D::shaderSource):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryResult
+        https://bugs.webkit.org/show_bug.cgi?id=30857
+
+        Inherits MediaQueryResult class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:5984 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryEvaluator
+        https://bugs.webkit.org/show_bug.cgi?id=30854
+
+        Inherits MediaQueryEvaluator class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:401 and   
+        it is no need to be copyable.
+
+        * css/MediaQueryEvaluator.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleSet
+        https://bugs.webkit.org/show_bug.cgi?id=30852
+
+        Inherits CSSRuleSet class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:455 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.cpp:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleData
+        https://bugs.webkit.org/show_bug.cgi?id=30851
+
+        Inherits CSSRuleData class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.h:320 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleDataList
+        https://bugs.webkit.org/show_bug.cgi?id=30850
+
+        Inherits CSSRuleDataList class from Noncopyable because it has been
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:2715 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSNamespace
+        https://bugs.webkit.org/show_bug.cgi?id=30849
+
+        Inherits CSSNamespace struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSheet.cpp:141 and
+        it is no need to be copyable.
+
+        * css/CSSNamespace.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor DatabaseTask in preparation for removing threadsafe refcounting from it.
+        Move the synchronizer object out of the DatabaseTask so there is no need to keep
+        the pointer to Databasetask around after passing it to MessageQueue.
+        Also pass the references to return parameters to the task so it can update them.
+        https://bugs.webkit.org/show_bug.cgi?id=30941
+
+        No new tests, since this is just moving the code around, no change in functionality.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion): Use new DatabaseTaskSynchronizer to wait for task completion.
+        (WebCore::Database::markAsDeletedAndClose): Ditto.
+        (WebCore::Database::tableNames): Ditto.
+        (WebCore::Database::stop): Use the boolean flag rather then 'killed' flag built into MessageQueue.
+        (WebCore::Database::scheduleTransaction): Transaction queue is a Deque now, change the way to fetch the transaction.
+        * storage/Database.h: Change the SQLTransaction queue to be a Deque rather then a MessageQueue.
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTaskSynchronizer::DatabaseTaskSynchronizer):
+        (WebCore::DatabaseTaskSynchronizer::waitForTaskCompletion):
+        (WebCore::DatabaseTaskSynchronizer::taskCompleted):
+        (WebCore::DatabaseTask::DatabaseTask): Ctor takes DatabaseTaskSynchronizer which can be 0.
+        (WebCore::DatabaseTask::performTask): Signal completion. m_synchronizer should still be around since main thread is waiting on it.
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask): Pass synchronizer and return parameters via constructor.
+        (WebCore::DatabaseCloseTask::DatabaseCloseTask): Ditto.
+        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask): Ditto.
+        (WebCore::DatabaseTableNamesTask::DatabaseTableNamesTask): Ditto.
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+
+2009-10-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: In Mail, Undo does not restore some characters I have deleted at the end of a line
+        https://bugs.webkit.org/show_bug.cgi?id=30955
+        <rdar://problem/7067033>
+        
+        When the command is deleteWordBackward or deleteWordForward
+        we should not add to the open typing command, but
+        create a new one.
+        
+        Test: editing/undo/undo-deleteWord.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+
+2009-10-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make MediaPlayer constructor private
+        https://bugs.webkit.org/show_bug.cgi?id=30965
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): 
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use MediaPlayer::create.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::create): New.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Alice Liu.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::stringRoleForMSAA):
+        (WebCore::AccessibilityObject::descriptionForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        If the element's tag name is one of h1, h2, h3, h4, h5, h6, return
+        true.
+        (WebCore::AccessibilityRenderObject::stringRoleForMSAA):
+        If the element should return its tag name as the role, return the tag
+        name.
+        (WebCore::AccessibilityRenderObject::positionalDescriptionForMSAA):
+        If the object is a heading, return the string "L" followed by the
+        heading level.
+        (WebCore::AccessibilityRenderObject::descriptionForMSAA):
+        If the object has a positional description, return it. Otherwise, get
+        the accessibility description, and prefix it with "Description" so that
+        MSAA clients know that it's not a positional description.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::stringValueForMSAA):
+        Return the URL.
+        (WebCore::AccessibilityImageMapLink::nameForMSAA):
+        Return the alt text.
+
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isLinked):
+        Return true.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isLinked):
+        (WebCore::AccessibilityObject::stringValueForMSAA):
+        (WebCore::AccessibilityObject::nameForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::isLinkable):
+        Return true if the element is considered "linkable" with respect to
+        accessibility.
+        (WebCore::AccessibilityRenderObject::stringValueForMSAA):
+        If the element is linkable, check whether it has a parent anchor
+        element. If so, return the anchor element's href.
+        (WebCore::AccessibilityRenderObject::isLinked):
+        Return true if the element is linkable and if it's parent anchor tag's
+        href is non-empty.
+        (WebCore::AccessibilityRenderObject::nameForMSAA):
+        For text nodes, return the text.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        This is similar to AX code that is already in place, except that this also informs the
+        chrome when there stops being a focused node. This is needed for a browser to show the
+        anchor for links that have keyboard focus.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::focusedNodeChanged):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::focusedNodeChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+
+2009-10-30  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        openDatabase() with empty version sets db version up incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=28417
+
+        Test: storage/open-database-set-empty-version.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Raise an exception if the current database version does not match the expected version when the current version is the empty string.
+
+2009-10-30  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        Moving the notificationsEnabled bit from NotificationCenter
+        to the new V8 RuntimeEnabledFeatures object.
+
+        Just moving a bit around, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::notificationsEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        * notifications/NotificationCenter.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] More cleanup after r49949: remove ListenerGuard.
+        ListenerGuard is no longer needed since EventListeners do not depend on frame or v8 context.
+        https://bugs.webkit.org/show_bug.cgi?id=30943
+
+        Covered by fast/events/add-event-without-document.html which will now pass in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        counterValueForElementById should return space-separated string for multiple counters
+        https://bugs.webkit.org/show_bug.cgi?id=30939
+
+        Test: fast/css/counters/counterValueForElementById.html
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+
+2009-10-30  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Add some comments to explain what is happening here.
+
+2009-10-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix Web Inspector crash on the errors/warnings counter click
+
+        RenderObject::createVisiblePosition(const Position& position)
+        understands "null Positions", so we can construct such a Position manually.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30499
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Third part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (nameFromChildren):
+        (webkit_accessible_get_name):
+        New convenience function to construct an object's name using the name(s) of
+        any children it has.
+
+        (atk_table_interface_init):
+        (webkit_accessible_table_get_column_description):
+        (webkit_accessible_table_get_row_description):
+        Implemented.
+
+        (webkit_accessible_table_get_column_header):
+        Stub function added so that webkit_accessible_table_get_column_description
+        could be implemented in the meantime.
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Second part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (cellAtIndex):
+        (webkit_accessible_table_get_column_at_index):
+        (webkit_accessible_table_get_row_at_index):
+        (webkit_accessible_table_get_caption):
+        (atk_table_interface_init):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showTimelinePanel):
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        If the owner widget of the page has a palette set, we
+        should use that one. This was only working when the
+        owner was a QWebView. This patch fixes that.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Wire CookieJarChromium to the cookies
+        backend. This is a final step of a 3-steps raw cookies
+        access implementation in Chromium.
+
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Chromium crash in console.log in "deeply recursive" function 
+
+        Check that result of 'frameSourceName' is not null handle
+        before casting it to String. 
+      
+        Allow V8Proxy::sourceName/sourceLineNumber() to report
+        that they have failed due to JavaScript stack overflow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30904
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::sourceLineNumber):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQuery
+        https://bugs.webkit.org/show_bug.cgi?id=30856
+
+        Inherits MediaQuery class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4905 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryExp
+        https://bugs.webkit.org/show_bug.cgi?id=30855
+
+        Inherits MediaQueryExp class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4874.
+
+        * css/MediaQueryExp.h:
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-10-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Removed test for an impossible condition (a glyph in a right-to-left run not having
+        the RTL flag 0x800)
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make links mouse focusable only on GTK and QT.
+
+        Links are now always mouse focusable on GTK and QT. On other platforms
+        the link needs a tabIndex or it needs to be contentEditable.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Complete the fix for hit-testing and selection highlighting in ligatures for the ATSUI
+        code path.
+
+        * platform/graphics/mac/ComplexTextController.h: Added m_ltr member to ComplexTextRun.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Skip over deleted
+        glyphs, but update indexes and advances correctly.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_ltr.
+
+2009-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(3.2.3 - 4.0.2): Message composing: when I undo a color change to text in Mail, undo/redo behaves strangely
+        <rdar://problem/7115041>
+        https://bugs.webkit.org/show_bug.cgi?id=30892
+
+        This problem shows in any scenario where it is necessary to split a text
+        node to apply a style. SplitElementCommand and WrapContentsInDummySpanCommand both
+        have member variables initialized in the constructor to keep reference to elements
+        they need to operate upon. These reference are not updated when reapplying the command.
+        For this reason it is necessary to guarantee that unapply doesn not delete the references
+        and that these commands implement doReapply to correctly reuse the existing
+        elements.
+
+        Test: editing/undo/redo-style.html
+
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply): Added.
+        (WebCore::SplitElementCommand::doApply): Modified to call executeApply. 
+        (WebCore::SplitElementCommand::doUnapply): Doesn't release m_element1.
+        (WebCore::SplitElementCommand::doReapply): Added.
+        * editing/SplitElementCommand.h: Added doReapply and executeApply.
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::executeApply): Added.
+        (WebCore::WrapContentsInDummySpanCommand::doApply): Modified to call executeApply.
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Doesn't release m_dummySpan.
+        (WebCore::WrapContentsInDummySpanCommand::doReapply): Added.
+        * editing/WrapContentsInDummySpanCommand.h: Added doReapply and executeApply.
+
+2009-10-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DOM Storage's condition variable needs to handle spurious wakeups
+        https://bugs.webkit.org/show_bug.cgi?id=30920
+
+        Add a boolean to keep track of whether it's been terminated.  Clean
+        up the locking code a tiny bit to make it easier to read.  There's
+        no way to reproduce this reliably in a LayoutTest.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Include ComplextTextController into Chromium Mac project.
+
+        * WebCore.gyp/WebCore.gyp: Added include rule for ComplextText* files.
+
+2009-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Fix tabbing through element attributes in the Web Insector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30429
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted): Don't call _updateTitle,
+        it is called for us when removeAttribute succeeds in the back-end.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto except for nodeValue.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Don't call _updateTitle, editing code reverts.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle): Return early if we are editing.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Problem editing or selecting text containing ligatures
+        https://bugs.webkit.org/show_bug.cgi?id=30025
+
+        Test: platform/mac/fast/text/ligature-subdivision.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize
+        m_characterInCurrentGlyph.
+        (WebCore::ComplexTextController::offsetForPosition): If the hit glyph spans multiple
+        characters, compute the hit character based on dividing the glyph’s total advance into
+        a number of equal intervals equal to the number of characters and assigning the hit to the
+        character corresponding to the hit interval.
+        (WebCore::ComplexTextController::advance): If the final offset occurs mid-glyph, advance
+        by a fraction of the glyph’s total advance.
+        * platform/graphics/mac/ComplexTextController.h: Added m_characterInCurrentGlyph.
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30918>.
+        Web Inspector: Datagrid Rows on Windows not properly aligned.
+        
+        Use line-height for the table rows to make sure the height
+        of our text and the height of the table rows are consistent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r50296.
+        http://trac.webkit.org/changeset/50296
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Remove build warning introduced by r50284.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove random crashes by removing retrieval of V8 context during garbage collection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30919
+
+        Unfortunately, I haven't been able to trigger this crash explicitly, so no test :(.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::jsWrapperForDOMObject): Added new "assume-it's-there" getter.
+        * bindings/v8/V8DOMWrapper.h: Added getter decl.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): Changed to use explicit getter.
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Adjust the project files to sync up with
+        http://trac.webkit.org/changeset/50259
+
+        * WebCore.gypi: Renamed and added files.
+
+2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Implement DELETE HTTP method for XmlHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=30894
+
+        No new tests as this functionality is already tested by the 
+        xmlhttprequest LayoutTests. As this patch depends on an unreleased
+        version of the dependent QtNetwork library and the tests will be
+        enabled later once the dependent library is released (and the
+        buildbot is updated).
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/30483>.
+        Web Inspector: Always show the Local and Session Storage Views.
+        
+        Even if the length of the DOM Storage entry array is 0, still
+        generate the Datagrid because users can add things storage items
+        through the UI, so we should allow them to even if there isn't
+        anything there currently.
+
+        * English.lproj/localizedStrings.js: Removed "This Storage is Empty".
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+
+2009-10-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Threading problems with some of the tests
+        https://bugs.webkit.org/show_bug.cgi?id=30814
+
+        Create strings shared among threads with crossThreadString
+        constructor method.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-29  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30308
+        
+        Add support for ARGB videos.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Create the Cairo image surface for ARGB32 or RGB24
+        depending on the buffer's caps.
+        
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        Handle ARGB video and convert GStreamer's ARGB to
+        Cairo's for displaying.
+
+2009-10-29  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] expose a method to access memory usage information in ChromiumBridge
+        Declare a static method to be implemented by http://codereview.chromium.org/332010/
+        https://bugs.webkit.org/show_bug.cgi?id=30829
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Implements the AtkSelection interface and enables the corresponding
+        (and expected) object:selection-changed event.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (optionFromList):
+        (optionFromSelection):
+        (atk_selection_interface_init):
+        (webkit_accessible_selection_add_selection):
+        (webkit_accessible_selection_clear_selection):
+        (webkit_accessible_selection_ref_selection):
+        (webkit_accessible_selection_get_selection_count):
+        (webkit_accessible_selection_is_child_selected):
+        (webkit_accessible_selection_remove_selection):
+        (webkit_accessible_selection_select_all_selection):
+        (GetAtkInterfaceTypeFromWAIType):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (AXObjectCache::postPlatformNotification):
+
+2009-10-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 30655 - Only plain text should be copied to clipboard for TextArea.
+        https://bugs.webkit.org/show_bug.cgi?id=30655
+
+        * editing/Editor.cpp:
+        (WebCore::nodeIsInTextFormControl):
+        (WebCore::Editor::cut):
+        (WebCore::Editor::copy):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hide timeline for now - not yet ready.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30912
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: deploy Web Inspector's images in WebCore.gypi.
+
+        * WebCore.gypi:
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: get rid of timelineProfilerEnabled method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30911
+
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        * inspector/InspectorController.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Create stub methods for raw cookies access in ChromiumBridge.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=30910
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's RareData
+        https://bugs.webkit.org/show_bug.cgi?id=30858
+
+        Inherits RareData struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSSelector.h:259 and 
+        it is no need to be copyable.
+
+        * css/CSSSelector.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's ShorthandScope
+        https://bugs.webkit.org/show_bug.cgi?id=30859
+
+        Inherits ShorthandScope class from FastAllocBase because it is 
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:902 and 
+        it is no need to be copyable.        
+
+        * css/CSSParser.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's AXObjectCache
+        https://bugs.webkit.org/show_bug.cgi?id=30848
+
+        Inherits AXObjectCache class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:1537 and                                
+        it is no need to be copyable.
+
+        * accessibility/AXObjectCache.h:
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't run JavaScript URLs in view source mode
+        https://bugs.webkit.org/show_bug.cgi?id=30881
+
+        Just say no.
+
+        Test: http/tests/security/view-source-no-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fixes style problems pointed out by Evan Martin.
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        64-bit Leopard build fix after r50259
+        
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Declared ATSUTextInserted in 64-bit.
+        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Attempted Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30899
+        WebKit fails to build release on 32-bit Windows systems
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
+        * bindings/js/JSBindingsAllInOne.cpp: Added.
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fixed typos in color names.
+
+        * inspector/front-end/Color.js:
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Share code between the ATSUI- and Core Text-based Font implementations by doing the
+        following:
+        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
+          parts in ComplexTextControllerCoreText.cpp.
+        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
+        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
+        - Remove FontMacATSUI.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
+        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
+        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
+        FontComplexTextMac.cpp.
+
+        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
+        kept the non-Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
+        m_complexTextRuns holding references instead of objects.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::advance): Updated for renames.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
+        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
+        and advances() accessors.
+
+        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
+        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
+        the latter RefCounted, added ATSUI-specific members to it, and made some other members
+        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
+        rather than objects.
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
+        (WebCore::ComplexTextController::ComplexTextRun::advances):
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
+        parts of the ComplexTextController implementation. 
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
+        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
+        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
+        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
+        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
+        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
+        get the glyphs, advances and indices vectors populated.
+        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
+        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
+        CoreTextController.cpp and kept the Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
+        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
+        this was done in adjustGlyphsAndAdvances().
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
+        including its own.
+        * platform/graphics/mac/CoreTextController.cpp: Removed.
+        * platform/graphics/mac/CoreTextController.h: Removed.
+        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
+        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
+        of CoreTextController.
+        (WebCore::Font::drawComplexText): Ditto.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        * platform/graphics/mac/FontMacATSUI.mm: Removed.
+        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: add support for 'option' role
+        https://bugs.webkit.org/show_bug.cgi?id=30843
+
+        Test: accessibility/aria-option-role.html
+
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+
+2009-10-28  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=30716
+
+        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
+        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
+            warning about missing cases in 'switch' statement.
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):  Fix struct visibiity warning.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
+            'switch' statement to avoid missing-case warning.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
+        https://bugs.webkit.org/show_bug.cgi?id=30839
+
+        Added null check for the case when the frame is detached from the page.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30817
+        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
+
+        Also removes the hack I had originally added to solve bug 25411, because
+        the fix here is what I should have done in the first place.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this, no change in functionality.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
+        (WebCore::SameDatabasePredicate::operator()):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Glue subsequent timeline records with same category
+        and title together.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30885
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fails new test fast/js/navigator-language.html
+        https://bugs.webkit.org/show_bug.cgi?id=30440
+
+        Reimplement WebCore::defaultLanguage to account for changes in
+        locale done by setLocale.
+
+        Already existing test: fast/js/navigator-language.html
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+            Exit from fullscreen if necessary.
+        * html/HTMLMediaElement.h:
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - a trivial fix to get Windows bots running.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
+        access empty vector's data.
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Remove the extraneous object of ROLE_PANEL.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-10-28  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=30547
+
+        Test: fast/css/text-input-with-webkit-border-radius.html
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+          Implemented rounded border rendering in Chromium Windows theme renderer.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pull items collections from resources panel and
+        timeline panel into AbstractTimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30875
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.reset):
+        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.addItem):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
+        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
+        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelineCategory):
+        (WebInspector.AbstractTimelineCategory.prototype.toString):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
+        (WebInspector.ResourcesPanel.prototype.createItemGraph):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.get searchableViews):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
+        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
+        (WebInspector.ResourcesPanel.prototype.searchCanceled):
+        (WebInspector.ResourcesPanel.prototype.performSearch):
+        (WebInspector.ResourcesPanel.prototype.refresh):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.removeResource):
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
+        (WebInspector.ResourcesPanel.prototype.clearMessages):
+        (WebInspector.ResourcesPanel.prototype.refreshResource):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.TimelinePanel.prototype.createItemGraph):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineCategory):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
+        that it remains active on refreshs and page transitions.
+        https://bugs.webkit.org/show_bug.cgi?id=30874
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Expose WebCore::counterValueForElement as a WebCore API.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+        * rendering/RenderTreeAsText.h:
+
+2009-10-28  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix for r50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds InspectorTimelineAgent  instrumentation for encountering a
+        <SCRIPT> tag when parsing an HTML document. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30861
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        (WebCore::ScriptSourceCode::url):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willScriptTag):
+        (WebCore::InspectorTimelineAgent::didScriptTag):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Makes sure that Geolocation watch IDs remain positive on overflow.
+        https://bugs.webkit.org/show_bug.cgi?id=30122
+
+        No new tests possible.
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+
+2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+
+        Attempt to fix the Mac debug build after 50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        Tests: http/tests/ssl/referer-301.html
+               http/tests/ssl/referer-303.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Remove Referer header if redirecting from https to another protocol.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
+        always done when changing or adding header fields.
+        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
+
+        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
+        no longer inline, since they have non-trivial implementations.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        Match Mac changes.
+        
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Add FrameLoader::defaultObjectContentType, containing common code for
+        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
+        and win ports have copied this code, and the qt port uses similar code
+        with a few extra clauses.  Moving this to a utility function cuts down
+        on copied code.)   This causes no behavioural change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30868
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Enforce the versioning, by ignoring any version different
+        from 1.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up fix to InspectorControllerStub.
+        Define it after inspector.js due to namespace
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add InspectorController stub in order to
+        support opening in standalone mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Added.
+        (.WebInspector.InspectorControllerStub):
+        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
+        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
+        (.WebInspector.InspectorControllerStub.prototype.platform):
+        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
+        (.WebInspector.InspectorControllerStub.prototype.attach):
+        (.WebInspector.InspectorControllerStub.prototype.detach):
+        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
+        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
+        (.WebInspector.InspectorControllerStub.prototype.search):
+        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorControllerStub.prototype.loaded):
+        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
+        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorControllerStub.prototype.getProfile):
+        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.setSetting):
+        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorControllerStub.prototype.setting):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.UIString):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Expands upon the new funtionality which allows platforms to indicate
+        that a particular object should not be ignored, so that they can
+        specify that an object should be ignored or that it should be left up
+        to the default handling to decide.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Expose the table summary as the accessible description because there is no summary object.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_description):
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=30678
+
+        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+
+        Build fix, no new tests required.
+
+        * bindings/js/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * bindings/v8/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * loader/icon/IconDatabase.cpp: Modified.
+        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+        * storage/Database.cpp: Modified.
+        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Document a feature of the m_liveDecodedResources list.
+        https://bugs.webkit.org/show_bug.cgi?id=30209
+
+        The code made the assumption that the list is sorted by
+        the m_lastDecodedAccessTime property of the CachedResource.
+        The above is not true when CachedResource::setDecodedSize
+        is called and the item is inserted the first time. In this
+        case the m_lastDecodedAccessTime is still zero and the
+        m_liveDecodedResources list becomes unsorted.
+
+        It is impossible that Cache::pruneLiveResources will
+        stop to process the list too early due this feature and
+        the alternatives of updating m_lastDecodedAccessTime in
+        CachedResource::setDecodedSize or changing the insert
+        to search the right position have a negative impact on
+        performance. The best solution for now is to document
+        this feature.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setDecodedSize):
+
+2009-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+
+        Make text controls always implement the text interface, and the
+        editable text interface when they are not read only. This is what
+        ATK-users expect.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The current HitTestResult methods are not using the (3d)
+        transformation aware routines. This can lead to an assertion
+        SVGRenderBase::mapLocalToContainer method.
+
+        Change HitTestResult::imageRect to use the (3d) transformation
+        aware RenderBox::absoluteContentQuad to avoid running into
+        an assertion with SVG content.
+
+        Remove HitTestResult::boundingBox() as it is only used in
+        two places and conceptually doesn't belong into a HitTest
+        which is operating on points.
+
+        A classic test case is not possible as the methods are not excercised
+        from within HTML/SVG but from the WebKit API Layer. A unittest
+        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
+        do not support 3d transformations making it impossible to write
+        a reliable test case and the Mac port is currently not doing
+        unit testing.
+
+
+        * rendering/HitTestResult.cpp: Remove boundingBox() method
+        (WebCore::HitTestResult::imageRect): Use transformation aware method
+        * rendering/HitTestResult.h: Remove boundingBox()
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Custom Cursor doesn't use hotspot.
+        https://bugs.webkit.org/show_bug.cgi?id=30820
+
+        Cursors loaded from a QPixmap didn't specifiy the
+        hotspot. Take the hotspot values from the mac
+        implementation.
+
+        * platform/qt/CursorQt.cpp:
+
+2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Initial revision of the Timeline grid.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30834
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelineCalculator):
+        * inspector/front-end/Images/timelineBarBlue.png: Added.
+        * inspector/front-end/Images/timelineBarGray.png: Added.
+        * inspector/front-end/Images/timelineBarGreen.png: Added.
+        * inspector/front-end/Images/timelineBarOrange.png: Added.
+        * inspector/front-end/Images/timelineBarPurple.png: Added.
+        * inspector/front-end/Images/timelineBarRed.png: Added.
+        * inspector/front-end/Images/timelineBarYellow.png: Added.
+        * inspector/front-end/Images/timelineCheckmarks.png: Added.
+        * inspector/front-end/Images/timelineDots.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.showCategory):
+        (WebInspector.TimelinePanel.prototype.hideCategory):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.get graphElement):
+        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
+        https://bugs.webkit.org/show_bug.cgi?id=30844
+
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+
+2009-10-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing forward declaration of FramelessScrollView.
+        https://bugs.webkit.org/show_bug.cgi?id=30824
+
+        * platform/chromium/FramelessScrollViewClient.h:
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WAI-ARIA: add support for 'presentation' role
+        https://bugs.webkit.org/show_bug.cgi?id=30806
+
+        Test: accessibility/aria-presentational-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA menu/menu item need AXRoleDescription
+        https://bugs.webkit.org/show_bug.cgi?id=30804
+
+        Make sure that role descriptions will default to the system's first, before
+        returning an unknown role.
+
+        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Fix wording in comment.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        We allocate an autorelease pool but then store it off the stack. In a
+        GC environment this led to it being collected, and thus caused badness
+        to ensue.  To work around this we simply avoid using a pool at all in
+        a GC environment as it would be a no-op anyway.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+        (ObjcInstance::virtualBegin):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
+        have already been denied.
+        https://bugs.webkit.org/show_bug.cgi?id=27944.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-error.html
+               fast/dom/Geolocation/permission-denied-already-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
+        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
+        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
+        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
+        https://bugs.webkit.org/show_bug.cgi?id=30840
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
+        https://bugs.webkit.org/show_bug.cgi?id=29620
+
+        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
+        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
+        created before returning a CSSValue that JavaScript can modify.
+
+        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incomplete repaint of text field in relative positioned inline at imdb.com
+        https://bugs.webkit.org/show_bug.cgi?id=30047
+
+        Test: fast/repaint/inline-relative-positioned.html
+
+        Implemented offsetFromContainer(), mapLocalToContainer() and
+        mapAbsoluteToLocalPoint() in RenderInline.
+
+        * rendering/RenderBox.h: Fixed argument names in the declaration of
+        mapLocalToContainer().
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::mapLocalToContainer):
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
+        * rendering/RenderInline.h:
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Speculative build fix for Chromium.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Make WebGL context failure more robust and make it succeed in more cases
+        https://bugs.webkit.org/show_bug.cgi?id=30349
+
+        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
+        return null from getContext. Also added a more robust pixel format choosing 
+        mechanism and can render correctly when a SW renderer is chosen.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::setPixelFormat):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::ensureContext):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: a forwarding header.
+
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Making fontWeightIsBold static to fix Snow Leopard build.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit cannot remove nested bold tags
+        https://bugs.webkit.org/show_bug.cgi?id=30784
+
+        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
+        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
+        all font weights to either bold or unbold state.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
+        if two style have the same value under getFontWeightValue
+
+2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Give an ability to WebKit to free statically allocated pointers
+        before quit.
+        https://bugs.webkit.org/show_bug.cgi?id=27980
+
+        No new tests for this as the change does not affect WebKit
+        functionality, but only memory usage.
+
+        * JavaScriptCore/wtf/StdLibExtras.h:
+        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
+        commandline options or elsewhere in the code. Useful for 
+        implementing custom builds that free resources allocated via
+        DEFINE_STATIC_LOCAL.
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Build fix, no review needed.
+
+        Fixing the BUILD. m_estimatedSize in Database.h should be of type
+        'unsigned long' instead of 'unsigned long long'.
+
+        No tests required.
+
+        * storage/Database.h:
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactoring the Database class to not depend on
+        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
+        Database instance, that is safe to use on the file
+        thread. Finally, adding new simple fields and getters to the
+        Database object for storing/getting the display name and estimated
+        size specified by the user in the openDatabase() call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30548
+
+        * page/SecurityOrigin.h:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Storing the display name and
+        the estimated size in the Database object.
+        (WebCore::Database::Database): Storing the display name and the
+        estimated size in the Database object, as well as a SecurityOrigin
+        instance that is safe to use on the DB thread.
+        (WebCore::Database::maximumSize): Delegate the call to
+        DatabaseTracker::getMaxSizeForDatabase().
+        (WebCore::Database::databaseThreadSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the DB thread.
+        (WebCore::Database::threadSafeSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the current thread.
+        (WebCore::Database::displayName): Return the display name
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::estimatedSize): Return the estimated size
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::fileName): Return the name of the file where
+        the current Database is tored.
+        * storage/Database.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
+        maximum size for a DB file based on the current size of that file
+        and the space available for that origin.
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
+        correct SecurityOrigin instance.
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
+        https://bugs.webkit.org/show_bug.cgi?id=30709
+
+        Test: inspector/console-format-collections.html
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type): check for instances of HTMLCollection like we do for NodeList
+        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
+        (WebInspector.dispatch): increment and decrement dispatch counter
+        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+
+2009-10-27  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds XMLHttpRequest support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30578
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-10-27  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
+        extends the top of the selection upwards (but should shrink the selection instead)
+        <rdar://problem/7269075>
+        https://bugs.webkit.org/show_bug.cgi?id=29981
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+
+2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Tim Hatcher.
+        
+        Removed an extra console.log from ElementsTreeOutline.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
+        https://bugs.webkit.org/show_bug.cgi?id=27147
+
+        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
+
+2009-10-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Missing null check after string conversion in error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=30774
+
+        Add null check after string conversion in error reporting code.
+        ToString conversion can fail for instance when an exception is
+        thrown during conversion.
+
+        Test: fast/dom/error-to-string-stack-overflow.html
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use a pair of maps to store Geolocation watchers.
+        https://bugs.webkit.org/show_bug.cgi?id=29178
+
+        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
+        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
+        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
+        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
+        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
+        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
+        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
+        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
+        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] DOM Storage runtime flag should default to on
+        https://bugs.webkit.org/show_bug.cgi?id=30828
+
+        The DOM Storage runtime flag was supposed to default to on.  I accidentally
+        changed the logic to default to false when I moved the flag.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+
+2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix crash found in chromium test_shell.
+        https://bugs.webkit.org/show_bug.cgi?id=30808
+
+        When WebSocket is deleted without close, webkit would crash
+        when it handles didClose.
+
+        Check scriptExecutionContext before post task for event.
+        Use WebSocketChannel::disconnect() instead of close() in WebSocket
+        destructor, so that WebSocketChannel should not call deleted WebSocket
+        back in didClose().
+        To make sure WebSocketChannel alive while it is processing WebSocket
+        protocol over SocketStreamHandle, ref() in connect() and deref() in
+        didClose().
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated Apple license
+
+        * LICENSE-APPLE:
+
+2009-10-27  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        Re-enable the check that disallows pages with unload handlers in the page cache.
+
+        <rdar://problem/7196485> and http://webkit.org/b/29021 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove more empty files that didn't get removed earlier.
+
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+
+2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix assertion crashes introduced by changes made in r50110.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove empty files that didn't get removed earlier.
+
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+
+2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        First part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getCell):
+        (getCellIndex):
+        (webkit_accessible_table_ref_at):
+        (webkit_accessible_table_get_index_at):
+        (webkit_accessible_table_get_n_columns):
+        (webkit_accessible_table_get_n_rows):
+        (webkit_accessible_table_get_column_extent_at):
+        (webkit_accessible_table_get_row_extent_at):
+        (webkit_accessible_table_get_row_header):
+        (atk_table_interface_init):
+        (AtkInterfacesInitFunctions):
+        (GetAtkInterfaceTypeFromWAIType):
+
+2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Don't lose remainder when computing wheel event deltas
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix QtWebKit build for WIN_OS if Netscape plug-in support
+        is turned off and refactor some related code
+        https://bugs.webkit.org/show_bug.cgi?id=30786
+
+        No new tests as there is no new functionality introduced.
+
+        * platform/FileSystem.h: Refactor to make sure that each different
+        type definition is only repeated once.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion): Move it out from the
+        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
+        function body from PluginPackageWin.
+
+        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
+        it is now in PluginPackage.cpp.
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27011
+        [Gtk] Implement support for get_index_in_parent
+
+        Implement atk_object_get_index_in_parent.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_index_in_parent):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r50131.
+        http://trac.webkit.org/changeset/50131
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30491
+
+        Fixes an issue where pressing return/enter on the keyboard 
+        in <isindex> does not submit it if is not within a <form>.
+
+        According to the HTML 2.0 thru HTML 4.01 spec 
+        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
+        <isindex> element does not need to be within a <form> element in 
+        order to submit it. It can submitted on its own. Also, if present,
+        the href property of the <base> element will dictate where to submit
+        the value of the <isindex> element (this is analogous to the action 
+        property of the <form> element).
+
+        Tests: http/tests/misc/isindex-with-no-form-base-href.html
+               http/tests/misc/isindex-with-no-form.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
+        to create a <form> if none is present and we are an <isindex> element.
+        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
+        * html/HTMLInputElement.h:
+
+2009-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        Use a RetainPtr in ObjcBinding to ensure that we adequately
+        protect the autorelease pool from GC in GC'd applications.
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50125.
+
+        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+
+2009-10-26  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+
+        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30658
+
+        Covered by running various svg tests under valgrind, ex:
+        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+
+        * svg/SynchronizablePropertyController.cpp:
+        (WebCore::SynchronizableProperties::addProperty):
+        (WebCore::SynchronizableProperties::synchronize):
+        (WebCore::SynchronizableProperties::startAnimation):
+        (WebCore::SynchronizableProperties::stopAnimation):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h:
+        (WebCore::SynchronizableProperties::SynchronizableProperties):
+        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Renames TimelineItem to TimelineRecord and updates all call sites.
+        https://bugs.webkit.org/show_bug.cgi?id=30785
+
+        * GNUmakefile.am: 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
+        * inspector/TimelineItemFactory.cpp: Removed.
+        * inspector/TimelineItemFactory.h: Removed.
+        * inspector/TimelineRecordFactory.cpp: Added.
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
+        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
+        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
+        * inspector/TimelineRecordFactory.h: Added.
+        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addRecordToTimeline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+
+2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
+        
+        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
+        QPicture holds a reference to the X Pixmap. As a result, the print preview would
+        update itself when the X Pixmap changes. To prevent the print preview from updating
+        whenever m_drawable is updated (i.e when the view updates), we create a copy.
+        
+        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
+        regardless of the graphicssystem. This is taken care of by
+        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
+        
+        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
+        it will free the Pixmap whenever the user closes the print preview dialog and
+        handles the case of displaying multiple preview dialogs nicely.
+        
+        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30714
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-26  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Don't store properties in the MediaPlayerPrivate class
+
+        Access them via the MediaPlayer class instead.
+        https://bugs.webkit.org/show_bug.cgi?id=30462
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30801>.
+        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
+        
+        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
+        [ and ], so we should honor those as well.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
+        even when MFC is not installed, and is all that's needed here.
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build corrections for ENABLE_FILTERS in Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30797
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
+          its piDouble constant.
+        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
+          its piDouble constant.  Remove unnecessary call to floor used in
+          the division of an unsigned, converting to int.
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
+          style for MathExtras.h.
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+
+        Test: fast/loader/grandparent-completion-starts-redirect.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Re-add CSSPropertyWebkitBackgroundSize in one more place
+
+        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+
+2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Tidy up the DOM Storage runtime flag stuff
+        https://bugs.webkit.org/show_bug.cgi?id=30794
+
+        Clean up the DOM Storage runtime flag stuff to match the new way of doing
+        things.  No behavioral changes.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+
+        Test: fast/loader/history-forward-in-head.html
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
+          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
+          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
+        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
+          the redirect is scheduled.
+
+2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30049
+        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+
+        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
+               fast/parser/remove-current-node-parent-x.xhtml
+
+        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
+        unreliable after DOM manipulation.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
+        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
+        exiting a node.
+        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
+        replaces setCurrentNode(0).
+        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
+        (not sure if it was ever practical though - how can a parent become null while adding text?)
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
+        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
+        added a check fo script element still being in document - Firefox parses those that aren't,
+        but doesn't execute them.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        Match libxml2 version changes.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        background-size: X treated as background-size: X X, not background-size: X auto
+        https://bugs.webkit.org/show_bug.cgi?id=28440
+
+        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
+        and fast/backgrounds/size/resources/parsing-inherit.js
+
+        Reinstated -webkit-background-size and kept its behavior of filling in
+        the second value with the first one; and changed background-size to have
+        the behavior of filling in the second value with 'auto'.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Ditto.
+        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
+        (WebCore::CSSParser::parseFillProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
+        background-size.
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
+        https://bugs.webkit.org/show_bug.cgi?id=30777
+
+        No new tests as the crash can be reproduced by existing storage
+        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+
+        * platform/text/String.cpp:
+        (WebCore::String::number): Qt's QString::vsprintf does not
+        understand the "%I64u" format string. Always use the "%lli"
+        format string for Qt port.
+
+2009-10-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Roll back r50073 because r50041-50043 were reverted.  r50073 was
+        a chromium side fix for r50041.
+        https://bugs.webkit.org/show_bug.cgi?id=30789
+
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
+        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
+        
+        and related bugs.
+
+        If the event listener being removed is prior to the current firing event
+        iterator, we need to decrement the current firing event iterator in
+        addition to the endpoint. (Otherwise, shrinking the event listener vector
+        by one implicity moves the current firing event iterator forward by one.
+        It's like relativity, only without the planets.)
+        
+        Also took the opportunity to change some pointers to references, since
+        they can't be null.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
+        to end, if need be.
+        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
+        Added a comment to explain a behavior that was implicit enough to be
+        confusing.
+
+        * dom/EventTarget.h:
+        (WebCore::FiringEventIterator::FiringEventIterator):
+        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30792>.
+        Web Inspector: When changing resource scope, resource graph can get in weird state.
+        
+        If the user was scrolled down while looking at All resources, and then just
+        selects Fonts, or something that doesn't have many resources, then the graph
+        will stay scrolled down, even when there is no content there.
+        
+        When the filter is updated, scroll to the top of the graph view, so this won't
+        happen.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Fix mac clean build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Extract AbstractTimelinePanel that will be a base
+        class for ResourcesPanel and TimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30776
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js: Added.
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.get categories):
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype.show):
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype._value):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.get categories):
+        (WebInspector.ResourcesPanel.prototype.showCategory):
+        (WebInspector.ResourcesPanel.prototype.hideCategory):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
+        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.resize):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-26  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use Helvetica in the Inspector as intended.
+        https://bugs.webkit.org/show_bug.cgi?id=30787
+
+        * inspector/front-end/inspector.css:
+
+2009-10-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30781
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+
+2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Data loss occurs when unbolding nested bold tags.
+        https://bugs.webkit.org/show_bug.cgi?id=30083
+
+        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
+        to a temporary valuable.  It was originally calling nextSibling() after appending the child
+        to new parent, in which case, nextSibling is always 0.
+
+        Test: editing/style/unbolding-nested-b.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Storage events should use Document::url() rather than documentURI()
+        https://bugs.webkit.org/show_bug.cgi?id=30535
+
+        Storage events should use Document::url() rather than Document::documentURI()
+        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        Test: storage/domstorage/documentURI.html
+
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
+        inherit from HTMLCollection.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        * bindings/objc/DOMHTML.mm:
+        (kitClass):
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for ENABLE_FILTERS under Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30762
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
+          (1) Create a new 'filters' sub-folder of the platform/graphics 
+              folder to properly show the sources held in this directory.
+          (2) Move the files that are currently shown in svn/graphics/filters
+              to platform/graphics/filters (where they actually live on disk).
+          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
+              the project so they are built.
+          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
+              being compiled by SVGAllInOne.cpp.  Its presence as a separate
+              entity is causing a linker warning for duplicate symbols.
+          (5) Add ImageBuffer.cpp to the build to support color space
+              calculations for non-CG builds.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
+          path to the search paths in the project.
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        console.assert should prefix messages with "Assertion failed: "
+        https://bugs.webkit.org/show_bug.cgi?id=19135
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition): Use AssertMessageType.
+        * page/Console.h:
+        (WebCore::MessageType): Added AssertMessageType.
+
+2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty by adding a NULL check.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        Test: fast/forms/select-empty-optgroup.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+
+2009-10-21  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor gyp for separate webcore_bindings{,_sources} targets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-26  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        Make the number of connections for chromium controlled by
+        chromium rather than by ResourceRequestBase.
+        https://bugs.webkit.org/show_bug.cgi?id=30661
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. make distcheck build fixes.
+
+        * GNUmakefile.am:
+
+2009-10-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Unbreak Chromium build: that requires adding custom implementations
+        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
+        close to JSC bindings as well.
+        https://bugs.webkit.org/show_bug.cgi?id=30780
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedItemsFromCollection):
+        (WebCore::getItemFromCollection):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30723
+        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+
+        Test: http/tests/security/escape-form-data-field-names.html
+
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::appendQuotedString):
+        (WebCore::FormDataBuilder::beginMultiPartHeader):
+        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
+        Percent-escape line breaks and quotation marks.
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds DOMTimer support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30467
+
+        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
+        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
+        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
+        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
+        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
+        * inspector/TimelineItemFactory.h:
+        * page/DOMTimer.cpp: Added instrumentation points.
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
+        that allows the layer to return a CGImageRef of its contents.
+        
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+
+2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Pass "console" as object group when evaluating selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30738
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix for Console not showing repeat count when repeatedly logging an Event
+        https://bugs.webkit.org/show_bug.cgi?id=30324
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
+        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
+        (WebInspector.updateConsoleMessageRepeatCount): Added.
+
+2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        Tests: accessibility/crashing-a-tag-in-map.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::addChildren):
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds feature ENABLE guards to V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30697
+
+        This adds guards for the following features to the V8 bindings,
+        to allow builds with V8 to succeed when these features are not enabled.
+        - DATABASE
+        - WORKERS
+        - SHARED_WORKERS
+        - SVG
+        - XPATH
+        - XSLT
+        - INSPECTOR
+
+        This is a build fix only, no new tests required.
+
+        * bindings/v8/DOMObjectsInclude.h: Modified.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
+        * bindings/v8/V8Index.cpp: Modified.
+        * bindings/v8/V8Index.h: Modified.
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Fixes the issues with the Atk states exposed for ListBoxOption
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27085
+        [Gtk] Incorrect rendering of list
+
+        Adds a way for platforms to indicate that a particular object
+        should not be ignored.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 30619: [Linux] Menu key doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=30619
+
+        Test: manual-tests/keyboard-menukey-event.html
+        No new layout tests: testing this will require changes in the test
+        controller in a platform-specific way.
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return V_APPS instead of VK_MENU.
+
+2009-10-25  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reuse already fetched proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=30747
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Build fix for WIN_OS if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30753
+
+        * plugins/PluginDatabase.cpp:
+
+2009-10-25  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        A quick fix for Bug 29103.
+        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
+        and the option string before calling String::startsWith().
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        Tests: fast/forms/listbox-typeahead-cyrillic.html
+               fast/forms/listbox-typeahead-greek.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::typeAheadFind):
+
+2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
+        https://bugs.webkit.org/show_bug.cgi?id=30749
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
+        HTMLOptionsCollection should not inherit from HTMLCollection
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLOptionsCollection::getCallData):
+        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
+        (WebCore::JSHTMLOptionsCollection::nameGetter):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::item):
+        (WebCore::JSHTMLOptionsCollection::namedItem):
+        Refactor to use generic implementation of HTMLCollection bindings functions
+        from JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLCollectionFunctions.h: Added.
+        (WebCore::getCollectionNamedItems):
+        (WebCore::getCollectionItems):
+        (WebCore::callHTMLCollectionGeneric):
+        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
+        JSHTMLOptionsCollection can all use.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
+        for toJS on document.all.
+
+        * bindings/objc/DOMHTML.mm:
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        Remove special cases for HTMLOptionsCollection.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fixed issue with IME inside console
+        https://bugs.webkit.org/show_bug.cgi?id=30660
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+        * inspector/front-end/utilities.js:
+        (isEnterKey): Added. Check if in IME.
+
+2009-10-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
+        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
+        
+        Have the scope bars select one scope by default, but if the multiple selection key
+        is pressed, allow for multiple selection.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
+        Also cleans up the CSS to use classes instead of ID selectors.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28186
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
+        * inspector/front-end/inspector.css: Lots of changes to make it look right.
+        * inspector/front-end/inspector.html: Add the scope-bar class.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix selecting Resources in the Web Inspector's Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30743
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
+        isCategoryVisible on the ResourcesPanel.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
+        All will deselect the other filters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30744
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
+        and the child variable instead of target in the loop. Other clean up.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make resizing the Web Inspector's Elements panel sidebar work again.
+        Also makes Resources panel use the sidebar code in Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30742
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel): Don't create the sidebar with an argument.
+        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
+        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
+        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
+        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
+        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel): Call createSidebar.
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
+        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
+        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
+        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel): Call createSidebar.
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel): Call createSidebar.
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Call updateSelection() in a few places so hovering in the Web Inspector's
+        Elements panel always has the correct row selection height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30735
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
+        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
+        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the re-root tree feature from the Web Inspector's
+        Elements panel. This feature wasn't super useful and gets
+        in the way of double-click to edit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30736
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-10-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Implements ReturnsNew hint for V8 bindings generation code.
+        https://bugs.webkit.org/show_bug.cgi?id=30745
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Missing images at 350.org due to wrong URLs
+        https://bugs.webkit.org/show_bug.cgi?id=30748
+
+        Test: fast/dom/HTMLImageElement/parse-src.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
+        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
+        and SVGImageLoader::sourceURI() do.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50013.
+
+        * WebCore.pro:
+
+2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Fix up to accommodate for HTMLAllCollection changes in
+        http://trac.webkit.org/changeset/49998.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
+        mac(const Credential&) after authenticating to MobileMe Gallery movie
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential): Initialize m_persistence.
+        (WebCore::Credential::isEmpty): Made this method const.
+        * platform/network/Credential.h:
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Return nil if the Credential is empty.
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
+        Web Inspector: Resources Scope Bar Should Allow Combinations.
+        
+        Refactor the filtering in ResourcePanel to make it match ConsoleView,
+        and add a divider between All, and the other choices of Resource types.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        * inspector/front-end/inspector.css:
+
+2009-10-23  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Ignore the Refresh header if we're in view source mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27239
+
+        Test: http/tests/security/view-source-no-refresh.html
+
+        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30734
+        Remove XMLTokenizer::m_currentNodeIsReferenced
+
+        No change in behavior, no tests.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::setCurrentNode):
+        * dom/XMLTokenizer.h:
+        Don't store a boolean for the current node being the document - we can always check for that.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
+        it unconditionally, and then begin checking it for null, as if it could help.
+
+2009-10-23  Beth Dakin  <bdakin@apple.com>
+
+        No review since this is a build fix.
+
+        Build fix for the Mac. (Build is only broken when SVG filters are 
+        enabled.)
+
+        Labelled these function static.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement a Timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30725
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Images/timelineIcon.png: Added.
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+        * inspector/front-end/TimelinePanel.js: Added.
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
+        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
+        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.getItemTypeName):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Clash Between Search's onkeyup and incremental search events
+        https://bugs.webkit.org/show_bug.cgi?id=30731
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
+
+2009-10-23  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
+        of ScriptObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=30707
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+        * inspector/TimelineItemFactory.cpp: Added.
+        (WebCore::TimelineItemFactory::createGenericTimelineItem):
+        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
+        * inspector/TimelineItemFactory.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItemFactory::TimelineItemFactory):
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::globalObject):
+        * bindings/js/ScriptController.h:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes style problems in Android-specific files.
+        https://bugs.webkit.org/show_bug.cgi?id=30717
+
+        Style changes only, no new tests possible.
+
+        * page/android/EventHandlerAndroid.cpp: Modified.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
+        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
+        * platform/android/CursorAndroid.cpp: Modified. 
+        (WebCore::grabCursor): Fixes function braces.
+        (WebCore::grabbingCursor): Fixes function braces.
+        * platform/android/FileChooserAndroid.cpp: Modified.
+        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
+        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
+        (WebCore::unloadModule): Fixes zero test.
+        (WebCore::writeToFile): Fixes if statement structure.
+        * platform/android/KeyEventAndroid.cpp: Modified.
+        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
+        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
+        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * DerivedSources.cpp:
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-23  Brady Eidson  <beidson@apple.com>
+
+        50,000!
+
+        * ChangeLog: Point out revision 50,000.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
+        Drop .tags() support from HTMLCollection
+
+        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
+          available for all HTMLCollection like objects in Objective-C since that
+          is API.
+        - Auto-generate HTMLAllCollection.
+
+        Test: fast/dom/HTMLDocument/document-all.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollection.cpp: Removed.
+        * bindings/js/JSHTMLAllCollection.h: Removed.
+        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::getCallData):
+        (WebCore::JSHTMLAllCollection::canGetItemsForName):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        * dom/HTMLAllCollection.idl: Removed.
+        * html/HTMLAllCollection.cpp: Added.
+        (WebCore::HTMLAllCollection::create):
+        (WebCore::HTMLAllCollection::HTMLAllCollection):
+        (WebCore::HTMLAllCollection::~HTMLAllCollection):
+        * html/HTMLAllCollection.h: Added.
+        * html/HTMLAllCollection.idl: Added.
+        * html/HTMLCollection.h:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * page/DOMWindow.idl:
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: pull basic sidebar implementation into the Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30720
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.handleKeyEvent):
+        (WebInspector.Panel.prototype._createSidebar):
+        (WebInspector.Panel.prototype._startSidebarDragging):
+        (WebInspector.Panel.prototype._sidebarDragging):
+        (WebInspector.Panel.prototype._endSidebarDragging):
+        (WebInspector.Panel.prototype._updateSidebarWidth):
+        (WebInspector.Panel.prototype.setCenterViewWidth):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
+
+2009-10-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Slight optimizations to object returning and exception handling in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30599
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
+
+2009-10-23  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider always starts at half volume
+        https://bugs.webkit.org/show_bug.cgi?id=28322
+
+        Sets the value attribute of volume slider to the volume attribute
+        of the media element. Also update the value attribute of the
+        input element for the volume slider when the volume attribute
+        of the media element is updated.
+
+        Test: media/video-volume-slider.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Set the value attribute of the input element for the volume slider
+        using the current volume of the media element.
+        * rendering/MediaControlElements.h:
+        Add method definition of update().
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+        Creates a volume slider with value attribute equals to the current
+        volume attribute of the media element.
+
+2009-10-23  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chrome Linux: fix caret positioning in LTR complex languages
+        The caret is positioned off by one in languages like Thai.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28284
+
+        A group of us spent a while trying various approaches to write a test
+        for this; however, since it is only that the blinking cursor is
+        displayed incorrectly, we concluded it can not be tested.
+
+        (Patch by Hironori Bono.)
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-10-23  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build after IsoldatedWorld change (r49963).
+        https://bugs.webkit.org/show_bug.cgi?id=30719
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInIsolatedWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+        * xml/XMLHttpRequest.cpp:
+        * xml/XMLHttpRequest.h:
+
+2009-10-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
+        for a zoomed and scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30689.
+
+        The real cause is the wrong calculation of event.clientX/Y when
+        page is zoomed and scolled.
+        After Sam fixed the event.clientX/Y in r49551, the hit test point
+        should be recalculated (revert r49490).
+
+        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+
+2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Adding a class that allows us to enable/disable features at
+        runtime. Adding a flag to enable database support.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30653
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
+        * bindings/v8/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector injects _inspectorCommandLineAPI into global object when opened
+        https://bugs.webkit.org/show_bug.cgi?id=30675
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] don't undef NULL in Symbian emulator
+
+        npapi.h way of defining mwerks compiler,__intel__
+        and win32 are all true for Symbian emulator.
+        Changed the definions so that NULL won't be undefined
+        when compiling for Symbian emulator nor target HW.
+
+        * bridge/npapi.h:
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Correct linking of sqlite3 for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30569
+
+        ".lib" will try to include library as static library
+        causing the library to be searched from wrong directory and if found
+        will be statically linked instead of the inteded dynamic linking.
+
+        * WebCore.pro:
+
+2009-10-23  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION: Copy is copying incorrect background-color
+        <rdar://problem/7248529>
+        https://bugs.webkit.org/show_bug.cgi?id=29697
+
+        Test: editing/execCommand/indent-paragraphs.html
+
+        This change removes the BackgroundColor from the list 
+        of inheritable CSS properties and changes significantly
+        the way we perform indentation.
+        The new implementation of IndentOutdentCommand uses a new method
+        defined in CompositeEditCommand called moveParagraphWithClones.
+        This is an improved version of the original moveParagraph that
+        is aimed at preserving the original markup of the paragraph being
+        moved.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
+        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
+        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
+        * editing/CompositeEditCommand.h: Added three new methods.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
+        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30677
+
+        Build fix, no new tests required.
+
+        * page/Console.cpp: Modified. Added UnusedParam.h include.
+        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Plugins : Use window's winId() instead of the widget's.
+
+        As per, https://developer.mozilla.org/en/NPN_GetValue
+        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
+        plug-in is displayed; returns Window".
+
+        The issue was found because NPNVNetscapeWindow winId() ends up creating
+        a native window resulting in flicker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30706
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+
+        Though it works, it is not correct to use m_clipRect for painting
+        in Windowless mode. Instead, the rect paramater that is passed
+        as a part of PluginView::paint() must be used. This change will
+        also result in some speedup since previously we used to paint all
+        the visible parts of a windowless plugin (even if those parts were
+        not dirty).
+
+        Also, fix invalidateRect() to compute the correct width and height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30711
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins : Use test.swf in the plugins manual tests.
+
+        They previously referenced youtube videos which among other things are
+        cumbersome to use without internet connection. The old youtube link is
+        just commented out so that testing with youtube can be done with
+        little effort.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30662
+
+        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+        * manual-tests/qt/plugin-sibling-frame-include.html:
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix the Windows Release build by moving Accessibility files
+        into all-in-one file and excluding them from the build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * accessibility/AccessibilityAllInOne.cpp: Added.
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Add support for IsolatedWorlds to JSC bindings.
+
+        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
+        a given document.  To support isolation this patch:
+
+            * Adds support to the ScriptController to track multiple window shells, one per world.
+            * Adds support to Document to support multiple separate wrapper-maps, one per world.
+            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
+              stored on the (new) IsolatedWorld objects.
+
+        In addition to supporting separate copies of these objects, two other features are supported:
+
+            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
+              we can determine which world (and as such, set of DOM bindings) we should be operating on.
+            * EventListeners & Callbacks are run in the world they were registered in.
+              This requires the handler to retain a reference to the world.
+
+        No new tests. (Enabled existing isolated world layout tests.)
+
+        * WebCore.base.exp:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::DOMObjectWrapperMap::get):
+        (WebCore::DOMObjectWrapperMap::set):
+        (WebCore::DOMObjectWrapperMap::remove):
+        (WebCore::DOMObjectWrapperMap::take):
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
+        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
+        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
+        (WebCore::JSGlobalDataWorldIterator::operator bool):
+        (WebCore::JSGlobalDataWorldIterator::operator*):
+        (WebCore::JSGlobalDataWorldIterator::operator->):
+        (WebCore::JSGlobalDataWorldIterator::operator++):
+        (WebCore::getCurrentWorld):
+        (WebCore::getNormalWorld):
+        (WebCore::commonNormalWorld):
+        (WebCore::commonCurrentWorld):
+        (WebCore::DOMObjectHashTableMap::mapFor):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        (WebCore::forgetDOMObject):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::allowsAccessFromFrame):
+        (WebCore::printErrorMessageForFrame):
+        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
+        (WebCore::JSC_callInWorld):
+        (WebCore::JSC_constructInWorld):
+        (WebCore::JSC_evaluateInWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::IsolatedWorld::rememberDocument):
+        (WebCore::IsolatedWorld::forgetDocument):
+        (WebCore::IsolatedWorld::rememberScriptController):
+        (WebCore::IsolatedWorld::forgetScriptController):
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::currentWorld):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::nodeForId):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::attachDebugger):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::createRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::forgetWorld):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+        (WebCore::Document::wrapperCacheMap):
+        (WebCore::Document::getWrapperCache):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * platform/network/mac/AuthenticationMac.mm:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
+        https://bugs.webkit.org/show_bug.cgi?id=30705
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+
+2009-10-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30506
+        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
+        in the inspectors resource pane
+
+        I don't know how to make a test for this.
+
+        The issue here was that preloaded resources weren't added to DocLoader document resource set,
+        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
+        parser eventually requested the same resource for real and it got added to resource set, it
+        was too late - the Inspector wasn't updated.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResource):
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
+        cache. This seems safe, and easier than updating the Inspector on transitions between
+        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+
+2009-10-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
+        shadows to work for SVG content
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=30479
+
+        This patch adds a new SVG-specific CSS property called -webkit-
+        shadow that has the same syntax as -webkit-box-shadow
+
+        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
+        make valueForShadow a member function rather than a static function 
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSComputedStyleDeclaration.h:
+
+        Call valueForShadow for CSSPropertyWebkitShadow
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+
+        Do standard CSS stuff for CSSPropertyWebkitShadow
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+        Set the appropriate shadow on the paint context if we have one. 
+        This seems to be all we have to do to have an SVG-shaped shadow.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
+        just because that's the way things are done here right now.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::SVGRenderStyle):
+        (WebCore::SVGRenderStyle::operator==):
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        (StyleShadowSVGData::StyleShadowSVGData):
+        (StyleShadowSVGData::operator==):
+        * rendering/style/SVGRenderStyleDefs.h:
+        (WebCore::StyleShadowSVGData::create):
+        (WebCore::StyleShadowSVGData::copy):
+        (WebCore::StyleShadowSVGData::operator!=):
+
+2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+ 
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25530
+        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+
+        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
+        Also causes the accessible name for labeled controls to be based on
+        the label as expected, rather than based on the contents.
+
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (correspondingLabelForControlElement):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkRelationSetFromCoreObject):
+        (webkit_accessible_ref_relation_set):
+        (webkit_accessible_class_init):
+        (webkit_accessible_get_name):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused): fix for inner iframes
+        (WebInspector.windowBlurred): fix for inner iframes
+        (WebInspector.addMainEventListeners): change useCapture to false
+
+2009-10-22  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Makes a page reload optional when activating resource monitoring in
+        InspectorController. It leaves the default behavior as performing the reload.
+        Reload is an optional param so callsites do not have to change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30684
+
+        No new tests added.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        * inspector/InspectorController.h:
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
+        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
+        after being released.
+        https://bugs.webkit.org/show_bug.cgi?id=30167
+
+        No layout test available as a non-functional fix.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOMAgent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Rework event listeners to not hold references to frame or V8 context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30648
+
+        Covered by existing layout tests: fast/events/attribute-listener*
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
+            to event listener handling code.
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
+        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
+            and usage.
+        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
+        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
+        (WebCore::V8DOMWrapper::getEventListener): Ditto.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
+            because it's no longer needed.
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
+        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
+        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
+        (WebCore::V8Proxy::isContextInitialized): Ditto.
+        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
+        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
+        (WebCore::V8Proxy::clearForNavigation): Ditto.
+        (WebCore::V8Proxy::setSecurityToken): Ditto.
+        (WebCore::V8Proxy::updateDocument): Ditto.
+        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
+        (WebCore::V8Proxy::context): Changed to use v8::Local.
+        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
+        (WebCore::V8Proxy::setContextDebugId): Ditto.
+        (WebCore::toV8Context):
+        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
+            v8::Persistent for m_context.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::workerProxy): Added.
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
+            WorkerContextExecutionProxy* param.
+        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
+        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
+        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Removed
+            WorkerContextExecutionProxy* param.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
+            template param.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
+        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
+        (WebCore::V8EventListener::callListenerFunction): Ditto.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Removed Frame* param.
+
+2009-10-14  Gaurav Shah  <gauravsh@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Replaces temporary link stub for <keygen> tag handler for the Chromium
+        browser with a call via the Chromium Bridge.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30360
+
+        * platform/SSLKeyGenerator.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SSLKeyGeneratorChromium.cpp:
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/chromium/TemporaryLinkStubs.cpp:
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2009-10-22  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30591
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make accelerated compositing debug indicators work in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=30588
+        
+        Allow some debug indicators, that show which page elements go into compositing layers,
+        to work in release builds, when the runtime prefs are set.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setZPosition):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::clearBorderColor):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::updateMasksToBounds):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::setDebugBorder):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
+        * platform/graphics/mac/WebLayer.mm:
+
+2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Inspector should support monitorEvents/un monitorEvents() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=19879
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
+        _normalizeEventTypes, monitorEvent, unmonitorEvent.
+
+2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused):
+        (WebInspector.windowBlurred):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Error - requestContentType [undefined] is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=30666
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+
+2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Haiku] Correction of the accented letter width (they were 2 characters long).
+        https://bugs.webkit.org/show_bug.cgi?id=30629
+
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Replace use of Frame::nodeImage() with a function that takes a snapshot
+        of a PluginView.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.h:
+        Made paintWindowedPluginIntoContext() non-const, as it now calls
+        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
+        and snapshot() for Windows platforms.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintIntoTransformedContext):
+        Paints into the passed HDC without applying any coordinate translations.
+        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
+        the memset() of windowpos in lieu of assignment.
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        Code moved to paintIntoTransformedContext().
+        (WebCore::PluginView::paint):
+        Ditto.
+        (WebCore::PluginView::snapshot):
+        Create a context, and if the plug-in is windowless, translate it so the
+        plug-in will draw at the correct location. Create a bitmap, and select
+        it into the context. Paint the plug-in, and create a BitmapImage from
+        the bitmap.
+        (WebCore::PluginView::halt):
+        Use snapshot().
+
+2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix calculation of length in WebSocketChannel.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30656
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the ability to enable/disable functions in V8 at runtime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30650
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-21  Darin Adler  <darin@apple.com>
+
+        Swedish search (and other languages as well) is broken while fixing Japanese search
+        https://bugs.webkit.org/show_bug.cgi?id=30646
+
+        Rolled Japanese tailoring out that was done to fix
+        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
+        It was overriding the locale-specific tailoring.
+        We'll land a fix once we figure out how to add the
+        Japanese tailoring without removing anything.
+
+        * editing/TextIterator.cpp: Rolled out r49924.
+
+2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix - add missing image to gypi.
+
+        * WebCore.gypi:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes part of <http://webkit.org/b/30522>.
+        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+
+        Expose the description attribute that is now a member of
+        ExceptionBase as of r49723, so when a user logs an exception, they
+        can see the description in the Web Inspector.
+
+        Test: fast/dom/dom-exception-description.html
+
+        * dom/DOMCoreException.idl:
+        * dom/EventException.idl:
+        * dom/RangeException.idl:
+        * svg/SVGException.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
+        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
+        
+        Add a check to make sure a function we need to calculate percentages is
+        defined before we use it.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+
+2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27231
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
+        treeOutline.showInElementsPanelEnabled is true.
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30637
+        Fix a compiler warning in windows.
+
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix the crash when a node not in a document receives dispatchEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=30611
+
+        Test: fast/events/dispatch-event-no-document.html
+
+        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
+        (WebCore::EventTarget::dispatchEvent):
+
+2009-10-21  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: disable subpixel text on layers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30635
+        http://code.google.com/p/chromium/issues/detail?id=25365
+
+        With the addition of layers for drawing rounded corners in r49641,
+        subpixel text on rounded rectangles broke. This is because the layer
+        only contains a single alpha channel and this is insufficient to
+        compose subpixel text correctly.
+
+        On Windows, a large body of code in TransparencyWin.cpp exists to try
+        to deal with this. Even then, in some cases, it downgrades to
+        anti-aliased text. We need a fix for the grevious effects quickly thus
+        this patch disables subpixel text when rendering into a layer.
+
+        This would be covered by existing tests except that subpixel text is
+        disabled for pixel tests on Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::isCanvasMultiLayered):
+        (WebCore::adjustTextRenderMode):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
+        it will use the sqlite3 system library rather than WebCoreSQLite3.
+
+        * wscript:
+
+2009-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed background-clip parsing regressions introduced in r46240.
+
+        Test: fast/css/background-clip-text.html
+
+        * css/CSSParser.cpp:
+        (WebCore::parseBackgroundClip): Added this helper method.
+        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
+        reparse the value. The old code called parseFillProperty() again, which
+        didn’t work, because parseFillProperty() advances the value list.
+        (WebCore::CSSParser::parseFillProperty): Changed to use
+        parseBackgroundClip().
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
+        CSSValueWebkitText.
+
+2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable creation of custom SidebarTreeElements for different ProfileTypes
+
+        ProfileTypes can now create sidebar tree elements of custom types.
+        https://bugs.webkit.org/show_bug.cgi?id=30520
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.CPUProfileType.prototype.createView):
+        (WebInspector.CPUProfile.prototype.get head):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfileType.prototype.viewForProfile):
+        (WebInspector.ProfileType.prototype.createView):
+        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=17126
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+
+2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOM Agent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins: Create manual tests for testing plugins
+        
+        Create two test files:
+        1. windowed.html - Test plugin in windowed mode.
+        2. windowless.html - Test plugin in windowless mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30503
+
+        * manual-tests/plugins/windowed.html: Added.
+        * manual-tests/plugins/windowless.html: Added.
+
+2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+
+        Reviewed by Darin Adler.
+
+        Fixed Japanese text search problems.
+        Treat small kana letters and kana letters as different characters in search.
+        Do not ignore diacritic marks in search for Japanese texts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+
+        Test: fast/text/international/japanese-kana-letters.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::createCollator):
+        (WebCore::collator):
+        (WebCore::createSearcher):
+
+2009-10-20  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Changes TimelineItems to be created with raw timestamps as opposed
+        to a time relative to a start of session.  Normalized timestamps cause
+        problems when monitoring a browsing session across multiple page
+        transitions.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix leak of WebSocketChannel by adopting the newly-created reference.
+
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::create):
+
+2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 1/2.  Removing sessionStorageEnabled in next patch after the
+        Chromium side of the changes lands.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-10-20  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        This code only affects chromium, and is all behind a compile time
+        flag current turned off, so no new tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::setIsAvailable):
+        (WebCore::NotificationCenter::isAvailable):
+        * notifications/NotificationCenter.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2009-10-20  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
+        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
+
+        No new tests, error was caught by valgrind on the Chromium builders.
+
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator=):
+        * bindings/v8/ScriptStringImpl.h:
+        (WebCore::ScriptStringImpl::create):
+
+2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: populate child nodes before sorting them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29673
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
+        (WebInspector.ProfileDataGridNode.prototype.get _parent):
+        (WebInspector.ProfileDataGridNode.prototype._populate):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+
+2009-10-20  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove redundant String ref/deref calls in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30579
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
+            instead of constructing/destructing a String.
+
+2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25411
+        [GTK] ATK accessible ancestry broken
+
+        Work around for the problem of bogus additional objects in the ancestry.
+        We now set the parent when we ref the child, then ask the Atk child if
+        it knows its parent. This solves the bulk of the cases. For those it
+        doesn't, fall back to the existing logic.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+        (webkit_accessible_ref_child):
+
+2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Alice Liu.
+
+        Fixes <http://webkit.org/b/30421>.
+        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+
+        When a page like Google generates an about:blank, it shows up as a local file on
+        the list of Cookie domains, but has all of the cookies of Google. When we are adding
+        cookie domains to the inspector, we should only add the domain is the URL of the resource
+        is in the HTTP protocol family or a file URL.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+
+2009-10-20  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Use a version of libWebKitSystemInterface with global symbols marked
+        private_extern for Chromium Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30590
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac: Added.
+        * WebCore.gyp/mac/Empty.cpp: Added.
+        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CSSProperty
+        https://bugs.webkit.org/show_bug.cgi?id=30564
+
+        Inherits CSSProperty class from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Hide Chromium's media slider thumb if no source has been loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30529
+
+        Covered by existing layout tests, notably:
+            LayoutTests/media/controls-rendering.html
+            LayoutTests/media/unsupported-tracks.html
+            LayoutTests/media/video-src-none.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
+        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+
+2009-10-20  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
+        This will allow Chromium to more intelligently detect
+        noreferrer links and therefore open them in a new process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30581
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserFunction
+        https://bugs.webkit.org/show_bug.cgi?id=30563
+
+        Inherits CSSParserFunction struct from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
+        https://bugs.webkit.org/show_bug.cgi?id=30554
+
+        * inspector/front-end/inspector.css: added style to pane buttons
+
+2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30559
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Unreviewed buildfix.
+        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+
+        * WebCore.pro:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Set EnabledAtRuntime for WebSocket in DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        Supported by chromium/v8 only.
+        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
+        bindings.
+        Remove Settings::experimentalWebSocketsEnabled() and
+        setExperimentalWebSocketsEnabled(bool).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::setIsAvailable):
+        (WebCore::WebSocket::isAvailable):
+        * websockets/WebSocket.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Whoops, make prototype bindings actually use the StructureFlags.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-10-19  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Better implementation of WebCore::ScriptString for the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29909
+
+        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
+        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
+        is pretty inefficient, especially since responseText is built up with a sequence of
+        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
+        this patch adopts a similar approach for V8.
+
+        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::v8StringOrNull):
+        * bindings/v8/ScriptStringImpl.cpp: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::~ScriptStringImpl):
+        (WebCore::ScriptStringImpl::toString):
+        (WebCore::ScriptStringImpl::isNull):
+        (WebCore::ScriptStringImpl::size):
+        (WebCore::ScriptStringImpl::append):
+        * bindings/v8/ScriptStringImpl.h: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r49837.
+        http://trac.webkit.org/changeset/49837
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        * page/Settings.h:
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        * platform/text/UScriptCode.h: Removed.
+
+2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
+        https://bugs.webkit.org/show_bug.cgi?id=30473
+
+        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
+        PLALTFORM(WIN_OS) guards.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-10-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20797
+
+        Make generic font family getters/setters accept an additional
+        argument (script code). It has a default value so that if an embedder
+        does not have/want a per-script font family setting, call-sites
+        don't have to be changed.
+        This is to prepare for fixing bug 10874 (font selection is not
+        language-dependent) and bug 18085.
+
+        There should be no change in layout and no new layout test
+        is added.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/text/UScriptCode.h: Added. This is for ports that
+          do not use ICU. the part of ICU's common/unicode/uscript.h
+          that defines script code enum was copied. To keep enums compatible
+          with those in ICU, we don't generate the list out of Scripts.txt
+          of the Unicode Data base or CLDR's data.
+
+2009-10-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clarify usage of SuddenTermination API. No code change.
+
+        * platform/SuddenTermination.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Make DOM bindings automatically inherit correct structure
+        flags rather than being needlessly conservative.  This is
+        done by making the bindings generator use the same model
+        for TypeInfo flags that we now use in JSC.
+
+        This gains us about 1% of this regression back.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fixed a bug on nested SVG <use> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=26117
+        When a <use> element refer to another <use> element which has
+        child/children, the instance tree built for this <use> element
+        is incorrect (more nodes than expected).
+
+        Test: svg/dom/use-on-use-with-child.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Small changes to fully invalidate and update the JavaScriptCallFrame.
+
+        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=27146
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::invalidate):
+        (WebCore::JavaScriptCallFrame::update):
+
+2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Remove "source" from storage events
+        https://bugs.webkit.org/show_bug.cgi?id=30536
+
+        Remove "source" from storage events per
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        This was removed because it makes it introduces synchronous access that can
+        cross the event loop boundry (since a storage event can fire from one process
+        and be handled in another).
+
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::uri):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ResourceLoadNotifier::activeDocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30533
+
+        Removing this method from ResourceLoadNotifier better decouples the
+        notifier from FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::requestFromDelegate):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move sendRemainingDelegateMessages to ResourceLoadNotifier
+        https://bugs.webkit.org/show_bug.cgi?id=30531
+
+        This method is about notifying folks and doesn't interact with the rest
+        of FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bypass popup blocker using click event
+        https://bugs.webkit.org/show_bug.cgi?id=21501
+
+        Keep track of which events were generated by JavaScript and use that
+        inforation when figuring out if we're processing a user gesture.
+
+        Test: http/tests/security/popup-blocked-from-fake-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::createdByDOM):
+        (WebCore::Event::setCreatedByDOM):
+
+2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixing a typo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30543
+
+        * platform/sql/SQLiteDatabase.h:
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30544
+
+        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+
+2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Flash at end of opacity/transform transition sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=30501
+        
+        When a transition finishes, there window of time between when the animation is
+        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
+        to its old appearance for one or two frames. To avoid this, we set the final
+        transform or opacity at the start of the transition; we know that the animation
+        will override the final value for as long as its running.
+        
+        No test because this is a very transient effect that can't be captured
+        in a test.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateLayerOpacity):
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+
+2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add more stop characters into console completions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30477
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Adam Roben.
+
+        implemented ClipboardWin::files()
+        https://bugs.webkit.org/show_bug.cgi?id=29666
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28986
+
+        Tests: http/tests/navigation/no-referrer-reset.html
+               http/tests/navigation/no-referrer-same-window.html
+               http/tests/navigation/no-referrer-subframe.html
+               http/tests/navigation/no-referrer-target-blank.html
+
+        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
+        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::hasRel):
+        (WebCore::HTMLAnchorElement::setRel):
+        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
+        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
+        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
+        * loader/FrameLoaderTypes.h: Add enum for referrer policy
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
+
+
+2009-10-19  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
+
+        [v8] typeof(HTMLMediaElement) should return undefined if media
+        engine is not available
+        https://bugs.webkit.org/show_bug.cgi?id=30343
+
+        Check for availability of the media engine to disable
+        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
+        in runtime.
+
+        Try runs and review in Chromium:
+        http://codereview.chromium.org/276011
+
+        Test: manual-tests/chromium/media-player-not-available.html
+
+        The above test can work work in Chromium. Testing procedures:
+        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
+        2. Open Chromium with above test page
+        3. Verify the test results according to the test page
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Declare enabler methods.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Report enabled only if media player is available.
+        * manual-tests/chromium/media-player-not-available.html: Added.
+        Manual test, following instruction in this test for procedures.
+        * page/DOMWindow.idl:
+        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
+        as enabled at runtime.
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Refactor out some of the code in paint() into paintPanScrollIcon()
+        and paintScrollbars() in preparation of some Qt API changes.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make the local static panScrollIcon into a Image* instead
+        of a RefPtr<Image>.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Forcefully set antialiasing for Chromium media controls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30521
+
+        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+
+2009-10-19  Jens Alfke  <jens@mooseyard.com>
+
+        Reviewed by Darin Adler.
+
+        Optimize string upper/lowercasing
+        https://bugs.webkit.org/show_bug.cgi?id=30261
+        
+        - Added AtomicString::upper() and lower()
+        - Further optimized StringImpl::lower()
+        - Removed StringImpl::isLower()
+        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
+          thousands of upper() calls and string allocations.
+ 
+         * dom/Element.cpp:
+         (WebCore::Element::setAttribute): Call AtomicString::lower()
+         * dom/QualifiedName.cpp:
+         (WebCore::QualifiedName::localNameUpper): New method
+         * dom/QualifiedName.h: Added localNameUpper() method
+         * dom/StyledElement.cpp:
+         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
+         * html/HTMLDocument.cpp:
+         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
+         * html/HTMLElement.cpp:
+         (WebCore::HTMLElement::nodeName): Call localNameUpper()
+         * platform/text/AtomicString.cpp:
+         (WebCore::AtomicString::lower): New method
+         (WebCore::AtomicString::upper): New method
+         * platform/text/AtomicString.h: Added lower() and upper()
+         * platform/text/StringImpl.cpp: Removed isLower()
+         (WebCore::StringImpl::lower): Further optimization of initial loop
+         * platform/text/StringImpl.h: Removed isLower()
+ 
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If a call to a plugin's invokeMethod, invokeDefault or construct
+        returns false, throw an exception into JS.        
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        Test: plugins/netscape-invoke-failure.html
+
+        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
+        (npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod): Check return value
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
+        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+
+2009-10-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for chromium/skia canvas arc start/end positions, when the arc is
+        >= 360 degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=30449
+
+        Covered by new test:
+        LayoutTests/fast/canvas/arc360.html
+
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::addArc):
+
+2009-10-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix uninitialized variable reference in Element::removeAttribute().
+        https://bugs.webkit.org/show_bug.cgi?id=30502
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+
+2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30463
+        Remove HTML5 media element 'loadend' event
+
+        * dom/EventNames.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::noneSupported): Ditto.
+        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove deletion of outgoing FormData object when reply is finished.
+        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
+        fastRealloc edge case.
+        https://bugs.webkit.org/show_bug.cgi?id=29313
+
+        No test, the crash shows up occasionally in crash dumps, we weren't able
+        to reproduce it locally.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
+            avoid calling fastRealloc with the size of 0.
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30371
+
+        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
+2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed build warning fix.
+        [Qt] Apply changes to WebCore.pro introduced in r49778
+
+        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+
+2009-10-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move feGaussianBlur from WebCore/svg to WebCore/platform
+        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+
+        This patch moves SVGFRGaussianBlur from svg/graphics/filters
+        to platform/graphics/filters/FEGaussianBlur. This is needed
+        for shadow support on Qt and Cairo.
+        No change in functionality, therfore no new test case needed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
+        * platform/graphics/filters/FEGaussianBlur.h: Added.
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
+        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
+
+2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Added reviewer name to r49574.
+
+2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30489
+        [Gtk] The document frame/html container claims to be parentless
+
+        Work around for the parentless claim made by the accessible associated
+        with the embedded WebView. When we identify this condition, get the
+        widget's parent, and then get the AtkObject from that. Admittedly an ugly
+        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
+        plan to switch over to WebKit.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-19  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Handle duration queries properly
+        https://bugs.webkit.org/show_bug.cgi?id=29999
+
+        Previously duration queries failed to handle unknown duration
+        and didn't treat the returned duration as an unsigned.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix build on Windows.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::~PluginContainerQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+        Allow one to customize the minimal and maximal shrink factors used when printing.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPrintingMinimumShrinkFactor):
+        (WebCore::Settings::setPrintingMaximumShrinkFactor):
+        * page/Settings.h:
+        (WebCore::Settings::printingMinimumShrinkFactor):
+        (WebCore::Settings::printingMaximumShrinkFactor):
+
+2009-10-18  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes issue where doubleclicking a word could select following adjacent newlines.
+        https://bugs.webkit.org/show_bug.cgi?id=30234
+
+        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/mac/editing/selection/script-tests/TEMPLATE.html
+               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/win/editing/selection/script-tests/TEMPLATE.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix, use proper header name.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30485
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._printArray):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touching WebCore so that it
+        initiated inspector frontend deployment on Windows.
+
+        Web Inspector: frontend files are not deployed in Windows
+        incremental build.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Title of dir(["test", "test2"]) should be Array
+
+        https://bugs.webkit.org/show_bug.cgi?id=30486
+
+        Test: inspector/console-tests.html
+
+        * inspector/front-end/InjectedScript.js:
+
+2009-10-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
+        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+
+        Patch for SVGMaskElement landed in r49598 should correct the location of
+        the mask image graphics context. It only corrects the location for userSpaceOnUse
+        mode in maskContentUnits but breaks objectBoundingBoxMode.
+        The maskDestRect shouldn't be moved. It is not responsible for the correct context
+        postioin but for the correct position of the mask image.
+        This patch calculates the context postion independently from the maskDestRect.
+        It also uses lineareRGB color space for masking on CG now. This is the default
+        color space for masking operations.
+        We already have tests for both maskContentUnits modes.
+
+            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
+            *svg/custom/mask-with-default-value.svg
+
+        Some tests needed new pixel tests because of the new color space.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-18  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
+        That is notably faster for small numbers (most common case).
+        https://bugs.webkit.org/show_bug.cgi?id=30493
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add MathML sources if MathML support is enabled.
+
+        * GNUmakefile.am:
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-PCH build fix. Added missing header.
+
+        * bridge/runtime_root.h:
+
+2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layers not correctly updated after partial layout
+        https://bugs.webkit.org/show_bug.cgi?id=30425
+        
+        When a partial layout happened, for example as the result of a postion-change-only
+        layout, then some compositing layer positions were not correctly updated. To fix
+        this, updateLayerPositions() now carries along a flag that is set at the rootmost
+        layer being updated, and used to determine when we hit the first compositing layer
+        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
+        to do a full geometry update on that layer, which is thus the rootmost compositing
+        layer that is being updated.
+
+        Test: compositing/geometry/partial-layout-update.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for proxies in CURL.
+ 
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * platform/network/curl/ResourceHandleManager.h:
+        (WebCore::ResourceHandleManager::):
+
+2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez
+
+        https://bugs.webkit.org/show_bug.cgi?id=25901
+        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+
+        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Cleanup SVGElement code, preparing for animVal support
+        https://bugs.webkit.org/show_bug.cgi?id=30466
+
+        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
+        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
+        be used to control the start/end state of an animated property.
+
+        We're currently tracking animated properties that need synchronization, generalize this concept and use
+        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
+        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+
+        No change in functionality, thus no tests.
+
+        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
+        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
+        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
+        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
+        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
+        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::viewTarget):
+        * svg/SVGViewSpec.h: Ditto.
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Added.
+        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h: Added.
+        (WebCore::SynchronizableProperty::SynchronizableProperty):
+        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
+        (WebCore::SynchronizableProperty::operator==):
+        (WebCore::SynchronizablePropertyHash::hash):
+        (WebCore::SynchronizablePropertyHash::equal):
+        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
+        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
+
+2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25413
+        [GTK] Please expose the level of headings
+
+        Exposes the heading level as an attribute of the AtkObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (addAttributeToSet):
+        (webkit_accessible_get_attributes):
+        (webkit_accessible_class_init):
+
+2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=30472
+
+        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
+        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+
+        * page/EventHandler.cpp:
+
+2009-10-17  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Video controls not zoomed / transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=30461
+
+        Draw the images in the controls scaled.
+
+        No new tests. With this change Chromium will pass the following tests:
+        LayoutTests/media/video-controls-zoomed.html
+        LayoutTests/media/video-controls-transformed.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        Pass along the target rect directly.
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        Adjust the thumb slide applied with the scale factor.
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Gtk] Build fix for WebKitGtk after r49723.
+
+        Add bindings/js/JSExceptionBase.* to the build.
+
+        * GNUmakefile.am:
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49723.
+
+        Add bindings/js/JSExceptionBase.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
+        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_hasBeenHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::hasBeenHalted):
+        Return m_hasBeenHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_hasBeenHalted.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        @charset rule after the first byte causes the rest of css to be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=18265
+
+        Apparently we're supposed to tolerate whitespace before the charset
+        rule so folks can write code like this:
+
+        <style>
+        @charset "utf-8"
+        ...
+        </style>
+
+        I'm told this is one of the top compatability problems in China.
+        Tests: fast/css/comment-before-charset-external.html
+               fast/css/comment-before-charset.html
+               fast/css/many-spaces-before-charset.html
+               fast/css/space-before-charset-external.html
+               fast/css/space-before-charset.html
+
+        * css/CSSGrammar.y:
+
+2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes part of <http://webkit.org/b/30412>.
+        Web Inspector should get human readable DOM Exceptions.
+
+        Add a description field to ExceptionBase, and call it through 
+        reportException which allows the user/developer to get a more detailed
+        and coherent error explanation through the Web Inspector.
+
+        This only applies to exceptions that come from a script on the page when
+        it is run. DOM Exceptions that come from the code run in the console, or DOM
+        exceptions that are caught and logged will come in a future patch.
+
+        Tests: inspector/uncaught-dom1-exception.html
+               inspector/uncaught-dom3-exception.html
+               inspector/uncaught-dom8-exception.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        * bindings/js/JSExceptionBase.cpp: Added.
+        (WebCore::toExceptionBase):
+        * bindings/js/JSExceptionBase.h: Added.
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::):
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: forgot to check in this #include.
+
+        * bridge/runtime_root.h:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transform layer gets stuck with the wrong transform after an animation ends
+        <rdar://problem/7311662>
+
+        Work around a CoreAnimation bug which causes an animated transform layer to
+        end up with a stale transform.
+        
+        Test: compositing/animation/state-at-end-event-transform-layer.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::bug7311367Workaround):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After running a transition with an end event listener, can't change the transform
+        https://bugs.webkit.org/show_bug.cgi?id=30454
+        
+        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
+        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        
+        Now, we always clean up the animations right after queuing up the end events.
+
+        Tests: animations/state-at-end-event.html
+               transitions/move-after-transition.html
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=30428
+
+        TextNode => Edit Text Node
+        Has Attributes => Edit First Attribute
+        No Attributes => Start Editing New Attribute
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
+        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
+        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix header indent style for FrameLoader and friends
+        https://bugs.webkit.org/show_bug.cgi?id=30430
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::frame):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::notifier):
+        (WebCore::FrameLoader::isLoadingMainResource):
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state):
+        (WebCore::FrameLoader::client):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+        (WebCore::FrameLoader::committingFirstRealLoad):
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * loader/HistoryController.h:
+        (WebCore::HistoryController::currentItem):
+        (WebCore::HistoryController::provisionalItem):
+        * loader/PolicyCallback.h:
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyChecker.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        * loader/RedirectScheduler.h:
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
+        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49693, because it broke Chromium build.
+        http://trac.webkit.org/changeset/49693
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+
+        Noticable changes:
+            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
+            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+
+        Tests: media/video-src-empty.html
+               media/video-src-none.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=30407
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Insecure plug-ins don't trigger mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=30431
+
+        Added the missing check.
+
+        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Set autobuffer to true and schedule load in V8 audio element constructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30448
+
+        Covered by existing tests.
+
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30422
+
+        Covered by existing media layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Removed round() and FIXME.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30410
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-16  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Transform transitions that used to be accelerated are no longer so
+        https://bugs.webkit.org/show_bug.cgi?id=30453
+
+        The change in r49633, to not run accelerated animations/transitions on layers that
+        are not attached, broke accelerated transitions/animations in many cases where they start
+        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
+        attached.
+        
+        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, build the MSW source to get methods that use the MSW version of
+        PlatformModuleVersion.
+
+        * wscript:
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
+        casing.
+
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change EmptyPluginHalterClient in SVGImage to be non-static, to
+        match changes made http://trac.webkit.org/changeset/49385.
+        https://bugs.webkit.org/show_bug.cgi?id=30403
+
+        Run the following layout test sequence:
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
+          LayoutTests/svg/carto.net/scrollbar.svg
+          LayoutTests/svg/carto.net/selectionlist.svg
+
+        selectionlist.svg should not crash.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+
+2009-10-16  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add beforeload event support to V8DOMWrapper
+
+        https://bugs.webkit.org/show_bug.cgi?id=30413
+
+        LayoutTests/fast/dom/beforeload/frame-before-load.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Chrome doesn't set Content-Type for file upload when the file extension
+        is not recognized
+        https://bugs.webkit.org/show_bug.cgi?id=30433
+
+        Apparently, getMIMETypeForPath is supposed to return
+        application/octet-stream when it doesn't have a better MIME type.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Inform the application when a plugin is created or destroyed, but only if the 
+        application registered for these notifications.
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Default language translation should be determined by locale settings,
+        e.g., "en-US".
+        https://bugs.webkit.org/show_bug.cgi?id=29653
+
+        Test: fast/js/navigator-language.html
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r49644.
+        http://trac.webkit.org/changeset/49644
+        
+        We need to think about this change some more. See bug #30418 
+        for more details.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_isHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isHalted):
+        Return m_isHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_isHalted to true.
+        (WebCore::PluginView::restart):
+        clear m_isHalted.
+
+2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Build fix for QtWebKit after r49649.
+
+        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed - build fix.
+
+        Web Inspector: add file missing in r49648
+
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: introduce test controller with waitUntilDone
+        on frontend side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30400
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27895
+        
+        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
+        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
+        the HTML Base element, HTML Object element, inline and external script tags, and
+        JavaScript multi-line variants of all of these attacks.
+
+        Tests: http/tests/security/xssAuditor/base-href-comment.html
+               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
+               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
+               http/tests/security/xssAuditor/img-onerror-comment.html
+               http/tests/security/xssAuditor/object-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
+               http/tests/security/xssAuditor/script-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-with-source-comment.html
+
+        * page/XSSAuditor.cpp: Added constant minAttackLength.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
+        to minAttackLength of script code plus context (if any).
+        * page/XSSAuditor.h:
+
+2009-10-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Currently, Skia clip paths are 1-bit. This patch makes our path
+        clipping anti-aliased for non-canvas drawing.
+
+        http://code.google.com/p/chromium/issues/detail?id=5927
+        https://bugs.webkit.org/show_bug.cgi?id=28820
+        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+
+        Already covered by layout tests. New baselines will be needed in the
+        Chromium tree.
+
+        (Reland. First landed in r49329, reverted in r49330 due to Windows
+        build break)
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::clip):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::clipPathAntiAliased):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebCore.Video.exp: Export muted and setMute.
+
+2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transitions fail to run sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=26770
+
+        Fix an issue where we could attempt to start accelerated animations or transitions on
+        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
+        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
+        software transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        Make some methods non-inline for ease of debugging (these are not hot methods).
+        Rename m_waitingForAResponse to m_waitingForResponse.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::hasAncestor):
+        New method to report whether the receiver has the given layer as an ancestor. Used for checking
+        whether a layer is rooted.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+
+2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Refactor ProfilesPanel to support multiple profile types
+
+        Data describing different profile types are now stored in distinct objects.
+        https://bugs.webkit.org/show_bug.cgi?id=30332
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.get buttonStyle):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfile):
+        (WebInspector.CPUProfile.prototype.get title):
+        (WebInspector.CPUProfile.prototype.get uid):
+        (WebInspector.CPUProfile.prototype.get head):
+        (WebInspector.CPUProfile.prototype.createView):
+        (WebInspector.CPUProfile.prototype.viewForProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType):
+        (WebInspector.ProfileType.prototype.get buttonTooltip):
+        (WebInspector.ProfileType.prototype.get buttonStyle):
+        (WebInspector.ProfileType.prototype.get buttonCaption):
+        (WebInspector.ProfileType.prototype.get id):
+        (WebInspector.ProfileType.prototype.get name):
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._makeKey):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.getProfileType):
+        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
+        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addProfileHeader):
+        (WebInspector.setRecordingProfile):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.showProfileForURL):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enable inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GStreamer] READY state doesn't mean "enough data"
+        https://bugs.webkit.org/show_bug.cgi?id=30003
+
+        STATE_READY means MediaPlayer::HaveNothing
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30002
+
+        implement cancelLoad
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30353
+        
+        Fix race condition, leading to a deadlock
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (webkit_video_sink_class_init):
+        Fix race condition in unlock/render that would lead to deadlocks.
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30374
+        
+        Check if caps are valid before parsing them
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+        Check if caps are valid before parsing them in ::naturalSize().
+        This prevents assertions if the natural size should be calculated
+        before the video caps are negotiated.
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30006
+        [GStreamer] Unnecessary checks for Messages types in callbacks
+
+        refactored gst message callbacks into a single one
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Adele Peterson.
+
+        Anchor elements should be mouse focusable regardless isLink flag.
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+
+2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Return correct shorthand property name for 
+        background-repeat-x, background-repeat-y, background-position-x,
+        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
+        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+
+        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Create and update frontend script objects only when
+        web inspector is visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30376
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Fix Windows build.
+
+        * dom/Document.idl:
+
+2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [HTML5] Add document.head
+        https://bugs.webkit.org/show_bug.cgi?id=30232
+
+        Test is fast/dom/document-head.html
+
+        * dom/Document.idl: added readonly attribute head
+
+2009-10-14  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
+        https://bugs.webkit.org/show_bug.cgi?id=30347
+        https://bugs.webkit.org/show_bug.cgi?id=22772
+
+        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Move scrolling code from FrameLoader to FrameView
+        https://bugs.webkit.org/show_bug.cgi?id=30370
+
+        This code is about controlling the Frame's view, not about loading
+        stuff into the frame.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::scrollToAnchor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragment):
+        (WebCore::FrameView::scrollToAnchor):
+        * page/FrameView.h:
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        [XSSAuditor] Add an exception for local files
+        https://bugs.webkit.org/show_bug.cgi?id=30352
+
+        Reduce XSS auditor false positives by always letting pages load scripts
+        from their own host. We don't actually know of any false positives
+        that this prevents, but it seems like a good idea.
+
+        One subtly is that we don't add this exception for scripts that have a
+        query string because (1) URLs with query strings are more apt to
+        confuse servers and (2) it is much less common to load scripts with a
+        query string.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
+               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+
+2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Kill virtual contextElement() method spread all over SVG code
+        https://bugs.webkit.org/show_bug.cgi?id=30183
+
+        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
+        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
+        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
+
+        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
+        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::synchronize):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGCircleElement.h: Ditto.
+        * svg/SVGClipPathElement.h: Ditto.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGDefsElement.h: Ditto.
+        * svg/SVGEllipseElement.h: Ditto.
+        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
+        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
+        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGLineElement.h: Ditto.
+        * svg/SVGMPathElement.h: Ditto. Fix license indention.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGMaskElement.h: Ditto.
+        * svg/SVGPathElement.h: Ditto.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
+        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGRectElement.h: Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGSwitchElement.h: Ditto.
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
+        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
+        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
+        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Masking with wrong offset
+        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+
+        SVGMaskElement moves the mask image graphics context to the wrong location.
+        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
+        is not used in the later calculation. Fix by consistenly calculating the translation
+        offsets from the final mask destination rect.
+
+        Test: svg/custom/mask-with-default-value.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Jon Honeycutt.
+        
+        Export a few more showSubstituteImage() related methods.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-14  Mark Seaborn  <mseaborn@google.com>
+
+        Reviewed by Darin Adler.
+
+        Check error return value in Perl build script
+        https://bugs.webkit.org/show_bug.cgi?id=30316
+
+        * css/makevalues.pl: Die if gperf fails.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG wrong filterRegions for userSpaceOnUse and percentage values
+        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+
+        Some clean-up of the SVG filter calculation code. This clean-up
+        also fixes the problem with percentage and userSpaceInUse mode.
+
+        Test: svg/filters/subRegion-in-userSpace.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::buildFilter):
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::~SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::create):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        The last change fixed the problem, removing diagnostic printfs.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix for versions < 7.18.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        One more round of changes to figure out why the webgl 
+        tests are crashing on the build bot. Here I am trying
+        to see if we can create a software renderer. I am also
+        printing the found pixel formats.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
+ 
+        Reviewed by Simon Hausmann.
+ 
+        Enabling NPAPI plugin support on Qt Webkit for S60 platform
+        https://bugs.webkit.org/show_bug.cgi?id=29302
+
+        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
+        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
+        <norbert.leser@nokia.com>
+         
+        * WebCore.pro:
+        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
+        new plugin files to be compiled under symbian: macro
+
+        * bridge/npapi.h:
+        Added NPEvent and NPRegion definition for Symbian
+
+        * plugins/PluginPackage.h:
+        Added S60 specific plugin interface and plugin loader variables
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
+        Default implementation to be used only for non-symbian platform
+        * plugins/PluginDatabase.cpp:
+        Macro !SYMBIAN checking
+        * plugins/PluginView.h:
+        Add Symbian to platforms that support setNPWindowIfNeeded
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
+        call setNPWindowRect from setFrameRect
+         
+        Added folder 'symbian' which contains implementation files for S60
+        platform-specific NPAPI plugin functionality, under /plugins folder
+        * plugins/symbian
+        * plugins/symbian/npinterface.h:
+        Plugin Interface to be implemented by S60 NPAPI plugins 
+        * plugins/symbian/PluginContainerSymbian.h:
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        * plugins/symbian/PluginDatabaseSymbian.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        More changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Round non-integer line height values.
+
+        Change webkit to rounding non-integer line height values
+        instead of truncating them. This fixes a layout test
+        failure on Windows and matches the calculation in IE and Firefox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=24434
+
+        Test: fast/css/line-height-rounding.html
+              fast/forms/textarea-scrollbar-height.htm
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-10-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
+        interfaces to be more consistent with the JavaScript profiler.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::startTimelineProfiler):
+        (WebCore::InspectorBackend::stopTimelineProfiler):
+        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
+        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+
+2009-10-01  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix crash when loading invalid image data
+        https://bugs.webkit.org/show_bug.cgi?id=29980
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setImageSizeForAltText):
+
+2009-10-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for NULL ptr deref in canvas's toDataURL().
+        https://bugs.webkit.org/show_bug.cgi?id=30254
+
+        Test: fast/canvas/canvas-toDataURL-crash.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed, reverting r49558 since it broke profiler tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        ImageDecoderQt: Minor tweaks to the decoder
+
+        - Only cache the data when we start to use it.
+        - Start with a repetition count of none for normal images.
+        - Do not use canRead as this will trigger parsing of the full image
+        - Cope with a GIF failing to decode the first frame, do not
+          set m_failed to true if decoding the first frame failed
+        - Inform the QImageReader about the format that was detected
+        - Always create a ImageDecoderQt when when we have more
+        than four byte.
+
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
+        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
+        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
+        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
+        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
+        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
+        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
+        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't collect call frame properties until they're needed for completion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30334
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
+        * inspector/front-end/ScriptsPanel.js:
+
+2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29106
+        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+
+        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
+        compiler aggressively resolve inheritance of class R.  
+        
+        The winscw compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+        
+        The change should be reverted when the above bug is fixed in winscw compiler.
+
+        * loader/CachedResourceHandle.h:
+        (WebCore::::CachedResourceHandle):
+
+2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49554, because it broke Win and Chromium builds.
+        http://trac.webkit.org/changeset/49554
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
+        While we're rebaselining scrollbars, fix an off by one in the vertical
+        scrollbar rendering too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30319
+
+        Tests: this is covered by every pixel test involving scrollbars.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+
+2009-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix issue where clientX and clientY on MouseEvents were wrong when
+        the page was zoomed and scrolled.
+
+        Test: fast/events/clientXY-in-zoom-and-scroll.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX): Take page zoom into account.
+        (WebCore::contentsY): Ditto.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
+        out into separate ones for scripts and stylesheets.
+
+        * WebCore.base.exp:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        (WebCore::PageGroup::userStyleSheets):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Chrome's "Skia" theme paints select controls backwards in RTL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30320
+
+        Test: fast/text/international/bidi-menulist.html
+        (The test is about something else, but it includes RTL selects.)
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30318
+        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
+        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
+        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+
+        Tests:
+        Test adds event listener to a DocumentType Node which is created without a document
+        and then dispatches the event after attaching a node to the tree. Event
+        should fire when node is attached to the tree.
+
+        * fast/events/add-event-without-document-expected.txt: Added.
+        * fast/events/add-event-without-document.html: Added.
+
+        All changes in files below are the same - remove the code that calls
+        EventTarget::scriptExecutionContext and checks it for NULL.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        Cleaned up bitrot in SharedWorker V8 bindings.
+
+        * WebCore.gypi:
+        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8SharedWorkerContext.cpp.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * bindings/v8/V8Index.h:
+        Added definition for SHAREDWORKERCONTEXT wrapper.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        Added includes for SharedWorker.h and SharedWorkerContext.h.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
+        Also added field indexes for SharedWorkers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        Added runtime enabler for the SharedWorker constructor.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Cleaned up bitrot (various APIs have changed since this file was written).
+        * page/DOMWindow.idl:
+        Added EnabledAtRuntime flag to window.SharedWorker.
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30345
+        HTTP tests for credential handling fail on Tiger
+
+        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
+        let it do its work without intervention. Once again, we pass explicitly passed credentials
+        in URL, fixing regressions from Safari 3.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Adam Barth.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Reworked and added to the getter/setter interface in ChromiumDataObject:
+        - added contains...() methods to just query the state
+        - added containsValid...URL() methods for URL data members
+        - removed takeFileNames() as this was too type-dependent
+        - changed return type of fileNames() to Vector<String>
+        - added interface methods to allow appending to and iteration over file names
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::containsMainURL):
+        (WebCore::ChromiumDataObject::containsValidMainURL):
+        (WebCore::ChromiumDataObject::containsMainURLTitle):
+        (WebCore::ChromiumDataObject::containsTextPlain):
+        (WebCore::ChromiumDataObject::containsTextHTML):
+        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsContent):
+        (WebCore::ChromiumDataObject::containsContentFileExtension):
+        (WebCore::ChromiumDataObject::containsContentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::containsFileNames):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::clearFileNames):
+        (WebCore::ChromiumDataObject::countFileNames):
+        (WebCore::ChromiumDataObject::fileNameAt):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::appendToFileNames):
+        (WebCore::ChromiumDataObject::popFileName):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Visibility:visible inside a compositing layer doesn't make the element visible
+        https://bugs.webkit.org/show_bug.cgi?id=30339
+        
+        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
+        only consulted hasVisibleContent(), which does not take into a account child layers which
+        may be visible. We also have to consult hasVisibleDescendant() as well.
+
+        Test: compositing/compositing-visible-descendant.html
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
+        from the make system into common code.
+
+        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
+        support is not enabled.
+
+        Remove notImplemented() from PluginPackageNone.cpp and 
+        PluginDataNone.cpp make them just empty functions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginDataNone.cpp:
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * plugins/PluginPackageNone.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30150
+        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+
+        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+
+        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
+        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
+        converts null strings to non-null @"".
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by Dimitri Glazkov.
+
+        window attributes (like localStorage) that are disabled at runtime are still visible
+        https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        Adding codegen/bindings to support runtime disabling of attributes.
+
+        No new tests (only supported by chrome currently)
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
+        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):
+        Refactored attribute setting code into a common inline routine.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::configureAttribute):
+        Inline function which configures a single attribute given a BatchedAttribute struct.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * page/DOMWindow.idl:
+        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+
+2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27457
+        Added support for static validation on type=email input elements as per
+        HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+
+        Test: fast/forms/ValidityState-typeMismatch-email.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
+        performs validation on type=email input elements now.
+        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
+        * html/ValidityState.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Event listeners installed on a window object returned from window.open() don't work
+        https://bugs.webkit.org/show_bug.cgi?id=28716
+
+        Tests: http/tests/security/window-events-clear-domain.html
+               http/tests/security/window-events-clear-port.html
+               http/tests/security/window-events-pass.html
+
+        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
+        window event handlers when implicitOpen is called. It is called in 2 cases - on
+        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+
+        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
+        event handlers, to preserve the behavior of document.open().
+
+        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
+        does not remove window event handlers.
+
+        * dom/Document.h: Removed clear().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
+        if we transition from temporary empty document to a loaded one.
+
+        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
+        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leak in the inspector by calling didRemoveNode with
+        an error code when it fails, instead of returning from the
+        Backend.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
+        Web Inspector: Should be able to delete nodes from the Elements Tree.
+        
+        When the delete key is pressed and a element is selected in the tree,
+        the element should be deleted from the Elements Tree and the DOM.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didRemoveNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        
+        Set pointer-events: none on the new overlay so mouseover events are passed
+        to the resources graph so we can show timings.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+       https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build system fix. Typo in a filename.
+
+        * GNUmakefile.am:
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+        Alter profile link format to enable multiple profile types
+        https://bugs.webkit.org/show_bug.cgi?id=30253
+
+        The new profile URL includes the profile type along with the
+        profile title and uid.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.linkifyStringAsFragment):
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix same-named profiles grouping in the Profiles panel.
+
+        The tree node re-parenting while adding a new group node was broken.
+         
+        https://bugs.webkit.org/show_bug.cgi?id=30299
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enforce async interaction between inspector controller and frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30300
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch.delayDispatch):
+        (WebInspector.dispatch):
+
+2009-10-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
+        scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30034
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        JavaScript bindings of WebSocket addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        Test: fast/websockets/websocket-event-target.html
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * websockets/WebSocket.idl:
+
+2009-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
+        <rdar://problem/7288221>
+
+        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::pruneBlacklistedCodecs):
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-10-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
+        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
+        for the Objective-C wrapper class as well.
+
+        Added fast/dom/beforeload/frame-before-load.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isBeforeLoadEvent):
+        * dom/Event.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-10-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix <rdar://problem/7094146> Reproducible crash at
+        RenderObject::localToAbsolute()
+
+        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+
+        The crash was caused by stale positioned objects lists following an
+        object transitioning from being absolutely position to being fixed
+        positioned.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): In case of a transition between
+        absolute and fixed position, mark the parent as having a child needing
+        layout, so that this object will get inserted into its new container's
+        positioned objects list.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
+        this transition, so that this object gets removed from its current
+        container's positioned objects list.
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a palette() method that is needed by our RenderTheme.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Gradients can't handle percentage values in userSpaceOnUse mode
+        [https://bugs.webkit.org/show_bug.cgi?id=30286]
+
+        Fixed *GradientAttributes to take SVGLength instead of double. This casues
+        the problem, that we can't calculate the correct size of a gradient on
+        userSpaceOnUse mode with percentage values.
+
+        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
+
+        * svg/LinearGradientAttributes.h:
+        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
+        (WebCore::LinearGradientAttributes::x1):
+        (WebCore::LinearGradientAttributes::y1):
+        (WebCore::LinearGradientAttributes::x2):
+        (WebCore::LinearGradientAttributes::y2):
+        (WebCore::LinearGradientAttributes::setX1):
+        (WebCore::LinearGradientAttributes::setY1):
+        (WebCore::LinearGradientAttributes::setX2):
+        (WebCore::LinearGradientAttributes::setY2):
+        * svg/RadialGradientAttributes.h:
+        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
+        (WebCore::RadialGradientAttributes::cx):
+        (WebCore::RadialGradientAttributes::cy):
+        (WebCore::RadialGradientAttributes::r):
+        (WebCore::RadialGradientAttributes::fx):
+        (WebCore::RadialGradientAttributes::fy):
+        (WebCore::RadialGradientAttributes::setCx):
+        (WebCore::RadialGradientAttributes::setCy):
+        (WebCore::RadialGradientAttributes::setR):
+        (WebCore::RadialGradientAttributes::setFx):
+        (WebCore::RadialGradientAttributes::setFy):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+
+2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30315>.
+        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        
+        Add tooltip text to the Load event and DOM Content event lines through
+        a new layer that allows these lines to be on top of the view.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/inspector.css:
+
+2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49429, because it broke layout tests.
+        http://trac.webkit.org/changeset/49429
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
+2009-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added automatic flush before compositing
+        https://bugs.webkit.org/show_bug.cgi?id=30236
+
+        This causes image to always render correctly. In writing a testcase
+        I needed to implement readPixels. This exposed a bug in reading back
+        values from a CanvasArray subclass, so I fixed that as well. Now when
+        you wrap a CanvasArray in a JSValue it actually wraps the specific
+        subclass. To do this I need to add virtual methods to each CanvasArray
+        subclass to determine the type and a custom toJS method for CanvasArray
+        to create the proper wrapper. 
+
+        Test: fast/canvas/webgl/triangle.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayCustom.cpp:
+        (WebCore::toJS):
+        * html/canvas/CanvasArray.h:
+        (WebCore::CanvasArray::isByteArray):
+        (WebCore::CanvasArray::isUnsignedByteArray):
+        (WebCore::CanvasArray::isShortArray):
+        (WebCore::CanvasArray::isUnsignedShortArray):
+        (WebCore::CanvasArray::isIntArray):
+        (WebCore::CanvasArray::isUnsignedIntArray):
+        (WebCore::CanvasArray::isFloatArray):
+        * html/canvas/CanvasArray.idl:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::isByteArray):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::isFloatArray):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::isIntArray):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::readPixels):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::isShortArray):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30307
+        
+        Fix 0 sentinel for g_object_set() function call.
+
+        * platform/graphics/gtk/DataSourceGStreamer.cpp:
+        (webkit_data_src_uri_set_uri):
+        0 is passed as 32 bit value on x86-64 in vararg functions, but
+        g_object_set() expects a 64 bit 0. This will cause crashes.
+
+2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop in="" from <feFlood>
+        https://bugs.webkit.org/show_bug.cgi?id=29001
+
+        This makes <feFlood in="bogus"> have an effect, too.
+
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+
+        Test: svg/dom/feFlood-no-in1.html
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29998
+        
+        Scale video to completely fill the target surface while
+        keeping the aspect ratio. This fixes displaying of the
+        YouTube HTML5 sample website.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Scale video to completely fill the target surface, keep
+        the aspect ratio and center it.
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29997
+        
+        Fixes double memcpy of all rendered video frames.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        Directly pass the buffers up to the MediaPlayerPrivate::paint()
+        method instead of rendering them first to an intermediate cairo
+        surface. This should increase performance and peak memory usage.
+
+2009-10-11  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30242
+        
+        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
+        bypass the XSSAuditor.
+        
+        JavaScript URLs that are completed by method Document::completeURL have added
+        URL-encoded characters such that a direct comparison with the URL-decoded 
+        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
+        HTTP parameters must be URL-decoded before comparison.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
+        the URL-decoded source code for the JavaScript URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
+        parameter decodeURLEscapeSequencesTwice.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fixes a build break in the V8 bindings caused by revision 49420.
+        https://bugs.webkit.org/show_bug.cgi?id=30294
+
+        Revision 49420 introduces an IDL-defined CanvasActiveInfo
+        type. This causes a build break in the V8 bindings where
+        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
+        non-ref type.
+
+        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
+        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
+          ptr type.
+        * bindings/v8/DOMObjectsInclude.h: Include generated
+          CanvasActiveInfo files.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-10-11  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Log mixed content warnings to console
+
+        https://bugs.webkit.org/show_bug.cgi?id=30290
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+
+2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
+        https://bugs.webkit.org/show_bug.cgi?id=30250
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+
+        https://bugs.webkit.org/show_bug.cgi?id=30244
+
+        This change requires no test case as it fix a compiling error.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Sets a 500K stack limit for JavaScript workers in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29797
+
+        Runaway recursion in JavaScript workers crashes the Chromium
+        worker process on OS X. This is because V8's default stack limit
+        is 512K on ia32 or 1M on x64, but the worker process runs workers
+        on a thread with the OS X default stack size--512K. Because there
+        are already some C+frames on the stack when V8 establishes its
+        512K default stack limit, and V8 doesn't precisely enforce the
+        stack limit, runaway recursion in V8 workers overflows the OS
+        stack and segfaults, killing the worker process. This is described
+        in Chromium bug 21653 <http://crbug.com/21653>.
+
+        This patch sets the V8 stack limit for worker JavaScript in
+        Chromium to a more conservative 500K on all platforms. This allows
+        some "headroom" for the C+stack in use when the limit is set up,
+        and some "legroom" for the V8 helper functions which in practice
+        briefly flout the V8 stack limit.
+
+        Test: LayoutTests/fast/workers/use-machine-stack.html
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Sam Weinig.
+
+        Allow [Reflect] on SVG elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28936
+
+        Update the JS binding generators to reference SVGNames instead of
+        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
+        SVGElement::id use [Reflect].
+
+        Also make [Reflect] on an attribute with a setter exception work in ObjC
+        bindings.
+
+        Test: svg/dom/id-reflect.html
+
+        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
+        appropriate C+namespace for attribute name constants.
+        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
+        code for [Reflect] on an attribute with a setter exception.
+        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
+        "HTMLNames" when appropriate.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/SVGElement.cpp: Remove getter and setter methods for id.
+        * svg/SVGElement.h: Ditto.
+        * svg/SVGElement.idl: Add [Reflect] to id.
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix paths in xcode.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Implement getActiveAttrib and getActiveUniform
+        https://bugs.webkit.org/show_bug.cgi?id=30276
+
+        Implements the getActiveAttrib and getActiveUniform APIs.
+        Rather simple patch, adds CanvasActiveInfo definition and implementation
+        and adds forwarding to the GraphicsContext3D.
+
+        Test: fast/canvas/webgl/getActiveTest.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasActiveInfo.h: Added.
+        (WebCore::CanvasActiveInfo::create):
+        (WebCore::CanvasActiveInfo::name):
+        (WebCore::CanvasActiveInfo::type):
+        (WebCore::CanvasActiveInfo::size):
+        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
+        * html/canvas/CanvasActiveInfo.idl: Added.
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+          Need to make the context public as it is needed to ensure we don't
+          provide a program from one context as an argument to another.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
+        (WebCore::CanvasRenderingContext3D::getActiveUniform):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+
+2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adding new attributes in Element Panel is
+        counterintuitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30057
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30275
+
+        In addition to fixing the build break with guards
+        remove notImplemented() from PluginViewNone.cpp and
+        make them just just be empty functions.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49415.
+
+        Add HistoryController.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
+        https://bugs.webkit.org/show_bug.cgi?id=30262
+
+        This is not testable from WebKit since WebKit never uses the member
+        function form of protocolIs with input that can be controlled from a
+        web page.  It always passes string literals lacking hyphens.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
+        transform the input character.
+
+2009-10-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move HistoryController to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=30272
+
+        Purely mechanical.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp: Added.
+        * loader/HistoryController.h: Added.
+
+2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ApplyStyleCommand removes presentational tags even when not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=28091
+
+        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
+        (triggering removal of tag) only if the style implicitly added by the element is not present in
+        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
+        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
+        style span when the style attribute is empty.
+
+        Test: editing/execCommand/toggle-style-3.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
+        decoration is not present in the style to apply
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
+        returns true if the tag is used in new style
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
+        with the surrounding identical elements
+        * editing/ApplyStyleCommand.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        HistoryController is in charge of managing the current / previous /
+        provisional HistoryItems.  The split isn't perfect, but it's a place to
+        start.  I'll move HistoryController into its own file in another patch.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::HistoryController::HistoryController):
+        (WebCore::HistoryController::~HistoryController):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::begin):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::setCurrentItem):
+        (WebCore::HistoryController::setProvisionalItem):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::didFirstLayout):
+        (WebCore::HistoryController::updateForFrameLoadCompleted):
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::receivedMainResourceError):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
+        (WebCore::HistoryController::createHistoryItem):
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
+        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
+        (WebCore::HistoryController::createHistoryItemTree):
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::HistoryController::urlsMatchItem):
+        (WebCore::HistoryController::goToItem):
+        (WebCore::HistoryController::recursiveGoToItem):
+        (WebCore::HistoryController::childFramesMatchItem):
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::updateForAnchorScroll):
+        (WebCore::HistoryController::saveDocumentAndScrollState):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::FrameLoader::didChangeTitle):
+        * loader/FrameLoader.h:
+        (WebCore::HistoryController::current):
+        (WebCore::HistoryController::provisional):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - fixing an obvious typo in my previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Fixes existing tests (which I thought I had run the previous time).
+
+        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
+        set by reference.
+
+2009-10-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
+        https://bugs.webkit.org/show_bug.cgi?id=30264
+
+        The base class method changed in r48884.
+
+        Test: fast/worker/worker-script-error.html
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Tests: http/tests/xmlhttprequest/logout.html
+               http/tests/xmlhttprequest/re-login-async.html
+               http/tests/xmlhttprequest/re-login.html
+
+        Fix several issues with existing credential handling code.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
+        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
+        want to iterate paths for origins that never had credentials associated with them. Changed
+        to use a separate HashSet for this.
+        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
+        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
+        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
+        is now PathToDefaultProtectionSpaceMap.
+        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
+        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
+        (WebCore::CredentialStorage::set): Updated for above changes.
+        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
+        a prefix in OriginToDefaultBasicCredentialMap.
+        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
+        URL default protection space. It does nothing if the given URL doesn't correspond to a known
+        protection space.
+        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
+
+        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
+        protection space and those that deduce one from URL more clear.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
+        This makes the following pattern work:
+          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
+          req.send("");
+          req.abort();
+        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
+        Note that one cannot log in using the same method, because there isn't a known protection
+        space for the URL yet in that case, so the added code has no effect.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
+        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
+        course), and matches sync case.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Renamed getDefaultAuthenticationCredential() to get().
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac code.
+
+2009-10-09  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Undoing a indent removes text instead of it's formatting.
+        <rdar://problem/7169206>
+        https://bugs.webkit.org/show_bug.cgi?id=28722
+        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
+        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        
+        Added editing/undo/undo-indent.html test.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
+        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
+        ensure TextIterator could correctly calculate the position starting from the index.
+        * editing/IndentOutdentCommand.h: Restored.
+
+2009-10-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+        
+        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=30186
+
+        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
+        detect no-ops and return this instead of creating a new instance.
+        Empirical testing shows that the majority of calls to these methods are no-ops, making
+        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
+        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
+        (WebCore::StringImpl::stripWhiteSpace):
+        (WebCore::StringImpl::simplifyWhiteSpace):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feGaussianBlur implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+
+        This is the implementation of GaussianBlur filter for SVG.
+
+        There is already a test for feGaussianBlur
+        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+
+        Test: svg/filters/feGaussianBlur.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isAlphaImage):
+        (WebCore::FilterEffect::setIsAlphaImage):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+        (WebCore::FEGaussianBlur::apply):
+
+2009-10-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] QoS support in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=29959
+
+        Removed the async buffer queue from the sink. Synchronize the
+        render method of the sink using a g_timeout_add() combined with a
+        gcond triggered when the buffer has been rendered.
+        Also fixed the video sink reference handling in the player, now
+        that the idle is not there anymore to mess up things.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_class_init):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
+        with the attribute "operator". It was only accessible via "_operator" 
+        on JavaScript.
+
+        Test: svg/dom/operatorAttribute.xhtml
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.SVG.Filters.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEMorphologyElement.cpp: Added.
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::setRadius):
+        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/SVGFEMorphologyElement.h: Added.
+        * svg/SVGFEMorphologyElement.idl: Added.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::operator<<):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::):
+        * svg/svgtags.in:
+
+2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Chromium breakage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+
+2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
+
+        https://bugs.webkit.org/show_bug.cgi?id=30023
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
+        ImageEventSender that can be used by both load and beforeload events.  If the document has any
+        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
+        and will be held up until the beforeload event can fire at a later date.
+
+        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
+        in the typical parsing case we don't have to put off the beforeload/load events until after
+        a layout or paint might already have happened.  This lets beforeload/load not cause extra
+        layouts and repaints.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
+        (WebCore::beforeLoadEventSender):
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
+        (WebCore::ImageLoader::dispatchPendingEvents):
+        (WebCore::ImageEventSender::ImageEventSender):
+        (WebCore::ImageEventSender::dispatchEventSoon):
+        (WebCore::ImageEventSender::cancelEvent):
+        (WebCore::ImageEventSender::dispatchPendingEvents):
+        (WebCore::ImageEventSender::timerFired):
+        * loader/ImageLoader.h:
+        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::attach):
+
+2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30174
+
+        No tests due to no Script* test infrastructure.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        
+        'client' is 0 when we have no view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30251
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Add missing setCurrentPlugin(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30248
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+
+2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] beforeload event does not fire on script elements in XML
+        https://bugs.webkit.org/show_bug.cgi?id=30235
+
+        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
+        made in XMLTokenizerLibxml2.cpp.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserValueList
+        https://bugs.webkit.org/show_bug.cgi?id=30249
+
+        Inherits CSSParserValueList class from FastAllocBase because it has 
+        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+
+        * css/CSSParserValues.h:
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30214
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        This fixes a leak of WebPluginHalterClients:
+        https://bugs.webkit.org/show_bug.cgi?id=30119.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.base.exp:
+        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyPluginHalterClient::enabled):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Remove initialization of m_pluginHalterClient, which was removed. If a
+        non-null PluginHalterClient was passed, create the PluginHalter, and
+        set its allowed run time.
+
+        * page/Page.h:
+        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::didStartPlugin):
+        Check whether the PluginHalterClient is enabled.
+        (WebCore::PluginHalter::didStopPlugin):
+        Ditto.
+
+        * page/PluginHalter.h:
+        Made m_client an OwnPtr.
+
+        * page/PluginHalterClient.h:
+        Added a function to return the enabled state.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Remove initialization of removed member.
+
+        * page/Settings.h:
+        Removed settings for the enabled state of the PluginHalter; we now use
+        the existence of a WebPluginHalterDelegate to determine whether the
+        PluginHalter is enabled.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        These methods have virtually no interaction with FrameLoader.  They
+        really seem like they ought to belong to ScriptController.
+
+        * WebCore.base.exp:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptController.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::replaceDocument):
+        * loader/FrameLoader.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing #include.
+
+        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
+        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        
+        Make sure to call update script object if we have an InspectorFrontend to
+        call it on when we get one of the new events.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated for removal of Structure::markAggregate().
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2009-10-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make AtomicString create its StringImpl via create(), not the constructor,
+        so it gets allocated in a single heap block, saving memory and CPU cycles.
+        This eliminates two StringImpl constructors, making the remaining ones
+        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
+        Added const attribute to UChar* in StringImpl constructor, eliminating the
+        need for several const_casts in calls to it.
+        StringImpl also unfriends AtomicString (OMG drama!!!)
+        https://bugs.webkit.org/show_bug.cgi?id=30141
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::CStringTranslator::translate): Call StringImpl::create().
+        (WebCore::UCharBufferTranslator::translate): Ditto.
+        (WebCore::HashAndCharactersTranslator::translate): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
+        (WebCore::StringImpl::adopt): Ditto.
+        (WebCore::StringImpl::createUninitialized): Ditto.
+        (WebCore::StringImpl::create): Ditto.
+        (WebCore::StringImpl::crossThreadString): Ditto.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL frame loader client function.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
+        which wasn't exposed until a clean build.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * bindings/v8/V8Index.cpp:
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        unselectable resources in resource panel
+        https://bugs.webkit.org/show_bug.cgi?id=30079
+
+        manual test added
+        
+        Also changed the way DnD for resources in the Resources panel is 
+        handled.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
+        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30233>
+        Local Storage and Cookies show Blank Titles on Local Files.
+
+        If a local storage or cookies sidebar item has no domain, set the 
+        title to "Local Files", because that is what it represents.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
+        document, since video/audio (and images eventually too) can load when not in the document yet.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30230
+
+        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
+        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
+        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+
+        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
+        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPatternElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Correct a typo that fixes the resizing of columns in Cookie view when you
+        resize the Inspector window.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
+        Text in Inspector's Styles gear menu is invisible.
+        
+        Adds a style rule for the option text and hr's in the gear menu,
+        to prevent them from being transparent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Fix build problem with SVGURIReference in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * WebCore.gypi:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Make beforeload work on <video>/<audio> elements.
+
+        Added fast/dom/beforeload/video-before-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30218
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        * svg/SVGDefsElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        * svg/SVGLineElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C+DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
+2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian SBSv2 .data segment adress fix
+        https://bugs.webkit.org/show_bug.cgi?id=30157
+
+        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+        base address to start from 0x800000 instead of the toolchain default 0x400000
+
+        * WebCore.pro:
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C+EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
+        selector gets constructed so that pattern match testing gets the correct URL.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::parse):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+
+        I couldn't find out why this only started to happen now, but it was incorrect to check
+        persistence of a credential returned by CredentialStorage::get() without checking that it
+        was non-null. When there is no credential for the protection space in storage, get()
+        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
+        assertion after credential null check.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
+        assertion, matching sync code (and CF one, as well).
+
+2009-09-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT for UTF8Encoding().isValid()
+        https://bugs.webkit.org/show_bug.cgi?id=29908
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::UTF8Encoding):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29892
+        Add support for whitelist patterns to control conditional injection of user scripts and
+        user stylesheets.
+
+        No new tests. Not testable until WebKit portion is added in followup patch.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/UserContentURLPattern.cpp: Added.
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        (WebCore::UserContentURLPattern::parse):
+        (WebCore::UserContentURLPattern::matches):
+        (WebCore::UserContentURLPattern::matchesHost):
+        (WebCore::MatchTester::MatchTester):
+        (WebCore::MatchTester::testStringFinished):
+        (WebCore::MatchTester::patternStringFinished):
+        (WebCore::MatchTester::eatWildcard):
+        (WebCore::MatchTester::eatSameChars):
+        (WebCore::MatchTester::test):
+        (WebCore::UserContentURLPattern::matchesPath):
+        * page/UserContentURLPattern.h: Added.
+        (WebCore::UserContentURLPattern::UserContentURLPattern):
+        (WebCore::UserContentURLPattern::scheme):
+        (WebCore::UserContentURLPattern::host):
+        (WebCore::UserContentURLPattern::path):
+        (WebCore::UserContentURLPattern::matchSubdomains):
+
+2009-09-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Reproducible crash pressing return inside quoted content
+        at WebCore::BreakBlockquoteCommand::doApply.
+        <rdar://problem/7085453>
+        In some case, like the one provided in the test case, m_downStreamEnd
+        refers to a node that gets deleted when executing the DeleteSelectionCommand.
+        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
+        pruning is needed, because it may be point to a node that has been deleted, but
+        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
+
+        Test: editing/selection/blockquote-crash.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
+        to avoid dereferencing a null node pointer.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
+        using the value in m_downStreamEnd when it is necessary to prune the start block.
+        
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Basic authentication credentials are not sent automatically to top resources
+        https://bugs.webkit.org/show_bug.cgi?id=29901
+
+        No new tests - I don't want to pollute root directory of http tests to check for this rather
+        minor issue.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
+        loop more explicit.
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
+        added to the inspector unless the inspector is already open
+        when the profile completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29897
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by David Hyatt.
+
+        Fix to logic of earlier commit 48902.
+
+        When merging two if's before committing, I forgot to invert the
+        bool check.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+
+2009-09-29  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, build fix.
+
+        Fixing Chromium build, following r48884.
+
+        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Follows HTML5's maxLength change in September 2009.
+        - Change HTMLTextAreaElement.maxLength type to signed.
+        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
+        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
+          throw INDEX_SIZE_ERR for setting negative values.
+        https://bugs.webkit.org/show_bug.cgi?id=29796
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48894, because review discussion was not complete.
+        http://trac.webkit.org/changeset/48894
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filter feComposite implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+
+        feComposite implementation for SVG.
+
+        Test: svg/filters/feComposite.svg
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        (WebCore::FEComposite::apply):
+
+2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Starting all read-only transactions with an explicit BEGIN
+        DEFERRED command instead of BEGIN, since some ports (chromium)
+        might compile their own SQLite library and set BEGIN to BEGIN
+        IMMEDIATE by default; which would result in a deadlock in case of
+        two concurrent read-only transactions on the same DB, and would
+        unnecessarily delay other potential transactions to the same DB.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29729
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Check page settings for
+        experimental WebGL flag before returning 3D graphics context.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize new flag to false.
+        (WebCore::Settings::setExperimentalWebGLEnabled):
+        * page/Settings.h: Set new flag.
+        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered - part 1
+        https://bugs.webkit.org/show_bug.cgi?id=29889
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        This patch should be a no-op for all ports other than Chromium.
+
+        * WebCore.gypi:
+        * storage/StorageEventDispatcher.h: Added.
+
+2009-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (missed file).
+
+        Adding file missed in previous commit.
+
+        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=29888
+
+        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Added isAttribute parameter.
+        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
+        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+
+2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix corruption for non-square images.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Added an additional manual-test for this issue to the existing Gtk
+        cursor image test.
+
+        * manual-tests/gtk/cursor-image.html:
+        * manual-tests/gtk/resources/long_cell.cur: Added.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Ensure that we don't scroll lock to an anchor node after a
+        user-initiated scroll, even if that scroll doesn't propagate
+        all the way up to FrameView.
+
+        Test: fast/events/node-event-anchor-lock.html
+
+        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
+        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
+        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
+        any object implementing EventTarget COM interface originated from WebCore).
+
+        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
+        COM bindings.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Don't rely on QNetworkReply::NetworkError codes, but
+        on HTTP error codes instead.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Use const references when using Qt's foreach.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix handling of QNetworkReply errors.
+
+        In the QNetworkReplyHandler::finish() a response was sent even when
+        the reply contained an error. This resulted in a sendResponseIfNeeded()
+        calling didReceiveResponse on the client, leading to the destruction
+        of the m_resourceHandle, discontinuing further processing in finish(),
+        and thus not calling didFail on the client.
+
+        Instead it continued as everything went fine, and
+        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
+        policy to PolicyDownload due to not being able to show the non existing
+        MIMEType. As the download also obviously fails, it ended up with a
+        policy change error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The code for showing error pages when the response was
+        a 401/403/404, was not actually doing so. This patch
+        fixes that.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
+        is failing/crashing intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=29322
+
+        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
+        The code had other issues as well, so I removed it altogether:
+        - it claimed to avoid some buffer copies, but it didn't;
+        - and I don't think that base64 encoding should be part of CString interface.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
+        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
+        to synchronous case.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
+
+        * platform/text/CString.cpp:
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+        Removed code that was added for Base64 in r48363.
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix typo in Localizations.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=29872
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementHelpText):
+
+2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
+        attribute conditional in the generated files, similar to
+        r44116.
+
+        * page/DOMWindow.idl:
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+
+        Use the ResourceError as it is supposed to and handle
+        not HTTP errors from QNetworkReply.
+
+        Thanks to Adam Roben for his input.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29816
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the build.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalWebSocketsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalWebSocketsEnabled):
+        
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add platform code to support WebSocket for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29171
+
+        To build within chromium tree, it requires a patch in bug 29174.
+        Real implementation will be landed in chromium tree.
+
+        * WebCore.gypi:
+        * platform/network/chromium/SocketStreamError.h: Added.
+        (WebCore::SocketStreamError::SocketStreamError):
+        * platform/network/chromium/SocketStreamHandle.h: Added.
+        (WebCore::SocketStreamHandle::create):
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
+        when Times New Roman is not installed
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
+        not available, use the Windows default GUI font.
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Do not add platform-specific methods to cross-platform header
+        FileSystem.h per Darin's feedback for 29109.
+        https://bugs.webkit.org/show_bug.cgi?id=29830
+
+        * platform/FileSystem.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+
+2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Register Chromium's VFSs with a proper sqlite3_io_methods
+        finder. This should only affect the POSIX implementation. The
+        Windows change is included for consistency and in case sqlite
+        starts using something similar in its Windows VFS in the future.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29743
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Change the V8 bindings' handling of window.toString(),
+        so we return [object DOMWindow] (like JSC), not [object global].
+
+        https://bugs.webkit.org/show_bug.cgi?id=29742
+
+        This will fix a couple of Chromium port test failures and enable us to
+        use the default expectations for a bunch more.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
+        of the global object wrapper when it's available in the DOMWindow toString callback.
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Rubber stamped by David Levin.
+
+        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        * bridge/runtime_object.h:
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=29823
+
+        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build by doing something approximating reasonableness in the Xcode project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Tiger build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add explicit frontend event for commit load.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29814
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCommitLoad):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.didCommitLoad):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
+          the sources list, since they are not supposed to be built here.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setTransformSource):
+        * dom/Document.h:
+        (WebCore::Document::transformSource):
+        * dom/TransformSource.h: Added.
+        (WebCore::TransformSource::platformSource):
+        * dom/TransformSourceLibxslt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/TransformSourceQt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a plain string.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::parseProcessingInstruction):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::sheetString):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::document):
+        * xml/XSLStyleSheetQt.cpp: Added.
+        * xml/XSLTProcessor.h:
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xmlDocPtrFromNode):
+        * xml/XSLTProcessorQt.cpp: Added.
+        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
+        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
+        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
+
+2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28689
+
+        Covered by LayoutTests/media/video-no-audio.html
+
+        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
+        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        * rendering/MediaControlElements.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] DragData::asURL should return file URL.
+        https://bugs.webkit.org/show_bug.cgi?id=29109
+
+        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+
+        * platform/FileSystem.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getAbsolutePath):
+        (WebCore::isDirectory):
+        (WebCore::filePathToURL):
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add a special case to handle index arguments, because we need to be
+        able to see if they're < 0.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
+          for index arguments.
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
+        https://bugs.webkit.org/show_bug.cgi?id=29792
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the linked style sheet is one of two versions of the
+        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
+        unsigned ints are accidentally used as signed.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/fast/forms/textarea-maxlength.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
+          properly generates on "unsigned" return value.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
+        have our own implementation which most likely will not share any code
+        with the current one.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
+        * xml/XSLStyleSheetLibxslt.cpp: Added.
+
+2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for r48812.
+
+        Forgot to remove the inline reset() implementation when reverting the indentation
+        changes in the file.
+
+        * xml/XSLTProcessor.h:
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
+
+        Web Inspector: Follow up to r48809.
+        InspectorController.wrapObject should only be called on the inspectable page side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection):
+        (WebInspector.EventListenersSection.prototype.update):
+        (WebInspector.EventListenerBar):
+        (WebInspector.EventListenerBar.prototype.update):
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Move the libxslt specific part of XSLTProcessor to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, move the libxslt part of the XSLTProcessor implementation into
+        another file and leave the part that can be reused and shared.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
+        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
+        * xml/XSLTProcessorLibxslt.cpp: Added.
+        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
+        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
+        (WebCore::docLoaderFunc): Moved.
+        (WebCore::setXSLTLoadCallBack): Moved.
+        (WebCore::writeToVector): Moved.
+        (WebCore::saveResultToString): Moved.
+        (WebCore::xsltParamArrayFromParameterMap): Moved.
+        (WebCore::freeXsltParamArray): Moved.
+        (WebCore::xsltStylesheetPointer): Moved.
+        (WebCore::xmlDocPtrFromNode): Moved.
+        (WebCore::resultMIMEType): Moved.
+        (WebCore::XSLTProcessor::transformToString): Moved.
+
+2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix the crash of SVG that crashes when use a non-exist symbol
+        https://bugs.webkit.org/show_bug.cgi?id=27693
+
+        Test: svg/custom/use-non-existing-symbol-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::shadowTreeContainsChangedNodes):
+
+2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Should Show Event Listeners/Handlers Registered on each Node
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+        
+          Extracted a method from dispatchEvent to get the event ancestor chain
+        
+        * dom/Node.cpp:
+        (WebCore::Node::eventAncestors): the extracted method
+        (WebCore::Node::dispatchGenericEvent): use eventAncestors
+        * dom/Node.h:
+
+          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
+          The DOMAgent's getEventListenersForNode handles the logic of finding
+          all the relevant listeners in the event flow.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getEventListenersForNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::EventListenerInfo::EventListenerInfo):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        * inspector/InspectorFrontend.h:
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
+        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+
+          New Sidebar Pane in the Element's Panel
+          Includes Gear Menu for filtering the Event Listeners on the
+          "Selected Node Only" or "All Nodes"
+
+        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.updateEventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js: Added. 
+        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection): The 2nd level in the Pane
+        (WebInspector.EventListenersSection.prototype.update): filters on Preference
+        (WebInspector.EventListenersSection.prototype.addListener):
+        (WebInspector.EventListenerBar): The 3rd level in the Pane
+        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
+        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
+        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
+        
+          Consolidated "appropriateSelectorForNode"
+
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+          Miscellaneous Updates
+
+        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
+        * WebCore.gypi: included the new inspector files
+        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
+        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
+        * inspector/front-end/inspector.css: reused as much as possible
+        * inspector/front-end/inspector.html: include the new script
+        * inspector/front-end/WebKit.qrc: included the new inspector files
+
+2009-09-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
+        Implement CSSOM Range.getClientRects/getBoundingClientRect 
+
+        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
+               fast/dom/Range/getBoundingClientRect.html
+               fast/dom/Range/getClientRects.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::getClientRects):
+        (WebCore::Range::getBoundingClientRect):
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/Range.h:
+        * dom/Range.idl:
+        Implement Range.getClientRects/getBoundingClientRect.
+
+        * dom/Element.cpp:
+        * rendering/RenderObject.h: 
+        (WebCore::adjustForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        Move point/quad adjustment methods from Element.cpp to RenderObject.h
+        so that Range.cpp can use them as well.
+
+2009-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial ChangeLog fix).
+
+        Restore WebCore/ChangeLog truncated in r48778.
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29770
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::unbind):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not track DOM changes while inspector window is closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29769
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+
+        https://bugs.webkit.org/show_bug.cgi?id=29762
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleText):
+        (InjectedScript.openInInspectedWindow):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * DerivedSources.make: Moved Platform.h check for
+        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
+        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
+        Added ifndef test to make it possible to override both
+        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
+        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
+        ADDITIONAL_IDL_DEFINES to common section.
+        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
+        it is ever used.
+        * WebCore.pro: Ditto.
+
+2009-09-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Move placeholder-related code to HTMLTextFormControlElement from
+        HTMLInputElement, WMLInputElement, InputElement, and
+        HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=28703
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/InputElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
+        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::handleFocusEvent):
+        (WebCore::HTMLInputElement::handleBlurEvent):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        (WebCore::HTMLInputElement::isEmptyValue):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
+        (WebCore::HTMLTextAreaElement::isEmptyValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::createRenderer):
+        * wml/WMLInputElement.h:
+
+2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Optimize the code so only the text from start to end is scanned.
+        https://bugs.webkit.org/show_bug.cgi?id=29092
+
+        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
+        file improved from 400ms to 40ms (10x faster).
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
+2009-09-26  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This Patch fixes [chromium] the drop-down is always left-aligned even
+        for RTL element.
+        https://bugs.webkit.org/show_bug.cgi?id=29612
+
+        For auto-complete, the items in drop-down should be right-aligned if
+        the directionality of <input> field is RTL.
+        For <select><option>, the items in drop-down should be right-aligned
+        if the directionality of <select> is RTL.
+
+        No automatic test is possible. Manual tests are added.
+
+        * manual-tests/autofill_alignment.html: Added.
+        * manual-tests/select_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
+        be paint if it should be right-aligned.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
+        to crash on launch
+        https://bugs.webkit.org/show_bug.cgi?id=29759
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
+        property list at the root of FontList.plist, but with an additional
+        key for the last value of the Fonts registry key.
+        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
+        to populatFontDatabaseFromPlist.
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix. Adding missing header files.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
+        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Load blocks during unload should not affect targeted loads
+        https://bugs.webkit.org/show_bug.cgi?id=29747
+
+        Move the check of the unload state after checking for targeted links.
+
+        Test: fast/loader/unload-hyperlink-targeted.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+
+2009-09-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add initial V8 bindings for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=29664
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
+        (WebCore::jsArrayToFloatArray):
+        (WebCore::jsArrayToIntArray):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for WebCore.
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reverting r48767, as it broke Windows build in a non-trivial way.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError):
+        (WebCore::EventListener::jsFunction):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+
+2009-09-24  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a gyp variable to allow building a debug webcore without debug
+        symbols.  This allows for faster compile, link, and gdb times.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29721
+
+        No new tests, build config change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Declare RegisteredEventListener as a class instead of a struct.
+        This fixes a warning in the Chromium build.
+
+        * dom/RegisteredEventListener.h:
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebCore part of
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        When the Windows Fonts directory contains more than one font file for a
+        given font name, which of the fonts gets assigned to the name in the
+        Core Graphics font database was determined arbitrarily and did not
+        always match the font GDI used for the same font name. The mismatch
+        caused character-to-glyph mapping to use one font and glyph rendering to
+        use another.
+
+        The fix is to update the Core Graphics font database from the registry
+        entries (that reflect the name-to-font mapping that GDI uses) after
+        populating it with the result of scanning the Fonts directory. As a
+        consequence, the directory needs to be scanned at startup every time the
+        registry key changes, so the last value of the registry key is kept
+        in the property list on disk so that it could be compared to the current
+        value on startup.
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
+        a parameter and avoids round-tripping through XML by calling
+        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
+        (WebCore::fontFilenamesFromRegistryKey):
+        (WebCore::cgFontDBKey):
+        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
+        list and a property list with the font filenames from the registry and
+        writes a dictionary with those property lists as values.
+        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
+        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
+        registry key.
+        (WebCore::populateFontDatabase): Changed to read the contents of the
+        Fonts registry key and compare it with the last-saved value from the
+        property list, and to call wkAddFontsFromRegistry() after populating the
+        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
+        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
+        API changes.
+
+2009-09-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24399
+        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
+        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
+        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
+        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
+        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
+        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        It's possible for RenderObject::container() to return an object that is higher
+        in the hierarchy than the repaintContainer that is being used to repaint an
+        object. For example, this can happen when running an accelerated opacity
+        transition on an element with a position:absolute parent, and a position:absolute child.
+        
+        In this case we need to detect when RenderObject::container() will skip over
+        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+
+        Test: compositing/repaint/opacity-between-absolute.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash with hardware accelerated rotation of a PDF image in a data URL
+        <rdar://problem/7250378>
+        
+        PDF images don't return a color space from CGImageGetColorSpace(),
+        so we need to null-check the return value before use.
+
+        Test: compositing/color-matching/pdf-image-match.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Null-deref when first access to an Attr node is after its Element is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=29748
+
+        Test: fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
+        long as the Attr is alive.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
+        long as the NamedNodeMap is alive.
+
+        * dom/Attr.idl: Added CustomMarkFunction attribute.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
+        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
+        have attributes hanging around that might need an Attr node created; that way
+        we won't crash with a null-dereference trying to deal with one of them. This
+        can't happen when working with JavaScript since the Element will be kept
+        alive due to the change above.
+        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
+        missing braces.
+
+        * dom/NamedAttrMap.h: Made the element function public so it can be used by
+        the JavaScript binding to keep the Element alive.
+
+        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+
+2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+2009-09-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
+        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+
+        Change the way style is preserved when inserting a new paragraph.
+        The original code handled insertion at the beginning and at the end of a paragraph as special
+        cases. The newly created paragraph contained a set of nodes generated starting from the
+        computed style of the insertion node. This approach has two problems:
+        1. if the insertion node has a non opaque background color and one of the parent element did have
+        a solid background color the new paragraph did not have the element with the solid color in the tree.
+        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
+        background color and some font attribute was being reproduced as span bold italic font as separate tags.
+        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
+        paragraph where the insertion point is.
+
+        Test: editing/inserting/insert-bg-font.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
+        between the insert node and the outer block.
+        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
+        in the new paragraph the same element hierarchy present in the starting paragraph.
+        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
+        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
+        at the end of the paragraph to use the new methods instead of applying the calculated style.
+        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+
+2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Content-type parameters not taken into account when building form-data
+        https://bugs.webkit.org/show_bug.cgi?id=28970
+
+        existing manual test case extended with new tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        * manual-tests/inspector/display-form-data.html:
+
+2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14566
+
+        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+
+        Test: fast/js/invalid-domain-change-throws-exception.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        When setTimeout is called with a string argument in an isolated
+        world, we now compile the string in the isolated world.
+
+        Last time we tried this change, we got a lot of crashes.  This
+        time we're using a fresh local handle as our context to avoid
+        trouble if the peristent handle gets disposed before we leave
+        the context.
+
+        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-25  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a regression in Mac Chromium popup menus, where the user's
+        selection was ignored and the popup became unresponsive.
+        https://bugs.webkit.org/show_bug.cgi?id=29726
+
+        The fix is to notify the popup's client that the popup was hidden,
+        even if the popup has no parent.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
+        https://bugs.webkit.org/show_bug.cgi?id=29734
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28876
+        [Qt] reduce peak memory consumption of text decoding.
+
+        Chop large input buffer into small buffers to reduce peak memory
+        during decoding.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt and Alice Liu.
+
+        * GNUmakefile.am:
+
+        * WebCore.base.exp:
+        Update export of Page constructor.
+
+        * WebCore.gypi:
+
+        * WebCore.pro:
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
+        HaltablePlugin.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add files to Mac project.
+
+        * loader/EmptyClients.h:
+        Added an empty PluginHalterClient.
+        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
+        Return false.
+
+        * page/PluginHalter.cpp: Added.
+        (WebCore::PluginHalter::PluginHalter):
+        (WebCore::PluginHalter::didStartPlugin):
+        Add the object to the plug-in set. If this is the only item in the set,
+        set m_oldestStartTime to this object's time, and start the timer.
+        (WebCore::PluginHalter::didStopPlugin):
+        Remove the plug-in from the set.
+        (WebCore::PluginHalter::timerFired):
+        Find the cut-off time as the current time minus the allowed run time;
+        plug-ins older than this may be halted. Iterate over the plug-ins. Find
+        the object with the oldest start time that is too young to be halted;
+        we'll use its start time to set the timer's next fire time. For all
+        plug-ins that are candidates to be halted, call the
+        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
+        call the plug-in's halt() function. Remove these objects from the set
+        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
+        (WebCore::PluginHalter::startTimerIfNecessary):
+        If the timer is set to fire, or the set of tracked plug-ins is empty,
+        return early. Set the timer to fire after the oldest plug-in has run
+        for the allowed run time.
+
+        * page/PluginHalter.h: Added.
+        (WebCore::PluginHalter::setPluginAllowedRunTime):
+
+        * page/PluginHalterClient.h: Added.
+        (WebCore::PluginHalterClient::~PluginHalterClient):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
+        to create the PluginHalter if necessary.
+        (WebCore::Page::pluginHalterEnabledStateChanged):
+        If plug-in halting is enabled, create the PluginHalter. If it is
+        disabled, clear it.
+        (WebCore::Page::pluginAllowedRunTimeChanged):
+        If there is a plug-in halter, call its setPluginAllowedRunTime().
+        (WebCore::Page::didStartPlugin):
+        If there is a plug-in halter, call its didStartPlugin().
+        (WebCore::Page::didStopPlugin):
+        If there is a plug-in halter, call its didStopPlugin().
+
+        * page/Page.h:
+        Add a parameter to the Page constructor for the PluginHalterClient.
+        Added declarations for didStartPlugin() and didStopPlugin(), which are
+        called when HaltablePlugins are added to or removed from the page. Adds
+        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
+        notify the Page when these settings are changed. Added members to hold
+        the PluginHalter and the PluginHalterClient.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPluginHalterEnabled):
+        If the enabled state has changed, call the Page's
+        pluginHalterEnabledStateChanged().
+        (WebCore::Settings::setPluginAllowedRunTime):
+        Call the Page's pluginAllowedRunTimeChanged().
+
+        * page/Settings.h:
+        (WebCore::Settings::pluginHalterEnabled):
+        (WebCore::Settings::pluginAllowedRunTime):
+
+        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
+        can be automatically halted.
+        (WebCore::HaltablePlugin::~HaltablePlugin):
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        Pass a dummy PluginHalterClient.
+
+2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: webkit-transform scale no longer works properly in nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=29730
+        
+        When the initial or final state of a scale animation does not specify a transform,
+        use a default scale of 1, rather than zero.
+
+        Test: compositing/transitions/scale-transition-no-start.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds a run-time flag in Settings object that controls whether
+        to expose desktop notifications.
+
+        No new test, but test code also modified to set this preference.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalNotificationsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalNotificationsEnabled):
+
+2009-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <rdar://problem/7162000> Crash while trying to
+        calculate the horizontal position of image
+
+        Test: fast/inline-block/relative-positioned-rtl-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
+        isInline() test to isRenderInline(). This is similar to r41259.
+
+2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix expanding profile call stacks being broken after sorting.
+        https://bugs.webkit.org/show_bug.cgi?id=26423
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort):
+        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
+        causes the children to be placed in the right positions.
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Fixed sudden termination console spew due to too many calls to
+        enableSuddenTermination.
+        
+        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+
+        * page/DOMWindow.cpp:
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners): Only
+        enableSuddenTermination if the set of listeners is empty *and* this
+        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+
+2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit returns "" instead of null when getting
+        inexistent, forbidden or invalidly named headers.
+        https://bugs.webkit.org/show_bug.cgi?id=29140
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed to return null as it should according to the spec.
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        WebCore/WebCore.gyp directory)
+
+        WebCore.xcodeproj
+        WebCore.sln
+        WebCore.vcproj
+        WebCore_Debug.rules
+        WebCore_Release.rules
+        WebCore_Release - no tcmalloc.rules
+        WebCore_Purify.rules
+        WebCore.mk
+        WebCore_Debug_rules.mk
+        WebCore_Release_rules.mk
+        WebCore_Release - no tcmalloc_rules.mk
+        WebCore_Purify_rules.mk
+        WebCore.scons
+        WebCore_main.scons
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Mac build fix.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        remove unused parameter from function signature;
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement correct horizontal scrollbar behavior for GTKalso on
+        styled scrollbars.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
+        wheel with the pointer on the horizontal scrollbar, scroll
+        horizontally;
+        * platform/PlatformWheelEvent.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
+        vertical scroll to the horizontal one;
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
+        https://bugs.webkit.org/show_bug.cgi?id=29290
+
+        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
+        per http://webkit.org/coding/RefPtr.html
+
+        No behavior change, so no tests.
+
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added back enable/disableSuddenTermination() functionality I accidentally
+        removed in my last patch.
+
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg and Mark Rowe.
+
+        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
+
+        * DerivedSources.make:
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Element.idl:
+
+2009-09-23  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert the relevant parts of r47925, and implement an alternate
+        fix (localize the coordinate check to GraphicsContext::clipPath()).
+        This fixes http://crbug.com/21174.
+
+        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-09-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge changes from Mozilla's FTP directory parser.
+        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+
+        FTP layout tests not possible at this time.
+        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::ParsingFailed):
+        (WebCore::parseOneFTPLine):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] re-enable some media tests
+        https://bugs.webkit.org/show_bug.cgi?id=29716
+
+        make canPlayType() return "probably" if mime-type is known
+        and codecs string is not empty. If codecs is empty return
+        "maybe".
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
+        Add a function to element to check whether it matches a CSS selector
+
+        Implement Element.webkitMatchesSelector.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::forEachSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
+        * css/CSSSelectorList.h:
+        Moved code to iterate the CSSSelectorList and determine if any
+        selectors need namespace resolution from a static function in
+        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
+        as well as querySelector/querySelectorAll.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitMatchesSelector):
+        * dom/Element.h: 
+        * dom/Element.idl:
+        Implement the new function. Handles exceptional cases identically to
+        querySelector/querySelectorAll.
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+
+2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
+        https://bugs.webkit.org/show_bug.cgi?id=29713
+
+        Got rid of isWindowEvent in function signatures:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+
+        Switched to EventTarget methods of adding/removing listeners:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::toEventID):
+        (WebCore::ACCESSOR_SETTER):
+
+        * dom/EventTarget.h: Some functions were incorrectly marked
+        as JSC-specific.
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Color-code watch expression errors with red.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29707
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        * inspector/front-end/inspector.css:
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix formatting for messages derived from resource warnings,
+        couple of drive-by formatting fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29705
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Implement InspectorController::copyNode(id).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28357
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        Overriding getPropertyNames is incorrect.
+
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
+        https://bugs.webkit.org/show_bug.cgi?id=24639
+
+        check duration returned by gst_element_query_duration() only
+        when using GStreamer < 0.10.23.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce Pasteboard::writePlaintext(const String&) so that copying
+        of the inspected elements HTML will be possible in WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=29634
+
+        * platform/Pasteboard.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+        (Pasteboard::writePlainText):
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/haiku/PasteboardHaiku.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWince.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+
+2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QApp::translate() calls to provide the correct class name without
+        a trailing comma.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
+        files, since it no longer exists in the repository.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Declare set/unsetPendingActivity public, so
+        SharedWorkerScriptLoader can call them.
+
+        * dom/ActiveDOMObject.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bit of the Windows build.
+
+        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
+        removed this in my last patch.)
+        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
+        to the build. (I accidentally removed this in my last patch.)
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: restore previous cast that I thought was unnecessary.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bring a little sanity to this crazy EventTarget world of ours
+        https://bugs.webkit.org/show_bug.cgi?id=29701
+
+        Lots of EventTarget refactoring to achieve a single shared implementation
+        that fixes some of the performance and correctness bugs of the many individual
+        implementations, and makes reasoning about EventTargets and EventListeners
+        much easier.
+        
+        The basic design is this:
+            - EventTarget manages a set of EventListeners.
+            - onXXX EventListener attributes forward to standard EventTarget APIs.
+            - Since the onXXX code is repetitive, it is usually done with macros
+              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
+            - EventTarget provides a shared implementation of dispatchEvent,
+              which subclasses with special event dispatch rules, like Node, override.
+            - To support Node, which lazily instantiates its EventTarget data,
+              EventTarget has no data members, and instead makes a virtual call
+              to get its data from wherever its subclass chose to store it.
+              
+        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
+        even though no exception could be thrown, has been changed not to do so,
+        to improve clarity and performance.
+        
+        Code that used to call a special dispatchXXXEvent function, which just
+        turned around and called dispatchEvent, has been changed to call
+        dispatchEvent, to improve clarity and performance.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
+        engineer.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
+        "is not in the document but is firing event listeners" as a condition
+        that makes a Node observable in the DOM, so that event listeners firing
+        on removed nodes are not destroyed midstream. (This was a long-standing
+        bug that was somewhat hidden by the old implementation's habit of
+        copying the RegisteredEventListener vector before firing events, which
+        would keep almost all the relevant objects from being destroyed.)
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
+        because it was one of the most elaborately planned no-ops in the history
+        of software crime, and one of the reasons clients thought they needed more
+        than one dispatchEvent function even though they didn't.
+        * bindings/js/JSEventListener.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        * bindings/js/JSEventSourceCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
+        now autogenerated. Classes that still have custom mark functions for other
+        reasons now call a shared EventTarget API to mark their EventListeners.
+
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
+        marking and invalidating event listeners.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchWindowLoadEvent):
+        (WebCore::Document::finishedParsing):
+        * dom/Document.h: Use dispatchEvent directly.
+
+        * dom/Element.h: Moved a few event listener attributes down from Node,
+        since they don't apply to all Nodes, only Elements.
+
+        * dom/EventListener.h: Removed isWindowEvent parameter.
+
+        * dom/EventNames.h: Added the "display" event name, so it works correctly
+        with attribute macros, and for performance.
+
+        * dom/EventTarget.cpp:
+        (WebCore::forbidEventDispatch):
+        (WebCore::allowEventDispatch):
+        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
+        safe, since it's now called on multiple threads. (Currently, we only forbid
+        event dispatch on the main thread. If we ever want to forbid event dispatch
+        on secondary threads, we can improve it then.)
+
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::setAttributeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::EventTarget::clearAttributeEventListener):
+        (WebCore::EventTarget::dispatchEvent):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
+        (WebCore::EventTarget::ref):
+        (WebCore::EventTarget::deref):
+        (WebCore::EventTarget::markEventListeners):
+        (WebCore::EventTarget::invalidateEventListeners):
+        (WebCore::EventTarget::isFiringEventListeners):
+        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
+        EventTarget APIs, crafted from an amalgam of all the different versions
+        we used to have. The most significant change here is that we no longer
+        make a copy of an EventListener vector before firing the events in the
+        vector -- instead, we use a reference to the original vector, along with
+        a notification mechanism for the unlikely case when an EventListener is
+        removed from the vector. This substantially reduces malloc, copying, and
+        refcount overhead, and complexity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create): Use dispatchEvent directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::eventTargetData):
+        (WebCore::MessagePort::ensureEventTargetData):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        * dom/MessagePort.idl: Removed custom EventTarget implementation.
+
+        * dom/MutationEvent.h:
+        (WebCore::MutationEvent::create): Added some default values so callers
+        can construct MutationEvents more easily, without calling a custom dispatch
+        function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::eventTargetData):
+        (WebCore::Node::ensureEventTargetData):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        * dom/Node.h:
+        (WebCore::Node::preDispatchEventHandler):
+        (WebCore::Node::postDispatchEventHandler):
+        * dom/Node.idl:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::eventTargetData):
+        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
+        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
+        functions that just forwarded to dispatchEvent.
+
+        * dom/RegisteredEventListener.cpp:
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        (WebCore::operator==): This is just a simple struct now, since we no longer
+        do a complicated copy / refCount / isRemoved dance just to honor the rule
+        that an EventListener can be removed during event dispatch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::checkValidity):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::errorEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::performTask):
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::eventTargetData):
+        (WebCore::DOMApplicationCache::ensureEventTargetData):
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
+        EventTarget API. As a part of this, I switched this class from using a
+        custom internal event name enumeration to using the standard EventNames.
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * notifications/Notification.idl: Switched to the standard EventTarget API.
+
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::event):
+        (WebCore::windowsWithUnloadEventListeners):
+        (WebCore::windowsWithBeforeUnloadEventListeners):
+        (WebCore::allowsBeforeUnloadListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::pendingUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
+        unload / beforeunload listener tracker just to track which windows had
+        such listeners, instead of actually keeping a copy of the listeners. Now,
+        this code can use the standard EventTarget API.
+
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        (WebCore::DOMWindow::eventTargetData):
+        (WebCore::DOMWindow::ensureEventTargetData):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::stop):
+        (WebCore::EventSource::createMessageEvent):
+        (WebCore::EventSource::eventTargetData):
+        (WebCore::EventSource::ensureEventTargetData):
+        * page/EventSource.h:
+        * page/EventSource.idl: Use the standard EventTarget APIs.
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::dummyEventTargetData):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
+
+        * svg/SVGElementInstance.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
+        new EventTarget API.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::eventTargetData):
+        (WebCore::WebSocket::ensureEventTargetData):
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::eventTargetData):
+        (WebCore::AbstractWorker::ensureEventTargetData):
+        * workers/AbstractWorker.h:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::createConnectEvent):
+        * workers/SharedWorkerContext.h:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventTargetData):
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::abortError):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        (WebCore::XMLHttpRequest::eventTargetData):
+        (WebCore::XMLHttpRequest::ensureEventTargetData):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestProgressEvent.h:
+        (WebCore::XMLHttpRequestProgressEvent::create):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventTargetData):
+        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
+        * xml/XMLHttpRequestUpload.h:
+        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
+
+2009-09-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Support for maxLength of <textarea>
+        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
+        https://bugs.webkit.org/show_bug.cgi?id=29292
+
+        Test: fast/forms/textarea-maxlength.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::sanitizeUserInputValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::numGraphemeClusters):
+        (WebCore::String::numCharactersInGraphemeClusters):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Give GDK_Backspace key events the proper text properties.
+
+        Instead of adding new tests, this change removes existing tests
+        from Gtk's skipped list.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
+        Should allow navigation of top-level openers
+        <rdar://problem/7034025>
+
+        Allow navigation of cross-origin window.opener if it is top-level frame.
+
+        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * WebCore.vcproj/WebCoreCairo.vsprops:
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when website does a history.back() followed by an alert()
+        https://bugs.webkit.org/show_bug.cgi?id=29686
+        rdar://problem/6984996
+
+        When loading is deferred, we need to defer timer-based loads
+        too, not just networking-driven loads. Otherwise we can get
+        syncronouse navigation while running a script, which leads to
+        crashes and other badness.
+
+        This patch includes a manual test; an automated test may be
+        possible some time in the future.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
+        instead of scheduleHTTPRedirection to implement the navigation
+        needed for x-frame-options.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader): Updated for data members with
+        new names and new data members.
+        (WebCore::FrameLoader::setDefersLoading): When turning deferral
+        off, call startRedirectionTimer and startCheckCompleteTimer, since
+        either of them might have been fired and ignored while defersLoading
+        was true.
+        (WebCore::FrameLoader::clear): Updated for replacement of the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
+        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Added code to set
+        m_shouldCallCheckCompleted to false. Changed code that calls
+        startRedirectionTimer to call it unconditionally, since that
+        function now knows when to do work and doesn't expect callers
+        to handle that any more.
+        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
+        timer fired callbacks. Calls checkCompleted and checkLoadComplete
+        as appropriate, but not when defersLoading is true.
+        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
+        the two different calls to start timers before. Only starts the
+        timers if they are needed.
+        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
+        startCheckCompleteTimer after setting boolean.
+        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
+        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
+        canGoBackOrForward check. The logic works more naturally when
+        we don't do anything until the timer fires.
+        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
+        defersLoading is true. Also moved canGoBackOrForward check here.
+        (WebCore::FrameLoader::scheduleRedirection): Changed code that
+        calls startRedirectionTimer to do so unconditionally. That
+        function now handles the rules about when to start the timer
+        rather than expecting the caller to do so.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to
+        handle the case where there is no redirection scheduled,
+        where the timer is already active, or where this is a classic
+        redirection and there is an ancestor that has not yet completed
+        loading.
+        (WebCore::FrameLoader::completed): Call startRedirectionTimer
+        here directly instead of calling a cover named parentCompleted.
+        Hooray! One less function in the giant FrameLoader class!
+        (WebCore::FrameLoader::checkLoadComplete): Added code to set
+        m_shouldCallCheckLoadComplete to false.
+
+        * loader/FrameLoader.h: Replaced the two functions
+        checkCompletedTimerFired and checkLoadCompleteTimerFired with
+        one function, checkTimerFired. Removed the parentCompleted
+        function. Added the startCheckCompleteTimer and
+        allAncestorsAreComplete functions. Replaced the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer data
+        members with m_checkTimer, m_shouldCallCheckCompleted, and
+        m_shouldCallCheckLoadComplete.
+
+        * manual-tests/go-back-after-alert.html: Added.
+        * manual-tests/resources/alert-and-go-back.html: Added.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+
+        Reviewed by Mark Rowe.
+
+        The "Generate 64-bit Export File" build phase script generated
+        the WebCore.LP64.exp export file used to link 64-bit WebCore.
+        Instead of having a separate build phase script, move its
+        generation into DerivedSources.make where WebCore.exp is
+        generated.
+
+        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
+        Added code to append WebCore.PluginHostProcess.exp to
+        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
+        is set to 1.
+        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
+        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
+        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
+        to WebCore.PluginHostProcess.exp.
+
+2009-09-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29694
+        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple elements during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scroll):
+        * rendering/RenderBox.h:
+
+2009-09-23  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29523
+        
+        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
+        XSSAuditor.
+        
+        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
+        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
+        Because the XSSAuditor also decodes the URL escape sequences as part of its
+        canonicalization, the double decoding of a JavaScript URL would
+        not match the canonicalization of the input parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
+               http/tests/security/xssAuditor/javascript-link-url-encoded.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Moved call to 
+        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
+        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
+        decoded.
+
+2009-09-22  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29657
+        Columns don't break properly in positioned elements with a fixed height.  Make sure that
+        a block is still considered to have columns even when the column count is 1 if the column
+        width is non-auto.
+    
+        Added fast/multicol/positioned-with-constrained-height.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+
+2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Add a null check for the Document*. In the mirror benchmarking
+        application a crash from a call from JavaScript was observed.
+
+        I was not able to come up with a test case for this issue.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+
+2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build, after the introduction of
+        the page client.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] media tests failing after their rework
+        https://bugs.webkit.org/show_bug.cgi?id=29532
+
+        Correctly advertise the mime types used by the common formats used
+        in the tests.
+
+        Tests that regressed, and will pass again:
+
+           media/video-canvas-source.html
+           media/video-controls.html
+           media/video-currentTime-set2.html
+           media/video-dom-autoplay.html
+           media/video-dom-src.html
+           media/video-error-abort.html
+           media/video-load-networkState.html
+           media/video-load-readyState.html
+           media/video-muted.html
+           media/video-no-autoplay.html
+           media/video-pause-empty-events.html
+           media/video-play-empty-events.html
+           media/video-seekable.html
+           media/video-seeking.html
+           media/video-size.html
+           media/video-source-type-params.html
+           media/video-source-type.html
+           media/video-source.html
+           media/video-src-change.html
+           media/video-src-invalid-remove.html
+           media/video-src-remove.html
+           media/video-src-set.html
+           media/video-src-source.html
+           media/video-src.html
+           media/video-timeupdate-during-playback.html
+           media/video-volume.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash problem with absolte positioned children in foreignobject
+        htts://bugs.webkit.org/show_bug.cgi?id=26342
+
+        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::isSVGForeignObject):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGForeignObject):
+
+2009-09-22  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers "name" attribute is now optional.
+        https://bugs.webkit.org/show_bug.cgi?id=28897
+
+        Test: fast/workers/shared-worker-name.html
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::constructSharedWorker):
+        Default 'name' attribute to empty string if it is not provided.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Default 'name' attribute to empty string if it is not provided.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::matches):
+        Now matches URLs if names are empty strings.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Pass URL in to SharedWorkerProxy::matches().
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another build fix.
+
+        [Chromium] Add another missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorController.cpp: Added DOMWindow.h include.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
+        https://bugs.webkit.org/show_bug.cgi?id=29663
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
+        initialized to false, to keep track if the redirection has been
+        communicated to the client.
+        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
+        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
+        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
+        (WebCore::FrameLoader::allChildrenAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
+        function for clarity.
+        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
+        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
+        toldClient flag and not call clientRedirected a second time if it is set.
+        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
+        called multiple times and it will call clientRedirectCancelledOrFinished
+        only once.
+
+        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
+        Added allChildrenAreComplete function.
+
+2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        DOMStorage interaction is now serialized into JSON messages
+        and doesn't require quarantined objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::getDOMStorageEntries):
+        (WebCore::InspectorBackend::setDOMStorageItem):
+        (WebCore::InspectorBackend::removeDOMStorageItem):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageEntries):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::removeDOMStorageItem):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        (WebCore::InspectorDOMStorageResource::operator==):
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::cast):
+        (WebCore::InspectorDOMStorageResource::id):
+        (WebCore::InspectorDOMStorageResource::domStorage):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get id):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.getEntriesAsync):
+        (WebInspector.DOMStorage.prototype.setItemAsync):
+        (WebInspector.DOMStorage.prototype.removeItemAsync):
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.selectDOMStorage):
+        (WebInspector.StoragePanel.prototype.updateDOMStorage):
+        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for XMLHttpRequest.abort() should destroy the response text.
+        https://bugs.webkit.org/show_bug.cgi?id=29658
+        <rdar://problem/5301430>
+
+        Clearing the response text after calling XMLHttpRequest.abort() is necessary
+        per spec and matches Firefox. It is also a potential memory win.
+
+        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
+        keep the actual ResourceReponse around so that the response status and response
+        status text are kept around.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48639.
+        http://trac.webkit.org/changeset/48639
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Changing the transaction coordinator to (re-)allow multiple read
+        transactions on the same database to run concurrently (without
+        risking a deadlock this time).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29115
+
+        Tests: storage/read-and-write-transactions-dont-run-together.html
+               storage/read-transactions-running-concurrently.html
+
+        * storage/SQLTransaction.h:
+        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
+        transaction.
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29652
+        Support true system colors for CSS system colors in Chromium/Win.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-09-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
+        table with fixed layout
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29501
+
+        New Tests:
+        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
+        * fast/table/fixed-table-with-small-percent-width.html: Added.
+
+        This new quirk is very similar to an existing one that was 
+        implemented in revision 4316.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcPrefWidths):
+
+2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        List HTTP status code with response headers in resources tab of Web Inspector.
+        http://webkit.org/b/19945
+
+        This patch adds a new top level list in the resources tab, HTTP Information, that 
+        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
+        Additionally, it adds a colored dot next to the requested URL to show the status 
+        (green for success, orange for redirect, red for error).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Images/errorRedDot.png: Added.
+        * inspector/front-end/Images/successGreenDot.png: Added.
+        * inspector/front-end/Images/warningOrangeDot.png: Added.
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.StatusTextForCode):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-09-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Back list isn't properly updated for fragment changes after a redirect.
+        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
+
+        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
+          consulting the policy delegate for fragment scrolling.
+
+2009-09-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects get stuck in the non-visible state and cannot be opened.
+        https://bugs.webkit.org/show_bug.cgi?id=29645
+
+        All paths that lead to hiding the popup menu must call popupDidHide on
+        the PopupMenuClient.  This change makes it so by moving all of the
+        hiding logic to PopupListBox::hidePopup.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector.log() function not protected if console not yet created
+        https://bugs.webkit.org/show_bug.cgi?id=29336
+        
+        No new tests.  Only affects Web Inspector developers adding logging
+        to their code during development.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.isLogAvailable):
+        (WebInspector.log.flushQueue):
+        (WebInspector.log.flushQueueIfAvailable):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's webcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * WebCore.gyp/WebCore.gyp: Added.
+
+2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Don't keep clean wrappers artificially alive        
+        We currently keep all DOM node wrappers alive, even when there are
+        no more references to them from JS, in case they have properties
+        that we need to keep around if new JS references are created.
+        This changes the policy to only keep wrappers artificially alive
+        if they have changed since they were created. Empty wrappers are
+        discarded and recreated as needed.
+        https://bugs.webkit.org/show_bug.cgi?id=29330
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: console.count and console.timeEnd
+        crash when inspector is opened.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29632
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+
+2009-09-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix bogus build fix I did last night.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Attempted fix for the V8 build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Don't re-enter JavaScript after performing access checks
+        https://bugs.webkit.org/show_bug.cgi?id=29531
+
+        Moved the access check slightly later in this functions to avoid
+        re-entering the JavaScript interpreter (typically via toString)
+        after performing the access check.
+
+        I can't really think of a meaningful test for this change.  It's more
+        security hygiene.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::if):
+        (CALLBACK_FUNC_DECL):
+        (V8Custom::WindowSetLocation):
+        (V8Custom::ClearTimeoutImpl):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make all write transaction start with a BEGIN IMMEDIATE command
+        instead of BEGIN.
+
+        We cannot test this change in a layout test, because in order to
+        test it we need to spawn two database threads and execute
+        transaction steps on these two threads in a very specific order,
+        which seems impossible to do when they share the same main thread
+        (as they would in a layout test). The SQLite docs and the case
+        described in the bug though should be enough proof that we do have
+        a problem here and that this patch will fix it.
+
+        Relevant SQLite documentation:
+        http://www.sqlite.org/lang_transaction.html
+        http://www.sqlite.org/lockingv3.html#locking
+
+        https://bugs.webkit.org/show_bug.cgi?id=29218
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
+        parameter.
+        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
+        for write transactions.
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
+        the read-only flag to the SQLiteTransaction instance.
+
+2009-09-21  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+
+2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Prevent sleeps in unload handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=29193
+
+        Test: fast/dom/Window/slow_unload_handler.html
+
+        * WebCore.gypi:
+        * bindings/v8/DateExtension.cpp: Added.
+        (WebCore::DateExtension::DateExtension):
+        (WebCore::DateExtension::get):
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::weakCallback):
+        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h: Added.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        * bindings/v8/V8Proxy.h:
+
+2009-09-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the
+        worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        The previous fix was partially reverted due to a reliability build break
+        in chromium. The break happens when an exception is thrown without
+        setting a message. We need to check for this scenario and handle it.
+
+        Tested by worker-close.html.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+        
+        See documentation here:
+        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
+
+        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
+        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
+        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
+        * WebCore.OrientationEvents.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
+        * dom/EventNames.h: Add onorientationchange.
+        * html/HTMLAttributeNames.in: Ditto.
+        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        (WebCore::HTMLBodyElement::onorientationchange):
+        (WebCore::HTMLBodyElement::setOnorientationchange):
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLBodyElement.idl: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onorientationchange):
+        (WebCore::HTMLFrameSetElement::setOnorientationchange):
+        * html/HTMLFrameSetElement.h: Ditto.
+        * html/HTMLFrameSetElement.idl: Ditto.
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
+        (WebCore::DOMWindow::onorientationchange):
+        (WebCore::DOMWindow::setOnorientationchange):
+        * page/DOMWindow.h: Handle onorientationchange properly.
+        * page/DOMWindow.idl: Ditto.
+        * page/Frame.cpp: Ditto.
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::sendOrientationChangeEvent):
+        * page/Frame.h: Ditto.
+        (WebCore::Frame::orientation):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: completions are always evaluated against
+        window (discarding call frames).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29616
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
+
+2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo) target.
+
+        Add stubs for SocketStream classes added in @r47788, which
+        broke the WinCairo build.
+
+        No new tests. (Build failure).
+
+        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
+          to Cairo build, exclude from standard Apple build.
+        * platform/network/curl/SocketStreamError.h: Added.
+        * platform/network/curl/SocketStreamHandle.h: Added.
+        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expose InspectorResource fields.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29537
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestHeaderFields):
+        (WebCore::InspectorResource::responseHeaderFields):
+        (WebCore::InspectorResource::responseStatusCode):
+        (WebCore::InspectorResource::requestMethod):
+        (WebCore::InspectorResource::requestFormData):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: JS error drilling down childless node.
+        No need to dispatch double click twice - it is already handled
+        in TreeElement.treeElementDoubleClicked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22144
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement new QWebPageClient class and let our classes
+        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * WebCore.pro:
+        * platform/Widget.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h: Added.
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Evaluating on call frame always returns "undefined".
+
+        https://bugs.webkit.org/show_bug.cgi?id=29613
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.evaluateInCallFrame):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Exception formatting is broken in console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29608
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript.createProxyObject):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console object formatting is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29607
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash When Logging an Element Before Opening Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=29514
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+
+2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect clipping with accelerated compositing content, and position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29347
+        
+        Fix the compositing clipping logic to behave correctly when position:fixed
+        elements clip, by using the new backgroundClipRect() method to determine
+        when we need to clip, and to compute the clipping layer position.
+
+        Test: compositing/overflow/fixed-position-ancestor-clip.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+
+2009-09-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add back in a special case for window.top in the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29605
+
+        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+
+2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        HTMLMediaElement: media file should not reload when page comes out of page cache
+        https://bugs.webkit.org/show_bug.cgi?id=29604
+
+        Test: media/restore-from-page-cache.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
+        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
+        otherwise set the network state to NETWORK_IDLE.
+
+2009-09-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+
+        Clarify two FIXMEs.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+
+2009-09-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects fail to close when a value is selected
+        https://bugs.webkit.org/show_bug.cgi?id=29582
+
+        Implement PopupListBox::hidePopup, which was previously
+        declared but unimplemented.  Removes the declaration of
+        showPopup since that method is not implemented.
+
+        PopupListBox::hidePopup takes care of hiding the popup,
+        by invoking hidePopup on its parent PopupContainer, and
+        then informs the PopupMenuClient that popupDidHide.
+        This mimics the old behavior prior to r48370.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29535
+
+        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash when clicking link in unload handler
+        https://bugs.webkit.org/show_bug.cgi?id=29525
+
+        Test that the first navigation always wins when the page tries to start
+        a new navigation in an unload handler.
+
+        Tests: fast/loader/unload-form-about-blank.html
+               fast/loader/unload-form-post-about-blank.html
+               fast/loader/unload-form-post.html
+               fast/loader/unload-form.html
+               fast/loader/unload-hyperlink.html
+               fast/loader/unload-javascript-url.html
+               fast/loader/unload-reload.html
+               fast/loader/unload-window-location.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
+        https://bugs.webkit.org/show_bug.cgi?id=29496
+
+        Protect the video sink object, and destroy it in an idle callback
+        to hopefully avoid a race condition that leads to a crash.
+
+        This is already tested by media/video-seekable.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::idleUnref):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix for GTKand a blind one for Qt after r48566.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
+        Remove JSNameNodeCollection and just use StaticNodeList
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp: Removed.
+        * bindings/js/JSNamedNodesCollection.h: Removed.
+
+2009-09-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29511
+        
+        Fixes an issue where script code that contains non-ASCII characters may bypass the 
+        XSSAuditor.
+        
+        Before performing a comparison between the script source code and input parameters, we
+        remove all non-ASCII characters, including non-printable ASCII characters from the
+        script source code and input parameters.
+
+        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
+        including non-printable ASCII characters.
+
+2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect animation with scale(0) transform (singular matrix)
+        https://bugs.webkit.org/show_bug.cgi?id=29465
+        
+        Make accelerated scale() and translate() animations go through the component animation
+        path (rather than just matrix animation) to avoid problems with singular scale matrices,
+        and be slightly more efficient.
+
+        Test: compositing/transitions/singular-scale-transition.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::getValueFunctionNameForTransformOperation):
+
+2009-09-19  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Adds CSS styling and basic DOM element support for MathML
+
+        * DerivedSources.make:
+          Added user stylesheet and tag factory generation
+
+        * WebCore.xcodeproj/project.pbxproj:
+          Added new DOM element code
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr):
+          Added check for document since stylesheet can be added before there is a document
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+          Added check to add MathML user agent stylesheet
+
+        * css/mathml.css: Added.
+          MathML user agent stylesheet
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+          Added support for creation of MathML DOM objects
+
+        * dom/Node.h:
+        (WebCore::Node::isMathMLElement):
+          Added check method for whether the node is a MathML node
+
+        * mathml: Added.
+        * mathml/MathMLElement.cpp: Added.
+        (WebCore::MathMLElement::MathMLElement):
+        (WebCore::MathMLElement::create):
+        (WebCore::MathMLElement::createRenderer):
+        * mathml/MathMLElement.h: Added.
+        (WebCore::MathMLElement::isMathMLElement):
+          MathML DOM base class
+
+
+        * mathml/MathMLInlineContainerElement.cpp: Added.
+        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
+        (WebCore::MathMLInlineContainerElement::create):
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLInlineContainerElement.h: Added.
+          Base class for non-text containers
+
+        * mathml/MathMLMathElement.cpp: Added.
+        (WebCore::MathMLMathElement::MathMLMathElement):
+        (WebCore::MathMLMathElement::create):
+        * mathml/MathMLMathElement.h: Added.
+          Root Math element
+
+        * mathml/mathtags.in: Added.
+          Element list mappings
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+          Added MathML name initialization
+2009-09-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
+        https://bugs.webkit.org/show_bug.cgi?id=29305
+
+        We need to special-case data URLs when tainting a canvas because we
+        treat data URLs has having no security origin, unlike other
+        browsers.  The reason we do this is to help sites avoid XSS via data
+        URLs, but that consideration doesn't apply to canvas taint.
+
+        Also, we were previously incorrectly taking document.domain state
+        into account when tainting canvas.
+
+        Tests: http/tests/security/canvas-remote-read-data-url-image.html
+               http/tests/security/canvas-remote-read-data-url-svg-image.html
+               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/SecurityOrigin.h:
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix stylistic issue raised in code review for previous commit.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasNonZeroTransformOrigin):
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
+        https://bugs.webkit.org/show_bug.cgi?id=29495
+        
+        If an element has zero size, but has a transform origin with absolute values,
+        then the transform origin would not be applied because it is implemented via
+        anchorPoint, which is expressed as a fraction of the layer size.
+        
+        Work around this by artificially inflating the size of the backing store when we need to.
+
+        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Init m_artificiallyInflatedBounds to false.
+        
+        (WebCore::hasNonZeroTransformOrigin):
+        Utility function that describes whether the transform-origin contains non-percentage
+        x or y offsets.
+        
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        New wrapper method around setCompositedBounds() that applies the size inflation
+        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
+        
+        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+
+2009-09-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29512
+        Don't recalculate style when restoring from the page cache
+
+        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
+        directly to update the scrollbars while keeping the existing style.
+        
+        Makes back/forward really fast on complex pages (in cases where page cache works).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
+        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
+        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
+        to ensure correct wrapping semantics of quarantined objects.
+
+        One major caveat in this patch is that it currently disallows the use
+        of Object.defineProperty on DOMObjects other than the window due to
+        the significant work involved in correctly propagating attributes and
+        ensuring correct semantics on dom objects.
+
+        Tests: fast/js/Object-defineProperty.html
+               http/tests/security/xss-DENIED-defineProperty.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObject::defineOwnProperty):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        (WebCore::JSDOMWindow::defineSetter):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29510
+        Active DOM objects should be suspended while a modal dialog is displayed
+
+        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
+        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
+        an object twice.        
+
+2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+
+        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
+        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+
+2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix parameter substitutions in console.log().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29366
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Brady Eidson.
+
+        Temporarily remove an assertion that was getting hit when going
+        back to a page in the page cache while a banner in Safari was visible.
+        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix windows build.
+        
+        * platform/win/PopupMenuWin.cpp:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin 'BearClaw' Barraclough.
+
+        Convert another callback type object to store the global object
+        instead of the frame.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29332
+        <rdar://problem/7231652> 
+        REGRESSION (r48446): While a <select> popup menu is open, the
+        rest of the WebView doesn't respond to mouse move events.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::translatePoint):
+        New helper function that translates a point between HWND coordinates.
+        
+        (WebCore::PopupMenu::show):
+        Protect the PopupMenu if someone removes the <select> in response to a mouse
+        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        
+        (WebCore::PopupMenu::wndProc):
+        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
+        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
+        mouse move event.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        Test: compositing/geometry/fixed-position.html
+
+        * WebCore.base.exp:
+        Export FrameView::scrollPositionChanged()
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        New method that sends the scroll event, and updates compositing layers positions if necessary.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transformed elements inside position:fixed container are clipped incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=29346
+        
+        Fix clipping and hit testing on transformed elements inside a position:fixed element.
+        Previously, the code used the overflowClipRect of the parent clip rects, but
+        this is not correct for fixed postion elements. Instead, share code that is
+        already present in calculateRects() to get the correct rect.
+
+        Test: fast/overflow/position-fixed-transform-clipping.html
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        Call the new backgroundClipRect() to get the correct clipRect.
+        
+        (WebCore::RenderLayer::backgroundClipRect):
+        New method, factored out of calculateRects(), that computes the clip rect,
+        doing the right thing for fixed position elements.
+        
+        (WebCore::RenderLayer::calculateRects):
+        Call the new backgroundClipRect() method.
+        
+2009-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
+        WebCore::RenderBlock::layoutBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=29498
+
+        Test: accessibility/nested-layout-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
+            call Document::updateLayoutIgnorePendingStylesheets() instead of
+            calling RenderObject::layoutIfNeeded(). The latter requires that
+            there be no pending style recalc, which allows methods that call
+            Document::updateLayout() to be called during layout without risking
+            re-entry into layout.
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
+            m_object after calling updateBackingStore(), since style recalc may
+            destroy the renderer, which destroys the accessibility object and
+            detaches it from the wrapper.
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+             Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+            Ditto.
+
+2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update Qt build system for Web Socket.
+        https://bugs.webkit.org/show_bug.cgi?id=29270
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamError.h: Added.
+        * platform/network/qt/SocketStreamHandle.h: Added.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+
+2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NULL check HTMLMediaElement::m_playedTimeRanges.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
+        necessary, add range specified.
+        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
+        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
+        to be more readable.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/HTMLMediaElement.h:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Don't use Document.elementFromPoint since it returns null if the point
+        is outside the viewport.  Instead, just hit test ourselves.
+
+        Test: fast/events/drag-file-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Each wrapped Objective-C object should use a single RuntimeObjectImp
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+        rdar://problem/7142294
+
+        * WebCore.base.exp: Added a newly-needed exported symbol.
+
+        * bindings/objc/DOMInternal.h: Eliminated unused
+        createWrapperCacheWithIntegerKeys; it has not been needed since the
+        RGBColor wrappers were reworked.
+        * bindings/objc/DOMInternal.mm: Ditto.
+
+        * bridge/objc/objc_instance.h: Made the create function non-inline.
+        * bridge/objc/objc_instance.mm:
+        (createInstanceWrapperCache): Added. Creates an appropriate map table.
+        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
+        NSMapInsert to cache the instance in a map table.
+        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
+        the instance from the map table.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
+        the instance from cachedObjects, which no longer exists.
+        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
+        bottleneck. Caching is now handled by the base class.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
+        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
+        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
+        if it's already set. Set m_runtimeObject and call addRuntimeObject
+        if it's not.
+        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
+        used only by createRuntimeObject.
+        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
+        Calls removeRuntimeObject and then clears m_runtimeObject.
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
+        Clears m_runtimeObject.
+
+        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
+        willDestroyRuntimeObject, willInvalidateRuntimeObject,
+        newRuntimeObject, and m_runtimeObject.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
+        call, now handled by caller.
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
+        call with willDestroyRuntimeObject call; the latter nows calls
+        removeRuntimeObject.
+        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
+        call.
+
+        * bridge/runtime_object.h: Made invalidate non-virtual.
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Make platformWindow return a PlatformPageClient
+        (for now typedef'ed to PlatformWidget)
+
+        Also, change the name of platformWindow to platformPageClient()
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformPageClient):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformPageClient):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::currentPlatformMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        * platform/HostWindow.h:
+        * platform/Widget.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::wndProc):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Web inspector UI adjustments specific to the Qt platform:
+        - Hide the close button
+        - Hide the dock button
+        - Disable the draggable toolbar
+
+        https://bugs.webkit.org/show_bug.cgi?id=29384
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.toolbarDragStart):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit Windows CE compile fixes
+
+        Exclude certain pure-WINCE specific code paths from the Qt build.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
+        the corresponding PluginViewWndProc has the same guard in the header file.
+
+2009-09-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Geolocation does not correctly handle Infinity for PositionOptions properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29099
+
+        * bindings/js/JSGeolocationCustom.cpp: Modified.
+        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
+        * page/PositionOptions.h: Modified.
+        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
+        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
+        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
+        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Document.elementFromPoint now takes point in client space, not page space.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reimplement default media UI for Mac Chromium to match the style
+        of the Windows and Linux versions.  Also breaks the dependency
+        on the internal wk* functions that were previously used to
+        render the media controller widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=29161
+
+        No media layout tests are currently enabled in Mac Chromium, so
+        nothing needs rebaselineing, etc.
+
+        This is a recommit of r48438 with a compile fix and merges of
+        recent changes to the file.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+        (WebCore::mediaSliderThumbImage):
+        (WebCore::mediaVolumeSliderThumbImage):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The Console scope bar should have a divider between All and the other possible
+        values (Errors, Warnings, Logs). It will look something like:
+        
+        All | Errors Warnings Logs.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        (WebInspector.ConsoleView):
+        * inspector/front-end/inspector.css:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove additional references to JSVoidCallback which no longer exists.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Remove commented out onhashchange attribute now that it is implemented.
+
+        * page/DOMWindow.idl:
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        
+        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
+        crashes while we're calling into it).
+        
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::invalidate):
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::RuntimeObjectImp::getCallData):
+        (JSC::RuntimeObjectImp::getConstructData):
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::getInternalInstance):
+
+2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Wrap primitive values (as objects) in InspectorController::wrap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28983
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
+         only object proxies will have objectId.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
+         that accepts an expression and returns possible completions. This way we don't need to wrap
+         and unwrap the completions result into a proxy object.
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.createProxyObject):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-09-17  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Wrap PageTransitionEvents properly for V8's use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29340
+
+        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hardware-accelerated opacity transition on inline asserts
+        https://bugs.webkit.org/show_bug.cgi?id=29342
+        
+        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
+        pass an empty size, because the box size is only required for transform animations.
+
+        Test: compositing/transitions/opacity-on-inline.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-09-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] OwnHandle might get a weak callback after destruction
+        https://bugs.webkit.org/show_bug.cgi?id=29172
+
+        Be sure to clear out weak reference so we don't get a weak callback
+        after we've destructed ourselves.  Also, removed some tricky methods
+        that had no clients.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore::OwnHandle::clear):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
+        fix crashes that started happening in V8Proxy::getEnteredContext().
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: labels of checkboxes should, when hit-tested, return the checkbox
+        https://bugs.webkit.org/show_bug.cgi?id=29335
+
+        When an accessibility hit test is done and it hits the label of a control element,
+        the control element should be returned instead of nothing, since the label
+        itself is usually ignored.
+
+        Test: accessibility/label-for-control-hittest.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-09-17  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Dimitri Glazkov, build fix.
+
+        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+
+        Covered by existing tests.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
+        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+              fast/dom/doctype-event-listener-crash.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+
+2009-09-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        FontDescription.h includes RenderStyleConstants.h, which violates layering
+        https://bugs.webkit.org/show_bug.cgi?id=29327
+
+        * GNUmakefile.am: Added FontSmoothingMode.h.
+        * WebCore.gypi: Added FontSmoothingMode.h.
+        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
+        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
+            it a private header.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
+            font smoothing mode via the font description.
+        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
+            of FontSmoothing to FontSmoothingMode.
+        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
+            via the font description.
+        * platform/graphics/FontDescription.h: Do not include
+            RenderStyleConstants.h.
+        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
+            FontSmoothing to FontSmoothingMode.
+        (WebCore::FontDescription::setFontSmoothing): Ditto.
+        * platform/graphics/FontSmoothingMode.h: Added.
+        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
+            RenderStyleConstants here and renamed it to this.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
+            this can be accessed via the font description.
+        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
+            from here to FontSmoothingMode.h.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx 2.9 build fix.
+
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements appear behind <video> when they should be in front sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=29314
+        
+        r45598 added logic that tests for overlap with <video> to determine when to throw
+        a layer into compositing mode. That logic was incorrect in some cases, and this patch
+        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
+        is composited (which adds a rect to the overlay map), and there is overlap.
+
+        Test: compositing/geometry/video-opacity-overlay.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-09-17  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update the Chromium Mac theming files (RenderTheme and Theme) to be
+        up-to-date.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+        http://crbug.com/19604
+
+        Covered by existing tests.
+
+        * WebCore.gypi:
+        * platform/chromium/ThemeChromiumMac.h: Added.
+        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
+        * platform/chromium/ThemeChromiumMac.mm: Added.
+        (WebCore::):
+        (WebCore::platformTheme):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
+        (WebCore::ThemeChromiumMac::controlFont):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::controlPadding):
+        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
+        (WebCore::ThemeChromiumMac::paint):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsControlTints):
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[RTCMFlippedView isFlipped]):
+        (-[RTCMFlippedView currentEditor]):
+        (WebCore::):
+        (WebCore::FlippedView):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::inflateRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
+        (WebCore::RenderThemeChromiumMac::paintTextField):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintTextArea):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchCellState):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+
+2009-09-16  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29306
+        
+        Fixes an issue where an attack that contains accented characters can
+        bypass the XSSAuditor.
+        
+        XSSAuditor::decodeURL used the wrong length for the input string. 
+        When the input string was decoded, the decoded result was truncated.
+        Hence, XSSAuditor was comparing the source code of the script to the 
+        truncated input parameters.
+
+        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL):
+
+2009-09-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Explore allowing pages with unload handlers into the Page Cache
+        https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        No new tests. (All previous tests continue to pass)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some groups to the xcode project to make the bindings/js/ group
+        a little nicer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
+        JS callback objects should store the global object
+
+        This just changes the callback objects to store the global object instead
+        of the frame. A follow up patch will change them to store the 'current' 
+        global object instead of the lexical or dynamic.
+
+        * DerivedSources.make: Remove unused VoidCallback.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
+        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::createTransaction):
+        (WebCore::JSDatabase::transaction):
+        (WebCore::JSDatabase::readTransaction):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+
+2009-09-15  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <input maxlength=> should restrict only values specified by users.
+        https://bugs.webkit.org/show_bug.cgi?id=21271
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::sanitizeValue):
+        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::updateValueIfNeeded):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::value):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::sanitizeValue):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::constrainValue):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::sanitizeValue):
+
+2009-09-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
+        https://bugs.webkit.org/show_bug.cgi?id=29319
+
+        * editing/IndentOutdentCommand.cpp:
+        Removed implementation of isAtUnsplittableElement.
+
+        * editing/IndentOutdentCommand.h:
+        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+
+        * editing/htmlediting.h:
+        Reordered functions to group them by type of object returned or operate upon.
+        Added comments.
+        Added isAtUnsplittableElement declaration.
+
+2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Anders Carlsson.
+
+        Removed some vestigial and potentially crashy code that makes consolidating
+        event listeners hard.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener): No need to limit when event listeners
+        can be added. Other EventTargets don't do this.
+        
+        Also, check for null when accessing document(). Technically, the JS bindings
+        do this check for us, but let's not rely on that.
+
+2009-09-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened
+        
+        Redo the way we handle events when a popup menu is shown, based on
+        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        
+        Since a non-active window can't capture the mouse, we use the owning window 
+        (the WebView) as the capture window. We then run a recursive message pump that 
+        forwards all mouse and keyboard events to the popup menu.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan.
+
+        Speculative fix for
+        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
+        is null. Add two assertions that can help determine how this crash
+        happens (in particular, whether node() becomes null during destroy() or
+        it is null before destroy() is called).
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7083741> Implement a CSS extension to 
+        adjust sub-pixel anti-aliasing for text
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29291
+
+        Added tests:
+        * fast/css/font-smoothing.html: Added.
+        * fast/css/parsing-webkit-font-smoothing.html: Added.
+
+        This patch adds a new CSS property called -webkit-font-smoothing 
+        that accepts the following as valid input: auto | none | 
+        antialiased | subpixel-antialiased
+
+        Return appropriate computed style for -webkit-font-smoothing
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
+        input.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Add mappings for FontSmoothing to the right CSS values.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+
+        Add -webkit-font-smoothing
+        * css/CSSPropertyNames.in:
+
+        Set fontSmoothing on the FontDescription.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add antialiased and subpixel-antialiased as possible new CSS 
+        values.
+        * css/CSSValueKeywords.in:
+        Store the font smoothing CSS value in the FontDescription.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::fontSmoothing):
+        (WebCore::FontDescription::setFontSmoothing):
+        (WebCore::FontDescription::operator==):
+
+        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
+        based on the CSS fontSmoothing() value.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+        New function fontSmoothing()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing):
+
+        New enum FontSmoothing.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove style property if empty string is entered.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29163
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Always reset m_implicitShorthand to false after parsing
+        background-repeat style property otherwise properties
+        following after it may be erroneously marked as implicit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+        https://bugs.webkit.org/show_bug.cgi?id=28973
+
+        Test: fast/backgrounds/repeat/margin-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
+        XMLHttpRequest::getResponseHeader in the
+        HEADERS_RECEIVED readyState.
+        https://bugs.webkit.org/show_bug.cgi?id=29121
+
+        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
+               http/tests/xmlhttprequest/getResponseHeader.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix style violation in V8AbstractEventListener.
+        https://bugs.webkit.org/show_bug.cgi?id=29303
+
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==):
+
+2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add Watch Expression support to inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27514
+
+        Manual test added.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        (WebInspector.WatchExpressionsSection.CompareProperties):
+        (WebInspector.WatchExpressionTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
+        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
+        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
+        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
+        * bindings/js/ScriptObject.h: Ditto.
+        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        (WebCore::Document::scriptImported):
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/ScriptExecutionContext.h: Ditto.
+        (WebCore::):
+        * html/HTMLDocument.cpp: Ditto.
+        (WebCore::HTMLDocument::createTokenizer):
+        * html/HTMLTokenizer.cpp: Ditto.
+        (WebCore::HTMLTokenizer::write):
+        * inspector/ConsoleMessage.cpp: Ditto.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * inspector/InspectorBackend.cpp: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/InspectorDOMAgent.cpp: Ditto.
+        * inspector/InspectorDOMStorageResource.cpp: Ditto.
+        * inspector/InspectorDatabaseResource.cpp: Ditto.
+        * inspector/InspectorFrontend.cpp: Ditto.
+        * inspector/InspectorResource.cpp: Ditto.
+        * inspector/InspectorTimelineAgent.cpp: Ditto.
+        * inspector/TimelineItem.cpp: Ditto.
+        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        (WebCore::FrameLoader::dispatchDidCommitLoad):
+        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::FrameLoader::dispatchWillSendRequest):
+        (WebCore::FrameLoader::dispatchDidReceiveResponse):
+        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoader::dispatchDidFinishLoading):
+        * page/Chrome.cpp: Ditto.
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/ContextMenuController.cpp: Ditto.
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/EventHandler.cpp: Ditto.
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/FrameView.cpp: Ditto.
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h: Ditto.
+        (WebCore::):
+        * storage/Database.cpp: Ditto.
+        (WebCore::Database::openDatabase):
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp: Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
+        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
+        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        (WebCore::Node::defaultEventHandler):
+        * loader/EmptyClients.h: Ditto.
+        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * page/mac/WebCoreViewFactory.h: Ditto.
+        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/mac/ContextMenuMac.mm: Ditto.
+        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
+        into ScrollView so that all platforms do it.
+        
+        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
+        the rectangle for repainting.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
+        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * loader/EmptyClients.h: Ditto.
+        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * platform/mac/ClipboardMac.mm: Ditto.
+        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix after adding support for high resolution times in Win.
+
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Added operator==() to event listeners. This fixes V8 bindings
+        build broken in http://trac.webkit.org/changeset/48402.
+        https://bugs.webkit.org/show_bug.cgi?id=29298
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
+        uses JSEventListenerType.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==): Only compares
+        pointers since we create at most one wrapper for a JS object.
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Crash when visiting http://flipper.googlelabs.com/
+        https://bugs.webkit.org/show_bug.cgi?id=29293
+
+        Check type for being null or empty before looking it up in the
+        hash of supported types.
+
+        Tested by http/tests/loading/redirect-with-no-location-crash.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the notion of "disconnected nodes with event listeners" because
+        it was vestigial. The reference cycle it tried to solve was solved another
+        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::clearAttributeEventListener):
+
+2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
+        https://bugs.webkit.org/show_bug.cgi?id=28841
+
+        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
+        Consolidate increment/decrement/changeValue methods. 
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::increment):
+        (WebCore::AccessibilityRenderObject::decrement):
+        (WebCore::AccessibilityRenderObject::changeValueByPercent):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        * accessibility/AccessibilitySlider.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
+        creation and destruction of JSDOMGlobalObject and event listeners.
+        
+        Added an abstract operator==() to EventListener, to replace the
+        jsEventListeners set's role in determining if two event listeners are
+        equal from the DOM's perspective.
+        
+        Added a type field to EventListener, and casting operations, to support
+        operator==() and other abstract operations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        (WebCore::JSEventListener::operator==):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::cast):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        (WebCore::ObjCEventListener::cast):
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::ObjCEventListener):
+        (WebCore::ObjCEventListener::operator==):
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        (WebCore::EventListener::type):
+        (WebCore::EventListener::EventListener):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        * dom/Node.cpp:
+        (WebCore::Node::removeEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::mainFrameDocument):
+        (WebCore::InspectorDOMAgent::operator==):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::cast):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::cast):
+        (WebCore::ImageEventListener::ImageEventListener):
+        (WebCore::ImageEventListener::operator==):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::removeEventListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeEventListener):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::cast):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addEventListener):
+        (WebCore::WorkerContext::removeEventListener):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added ENABLE_MATHML to feature defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-14  Andrew Richards  <randrew@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=29245
+
+        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        http://bugs.webkit.org/show_bug.cgi?id=26660
+
+        Chromium Windows: When rotated, the baseline for a span of complex
+        script is completely misaligned with that of the adjacent 
+        simple script text. It's fixed by not applying the baseline offset for
+        the Skia code path.
+
+        Test: transforms/2d/hindi-rotated.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
+        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+
+2009-09-15  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        MessageEvent should not be cancelable by default
+        https://bugs.webkit.org/show_bug.cgi?id=27846
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+
+2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Fix SVG path parsing error if a command starts with dot '.'
+        https://bugs.webkit.org/show_bug.cgi?id=29123
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
+2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=28908
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Popup.js: Added.
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype.get visible):
+        (WebInspector.Popup.prototype.set element):
+        (WebInspector.Popup.prototype.get element):
+        (WebInspector.Popup.prototype.positionElement):
+        (WebInspector.Popup.prototype.set anchor):
+        (WebInspector.Popup.prototype.get anchor):
+        (WebInspector.Popup.prototype.set autoHide):
+        (WebInspector.Popup.prototype._checkNotVisible):
+        (WebInspector.Popup.prototype._keyEventHandler):
+        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentContextMenu):
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentFocusElement):
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+        (WebInspector.contextMenu):
+        (WebInspector.elementDragStart):
+        (WebInspector.updateResource):
+        (WebInspector.drawLoadingPieChart):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.startEditing.getContent):
+        (WebInspector.startEditing.editingCancelled):
+        (WebInspector.startEditing.editingCommitted):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.positionAt):
+        (Element.prototype.offsetRelativeToWindow):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Page cache should support pages with unload handlers as an experiment.
+        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        For the experiment, only allow pages with unload handlers into the Page Cache on
+        Mac and Windows.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the change in r48376 to do a null-check to fix a crashing test.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
+        
+        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
+        to a list (by setting the 'size' property) inside the event handler.
+
+        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        More PopupMenu cleanup.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Call registerClass.
+        
+        (WebCore::PopupMenu::registerClass):
+        Make this a private static member function so it can refer to PopupMenuWndProc.
+        
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        Try to get the PopupMenu and call its wndProc member function.
+        
+        (WebCore::PopupMenu::wndProc):
+        Make this a member function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
+          as related checks all look at nullity when they really mean to be looking for emptiness. 
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Speculative Qt build fix.
+        
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
+        matches the state values (and you get a single classic_state value
+        for a given {part,state} value. This change will be tested by a 
+        chromium patch that will land after this.
+
+        This will be tested by code landing downstream on Chromium.org; the
+        code does not execute on webkit.org.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29138
+        Simplify popup menu handling.
+
+        * platform/PopupMenuClient.h:
+        Rename hidePopup to popupDidHide.
+        
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):        
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        Call popupDidHide instead of hidePopup.
+        
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        Ditto.
+        
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        Ditto.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        Call popupDidHide.
+        
+        (WebCore::PopupWndProc):
+        Call PopupMenu::hide.
+        
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        Call popupDidHide.
+        
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::hidePopup):
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        Set the "popup is visible" flag in popupDidHide.
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        Ditto.
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        - Fix <rdar://problem/7182275>.
+
+        Make sure that the newly created scrollbar's style is up to date.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        Call setParent so that the scrollbar's parts are torn down correctly.
+        
+        (WebCore::PopupMenu::show):
+        Call styleChanged.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added declaration for handleScrolledToAnchor(). Added a new entry to
+        the enum of accessibility notifications.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+        Code moved from AccessibilityRenderObject::internalLinkElement() and
+        refactored slightly; walks the tree until it finds a Node (with a
+        renderer) whose accessibility is not ignored.
+
+        * accessibility/AccessibilityObject.h:
+        Added a declaration for firstAccessibleObjectFromNode().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Add a default case that returns early for notifications that Mac
+        doesn't handle.
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Post an AXScrolledToAnchor notification for the first accessible from
+        the anchor Node.
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the notification is AXFocusedUIElementChanged, fire an
+        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
+        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Code moved to postPlatformNotification().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        Call AXObjectCache::handleScrolledToAnchor().
+
+2009-09-14  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Cookies are not inspectable after reloading a page
+        https://bugs.webkit.org/show_bug.cgi?id=29222
+
+        Create the cookieTreeElement on initialization instead of when the view is shown.
+        Reset the selected element of the sidebar on reset.
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
+        implemented our own in WebCore.
+
+        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
+        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+
+        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
+        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+
+        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
+        due to the change in Digest behavior.
+
+        Test: http/tests/loading/basic-credentials-sent-automatically.html
+              http/tests/loading/basic-auth-resend-wrong-credentials.html
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::isEmpty):
+        * platform/network/Credential.h:
+
+        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
+        * platform/network/CredentialStorage.cpp: Added.
+        (WebCore::protectionSpaceToCredentialMap):
+        (WebCore::originToDefaultCredentialMap):
+        (WebCore::originStringFromURL):
+        (WebCore::CredentialStorage::set):
+        (WebCore::CredentialStorage::get):
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
+        * platform/network/CredentialStorage.h: Added.
+
+        Allow ProtectionSpace to be a hash key:
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        * platform/network/ProtectionSpace.h:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        (WebCore::ProtectionSpace::isHashTableDeletedValue):
+        * platform/network/ProtectionSpaceHash.h: Added.
+        (WebCore::ProtectionSpaceHash::hash):
+        (WebCore::ProtectionSpaceHash::equal):
+
+        Allow ResourceHandles to remember the initial credential they used:
+        * platform/network/ResourceHandleInternal.h:
+
+        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+
+        Remove WebCoreCredentialStorage:
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        * platform/network/mac/AuthenticationMac.h:
+        * platform/network/mac/AuthenticationMac.mm:
+
+        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::WebCoreSynchronousLoader::load):
+
+        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
+          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+
+        Add base64-ability to CString:
+        * platform/text/CString.cpp:
+        (WebCore::CStringBuffer::base64Encode):
+        (WebCore::CString::base64Encode):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+
+        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
+        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
+        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+
+        No test is possible until <rdar://problem/7090444> is fixed.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
+        duration of a function.  Deploy it within RenderWidget.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
+        ref'ing and deref'ing the node.
+        * rendering/RenderWidget.h:
+        * rendering/RenderWidgetProtector.h:
+        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
+        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+
+2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        CodeGenerator.pm needs some cleaning up
+        https://bugs.webkit.org/show_bug.cgi?id=29238
+
+        * bindings/scripts/CodeGenerator.pm:
+        (FindParentsRecursively): Removed; its functionality is now handled in
+        AddMethodsConstantsAndAttributesFromParentClasses.
+        (ForAllParents): New function that visits an interface's ancestors and
+        invokes a callback for each one.
+        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
+        ForAllParents.
+        (GetMethodsAndAttributesFromParentClasses): Ditto.
+        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
+        this new function, which returns the filename containing a given IDL
+        interface definition.
+        (ParseInterface): Simplified by using IDLFileForInterface.
+        (ScanDirectory): Removed in lieu of IDLFileForInterface.
+        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
+        FindParentsRecursively and get the list of parents from the
+        AddMethodsConstantsAndAttributesFromParentClasses call instead.
+
+2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Assert hit when dropping a file in QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=29242
+
+        Qt's implementation of DropData::asURL does not return a URL encoded string
+        as expected.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, file was missed during TLS.cpp removal.
+
+        * page/wx/FrameWx.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-09-13  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector: Add "New Style Rule" to the localizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=29237
+
+        * English.lproj/localizedStrings.js:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement filesystem functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29196
+
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::homeDirectoryPath):
+        (WebCore::directoryName):
+
+2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx 2.9.
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
+        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
+        in order to ensure correct semantics are maintained.
+
+        Test: fast/js/Object-keys.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
+        Document.elementFromPoint() should take page scroll into consideration
+
+        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
+        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+
+        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
+        the point passed to it as relative to the viewport, not the document.
+
+        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some manual tests to show WebGL in action
+        https://bugs.webkit.org/show_bug.cgi?id=29215
+
+        * manual-tests/webgl: Added.
+        * manual-tests/webgl/Earth.html: Added.
+        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
+        * manual-tests/webgl/SpinningBox.html: Added.
+        * manual-tests/webgl/TeapotPerPixel.html: Added.
+        * manual-tests/webgl/TeapotPerVertex.html: Added.
+        * manual-tests/webgl/resources: Added.
+        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
+        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
+        * manual-tests/webgl/resources/mars500x250.png: Added.
+        * manual-tests/webgl/resources/teapot.obj: Added.
+        * manual-tests/webgl/resources/utils3d.js: Added.
+ 
+2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        aria definition role spelled wrong "defintion"
+        https://bugs.webkit.org/show_bug.cgi?id=28840
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-09-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=29210
+
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29139
+        
+        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
+        to the baseAddress().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::toArray):
+        (WebCore::):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::data):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::data):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::data):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::data):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::data):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::data):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::data):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(WEB_SOCKETS) guards.
+        https://bugs.webkit.org/show_bug.cgi?id=29174
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebCore.base.exp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::Clipboard::sourceOperation):
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Fix the build.
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27456
+        Added support for static validation of url in
+        ValidityState, for url state inputs.
+        From HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+
+        Test: fast/forms/ValidityState-typeMismatch-url.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Revert r47992: Expose functions to change the focus ring color for
+        Linux Chromium.
+
+        As Darin Fisher has pointed out, there is a better way to do this.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        Set the new debug-only mainThreadOnly flag.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector should have scope bars.
+        https://bugs.webkit.org/show_bug.cgi?id=14353
+        
+        Add scope bars to the console, so the user can choose which category
+        of messages they want to see (All, Errors, Warnings, Logs), and they
+        can choose from one or more of {Errors, Warnings, Logs}.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createFilterElement):
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        (WebInspector.ConsoleView.prototype.attach):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Added extra NULL checks for HDC. This is the second fix for issue 28707,
+        and the fix is similar to http://trac.webkit.org/changeset/45482.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make ElementTimeControl methods return void and not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=28831
+
+        SVG 1.1 erratum:
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+
+        Test: svg/dom/smil-methods.svg
+
+        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
+        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
+        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
+        (WebCore::SVGAnimationElement::endElement): Ditto.
+        (WebCore::SVGAnimationElement::endElementAt): Ditto.
+        * svg/SVGAnimationElement.h: Ditto.
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for texImage2D which takes CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29191
+
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
+        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
+        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+
+2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Share persistent context handles between events        
+        Change events to use a single ref-counted shared persistent handle
+        to the context in which to run, rather than create a new
+        persistent handle for each new event which puts pressure on the
+        gc.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29077
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/SharedPersistent.h: Added.
+        (WebCore::SharedPersistent::set):
+        (WebCore::SharedPersistent::get):
+        (WebCore::SharedPersistent::disposeHandle):
+        (WebCore::SharedPersistent::create):
+        (WebCore::SharedPersistent::SharedPersistent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+        (WebCore::V8IsolatedWorld::shared_context):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearDocumentWrapperCache):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::setSecurityToken):
+        (WebCore::V8Proxy::updateDocument):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::shared_context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::shared_context):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create a real handle (one which would save an object from GC).
+        https://bugs.webkit.org/show_bug.cgi?id=29150
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
+        https://bugs.webkit.org/show_bug.cgi?id=29152
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8String):
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * ChangeLog-2009-06-16:
+
+2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use LIBS_PRIVATE on Qt/Mac.
+
+        On the Mac, it means "-framework ApplicationServices -framework Carbon
+        -framework AppKit" are no longer part of the default LIBS in Qt
+        applications. This required a lot of fixes where we used Mac-specific
+        code in Qt.
+
+        * WebCore.pro:
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=29165
+
+        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
+        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29132
+        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+
+        Add RegularExpression class qualifier before Private.
+
+        * platform/text/RegularExpression.cpp:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29131
+        Use a different variadic macro format for Symbian compiler.
+        
+        Use arg... instead of ellipsis in variadic macro.        
+
+        * platform/StaticConstructors.h:
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * WebCore.pro:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed fix for the Web Inspector with the Qt build.
+
+        Re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, remove stray semicolon from function definition.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Detect mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=29003
+
+        Detect some basic kinds of mixed content (HTTP content loaded into an
+        HTTPS context).  This new detection logic isn't perfect, but it's a
+        place to start.
+
+        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-script-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-main-frame.html
+               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
+               http/tests/security/mixedContent/insecure-image-in-iframe.html
+               http/tests/security/mixedContent/insecure-image-in-main-frame.html
+               http/tests/security/mixedContent/insecure-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::checkCacheObjectStatus):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        Restore platform/mock to the header search path after it was removed in r48270.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-09-08  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29039
+
+        Reviewed by Sam Weinig.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
+        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
+        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
+        while calling the correct action.
+        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
+        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
+        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
+        is remembered by the editing code.
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
+        restored by the editing code.
+        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
+        Remove event listener code.
+        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
+        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
+        override the base class.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
+        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
+        the end to correctly swtich to a real StylePropertiesSection.
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
+        (WebInspector.startEditing.editingCommitted): Ditto.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::duration):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for GTKafter r48267.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap):
+        (WebCore::serviceTypeForClassId):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Don't copy IDL files in to the built framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-10  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implment Range.expand().
+        https://bugs.webkit.org/show_bug.cgi?id=27632
+
+        Test: fast/dom/Range/range-expand.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::expand):
+        * dom/Range.h:
+        * dom/Range.idl:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
+        WebCore.vcproj.
+        Add websockets directory and WebSocket.idl in qt build system.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, windows build fix only.
+        
+        Spurious semicolon causing parse error in chromium build on windows.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, build fix only.
+
+        Adding in a missed include from the last patch that is breaking the
+        chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+
+2009-09-10  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement buffered attribute should report a list of time ranges
+        https://bugs.webkit.org/show_bug.cgi?id=29041
+
+        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
+        report a list of buffered time ranges as WebCore::TimeRanges. This
+        change also got rid of the maxTimeBuffered() method.
+
+        No new tests since this is a API change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded):
+        Use MediaPlaier::buffered() instead of maxTimeBuffered().
+        (WebCore::HTMLMediaElement::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::buffered):
+        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
+        (WebCore::MediaPlayer::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/MediaPlayerPrivate.h:
+        ditto.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Implements PassRefPtr<TimeRanges> buffered();
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::buffered):
+        Implementation of buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Implements PassRefPtr<TimeRanegs> buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        Implements PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+        ditto.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        Use buffered() instead of maxTimeBuffered().
+        * rendering/RenderThemeChromiumSkia.cpp:
+        ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        ditto.
+
+2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make bindings generators more aware of IDL dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=29114
+
+        Make the JS and ObjC bindings generators able to output dependency
+        rules for DerivedSources.make to consume.  These rules make a given
+        generated binding class file header, JSWhatever.h, depend on Whatever's
+        ancestor interfaces.
+
+        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
+        when generating JS and ObjC bindings.  Include dependency fies that are
+        generated due to that.
+        * bindings/scripts/CodeGenerator.pm: Make
+        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
+        the ancestor interfaces that were visited.
+        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
+        file.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
+        option.
+
+2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Dan Winship.
+
+        Give all requests to libsoup, to let it queue, and schedule them
+        itself, instead of throttling the number of requests in WebCore.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-09-10  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Make XMLHttpRequest.send handle File object.
+        https://bugs.webkit.org/show_bug.cgi?id=28924
+
+        Test: http/tests/local/send-dragged-file.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        Change using of operator new to fastNew and operator delete to
+        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+
+        This change fixes valgrind's 'mismatched free' notification.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+
+2009-09-10  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation does not correctly handle reentrant calls from callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=29040
+
+        Tests: fast/dom/Geolocation/reentrant-error.html
+               fast/dom/Geolocation/reentrant-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
+        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+
+2009-09-10  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
+        https://bugs.webkit.org/show_bug.cgi?id=27105
+
+        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+
+2009-09-10  Adam Roben  <aroben@apple.com>
+
+        Make the play/pause button in <video> controls indicate the button's
+        action, not the movie state
+
+        This matches the Mac behavior, iTunes, and many other media players.
+
+        No test possible.
+
+        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
+        controls shows the wrong image
+
+        Reviewed by Eric Carlson.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
+        we show the play vs. pause artwork, so that the button reflects what
+        will happen when you click it, rather than the current state of the
+        movie.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        Test: fast/dom/Geolocation/position-string.html
+
+        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * page/Coordinates.cpp: Removed.
+        * page/Coordinates.h: Modified. Removes toString method.
+        * page/Coordinates.idl: Modified. Removes toString method.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Modified. Removes toString method.
+        * page/Geoposition.idl: Modified. Removes toString method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Correctly applies the Geolocation timeout property.
+        https://bugs.webkit.org/show_bug.cgi?id=27256
+
+        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
+        If a position fix is not obtained within the timeout interval, the position request is cancelled
+        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
+        interval, the timer is stopped. Permissions are then requested from the user if required. See
+        http://www.w3.org/TR/geolocation-API/#position-options.
+
+        Note that this logic means that the time required to obtain permissions from the user is not
+        included in the timeout interval.
+
+        Tests: fast/dom/Geolocation/timeout.html
+               fast/dom/Geolocation/timeout-zero.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
+        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
+        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
+        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
+        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
+        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
+        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
+        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
+        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+
+2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Build fix for Qt.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Moves AX notifications over to an ENUM type instead of
+        using the actual string values that are used on OS X.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-09-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Missing checkout for getSVGDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=29064
+
+        The V8 code generator didn't understand SVGCheckSecurityDocument.
+
+        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
+               http/tests/security/xss-DENIED-getSVGDocument-object.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement inherit from SVGLangSpace
+        https://bugs.webkit.org/show_bug.cgi?id=29058
+
+        Required by SVG 1.1 Second Edition:
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+
+        Test: svg/dom/SVGStyleElement/style-langspace.html
+
+        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
+        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
+        initializer.
+        (WebCore::SVGStyleElement::parseMappedAttribute): Call
+        parseMappedAttribute on SVGLangSpace.
+        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
+        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
+        as a superinterface.
+
+2009-09-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary includes and forward declarations in V8Proxy.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=29111
+
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add more position constructors
+        positionBeforeNode, positionAfterNode
+        firstPositionInNode, lastPositionInNode
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        I also added a lastOffsetInNode and deployed it to a couple places.
+
+        There are no callers to these new constructors yet, but those
+        will be coming in future patches.
+
+        * dom/Position.cpp:
+        (WebCore::Position::computeOffsetInContainerNode):
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::lastOffsetInNode):
+        (WebCore::firstPositionInNode):
+        (WebCore::lastPositionInNode):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/TextIterator.cpp:
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::lastOffsetForEditing):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename positionBeforeNode to positionInParentBeforeNode
+        and positionAfterNode to positionInParentAfterNode
+        in preparation for adding a positionBeforeNode
+        which returns a neighbor-anchored position.
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        No functional changes, thus no tests.
+
+        * dom/PositionConstructors.h:
+        (WebCore::positionInParentBeforeNode):
+        (WebCore::positionInParentAfterNode):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::deleteTarget):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::updatePositionForNodeRemoval):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::positionBeforeContainingSpecialElement):
+        (WebCore::positionAfterContainingSpecialElement):
+        (WebCore::positionBeforeTabSpan):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-organize position creation functions in preparation for adding more
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        Make position functions inline to avoid ref-churn.
+        Remove startPosition/endPosition as they were only used in one place.
+
+        No functional changes, thus no tests.
+
+        * dom/Position.cpp:
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        * editing/TypingCommand.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * rendering/RenderObject.cpp:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+        
+        [wx] Add wxSize conversions for IntSize.
+        https://bugs.webkit.org/show_bug.cgi?id=29104
+
+        * platform/graphics/IntSize.h:
+        * platform/graphics/wx/IntSizeWx.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator wxSize):
+
+2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+        
+        Chromium uses its own config.h file that was forked from webkit's config.h.
+        By merging in Chromium's defines, Chromium would again be able to use webkit's
+        config.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28882 
+
+        * config.h: Added chromium-specific defines. 
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+        - At the start of a drag operation, the value of effectAllowed should be
+          the string "uninitialized".
+        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
+          should be set to "copy".
+        - on dragenter and dragover event, dropEffect should be initialized to a
+          default value based on the value of effectAllowed.
+        - at end of dragenter and dragover the dropEffect should be set to "none"
+          if the value set by the handler doesn't match the effectAllowed.
+        - on dragleave event, dropEffect should be "none".
+        - on drop event, dropEffect should be the previously negotiated value.
+
+        Test: fast/events/drag-dropeffect.html
+
+        * WebCore.base.exp:
+            Added a parameter to EventHandler::dragSourceMovedTo.
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+            Initialize m_effectAllowed to "uninitialized".
+        (WebCore::Clipboard::sourceOperation):
+            Treat "uninitialized" as meaning no value has been set.
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+            Initialize new member m_destinationDragOperation.
+        (WebCore::DragController::dragExited):
+            Set m_destinationDragOperation to none on dragExit.
+        (WebCore::DragController::performDrag):
+            Set m_destinationDragOperation to current dropEffect.
+        (WebCore::DragController::dragEnteredOrUpdated):
+            Make sure to clear the operation if drag source doesn't allow it.
+        (WebCore::DragController::tryDHTMLDrag):
+            Set a default value for the dst drag op before sending dragEnter/Over.
+        (WebCore::DragController::startDrag):
+            Clear m_destinationDragOperation at start of drag.
+        * page/DragController.h:
+        (WebCore::DragController::destinationDragOperation):
+            Added new member m_destinationDragOperation, and its public getter.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+            dropEffect should be 'none' during dropleave handler, per spec.
+        (WebCore::EventHandler::dragSourceMovedTo):
+            Added DragOperation parameter, so the handler sees the current dropEffect.
+        (WebCore::EventHandler::handleDrag):
+            Assume DragOperationEvery for non-DHTML drags.
+        * page/EventHandler.h:
+            Added DragOperation parameter to dragSourceMovedTo().
+
+2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Adding support/bindings for read-only transactions.
+        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
+        private browsing mode.
+        3. Adding an authorizer test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28918
+
+        Test: storage/test-authorizer.html
+
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::JSDatabase::transaction): Refactored to use
+        createTransaction().
+        (WebCore::JSDatabase::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
+        Database::readTransaction().
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::transaction): Refactored to use createTransaction().
+        (WebCore::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * storage/Database.cpp:
+        (WebCore::Database::transaction): Added support for read-only
+        transactions.
+        * storage/Database.h: Added support for read-only transactions.
+        * storage/Database.idl: Added support for read-only transactions.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
+        that the statement will be denied in private browsing mode and
+        read-only transactions.
+        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
+        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::createView): Deny in private
+        browsing mode and read-only transactions.
+        (WebCore::DatabaseAuthorizer::createTempView): Same.
+        (WebCore::DatabaseAuthorizer::dropView): Same.
+        (WebCore::DatabaseAuthorizer::dropTempView): Same.
+        (WebCore::DatabaseAuthorizer::allowReindex): Same.
+        * storage/DatabaseAuthorizer.h:
+        * storage/SQLTransaction.cpp: Added support for read-only
+        transactions.
+        (WebCore::SQLTransaction::create):
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::acquireLock):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
+        parameter in preparation for a change that will allow multiple
+        read-only transactions on the same DB to run concurrently.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::clearPageGroupUserSheets):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userStyleSheets):
+        * page/UserStyleSheet.h: Added.
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::source):
+        (WebCore::UserStyleSheet::url):
+        (WebCore::UserStyleSheet::patterns):
+        (WebCore::UserStyleSheet::worldID):
+        * page/UserStyleSheetTypes.h: Added.
+
+2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
+        Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+         Added the ability to draw shadows for all these curves.
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add the qwebgraphicsitem.cpp to the build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebCore.pro:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
+        they belong.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29088
+
+        * editing/wx/EditorWx.cpp:
+        (WebCore::Editor::showColorPanel):
+        (WebCore::Editor::showFontPanel):
+        (WebCore::Editor::showStylesPanel):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/wx/IconWx.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        * platform/wx/CursorWx.cpp:
+        (WebCore::moveCursor):
+        * platform/wx/FileChooserWx.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/wx/KURLWx.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
+        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/wx/SearchPopupMenuWx.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/wx/SharedBufferWx.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/wx/SystemTimeWx.cpp: Added.
+        (WebCore::userIdleTime):
+        * platform/wx/TemporaryLinkStubs.cpp: Removed.
+        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Geolocation incorrectly calls error callback in case of exception in success callback.
+        https://bugs.webkit.org/show_bug.cgi?id=27255
+
+        Test: fast/dom/Geolocation/callback-exception.html
+
+        * bindings/js/JSCustomPositionCallback.cpp: Modified.
+        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
+        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
+        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
+        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When Geolocation permission is denied, stops watches as well as one-shots.
+        https://bugs.webkit.org/show_bug.cgi?id=28305.
+
+        Tests: fast/dom/Geolocation/watch.html
+               fast/dom/Geolocation/permission-denied-stops-watches.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
+        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
+        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+
+2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Added getter/setter methods and trivial inline implementations for each.
+        (Note that they are not yet actually used.)
+        Once the Chromium code is changed to use them instead of directly accessing the
+        member variables, the member variables should be made private and cleaned up.
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::mainURL):
+        (WebCore::ChromiumDataObject::setMainURL):
+        (WebCore::ChromiumDataObject::mainURLTitle):
+        (WebCore::ChromiumDataObject::setMainURLTitle):
+        (WebCore::ChromiumDataObject::textPlain):
+        (WebCore::ChromiumDataObject::setTextPlain):
+        (WebCore::ChromiumDataObject::textHTML):
+        (WebCore::ChromiumDataObject::setTextHTML):
+        (WebCore::ChromiumDataObject::htmlBaseURL):
+        (WebCore::ChromiumDataObject::setHTMLBaseURL):
+        (WebCore::ChromiumDataObject::content):
+        (WebCore::ChromiumDataObject::releaseContent):
+        (WebCore::ChromiumDataObject::setContent):
+        (WebCore::ChromiumDataObject::contentFileExtension):
+        (WebCore::ChromiumDataObject::setContentFileExtension):
+        (WebCore::ChromiumDataObject::contentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::takeFileNames):
+
+2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] locale date displays incorrect date format in symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=29032
+
+        strftime() in Symbian does not support #
+        Layout tests cannot be run on Symbian yet, so they are not updated.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI Plugin NPP_AsFile not working on Qt Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29068
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile)
+        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
+        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Remove a few incorrect changes I left in.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support numeric index getters in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=29067
+
+        Add HasNumericIndexGetter to indicate a non-custom getter that
+        returns a number.  The numeric index getter also uses PropertySlot's
+        setValue rather than setCustomIndex to avoid an additional indirect
+        call.
+
+        * bindings/js/JSCanvasByteArrayCustom.cpp:
+        * bindings/js/JSCanvasFloatArrayCustom.cpp:
+        * bindings/js/JSCanvasIntArrayCustom.cpp:
+        * bindings/js/JSCanvasShortArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::item):
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::get):
+        (WebCore::CanvasFloatArray::item):
+        * html/canvas/CanvasFloatArray.idl:
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::get):
+        (WebCore::CanvasIntArray::item):
+        * html/canvas/CanvasIntArray.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::get):
+        (WebCore::CanvasShortArray::item):
+        * html/canvas/CanvasShortArray.idl:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::get):
+        (WebCore::CanvasUnsignedByteArray::item):
+        * html/canvas/CanvasUnsignedByteArray.idl:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::get):
+        (WebCore::CanvasUnsignedIntArray::item):
+        * html/canvas/CanvasUnsignedIntArray.idl:
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::item):
+        * html/canvas/CanvasUnsignedShortArray.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        In Mac Chromium, clicking below the last line of an editable area (textarea or
+        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+
+        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
+               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+
+2009-09-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
+        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        More robust wx build fix for 2.9.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
+        Implement CSSOM DocumentView.caretRangeFromPoint
+
+        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
+               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+
+        Test: Chromium mac canary build is fixed.
+
+        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
+        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::clearPageUserSheet):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/Settings.cpp:
+        (WebCore::Settings::setUserStyleSheetLocation):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildfix.
+
+        Fix Qt build after 48167, by adding the new cpp/h files
+        added to WebCore.gypi to WebCore.pro as well.
+
+        * WebCore.pro:
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        should not pass URI fragments to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=28687
+
+        Strip the fragment from the URI before passing it to soup, since
+        it forwards it to servers in some cases (like when using a proxy)
+        which confuses them and makes them return 403/404.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add QGraphicsScene events support to the Qt platform events.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-09-08  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Cleanup: remove a few deprecated methods.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests, just syntactic sugar.
+
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.h:
+
+2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28981
+
+        [Qt] make npapi.h compile in winscw compiler.
+
+        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
+        specific changes in npapi.h.
+        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+
+        * bridge/npapi.h:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Web Inspector assertion failure related to marking
+        https://bugs.webkit.org/show_bug.cgi?id=28997
+
+        When wrapping the callback the JSInspectorCallbackWrapper creator was using
+        inheritorID for the prototype structure which is unsafe for anything other
+        than a pure JS object.  Instead we now create a new structure, which while
+        inefficient is not problematic as this code is not hit frequently.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing extension to the file entry in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+
+2009-09-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        dataTransfer.types() should not return Files if file list is empty in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28891
+
+        We change the behavior to handle the empty file list in order to match the spec.
+
+        Tested by clipboard-file-access.html.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+
+2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Eric Seidel.
+
+        WebInspector: Adds a timeline agent to InspectorController that collects
+        high-level timing data about event dispatch, layout, painting and HTML
+        parsing and makes it available to Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=25503
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        (WebCore::Document::inspectorTimelineAgent):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/DOMDispatchTimelineItem.cpp: Added.
+        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
+        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
+        * inspector/DOMDispatchTimelineItem.h: Added.
+        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableTimeline):
+        (WebCore::InspectorBackend::disableTimeline):
+        (WebCore::InspectorBackend::timelineEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::enableTimeline):
+        (WebCore::InspectorController::disableTimeline):
+        (WebCore::InspectorController::timelineEnabled):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::timelineAgent):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineWasEnabled):
+        (WebCore::InspectorFrontend::timelineWasDisabled):
+        (WebCore::InspectorFrontend::addItemToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp: Added.
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
+        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
+        * inspector/InspectorTimelineAgent.h: Added.
+        * inspector/TimelineItem.cpp: Added.
+        (WebCore::TimelineItem::TimelineItem):
+        (WebCore::TimelineItem::addToTimeline):
+        (WebCore::TimelineItem::convertToScriptObject):
+        (WebCore::TimelineItem::convertChildrenToScriptArray):
+        (WebCore::TimelineItem::addChildItem):
+        * inspector/TimelineItem.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItem::~TimelineItem):
+        (WebCore::TimelineItem::previous):
+        (WebCore::TimelineItem::releasePrevious):
+        (WebCore::TimelineItem::setEndTime):
+        (WebCore::TimelineItem::type):
+        * inspector/front-end/TimelineAgent.js: Added.
+        (WebInspector.TimelineAgent):
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineWasEnabled):
+        (WebInspector.timelineWasDisabled):
+        * inspector/front-end/inspector.html:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (WebCore::FrameView::inspectorTimelineAgent):
+        * page/Page.cpp:
+        (WebCore::Page::inspectorTimelineAgent):
+        * page/Page.h:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        No functional change, no tests.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        No functional change, no new tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+
+2009-09-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ValidityState::typeMismatch() for <input type=number>.
+        https://bugs.webkit.org/show_bug.cgi?id=28934
+
+        Test: fast/forms/ValidityState-typeMismatch-number.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToDouble):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * html/ValidityState.h:
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Another attempt of a buildfix.
+
+        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Save the QCursor as a property in WidgetQt::setCursor
+        and actually change the cursor in QWebView::event() by making use
+        of the QEvent::DynamicPropertyChange event type.
+        When unsetCursor() is called on the QWidget we can fallback to
+        the cursor set by WebCore.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Buildfix for build error introduced in r48150.
+
+        * GNUmakefile.am: Modified. Added missing IDL files.
+
+2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Buildfix. Build error caused by r48150.
+
+        * WebCore.pro: missing IDL files added
+
+2009-09-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update Canvas 3D implementation to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=29010
+
+        This adds several new CanvasXXXArray classes each of which has a custom constructor
+        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
+        to match the new and changed API.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::bufferData):
+        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
+        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::canvasArrayBuffer):
+        (WebCore::JSDOMWindow::canvasByteArray):
+        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
+        (WebCore::JSDOMWindow::canvasIntArray):
+        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
+        (WebCore::JSDOMWindow::canvasShortArray):
+        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
+        (WebCore::JSDOMWindow::canvasFloatArray):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.idl: Added.
+        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.idl: Added.
+        * html/canvas/CanvasByteArray.cpp:
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.idl: Added.
+        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
+        (WebCore::CanvasRenderingContext3D::markContextChanged):
+        (WebCore::CanvasRenderingContext3D::beginPaint):
+        (WebCore::CanvasRenderingContext3D::endPaint):
+        (WebCore::CanvasRenderingContext3D::reshape):
+        (WebCore::CanvasRenderingContext3D::sizeInBytes):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::bufferData):
+        (WebCore::CanvasRenderingContext3D::bufferSubData):
+        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
+        (WebCore::CanvasRenderingContext3D::clear):
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        (WebCore::CanvasRenderingContext3D::deleteBuffer):
+        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
+        (WebCore::CanvasRenderingContext3D::deleteProgram):
+        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::deleteShader):
+        (WebCore::CanvasRenderingContext3D::deleteTexture):
+        (WebCore::CanvasRenderingContext3D::drawArrays):
+        (WebCore::CanvasRenderingContext3D::drawElements):
+        (WebCore::CanvasRenderingContext3D::getBoolean):
+        (WebCore::CanvasRenderingContext3D::getBooleanv):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getFloat):
+        (WebCore::CanvasRenderingContext3D::getFloatv):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::CanvasRenderingContext3D::getInteger):
+        (WebCore::CanvasRenderingContext3D::getIntegerv):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getTexParameterf):
+        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
+        (WebCore::CanvasRenderingContext3D::getTexParameteri):
+        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texParameterf):
+        (WebCore::CanvasRenderingContext3D::texParameteri):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        (WebCore::CanvasRenderingContext3D::uniform1f):
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1i):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2f):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2i):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3f):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3i):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4f):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4i):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::useProgram):
+        (WebCore::CanvasRenderingContext3D::validateProgram):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
+        (WebCore::CanvasRenderingContext3D::viewport):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.idl: Added.
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::CanvasTexture):
+        * html/canvas/CanvasTexture.h:
+        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
+        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
+        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
+         * html/canvas/CanvasUnsignedByteArray.idl: Added.
+        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.idl: Added.
+        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.idl: Added.
+        * page/DOMWindow.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+
+2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Make m_windowVisible more consistent with the actual visibility of the inspector.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed speculative build fix for Snow Leopard.
+
+        * platform/GeolocationService.cpp:
+        (WebCore::createGeolocationServiceNull):
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        The mock Geolocation service returns a fixed position or error. This position or error can be
+        set through static methods on the GeolocationService class. The position or error is shared
+        between all instances of the mock Geolocation service.
+
+        Implementation details.
+        The GeolocationService object maintains a pointer to a factory function which it uses to create
+        Geolocation service instances. Each platform implementing Geolocation sets this pointer
+        to the factory function for their platform's implementation. When the mock Geolocation service
+        is activated, the factory function pointer is reset to the factory function for the mock service.
+
+        Test: fast/dom/Geolocation/error.html
+
+        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
+        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
+        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
+        * WebCore.pro: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
+        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
+        * page/ChromeClient.h: Modified. Fixed comment.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
+        * platform/GeolocationService.cpp: Modified.
+        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
+        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
+        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
+        * platform/GeolocationService.h: Modified.
+        * platform/mock: Added.
+        * platform/mock/GeolocationServiceMock.cpp: Added.
+        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
+        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
+        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
+        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
+        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
+        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
+        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
+        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
+        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
+        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
+        * platform/mock/GeolocationServiceMock.h: Added.
+        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
+        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
+        * platform/gtk/GeolocationServiceGtk.h: Modified.
+        * platform/mac/GeolocationServiceMac.h: Modified.
+        * platform/mac/GeolocationServiceMac.mm: Modified.
+        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28985
+
+        We need to be slightly more careful about how we pick up a script
+        execution context.  In particular, we were getting the wrong document
+        for frames that had been navigated somewhere else.
+
+        In the long term, we should think about a better algorithm for
+        computing the script context.
+
+        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieveFrame):
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8 compilation.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Reverting r48121 to fix Windows build errors.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed speculative build fix.
+
+        Reverted previous build fix as it didn't fix the problem.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
+
+        * WebCore.pro:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        Tests (enabled in a separate patch):
+               fast/workers/shared-worker-constructor.html
+               fast/workers/shared-worker-context-gc.html
+               fast/workers/shared-worker-event-listener.html
+               fast/workers/shared-worker-exception.html
+               fast/workers/shared-worker-frame-lifecycle.html
+               fast/workers/shared-worker-gc.html
+               fast/workers/shared-worker-lifecycle.html
+               fast/workers/shared-worker-load-error.html
+               fast/workers/shared-worker-location.html
+               fast/workers/shared-worker-navigator.html
+               fast/workers/shared-worker-replace-global-constructor.html
+               fast/workers/shared-worker-replace-self.html
+               fast/workers/shared-worker-shared.html
+               fast/workers/shared-worker-simple.html
+               http/tests/workers/shared-worker-importScripts.html
+               http/tests/workers/shared-worker-redirect.html
+               http/tests/xmlhttprequest/workers/shared-worker-close.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods.html
+               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
+
+        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new file to sources list.
+
+        * GNUmakefile.am:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk. 
+
+        * config.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Chris Hills <chaz@chaz6.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use direct includes for Phonon, not the pretty ones
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Add infrastructure required to provide the new
+        WebKitNetworkResponse object in our API.
+
+        * GNUmakefile.am: Add new files to the build.
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        * platform/network/soup/ResourceResponseSoup.cpp: Added.
+        (WebCore::ResourceResponse::toSoupMessage):
+
+2009-09-07  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29009
+
+        Be consistent in document and frame null checks.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Soup] Limit the number of connections
+        https://bugs.webkit.org/show_bug.cgi?id=18431
+
+        Increase the maximum number of per host and total connections to
+        similar values than those used by the other modern browsers. Seems
+        to significantly improve page loading time in many cases.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Various minor chromium appcache modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests.
+
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+          Fix a null pointer exception.
+        (WebCore::ACCESSOR_GETTER):
+        * platform/network/chromium/ResourceRequest.h:
+          Switch from appCache 'context' to 'host' terminology.
+          Note: leaving the old deprecated accessors in place until the matching
+          change in chrome is landed to use the new accessors.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheHostID):
+        (WebCore::ResourceRequest::setAppCacheHostID):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+          Add an appCacheManifestURL getter/setter.
+          Drop the 'get' prefix from the appCacheID getter.
+          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
+          change in chrome is landed to use the new accessor.
+        (WebCore::ResourceResponse::appCacheID):
+        (WebCore::ResourceResponse::appCacheManifestURL):
+        (WebCore::ResourceResponse::setAppCacheManifestURL):
+        (WebCore::ResourceResponse::getAppCacheID):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28359
+        Cleanup: Undo some accidental changes around DOMApplicationCache.
+        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
+        - Return a non-null object for window.applicationCache when the feature is disabled.
+        - Simplify the swapCache method.
+
+        Test: http/tests/appcache/disabled.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        handle the case of port 0.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+
+2009-09-06  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make hidden elements not focusable.
+
+        Clean up supportsFocus and isFocusable.
+        supportsFocus now strictly means that the node can be focused by default.
+        This is true for links, form controls and content editable elements for example.
+        isFocusable means that the user can actually focus it.
+        All (2) calls to supportsFocus have been updated to take this into account.
+        
+        Make a elements without href work correctly as well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27099
+
+        Tests: fast/events/click-focus-anchor.html
+               fast/events/tab-focus-anchor.html
+               fast/events/tab-focus-hidden.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        * dom/Node.cpp:
+        (WebCore::Node::supportsFocus):
+        (WebCore::Node::isFocusable):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::supportsFocus):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::supportsFocus):
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::supportsFocus):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::supportsFocus):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::supportsFocus):
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::supportsFocus):
+        (WebCore::HTMLOptionElement::isFocusable):
+        * html/HTMLOptionElement.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+        (WebCore::SVGAElement::isFocusable):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::supportsFocus):
+        * wml/WMLAElement.h:
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::supportsFocus):
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+
+2009-09-06  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        Default value is set to that of RenderTheme::caretBlankInterval().
+        Uses caretBlinkIntervalInternal to avoid overriding
+        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
+        of blinking caret required for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-06  Ada Chan  <adachan@apple.com>
+
+        Remove an extra </File> in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-06  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a persistent setting for color format in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28889
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * inspector/front-end/Color.js: Minor style fixes.
+        (WebInspector.Color.prototype.toString): Added. Replaces the individual
+        "toFoo" functions. Takes a optional arguments for the color format to return.
+        * inspector/front-end/Images/paneSettingsButtons.png: Added.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
+        the new color format.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
+        Use the new toString function on Color.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
+        to format colors by default. Add a tooltip for the color swatch.
+        * inspector/front-end/inspector.css: New styles for the settings menu.
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): Initilize the colorFormat preference.
+
+2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
+        https://bugs.webkit.org/show_bug.cgi?id=28993
+
+        * platform/network/qt/DnsPrefetchHelper.cpp:
+        * platform/network/qt/DnsPrefetchHelper.h:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+
+        * DerivedSources.cpp: Remove references to definition-src.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap): Ditto.
+        * bindings/objc/DOMSVG.h: Ditto.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
+        * bindings/v8/V8DOMWrapper.cpp: Ditto.
+        * bindings/v8/V8Index.cpp: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGDefinitionSrcElement.cpp: Removed.
+        * svg/SVGDefinitionSrcElement.h: Removed.
+        * svg/SVGDefinitionSrcElement.idl: Removed.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
+        definition-src child.
+        * svg/svgtags.in: Remove definition-src.
+
+2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
+        logic of retrieving default caret blink interval was incorrect (non-existent)
+        and caused layout test flakiness.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium reliability build break).
+
+        Back up partial change in r48072 in order to fix chromium reliability build break.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2009-09-05  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28975
+        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
+        such as screenshots by default, can now be uploaded to sites such as
+        imgur.com.
+
+        * platform/FileSystem.h:
+        Add pathGetDisplayFileName().
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        Call pathGetDisplayFileName() instead of pathGetFileName().
+        * platform/chromium/FileSystemChromiumLinux.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+        * platform/chromium/FileSystemChromiumMac.mm:
+        (WebCore::pathGetFileName):
+        Now returns a real filename instead of a presentational one, which
+        fixes the problem addressed by this change.
+        (WebCore::pathGetDisplayFileName):
+        New function that returns a presentational filename; does what
+        pathGetDisplayFileName() did prior to this patch.
+        * platform/chromium/FileSystemChromiumWin.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+
+2009-09-05  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by David Levin.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Prevent UI freeze in case when too many timers are in the timer queue.
+        https://bugs.webkit.org/show_bug.cgi?id=23865
+
+        The fix measures the elapsed time while executing timers. If we have too many
+        timers and it takes significant time to fire, quit the loop and reschedule.
+        This lets the run loop process user input (close the window for example).
+
+        * platform/ThreadTimers.h:
+        * platform/ThreadTimers.cpp:
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        Removed functions and members used before to grab a list of all expired timers.
+        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::setNextFireTime):
+        Since timers are now fired one by one, there is no need to keep track of updated timers.
+        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
+        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
+        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
+        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
+        eventSender, which does not reproduce the UI freeze that happens with real input.
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7201063>
+        
+        Detach any custom scrollbars before detaching the document.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+                Unreviewed, build fix.
+
+                Remove remaining references to UserStyleSheetLoader after r48075.
+
+                * WebCore.gypi:
+                * WebCore.xcodeproj/project.pbxproj:
+                * page/qt/FrameQt.cpp:
+                * page/wince/FrameWince.cpp:
+
+2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+
+                Reviewed by David Levin.
+
+                https://bugs.webkit.org/show_bug.cgi?id=28988
+                Minor fix: "novalidate" attribute renamed in "noValidate", according to
+                HTML5 specs:
+                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+
+                * html/HTMLFormElement.cpp:
+                (WebCore::HTMLFormElement::noValidate):
+                (WebCore::HTMLFormElement::setNoValidate):
+                * html/HTMLFormElement.h:
+                * html/HTMLFormElement.idl:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused line of code from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=28990
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen when running buildbot.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
+        the HasDefaultMark bit since this has a custom mark function.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
+        Make sure the other code path (now used by everybody) can handle data URLs.
+
+        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
+        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
+        that anybody is relying on this support.
+        
+        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
+        code.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::userStyleSheet):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * loader/UserStyleSheetLoader.cpp: Removed.
+        * loader/UserStyleSheetLoader.h: Removed.
+        * page/Frame.cpp:
+        (WebCore::Frame::reapplyStyles):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        (WebCore::Page::userStyleSheet):
+        * page/mac/FrameMac.mm:
+        * page/qt/FrameQt.cpp:
+
+2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add "sampling profiler" preference, simplify data display when it's set.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28969
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        * inspector/front-end/inspector.js:
+
+2009-09-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        Tested by worker-close.html.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused m_sheet variable and setCSSStyleSheet methods.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Adele Peterson.
+
+        (Based on a patch from Adele).
+        
+        Fix <rdar://problem/7185875>.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        Detach any custom scroll bars from the old view.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
+        not a RenderPart object.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make m_userStyleSheetLoader in Frame an OwnPtr.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2009-09-04  Timothy Hatcher  <timothy@apple.com>
+
+        Show color swatches in the Web Inspector before the color text so clicking them will not
+        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28978
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
+        the processing we do on the property value. This eliminated the old nickname code, since the new
+        WebInspector.Color class handles this. We could also simplify the color regex since more
+        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
+        process a value given a regex and processor functions. 
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
+        URL with "url()" syntax surrounding it.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
+        there was an exception just return a text node.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
+        Moved from later in the file.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
+        * inspector/front-end/inspector.css:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        Swapped the implementation of host and hostname, and made sure not to return
+        the port number if it is default for the given protocol. 
+        FireFox also avoids returning the protocol number if it is default.
+
+        Test: fast/dom/Element/hostname-host.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::hostname):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
+        * page/SecurityOrigin.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Fix <rdar://problem/7192902>.
+
+        Add the necessary plumbing for having QTMovieWin use WebCore timers.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::TaskTimer::initialize):
+        Create the timer and call QTMovieWin::setTaskTimerFuncs.
+        
+        (WebCore::TaskTimer::setTaskTimerDelay):
+        Start the timer.
+        
+        (WebCore::TaskTimer::stopTaskTimer):
+        Stop the timer.
+        
+        (WebCore::TaskTimer::fired):
+        Call QTMovieWin::taskTimerFired().
+        
+        (WebCore::MediaPlayerPrivate::load):
+        Initialize the Task timer.
+        
+        * platform/graphics/win/QTMovieWin.cpp:
+        (updateTaskTimer):
+        Call the global stopTaskTimer function and setTaskTimerDelay.
+        
+        (QTMovieWin::taskTimerFired):
+        Make this a member function.
+        
+        (QTMovieWin::setTaskTimerFuncs):
+        Set the global function pointers.
+        
+        (QTMovieWin::initializeQuickTime):
+        (DllMain):
+        No need to use the QT shared timer.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Win compile.  Missing return statement in
+        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28974
+
+        No new tests, build fix.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+
+2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
+        the build.
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/Frame.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::~PageGroup):
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        * page/UserScript.h: Added.
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::source):
+        (WebCore::UserScript::url):
+        (WebCore::UserScript::patterns):
+        (WebCore::UserScript::worldID):
+        (WebCore::UserScript::injectionTime):
+        * page/UserScriptTypes.h: Added.
+        (WebCore::):
+
+2009-09-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Crashes when using a detached DocumentType node
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+
+        DocumentType nodes are the only one that can have null document(), and they can never have
+        children, so they are a degenerate case for NodeLists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Don't try register node list with document if there's no
+        document. Since there are no changes possible for a DocumentType's node list, this is not
+        necessary.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
+        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
+        de-registration code path that I saw taken was via Node destructor, and that already has
+        a null check for document).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
+        if there is no window).
+        (WebCore::JSNode::removeEventListener): Ditto.
+
+2009-09-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] loadFinished never emitted
+        https://bugs.webkit.org/show_bug.cgi?id=28935
+
+        Do not report errors right away from
+        ResourceHandle::start. Instead return true and schedule an error
+        to be reported in the handle later. Otherwise WebCore gets
+        confused and thinks the resource never finished loading, making it
+        not emit the finished status.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] DOM Storage bindings: Event Handler should create StorageEvents
+        https://bugs.webkit.org/show_bug.cgi?id=28942
+        
+        Tests:
+        Causes the following tests that were failing with V8 to pass:
+        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/localstorage/complex-keys.html
+        * storage/domstorage/localstorage/onstorage-attribute-markup.html
+        * storage/domstorage/localstorage/simple-events.html
+        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/localstorage/index-get-and-set.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
+        * storage/domstorage/sessionstorage/simple-events.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/sessionstorage/index-get-and-set.html
+
+        Code changes:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28911
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        * inspector/front-end/InjectedScriptAccess.js: Added.
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.html:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement <input type="range"> for Chromium Linux by painting
+        the slider and the thumb using skia.
+        https://bugs.webkit.org/show_bug.cgi?id=28928
+
+        Covered by existing tests (we're currently hitting an assert for them).
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-04  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Implement <input type=color> as a text field.
+        - ValidityState::typeMismatch supports for type=color.
+        https://bugs.webkit.org/show_bug.cgi?id=28966
+
+        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
+               fast/forms/ValidityState-typeMismatch-color.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::isValidColorString):
+        * html/ValidityState.h:
+
+2009-09-04  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Crash when updating document cache
+        https://bugs.webkit.org/show_bug.cgi?id=28965
+
+        Initialization of a V8 JavaScript context can fail.  When that
+        happens, do not attempt to update the document wrapper cache.
+
+        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Two bugs:
+
+        https://bugs.webkit.org/show_bug.cgi?id=25489
+        CSS property background-position is now serialized in shorthand string as
+        background-position-x background-position-y, as the specification requires
+        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
+        
+
+        https://bugs.webkit.org/show_bug.cgi?id=26541
+        CSS background-color is now be serialized before other background properties, 
+        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+
+        An existing layout test that accepted wrong order and skipped position test 
+        had to be modified.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for HTMLTextAreaElement.textLength
+        https://bugs.webkit.org/show_bug.cgi?id=28929
+
+        Test: fast/forms/textarea-textlength.html
+
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::textLength):
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with Frames.
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
+               fast/loader/frames-with-unload-handlers-in-page-cache.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Fix a bug where subframes weren't asked if they were cacheable.
+
+        No new tests, especially since page caching for frames isn't turned on yet.
+        A layout test will come in my next patch, which enables frames in the page cache.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Added mixed content methods to FrameLoaderClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollbarThemeWx.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::scrollbarThickness):
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paintScrollCorner):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h: Added.
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
+        (wxStyleForPart):
+        (GetButtonWidget):
+        (wxGetGdkWindowForDC):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
+        (wxScrollbarPartToHIPressedState):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h: Added.
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
+        (GraphicsHDC::GraphicsHDC):
+        (GraphicsHDC::~GraphicsHDC):
+        (GraphicsHDC::operator HDC):
+        (getTSStateForPart):
+        (wxRenderer_DrawScrollbar):
+        * webcore-wx.bkl:
+
+2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Page content is not displayed in case of HTTP status error
+        https://bugs.webkit.org/show_bug.cgi?id=28949
+
+        If the server sent content, show it to the user instead of an error,
+        even if the HTTP status code is not success.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update v8 bindings to support passing multiple ports to postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28839
+
+        Added support for passing MessagePortArray to v8 bindings.
+
+        New tests that now pass with V8:
+               fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * WebCore.gypi:
+        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom postMessage() handlers for various classes.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::DOMWindowPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::DedicatedWorkerContextPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
+        (WebCore::MessageEventPorts):
+        Added getter for ports attribute.
+        (WebCore::MessageEventInitMessageEvent):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::MessagePortPostMessage):
+        Added custom handler that supports MessagePortArray.
+        (WebCore::getMessagePortArray):
+        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.h: Added.
+        Added declaration for getMessagePortArray().
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::WorkerPostMessage):
+        Added custom handler that supports MessagePortArray.
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28460
+
+        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+
+        Tests: fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toJSSequence):
+        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSMessageEventCustom.cpp: Added.
+        (WebCore::JSMessageEvent::ports):
+        Added custom ports() getter that converts from MessagePortArray to JSArray.
+        (WebCore::JSMessageEvent::initMessageEvent):
+        Added support for passing a MessagePortArray.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        (WebCore::fillMessagePortArray):
+        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
+        * bindings/js/JSMessagePortCustom.h: Added.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports):
+        Changed ports() to return a MessagePortArray* since this value can be null.
+        * dom/MessageEvent.idl:
+        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        * dom/MessagePort.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/Worker.cpp:
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do not query non-function call frames for function name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28799
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Crash after typing "clear" and pressing return in inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28684
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Squeezed out some performance from string conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=28945
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::string):
+        Avoid calling virtual length method. Be more explicit with
+        external memory computation. Avoid function calls in data and
+        length.
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        Avoid extra calls of WebCoreStringResource::toString. When
+        AtomicString is computed pass it immediately when constructing
+        WebCoreStringResource. Use inline buffer for small strings.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toString):
+        Inline dispatch of string vs. non-string values.
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
+        up V8Proxy lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=28946
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::getEnteredImpl):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a regression bug that maxLength doesn't work for IME input.
+        https://bugs.webkit.org/show_bug.cgi?id=25253
+
+        Tests: fast/forms/input-maxlength-ime-completed.html
+               fast/forms/input-maxlength-ime-preedit.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-09-03  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement title/media/type setters do something
+        https://bugs.webkit.org/show_bug.cgi?id=28828
+
+        Test: svg/dom/style-reflect.html
+
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
+        (WebCore::SVGStyleElement::setType): Ditto.
+        (WebCore::SVGStyleElement::setMedia): Ditto.
+        (WebCore::SVGStyleElement::setTitle): Ditto.
+
+2009-09-03  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28872
+        
+        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+
+        Test: storage/statement-error-callback.html
+
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+
+2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
+        and FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/haiku/FontPlatformData.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::oblique):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
+          only unload, or unload and pagehide.
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::scheduleRedirection):
+        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
+        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
+          where a page is added to the PageCache.
+        * loader/FrameLoader.h:
+
+        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        - More CachedFrame destruction work.
+        - Including related Frame and FrameLoader changes and cleanup.
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
+        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
+        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
+          the PageCache, do lightweight cleanup to:
+          A - Prevent referring to a stale Page object.
+          B - Prevent World Leaks of WebKit objects.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
+          in the PageCache. ASSERT that fact.
+        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
+          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
+        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
+          referencing it.
+        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
+        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
+        * loader/FrameLoader.h:
+
+        * page/Frame.cpp:
+        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
+        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
+        * page/Frame.h:
+
+2009-09-02  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
+        in Chromium. This is to fix a new file added in r28742 since the
+        last patch for this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Correct a typo to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add a missing include to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+
+2009-09-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Implement file support for DragData.
+        https://bugs.webkit.org/show_bug.cgi?id=28896
+
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsCompatibleContent):
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
+        https://bugs.webkit.org/show_bug.cgi?id=28920
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::sharedResourceMutex):
+        (WebCore::curl_lock_callback):
+        (WebCore::curl_unlock_callback):
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+
+2009-09-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Expose functions to change the focus ring color for Linux Chromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=28887
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
+        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::open):
+        * history/CachedFrame.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
+        Removing them is a little trouble, but worth it going forward.
+        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
+        was suggested by Darin Adler.
+
+        No new tests. (No change in behavior)
+
+        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        (WebCore::CachedFrameBase::~CachedFrameBase):
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::openInFrameLoader):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrameBase::document):
+        (WebCore::CachedFrameBase::view):
+        (WebCore::CachedFrameBase::domWindow):
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::mousePressNode):
+
+        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
+        thing capable of interacting with FrameLoader::open(CachedFrameBase):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::documentLoader):
+
+        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
+        https://bugs.webkit.org/show_bug.cgi?id=24866
+
+        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
+        (a list to break out of is inside another list item).
+
+        When the empty list item appears at the end of another list item, WebKit breaks out of
+        the outer list item, and adds new item below the outer list item.
+        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+
+        Test: editing/execCommand/break-out-of-empty-list-item.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
+        based on whether a CachedFrame is the main frame or a subframe.
+
+        - Store whether a CachedFrame represents the main frame or a subframe.
+        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
+          are reused and need to start new page loads with an empty frame tree.
+        - Reattach the frame tree to the main frame when restoring it.
+        - open() the cached subframes in their respective loaders when restoring.
+        - Properly clear() and destroy() cached subframes.
+        - When committing to a new page load, and after caching the previous page, only clear the
+          FrameView for the main frame.
+
+        Note that all of above will eventually be necessary as I continue to land this work in pieces,
+        but doesn't actually change any behavior right now because we still refuse to even *try* to
+        cache pages with frames.
+
+        No new tests. No change in behavior, and current tests continue to pass.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::destroy):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::isMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        No review, build fix.
+
+        http://trac.webkit.org/changeset/47976 broke the build.  
+        Let's try compiling before we land things, shall we?
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        Unreviewed build fix for Chromium.
+
+        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+
+        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix, don't define symbols we now grab from other sources.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+
+        No test cases needed since this just fixes the build problem.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::create):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::joinSuperflousColumns):
+        (WebCore::WMLTableElement::padWithEmptyColumns):
+
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: use shared buffer for custom font data
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        Refactored by Joe Mason <joe.mason@torchmobile.com>
+
+        * loader/CachedFont.cpp:
+        add WINCE to platforms using cached custom data
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameFont): implement for WinCE
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        build fixes
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::setCustomFontCache): add accessor
+        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        update function signatures 
+ 
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: font-related build fixes and minor bugfixes
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
+        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+
+2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Another pass at releasing the storage mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=28904
+
+        Another pass at releasing the storage mutex (when applicable) when we finish
+        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+        describes the required behavior.
+
+        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
+        the problem correctly.  First of all, I missed that events and timeouts go
+        through a different call path.  Second of all, I didn't consider recursion
+        correctly.  Third of all, my check to see if LocalStorage is alive actually
+        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
+        it.  So I'm reverting that change completely and doing it more cleanly.
+        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
+        implementation for now).
+
+        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
+        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
+        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
+        scenareos where you can have nested callbacks probably should have always been
+        protected by a recursion guard.
+
+        Unfortunately, this can't be tested without a hook added to the layout test
+        controllers since the lock is (by design) not supposed to be observable by
+        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::callFunction):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::releaseStorageMutex):
+            Check to see if localStorage has been instantiated.  If so, tell it to
+            unlock all storage areas.
+        * bindings/v8/V8Proxy.h:
+        * page/PageGroup.h:
+        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+
+2009-09-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: Implement ImageBuffer for WINCE
+        Implement Image interface with a light class BufferedImage
+        for rendering ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=28167
+
+        * platform/graphics/wince/ImageBufferData.h: Added.
+        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Join the various PluginView destructors into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The Qt port used to delete the platform plugin widget as the last step.
+        Now this is done before cleaning up the script objects and unloading the
+        plugin package, similar to how the Win port does it.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Share PluginView::init() between ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The port-spesific bits are moved to platformStart(), which now returns
+        a bool based on the success of the platformStart.
+
+        m_hasPendingGeometryChange is now initialized in the initializer list
+        instead of in PluginViewQt's init()
+
+        PluginViewMac (currently used only by the Qt port) used to manually call
+        stop() in the case where an unsupported drawing or event model was detected.
+        This was wrong, as the m_status and m_isStarted fields should be used to
+        guard against doing operations on a plugin in this intermediate state.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28737
+        
+        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.isDB):
+        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
+        (WebInspector.Database.prototype.runWithTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.Database.prototype.executeSql.errorCallback):
+        (WebInspector.Database.prototype.executeSql.queryTransaction):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
+
+2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (trivial followup fix). 
+        
+        Web Inspector: Trivial follow up fix to r47944.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::nodeForId):
+
+2009-09-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28047
+        add utility method to enable logging messages for inspector development
+
+        manual test case added (see below)
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log):
+        * manual-tests/inspector/webinspector-log.html: Added.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h:
+        (WebCore::):
+
+2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21990
+        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
+        is mistreated as Shift_JIS
+
+        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
+
+        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
+        This didn't really match any browser, and did cause problems on some sites.
+
+        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
+        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
+        especially in comments. Also, some valid EUC-JP sequences are not known to it.
+
+        Some pages that are fixed by this change:
+
+        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
+        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
+        Firefox and IE.
+
+        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
+        in Safari. There is a stray byte in comments that was makes charset detector think it can't
+        be EUC-JP.
+
+        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
+        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
+        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
+        Shift_JIS in normal HTML view though).
+
+        Test: fast/encoding/japanese-encoding-mix.html
+
+        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
+        detection if there is no solid charset information yet.
+
+2009-09-01  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] FileList cannot be accessed via index in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28883
+
+        Tested by clipboard-file-access.html.
+
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8FileListCustom.cpp: Added.
+
+2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the workaround added in r47316.
+
+        Reviewed by Sam Weinig.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+
+        * accessibility/AXObjectCache.h:
+        Remove the Document argument to the AXObjectCache constructor and the
+        m_document member variable, and replace the no-parameter
+        handleFocusedUIElementChanged() with the two-parameter GTK function.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+        Don't pass a null Document when constructing the AXObjectCache.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Get the document from the RenderObject; m_document was removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Don't pass the Document when constructing the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Pass the old and new focused RenderObjects when calling
+        handleFocusedUIElementChanged().
+
+2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that InspectorDOMAgent and InspectorFrontend are not null
+        before accessing them in InspectorBackend. They may be null if
+        InspectorController is closed before an asynchronous operation is
+        started.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::inspectorDOMAgent):
+        (WebCore::InspectorBackend::inspectorFrontend):
+        * inspector/InspectorBackend.h:
+
+2009-09-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with frames
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Things learned in the full task that this patch addresses:
+        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
+          needed to be managed separately.
+        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
+          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
+          will be guided by the CachedFrames themselves.
+
+        No new tests. (No change in behavior, current layout tests pass)
+        
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::clear): Only clear pointers out.
+        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
+          occur simply by navigating back to a page with a CachedFrame.
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::~CachedPage):
+        (WebCore::CachedPage::restore): Call clear() after restoring.
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::destroy):
+        * history/CachedPage.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
+          instead of clearing them.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
+        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
+        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
+          Even though CachedFrame::restore() isn't used for now, it will be soon.
+
+2009-09-01  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add a "lowMemoryNotification" method to the V8 ScriptController class.
+        This is needed in order to allow the host application (Android Web browser in this case)
+        to call the v8::V8::LowMemoryNotification() method added to V8 in
+        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28776
+
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::lowMemoryNotification):
+        * bindings/v8/ScriptController.h:
+
+2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 Bindings for WebSocket API.
+        https://bugs.webkit.org/show_bug.cgi?id=28844
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Missed a "." -> "->" conversion.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build, take 2.  The Qt code had what looks like a
+        broken virtual function override.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Uninitialized variable in XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=28874
+
+        One ought to initialize variables before use even when it doesn't
+        matter.  No behavior change.
+
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build.
+
+        * platform/graphics/ImageSource.cpp:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make InjectedScript self-contained (move necessary
+        methods from utilities.js into InjectedScript).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28871
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+        (Object.type):
+        (Object.hasProperties):
+        (Object.className):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/utilities.js:
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: console log message repeat count double.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28856
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Fix DATALIST build
+        https://bugs.webkit.org/show_bug.cgi?id=28826
+
+        Add ENABLE_DATALIST to FEATURE_DEFINES.
+
+        * GNUmakefile.am:
+
+2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement suspend methods argument/return types incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=28860
+
+        Also fix the style of the argument names.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::suspendRedraw):
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+
+2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
+        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+
+        The bug fix adds an explicit check for the validity of the path when it is 
+        transformed into local coordinates. 
+        This was the most suitable place I could find that didn't cause an inordinate 
+        amount of refactoring. Also, it seems pertinent and may also catch other cases 
+        that are not limited to clipping paths.
+
+        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
+        (WebCore::):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+
+2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=28742 
+
+        Normalize (NFC) a TextRun when the run contains combining diacritical marks
+        so that Skia can pick a correct glyph without relying on GSUB table in a font.
+        This change is for Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun): Added.
+        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
+
+        This function is called when the run contains U+0300..U+036F and converts characters in
+        the run to the combined form (NFC) using ICU.
+
+2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
+        V8Proxy::createWrapperFromCache.
+        https://bugs.webkit.org/show_bug.cgi?id=28848
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
+        function for document wrapping.
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
+        wrapping a new node.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
+        path from V8DOMWrapper.cpp.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
+        from V8Proxy.cpp.
+
+2009-09-01  Eric Seidel  <eric@webkit.org>
+
+        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+
+        Allow excluding certain plugins from loading
+        https://bugs.webkit.org/show_bug.cgi?id=28677
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+
+2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector backend
+        and add frontend JavaScript stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=28846
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::profiles):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::breakpointInfo):
+        (WebCore::JavaScriptDebugServer::updateBreakpoint):
+        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::JavaScriptDebugServer::clearBreakpoints):
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get id):
+        (WebInspector.Breakpoint.prototype.get condition):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-09-01  Marius Renn  <damarvy@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added delegate to PluginDatabase to disable loading certain plugins.
+        This is useful when you want to load from the standard plugin
+        directory, but want to exclude certain plugins. Plugins may be
+        excluded early on by name, so that no plugin code is executed (which
+        may have caused a crash).
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::PluginDatabase):
+        (WebCore::PluginDatabase::refresh):
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setClient):
+        * plugins/PluginDatabaseClient.h: Added.
+        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
+
+2009-08-31  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        * WebCore.base.exp: Removed an unneeded symbol export.
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Can't think of a way to test this.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources): only nullify the
+        handle's client when it is the ResourceLoader, to support the case
+        in which a download API uses a different client
+
+2009-08-31  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Text Fields and Text Areas are reported as read-only by inspect32.exe.
+        https://bugs.webkit.org/show_bug.cgi?id=28854
+
+        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
+        and texts areas are read-only.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2009-08-31  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=28795
+
+        Changed WorkerContext::close() to no longer stop the worker thread.
+        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+
+        * workers/AbstractWorker.cpp:
+        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        Now shuts down the worker thread when notified that the context is closed.
+        (WebCore::SharedWorkerProxy::close):
+        Now handles being invoked when the context is already in the process of shutting down.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Error events should still be delivered even if the worker thread is closing.
+        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
+        (WebCore::WorkerTerminateTask::create):
+        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
+        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
+        (WebCore::WorkerTerminateTask::performTask):
+        (WebCore::WorkerMessagingProxy::workerContextClosed):
+        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
+        * workers/WorkerMessagingProxy.h:
+        WorkerMessagingProxy now overrides workerContextClosed().
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        Now drops tasks on the floor if the WorkerContext is closing.
+
+2009-08-31  Ojan Vafai  <ojan@chromium.org>
+
+        Not reviewed (build fix)
+
+        Build fix for Chromium to match r49707.
+
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28858
+        Element.baseURI parses xml:base attribute incorrectly
+
+        Test: fast/dom/base-attribute-parsing.xhtml
+
+        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
+        release mode).
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting http://trac.webkit.org/changeset/47904, because it caused
+        layout test failure.
+
+        Test: fast/dom/Window/new-window-opener.html
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * platform/KURL.h: The constructor that used to be single argument should now be invoked
+        as KURL(ParsedURLString, myString).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
+        * editing/markup.cpp:
+        (WebCore::completeURLs):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::url):
+        (WebCore::HistoryItem::originalURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createCached):
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestResource):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::manifestURLs):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createResource):
+        (WebCore::LegacyWebArchive::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+        * platform/KURLHash.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::operator CFErrorRef):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::headerCallback):
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::operator NSError*):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::ClipboardWin::setData):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+        Adapt to the change everywhere the single argument constructor was used. I did a very
+        cursory check of whether these locations were using this constructor properly, and didn't
+        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
+        better when refactoring any such code.
+
+2009-08-31  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
+        Backgrounds and Borders] Add support for 2-keyword values for 
+        background-repeat
+
+        This patch allows background-repeat to take two values by making 
+        background-repeat just like background-position internally. There 
+        is a little extra legwork for background-repeat because the spec 
+        indicates that its computed value should be equivalent to how it 
+        was specified. I keep track of the specified thing by setting the 
+        implicit flag whenever background-repeat is defined with only one 
+        value (since internally, we now store this as 2 values.)
+        
+        Here we can't access the implicit flag, so for backwards-
+        compatibility's sake, we always return one value when that makes 
+        sense.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Here we check for the implicit flag and return one value when it is 
+        set.
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+
+        Add support for CSSPropertyBackgroundRepeatX and 
+        CSSPropertyBackgroundRepeatY
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillRepeat):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSParser.h:
+
+        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
+        need those parts of the EFillRepeat enum anymore.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+
+        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+
+        Add background-repeat-x and -y.
+        * css/CSSPropertyNames.in:
+
+        Break repeat into x and y.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillRepeatX):
+        (WebCore::CSSStyleSelector::mapFillRepeatY):
+        * css/CSSStyleSelector.h:
+
+        There is no more RepeatXFill. Instead, look for 
+        fillLayer->repeatX() == RepeatFill
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+
+        Break m_repeat into m_repeatX and m_repeatY
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::repeatX):
+        (WebCore::FillLayer::repeatY):
+        (WebCore::FillLayer::isRepeatXSet):
+        (WebCore::FillLayer::isRepeatYSet):
+        (WebCore::FillLayer::setRepeatX):
+        (WebCore::FillLayer::setRepeatY):
+        (WebCore::FillLayer::clearRepeatX):
+        (WebCore::FillLayer::clearRepeatY):
+        (WebCore::FillLayer::initialFillRepeatX):
+        (WebCore::FillLayer::initialFillRepeatY):
+
+        Again, break backgroundRepeat into backgroundRepeatX and 
+        backgroundRepeatY
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundRepeatX):
+        (WebCore::InheritedFlags::backgroundRepeatY):
+        (WebCore::InheritedFlags::maskRepeatX):
+        (WebCore::InheritedFlags::maskRepeatY):
+
+        We don't need RepeatXFill or RepeatYFill. Now that we store two 
+        values, they are represented by Repeat-NoRepeat and NoRepeat-
+        Repeat, respectively.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layer size needs to take into account software reflections on children.
+        https://bugs.webkit.org/show_bug.cgi?id=28837
+        
+        When computing the bounds of a composited layer, take software-rendered
+        reflections into account.
+
+        Test: compositing/reflections/reflection-in-composited.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Request Headers Should Show Data Sent With Request
+        https://bugs.webkit.org/show_bug.cgi?id=22920
+
+        Manual test added - see below.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateRequest):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshQueryString):
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        (WebInspector.ResourceView.prototype._getHeaderValue):
+        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        * manual-tests/inspector/display-form-data.html: Added.
+
+2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: pass call frames into the frontend as a part of
+        pausedScript event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28847
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Un-blacklist Silverlight on Mac
+
+        Does not seem to crash anymore, probably due to how we now handle
+        drawing and event model handshake better.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-08-31  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28827
+        SVGSVGElement.unsuspendRedraw() shouldn't throw
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSVGElement.idl:
+
+2009-08-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Change the reutrn type of HTMLInputElement::list so that it
+          conforms to the standard.
+        - Add HTMLInputElement::dataList()
+        https://bugs.webkit.org/show_bug.cgi?id=28769
+
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::dataList):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=28802
+
+        Remove ASSERT because the frame could be null if the
+        ResourceHandle is not associated with any frame, e.g. if we are
+        downloading a file.
+        If the frame is not null but the page is null this must be an
+        attempted load from an onUnload handler, so let's just block it.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix for platforms which don't enable DOM_STORAGE.
+        https://bugs.webkit.org/show_bug.cgi?id=28834
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
+        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+
+        Test: accessibility/aria-activedescendant-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
+        port in Mac and Unix/Linux.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
+        https://bugs.webkit.org/show_bug.cgi?id=28754
+        
+        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
+        ancestor, since the layer x and y are relative to that ancestor. However, this could
+        skip over the ancestorLayer, thus giving the wrong result.
+        
+        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
+        and checking for ancestorLayer along the way. If found, compute offset of both to
+        the enclosingPositionedAncestor() and subtract.
+        
+        This also fixes a positioning bug with abs. positioned elements in reflections,
+        so there is a new reflection test with a pixel result.
+
+        Tests: compositing/geometry/abs-position-inside-opacity.html
+               fast/reflections/abs-position-in-reflection.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=27727
+
+        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
+        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
+        because there is not a unique enum value for WebkitCSSTransformValue.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+        Fix some warnings introduced by r47381.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+
+2009-08-28  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21442
+        Make sure filesystemPathFromUrlOrTitle() returns a string with length
+        <= MAX_PATH - 1.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+
+2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's VFS for Linux and Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28750
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+
+2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Made bindings use Node::setOnEvent functions for Node descendants
+        instead of Node::setAttributeEventListener.
+
+        Node::setAttributeEventListener is an internal function and
+        doesn't do the forwarding to DOM window that is required for some
+        HTML elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28709
+
+        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Now generates EventListener accessors for Node descendants instead
+        of using custom callbacks.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
+        signature.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        Changed signature to accept Handle instead of Local.
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Removed custom callbacks for EventListener accessors.
+
+2009-08-28  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28803
+        
+        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed (build fix).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move ImageDecoder creation function to a factory function on
+        ImageDecoder.  This is arguably where it makes the most sense anyway,
+        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
+        function.
+
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Combine duplicated code from ImageDecoder*.cpp into the main
+        ImageDecoder.cpp.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override setScrollbarModes to correctly forward scrollbar modes
+        policy changes to client code, via a new platform-specific method,
+        scrollbarsPolicyDidChange.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø
+
+        [Qt/Mac] Un-blacklist the QuickTime plugin
+
+        https://bugs.webkit.org/show_bug.cgi?id=28768
+
+        Now that the drawing model is properly negotiated, there is no need the
+        blacklist the QuickTime plugin anymore.
+
+        This revealed a bug in PluginView::performRequest: it should not initiate a
+        request if the plugin has been stopped, which is what happens when a plugin
+        only supports the QuickDraw drawing model.
+
+        * plugins/PluginView.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Set DOM agent document to 0 in InspectorController::close to
+        make DOM agent remove DOM listeners from the inspected document.
+
+        Replace windowVisible checks with m_frontend checks to as inspector
+        window lives in a different process in Chromium while frontend proxy
+        is in the inspected page process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addProfile):
+        * inspector/InspectorController.h:
+
+2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28801
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.update):
+
+2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (patching in l18n change that was missing due to
+        the git binary diff format).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+
+2009-08-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSAuditor go fast
+        https://bugs.webkit.org/show_bug.cgi?id=28667
+
+        Make the XSSAuditor go faster by implementing two optimizations:
+
+        1) We avoid canonicalizing scripts that are larger than the page's URL.
+           This saves a bunch of time for large inline scripts.
+
+        2) We memoize canonicalizing the page's URL because it's silly to
+           canonicalize repeated for each inline event listener.
+
+        These optimizations have a measurable affect on the intl1 page cycler.
+
+        No behavior change.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
+        fast/canvas/change-context.html. And it's alright to reach it.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+
+        Peter's change forgot one m_decoder->
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Add NULL-check, since the context ain't changeable no more, and
+        thus getContext could return 0.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        dataTransfer.types() should include type "Files" when files are present in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28780
+
+        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
+        patch for same for the mac port.
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed GL_ from all constants, and gl prefix from all calls
+        https://bugs.webkit.org/show_bug.cgi?id=28773
+
+        This was done for the external API in CanvasRenderingContext3D and
+        the internal API in GraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+
+2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Qt and Gtk build fixes. Not reviewed.
+
+        Add CanvasRenderingContext3D.idl to the build scripts.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Release the storage mutex whenever leaving JavaScript execution.
+        https://bugs.webkit.org/show_bug.cgi?id=28789
+
+        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
+        required behavior.  After we leave JavaScript, we must be sure the storage
+        mutex has been released.  At the end of evaluate(), if localStorage has been
+        instantiated, tell it to release any locks that may be applicable.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
+        - when resolver is idle, the first few requests are sent immediately (they may or may not
+        hit the wire);
+        - if there are a few requests in flight already, coalesce all requests for one second;
+        - to avoid pathological cases with lots of links to different sites on a page, only ask
+        CFHost about a handful of names (dropping the rest).
+
+        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
+        link, and these tend to have identical host name.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        (WebCore::DNSResolveQueue::shared):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::decrementRequestCount):
+        (WebCore::DNSResolveQueue::fired):
+        (WebCore::clientCallback):
+        (WebCore::DNSResolveQueue::resolve):
+        (WebCore::prefetchDNS):
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Final patch for Canvas 3D support
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This hooks everything up and provides a working implementation of
+        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
+        passing the opaque context and texture pointers so a Canvas3DLayer can be
+        created (more on that later). It also plumbs changes to the 3D canvas so
+        that Canvas3DLayer can recomposite the results.
+        
+        A 3D Canvas element needs a RenderLayer and compositing layer to render.
+        This is because it renders to an off-screen texture in the GPU and then
+        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
+        render that texture as a 3D quad. This keeps everything in GPU memory to 
+        maximize performance. When a CanvasRenderingContext3D is created it 
+        forces a style recalc which creates the RenderLayer and compositing 
+        layer if needed. 
+        
+        I repurposed an existing flag which was put in place for animation to accomplish 
+        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
+        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
+        to do a complete style recalc, even though the style itself has not really
+        changed.
+        
+        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
+        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
+        This is needed when making a JS wrapper for the object so the prototype 
+        property can be set.
+
+        Test: fast/canvas/change-context.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        * dom/Node.h:
+        (WebCore::):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::is3D):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasBuffer.cpp:
+        (WebCore::CanvasBuffer::create):
+        (WebCore::CanvasBuffer::CanvasBuffer):
+        (WebCore::CanvasBuffer::_deleteObject):
+        * html/canvas/CanvasBuffer.h:
+        * html/canvas/CanvasFramebuffer.cpp:
+        (WebCore::CanvasFramebuffer::create):
+        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
+        (WebCore::CanvasFramebuffer::_deleteObject):
+        * html/canvas/CanvasFramebuffer.h:
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::~CanvasObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+        * html/canvas/CanvasProgram.cpp:
+        (WebCore::CanvasProgram::create):
+        (WebCore::CanvasProgram::CanvasProgram):
+        (WebCore::CanvasProgram::_deleteObject):
+        * html/canvas/CanvasProgram.h:
+        * html/canvas/CanvasRenderbuffer.cpp:
+        (WebCore::CanvasRenderbuffer::create):
+        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
+        (WebCore::CanvasRenderbuffer::_deleteObject):
+        * html/canvas/CanvasRenderbuffer.h:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        * html/canvas/CanvasShader.cpp:
+        (WebCore::CanvasShader::create):
+        (WebCore::CanvasShader::CanvasShader):
+        (WebCore::CanvasShader::_deleteObject):
+        * html/canvas/CanvasShader.h:
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::create):
+        (WebCore::CanvasTexture::CanvasTexture):
+        (WebCore::CanvasTexture::_deleteObject):
+        * html/canvas/CanvasTexture.h:
+        * page/DOMWindow.idl:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::requiresLayer):
+        * rendering/RenderHTMLCanvas.h:
+        (WebCore::RenderHTMLCanvas::isCanvas):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCanvas):
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageDecoder*.cpp a bit.
+
+        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
+          order as in the header file.  Also, since there's already an anonymous
+          namespace in this file, use it to enclose the local helper functions.
+        (WebCore::):
+        (WebCore::ImageDecoder::upperBoundScaledX):
+        (WebCore::ImageDecoder::lowerBoundScaledX):
+        (WebCore::ImageDecoder::scaledY):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
+        (WebCore::RGBA32Buffer::operator=): Simplify.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageSource.* in preparation for more fixes on bug 27965.
+
+        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
+        (WebCore::ImageSource::isSizeAvailable): Shorten.
+        (WebCore::ImageSource::size): Shorten.
+        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
+        (WebCore::ImageSource::repetitionCount): Shorten.
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Add ImageDecoder.cpp to various build files so platforms will be able to
+        use it.  Move an ENABLE to not cover the whole file, in preparation for
+        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
+        vs. everyone else", which also gives new platforms a reasonable default
+        behavior.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28784
+        
+        Add an exported method to flush pending repaints.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        (WebCore::FrameView::flushDeferredRepaints):
+        * page/FrameView.h:
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Expose files from the pasteboard in drop events.
+        https://bugs.webkit.org/show_bug.cgi?id=28782
+
+        Update chromium port to expose dataTransfer.files() as per
+        HTML5 drag drop (Aug 2009 edition).
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        ScriptState now keeps explicit Handle of devtools front-end
+        utility context instead of trying to retrieve it from inspected
+        Frame.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28772
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::~ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::context):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::~ScriptValue):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Console won't close.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28778
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.isAncestor):
+
+2009-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a typo in files() causing image drags to have junk file arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=28755
+
+        Test: editing/pasteboard/files-during-page-drags.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for Chromium.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
+
+2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28758
+        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached.html
+               fast/events/pageshow-pagehide-on-back-uncached.html
+               fast/events/pageshow-pagehide.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
+        (this function is called both when a document goes away, and when it goes to b/f cache).
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
+        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
+        that can be installed on Window object.
+        (WebCore::DOMWindow::onpagehide): Ditto.
+        (WebCore::DOMWindow::setOnpagehide): Ditto.
+        (WebCore::DOMWindow::onpageshow): Ditto.
+        (WebCore::DOMWindow::setOnpageshow): Ditto.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
+        that isn't being restored from cache.
+
+        * dom/PageTransitionEvent.cpp: Added.
+        (WebCore::PageTransitionEvent::PageTransitionEvent):
+        (WebCore::PageTransitionEvent::~PageTransitionEvent):
+        (WebCore::PageTransitionEvent::initPageTransitionEvent):
+        * dom/PageTransitionEvent.h: Added.
+        (WebCore::PageTransitionEvent::create):
+        (WebCore::PageTransitionEvent::isPageTransitionEvent):
+        (WebCore::PageTransitionEvent::persisted):
+        * dom/PageTransitionEvent.idl: Added.
+        Add event class implementation.
+
+        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
+        inline listener definition (note that adding listeners to document.body programmatically
+        is not supported, matching Firefox).
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
+        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
+        Docuemnt.
+        (WebCore::Document::createEvent): Ditto.
+
+        * dom/Document.h: Added dispatchPageTransitionEvent.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
+        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * html/HTMLAttributeNames.in:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Do what it takes to add a new event type.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Adding missing file from previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+
+2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Factor out Factor out summary bar from Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Start adding heap profiler to Inspector (hidden behind a flag.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar editing is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+
+2009-08-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28767
+
+        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
+        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix, missing functions after r47763.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Removing trailing whitespaces from all storage classes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28075
+
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        * storage/StorageMap.cpp:
+        * storage/StorageMap.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
+
+        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
+        to do this in order for overflow information to be properly recomputed.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement sometimes loses events
+        https://bugs.webkit.org/show_bug.cgi?id=28762
+        <rdar://problem/7172437>
+
+        A media element triggers the resource selection algorithm if 
+        play() is called when the networkState attribute is NETWORK_EMPTY, but
+        it also immediately queues 'play' and either 'waiting' or 'playing' events.
+        One of the steps in preparing to load is to flush pending events, so those 
+        events were lost if the load timer fired quickly enough. Fixed by deleting
+        pending events before scheduling the load timer.
+
+        Test: media/audio-play-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleLoad):
+            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
+            pending events is flushed immediately.
+        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
+            New, start the load timer without flushing pending events.
+        (WebCore::HTMLMediaElement::load):
+            Call prepareForLoad();
+        (WebCore::HTMLMediaElement::prepareForLoad):
+            New, load setup code moved from loadInternal.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Moved some setup code to prepareForLoad so it can be invoked immediately before
+            arming the load timer.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
+            pending events.
+        * html/HTMLMediaElement.h:
+            Declare scheduleNextSourceChild.
+
+2009-08-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Switch ICO decoder from a Vector of raw pointers to a Vector of
+        OwnPtrs now that that is possible.  Makes code slightly simpler.
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
+        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
+        propagated to parents.
+
+        Added fast/repaint/rel-positioned-inline-with-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        Renaming the method to imply its wider implications of affecting cookies
+        over any protocol that supports them.
+
+        No change in functionality so no new tests.
+
+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::allowCookies):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-08-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made RenderInline::clippedOverflowRectForRepaint() actually include
+        overflow.
+
+        Test: fast/repaint/inline-overflow.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
+            the bounding box of all lines’ visible overflow boxes (under the
+            assumption that the first and last lines determine the top and
+            bottom, respectively).
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
+            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
+        * rendering/RenderInline.h:
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
+        * notifications/Notification.cpp: change enum style to InterCaps
+        (WebCore::Notification::Notification):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+
+        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
+        * dom/MessageEvent.cpp:
+        Updated APIs to support passing MessagePortArrays.
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::MessageEvent::ports):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::disentanglePorts):
+        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
+        (WebCore::MessagePort::entanglePorts):
+        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::channels):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        * page/DOMWindow.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
+
+2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        SocketStreamHandle interface for WebSocket API
+        https://bugs.webkit.org/show_bug.cgi?id=28037
+
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once this code is complete and functional.
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/SocketStreamErrorBase.cpp: Added.
+        * platform/network/SocketStreamErrorBase.h: Added.
+        * platform/network/SocketStreamHandleBase.cpp: Added.
+        * platform/network/SocketStreamHandleBase.h: Added.
+        * platform/network/SocketStreamHandleClient.h: Added.
+        * platform/network/cf/SocketStreamError.h: Added.
+        * platform/network/cf/SocketStreamHandle.h: Added.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
+        * platform/network/soup/SocketStreamError.h: Added.
+        * platform/network/soup/SocketStreamHandle.h: Added.
+        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
+
+2009-08-26  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] setTimeout does not convert non-string argument to string
+        https://bugs.webkit.org/show_bug.cgi?id=28739
+
+        Convert non-string argument to setTimeout to string in the V8
+        bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the WebCore side of getOwnPropertyDescriptor.  This
+        requires a custom implementation of getOwnPropertyDescriptor
+        for every class with a custom implementation of getOwnPropertySlot.
+
+        The bindings generator has been updated to generate appropriate
+        versions of getOwnPropertyDescriptor for the general case where
+        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
+        about how getOwnPropertyDescriptor should work in the context of
+        "host" functions with polymorphic [[GetOwnProperty]], so it seems
+        okay that occasionally we "guess" what attributes -- eg. determining
+        whether a property is writable.
+
+        Test: fast/js/getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime_object.h:
+
+2009-08-26  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        GObject checks for NULL (and not 0) in g_object_get, so use that
+        as we were already doing elsewhere to make the compiler happy.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+
+2009-08-26  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        RenderThemeMac.mm has incorrect casting for media control element.
+        https://bugs.webkit.org/show_bug.cgi?id=28730
+
+        MediaControlMuteButtonElement was incorrectly casted to
+        MediaControlPlayButtonElement. This is corrected in this patch.
+
+        No new tests because this is code cleanup and is already covered by existing
+        media layout tests.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+
+2009-08-26  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=28670
+
+        Change the condition regarding the key modifier check for non-contiguous
+        selection on a multi-value list from just PLATFORM(MAC) to
+        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+
+        No new tests. This patch only changes the condition on which a certain mouse
+        event modifier key is used.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
+        https://bugs.webkit.org/show_bug.cgi?id=28732
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+            Don't call setAttribute from the construtor, any registered mutation event 
+            listener will cause a crash.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+            Set the maxAttr here instead of in the constructor.
+
+2009-08-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Timers from cached pages fire instantly rather than the after the specified timeout delay
+        https://bugs.webkit.org/show_bug.cgi?id=28683
+
+        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
+            it should be done only once in FrameLoader::open(cachedFrame)
+        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
+        (WebCore::DOMTimer::DOMTimer): Ditto.
+        (WebCore::DOMTimer::suspend): Ditto.
+        (WebCore::DOMTimer::resume): Ditto.
+        * page/DOMTimer.h: Ditto.
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting the volume of a media element has no effect if called too early
+        https://bugs.webkit.org/show_bug.cgi?id=28731
+
+        * manual-tests/audio-volume.html: 
+            Added.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
+            volume as soon as the movie has been created.
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=28728
+
+        Test: This code path is exercised while running xhr layout tests in chromium.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
+        back synchronously, the loader is 0, so the assert is changed to allow for that.
+        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
+        done before SubresourceLoader::create finishes, so ensure that any previous loader
+        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+
+2009-08-25  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing IDL files in to the framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
+        https://bugs.webkit.org/show_bug.cgi?id=27756
+
+        Tests: fast/forms/input-list.html
+               fast/forms/input-selectedoption.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible (edit)
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Test: accessibility/media-element.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Add AccessibilityMediaControls.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilityMediaControl. Update Copyright
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        * accessibility/AccessibilityMediaControls.h:
+            Added.
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+            Add isMediaTimeline. Update Copyright.
+
+        * accessibility/AccessibilitySlider.h:
+            Make constructor protected instead of private so AccessibilityMediaTimeline can
+            call it.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
+        (-[AccessibilityObjectWrapper subrole]):
+            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+
+        * dom/Node.h:
+            add isMediaControlElement.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::localizedMediaControlElementString): 
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription): 
+            New, return localized media controller strings.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+            Move inside of "#if ENABLE(VIDEO)"
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::MediaControlElement):
+            Initialize m_displayType.
+        (WebCore::MediaControlElement::MediaControlElement):
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Fix style.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Set m_displayType based on pseudo style ID.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            rename local "o" to "object".
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+            Update for MediaControlInputElement constructor change.
+        (WebCore::MediaControlTimeDisplayElement::formatTime):
+            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
+            New, set text to current time.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create controls in tab order.
+        (WebCore::RenderMedia::formatTime):
+            Moved to MediaControlTimeDisplayElement::formatTime.
+        (WebCore::RenderMedia::updateTimeDisplay):
+            Call MediaControlTimeDisplayElement::setCurrentValue.
+        * rendering/RenderMedia.h:
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix Canvas layout test failures in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=28720
+
+        The previous fix r47757 does not handle the V8 object conversion correctly.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
+        https://bugs.webkit.org/show_bug.cgi?id=28717
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media volume slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=28715
+
+        Provided the implementation of the volume slider and its container for
+        chromium port. With this change there will be a usable volume control
+        slider for chromium theme.
+
+        No new tests since this is covered by existing media layout tests.
+
+        * css/mediaControlsChromium.css: CSS style for the volume slider.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
+        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missed checking in 2 Canvas3D files
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+
+2009-08-25  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Exception from JavaScript propagates to main script
+        https://bugs.webkit.org/show_bug.cgi?id=26433
+
+        Make sure that exceptions thrown both at compile time and at
+        runtime in javascript URLs are isolated from the main script.
+
+        Test: fast/dom/javascript-url-exception-isolation.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Added all new Canvas3D files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This also hooks up CanvasRenderingContext as the common base class for
+        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
+        of logic throughout to support the new CanvasRenderingContext3D object.
+        But nothing is hooked up yet.
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore/GNUmakefile.am:
+        * WebCore/WebCore.gypi:
+        * WebCore/WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::markChildren):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasContext):
+        * dom/Document.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::is3D):
+        (WebCore::HTMLCanvasElement::context3D):
+        (WebCore::HTMLCanvasElement::texture3D):
+        * html/HTMLCanvasElement.h:
+        (WebCore::HTMLCanvasElement::renderingContext):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::~CanvasObject):
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::is2d):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-08-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (r47630): fast/repaint/background-generated.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=28704
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize): Changed assignment to initialization and
+            removed redundant assignment to size.
+
+2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Skip the NULL check of m_hdc if Windows GDI is not in use.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media controls panel does not have a volume control slider
+        https://bugs.webkit.org/show_bug.cgi?id=28241
+
+        Introduced "-webkit-media-controls-volume-slider",
+        "-webkit-media-controls-volume-slider-container" and the supporting
+        implementation. Also added appearances of "media-volume-slider" and
+        "media-volume-slider-container".
+
+        The implementation of the controls are in WebCore::MediaControlElements.
+        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+
+        No new tests since this change doesn't have theme implementation and the
+        volume slider is disabled by default.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): ditto.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
+        * css/CSSValueKeywords.in: ditto.
+        * css/mediaControls.css: Makes the volume slider disabled by default.
+        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
+        (WebCore::):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
+        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
+        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
+        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
+        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
+        * rendering/MediaControlElements.h:
+        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
+        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
+        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
+        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
+        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
+        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
+        (WebCore::RenderMedia::forwardEvent):
+        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
+        * rendering/RenderMedia.h:
+        Added definition for RenderMedia::updateVolumeSliderContainer().
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
+        (WebCore::RenderSlider::thumbRect): ditto.
+        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
+        (WebCore::RenderSlider::setValueForPosition): ditto.
+        (WebCore::RenderSlider::positionForOffset): ditto.
+        (WebCore::RenderSlider::currentPosition): ditto.
+        (WebCore::RenderSlider::trackSize): ditto.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
+        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::): Constants for volume control parts.
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * WebCore.pro:
+
+2009-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28690
+        Build failure in webkitgtk+-1.1.3
+
+        Do not use deprecated function to unref a pixbuf.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        Test: fast/events/keydown-function-keys.html
+
+       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
+        to WebKit key-code for function keys.
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-08-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28698
+        Avoid unnecessary transformations for the window resizer rect.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
+        (DNS prefetching support)
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
+        thread on Windows, because there isn't one on main one.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28374
+        Cross-scheme requests should not be blocked by appcache rules
+
+        Test: http/tests/appcache/different-scheme.html
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
+        Resources with different schemes can never be loaded from appcache.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28688
+        REGRESSION(r24994): Cannot create a frame with a javascript URL
+
+        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+
+        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
+        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
+        Omit the checks if there is no document in frame yet.
+
+2009-08-24  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
+        RenderStyle being accessed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28681
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/5743105> Long freezing during loading and selecting text
+        of a large table
+        https://bugs.webkit.org/show_bug.cgi?id=14918
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added calls to
+            beginDeferredRepaints() and endDeferredRepaints() around the
+            invalidation of the selection, in order to better coalesce multiple
+            invalid rectangles.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28680
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.getCachedTreeElement):
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (isAncestorNode):
+        ():
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Make sure we use the current FrameView's frame rect when
+        going back to a cached page.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28659
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
+        https://bugs.webkit.org/show_bug.cgi?id=28673
+
+        Test: svg/dom/text-rotate-live.html
+
+        * svg/SVGNumberList.cpp:
+        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
+        numbers.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Only expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        background-size fails to parse if a single length/percentage/auto is followed by a comma
+        https://bugs.webkit.org/show_bug.cgi?id=28674
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
+            which is set to false when this method consumes a comma. Moved
+            handling of 'contain' and 'cover' from parseFillProperty into this
+            method.
+        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
+            processing the next value, and pass allowComma to parseFillSize.
+        * css/CSSParser.h:
+
+2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Support for cursors that are images
+        https://bugs.webkit.org/show_bug.cgi?id=28346
+
+        Added support for cursors which are images for CursorGtk. Added
+        a manual test for this.
+
+        * manual-tests/gtk/cursor-image.html: Added.
+        * manual-tests/gtk/resources/redcursor.cur: Added.
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Integrate GStreamer video with the graphics backend
+        https://bugs.webkit.org/show_bug.cgi?id=16356
+
+        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
+        error for different GStreamer errors to MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
+        initialization boolean to a better place.
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
+        consider the source as stream if duration query failed.
+        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
+        an early return.
+        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
+        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
+        function doesn't seem to be used anywhere in WebCore.
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytesKnown):
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
+        after seek ended with a successful change
+        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
+        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
+        support.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
+        do not set playbin's audio sink.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
+        queue at the end of the idle function.
+        (webkit_video_sink_render): Increase reference count of async queue.
+        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+
+2009-08-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remaining new files for Canvas3D
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
+        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
+        * html/canvas/CanvasByteArray.h: Added.
+        * html/canvas/CanvasByteArray.idl: Added.
+        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
+        * html/canvas/CanvasNumberArray.h: Added.
+        * html/canvas/CanvasNumberArray.idl: Added.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28408
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleTextMessage):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get domWindow):
+        (InspectorController.openInInspectedWindow):
+        (InspectorController.getCallFrames):
+        (InspectorController.evaluateInCallFrame):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.openInInspectedWindow):
+        (InjectedScript.getCallFrames):
+        (InjectedScript.evaluateInCallFrame):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
+        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
+        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+
+2009-08-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for the placeholder attribute and DOM property of the textarea element.
+        https://bugs.webkit.org/show_bug.cgi?id=21248
+
+        A DOM node for an INPUT element doesn't have a flag for placeholder
+        visibility anymore.  This patch also fixes a bug that a renderer
+        doesn't reflect a corresponding DOM value change.
+
+        Tests: fast/forms/textarea-placeholder-dom-property.html
+               fast/forms/textarea-placeholder-pseudo-style.html
+               fast/forms/textarea-placeholder-set-attribute.html
+               fast/forms/textarea-placeholder-set-value.html
+
+        * css/html.css: Add the default style for placeholder of textarea.
+        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::placeholderShouldBeVisible):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
+        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
+        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::setInnerTextStyle):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        (WebCore::RenderTextControlMultiLine::textBaseStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::textBaseStyle):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+
+2009-08-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
+        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
+        files. They are needed there after r47688.
+
+        * dom/Document.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, build fix for make distcheck on GTK+.
+
+        * GNUmakefile.am: Added files needed for the build.
+        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
+        with #if clause.
+        * bindings/js/JSEventTarget.cpp: Dito.
+        * dom/Document.cpp: Dito.
+        * loader/FrameLoader.cpp: Dito.
+
+2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Throws an Error on "null"
+        https://bugs.webkit.org/show_bug.cgi?id=28665
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+
+2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
+
+        https://bugs.webkit.org/show_bug.cgi?id=28666
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getProperties):
+        (InjectedScript.createProxyObject):
+
+2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
+        https://bugs.webkit.org/show_bug.cgi?id=28345
+
+        When doing the conversion between cairo_surface_t* and GdkPixbuf*
+        account for the differences in the respective formats' in-memory
+        image format.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        
+        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
+        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
+        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
+
+        * DerivedSources.make: Fix error seen every time we build by escaping the $
+        in the build rule, since you have to use $$ for that in make.
+
+        * WebCore.base.exp: Updated.
+
+        * bindings/objc/DOM.mm:
+        Added now-needed include of SVGNames.h.
+
+        * dom/Document.cpp: Added now-needed include of SVGNames.h.
+        (WebCore::Document::createElement): Use create instead of new.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Added ConstructionType argument so the caller
+        can determine whether this starts with a reference count of either 0 or 1.
+        Later we will remove this again once they are all 1.
+        (WebCore::Element::create): Added.
+
+        * dom/Element.h: Added create and made constructor protected.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
+        * dom/StyledElement.h: Made many functions protected or private, including
+        the constructor.
+
+        * dom/make_names.pl: Use create to create the base elements HTMLElement,
+        SVGElement, and WMLElement.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
+        * editing/UnlinkCommand.cpp:
+        (WebCore::UnlinkCommand::doApply): Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::create): Added.
+        * html/HTMLAnchorElement.h: Made constructor protected and added create.
+        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::create): Added.
+        * html/HTMLAppletElement.h: Made constructor private and added create.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::create): Added.
+        * html/HTMLAreaElement.h: Made constructor private and added create.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::create): Added.
+        * html/HTMLElement.h: Made constructor protected and added create.
+        Made other functions protected and private. Also added inline
+        definition of constructor.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::create): Added.
+        * html/HTMLEmbedElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::create): Added.
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElementBase.h: Made functions protected and private.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
+        CreateElement so reference count starts at 1.
+
+        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::create): Added.
+        * html/HTMLIFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::create): Added.
+        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
+        into a for loop and tweaked formatting.
+
+        * html/HTMLObjectElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLPlugInElement.h: Made constructor protected.
+        Made other functions protected and private.
+
+        * html/HTMLPlugInImageElement.h: Made constructor and another function
+        protected.
+
+        * html/HTMLTagNames.in: Removed createWithNew from all classes that
+        now have create functions. Moved conditional noscript to a separate
+        paragraph.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::SVGElement::create): Added.
+        * svg/SVGElement.h: Added create, made constructor protected, and
+        made other functions protected and private. Removed unneeded
+        SVGNames.h include.
+
+        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
+        include.
+
+        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
+        Made functions private.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::WMLElement::create): Added.
+        * wml/WMLElement.h: Added create and made constructor protected.
+
+        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+
+2009-08-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+
+        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
+        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+
+        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
+          They'll get reattached when the document comes out of the page cache.
+        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+
+2009-08-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
+        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
+        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
+        
+        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
+        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
+        on it to get comparable results.
+
+        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+
+2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="listitem" and role="list"
+        https://bugs.webkit.org/show_bug.cgi?id=28606
+
+        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Clean up fill image geometry calculation
+        https://bugs.webkit.org/show_bug.cgi?id=28652
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
+            calculateBackgroundSize() to this. Replaced separate scaledWidth and
+            scaledHeight parameters with a single scaledSize parameter. Renamed
+            parameters and local variables.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
+            to use CSS3 Backgrounds and Borders terminology in comments and
+            local variable names. Renamed, clarified and consolidated some local
+            variables.
+        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
+
+2009-08-22  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47669
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47671 in preparation of
+        rolling out http://trac.webkit.org/changeset/47669.
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Build fix, add CanvasRenderingContext to build systems.
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * DerivedSources.make: Added CanvasRenderinContext.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files implementing GL buffer wrappers, and support to make them platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
+        * html/canvas/CanvasBuffer.h: Added.
+        * html/canvas/CanvasBuffer.idl: Added.
+        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
+        * html/canvas/CanvasFramebuffer.h: Added.
+        * html/canvas/CanvasFramebuffer.idl: Added.
+        * html/canvas/CanvasObject.h: Expose m_context
+        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
+        * html/canvas/CanvasProgram.h: Added.
+        * html/canvas/CanvasProgram.idl: Added.
+        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
+        * html/canvas/CanvasRenderbuffer.h: Added.
+        * html/canvas/CanvasRenderbuffer.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
+        * html/canvas/CanvasShader.h: Added.
+        * html/canvas/CanvasShader.idl: Added.
+        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
+        * html/canvas/CanvasTexture.h: Added.
+        * html/canvas/CanvasTexture.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Removed.
+        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        * WebCore.vcproj/build-generated-files.sh:
+        * make-generated-sources.sh:
+        Removed obsolete code to set up CREATE_HASH_TABLE.
+
+2009-08-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+
+        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
+        No need to open the file with write access.  Only read access is needed.
+
+2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+
+        Also fixes leaks seen on appcache tests.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
+        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
+        to call, and we do not think that the leak occurs there anyway.
+
+2009-08-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28650
+        Remove cross-thread code from CrossOriginPreflightResultCache.
+        Removed mutexes, atomic initializer and string copy.
+
+        No new tests, the worker tests cover this.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix after http://trac.webkit.org/changeset/47655.
+
+        * html/HTMLFormControlElement.h:
+
+2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+          Removed Custom Bindings
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+
+          Made Non-Custom Bindings in the Backend
+
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+
+          Build the Cookie ScriptObjects, handles using document.cookie in
+          case the platform hasn't implemented raw cookie access.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getCookies):
+        (WebCore::InspectorDOMAgent::buildObjectForCookie):
+        (WebCore::InspectorDOMAgent::buildArrayForCookies):
+        * inspector/InspectorDOMAgent.h:
+
+          Complete the Asynchronous Calls
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetCookies):
+        * inspector/InspectorFrontend.h:
+
+          Asynchronous Functions to get Cookie Data
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+
+          Refactor to use the Asynchronous Functions
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Cleaned/Commented Related Code
+
+        (InspectorController.searchCanceled):
+        * inspector/front-end/InjectedScript.js:
+        * platform/Cookie.h:
+        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28145
+        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+
+        Tests: fast/forms/formnovalidate-attribute.html
+               fast/forms/novalidate-attribute.html
+
+        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
+        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
+        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::novalidate): attribute getter
+        (WebCore::HTMLFormElement::setNovalidate): attribute setter
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl: novalidate attribute exposed
+        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Rendering changes to complete
+        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27573
+        and
+        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27574
+
+        Test: fast/backgrounds/size/contain-and-cover.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27452
+        Add support for checkValidity() method and invalid event, from HTML5
+        specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
+
+        Tests: fast/events/invalid-001.html
+               fast/events/invalid-002.html
+               fast/events/invalid-003.html
+               fast/events/invalid-004.html
+               fast/events/invalid-005.html
+               fast/forms/checkValidity-001.html
+               fast/forms/checkValidity-002.html
+               fast/forms/checkValidity-003.html
+               fast/forms/checkValidity-004.html
+
+        * dom/Document.idl: oninvalid event handler
+        * dom/Element.idl: ditto
+        * dom/EventNames.h: added invalid event
+        * dom/Node.cpp:
+        (WebCore::Node::oninvalid): ditto
+        (WebCore::Node::setOninvalid): ditto
+        * dom/Node.h: ditto
+        * html/HTMLAttributeNames.in: oninvalid attribute
+        * html/HTMLButtonElement.idl: added checkValidity() method
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
+        * html/HTMLFieldSetElement.idl: added checkValidity() method
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
+        implementation
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
+        for form elements
+        * html/HTMLFormElement.h: checkValidity() definition
+        * html/HTMLFormElement.idl: added checkValidity() method
+        * html/HTMLInputElement.idl: added checkValidity() method
+        * html/HTMLSelectElement.idl: added checkValidity() method
+        * html/HTMLTextAreaElement.idl: added checkValidity() method
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninvalid): oninvalid event handler
+        (WebCore::DOMWindow::setOninvalid): ditto
+        * page/DOMWindow.h: ditto
+        * page/DOMWindow.idl: ditto
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
+        Backgrounds and Borders] Add support for the "round" value for 
+        background-repeat
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
+        Borders] Add support for the "space" value for background-repeat
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+        * css/CSSValueKeywords.in:
+        * rendering/style/FillLayer.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files for Canvas 3D feature
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This is all the new files for implementing Canvas 3D. None of them are hooked up and
+        are not even included in the build yet. This incorporates the reviews from Simon
+        and Ollie for these files.
+
+        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
+        * html/CanvasObject.cpp: Added. Base class for all GL object containers
+        * html/CanvasObject.h: Added.
+        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
+        * html/CanvasRenderingContext.h: Added.
+        * html/CanvasRenderingContext.idl: Added.
+        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
+        * html/CanvasRenderingContext3D.h: Added.
+        * html/CanvasRenderingContext3D.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
+        * platform/graphics/GraphicsContext3D.h: Added.
+        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
+        * platform/graphics/mac/Canvas3DLayer.mm: Added.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Another Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::diffTextDecorations):
+
+2009-08-21  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
+        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
+        of the root line box.
+
+        Covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::setTextDecorationProperty): Made it static
+        (WebCore::diffTextDecorations): Made it static
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
+        https://bugs.webkit.org/show_bug.cgi?id=23892
+
+        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
+        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::copy): Added.
+        * css/CSSValueList.h: Added copy.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
+        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Rename "Databases" Panel as "Storage"
+        https://bugs.webkit.org/show_bug.cgi?id=28620
+
+          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
+          any DatabasesPanel constructors and appropriate function names.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
+        (WebInspector.showStoragePanel):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+
+          Renamed some files and Updated Accordingly.
+
+        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
+        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
+        * inspector/front-end/WebKit.qrc: use new file names
+        * inspector/front-end/inspector.css: use new images name and class names
+        * inspector/front-end/inspector.html: use new file name
+        * WebCore.gypi: use new file names
+
+          Miscellaneous Updates.
+
+        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
+
+2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getTraitsInFamily):
+        * platform/graphics/haiku/FontHaiku.cpp: Added.
+        (charUnicodeToUTF8HACK):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Middle click panning icon is offset by 3 pixels
+        https://bugs.webkit.org/show_bug.cgi?id=28611
+
+        * platform/ScrollView.cpp:
+        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
+        * platform/win/CursorWin.cpp:
+        (WebCore::middlePanningCursor):
+        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
+        
+2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove inspector resources for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=28610
+
+        Based on an idea from Simon Hausmann.
+
+        * WebCore.pro:
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector: Remove Unused Variable
+        https://bugs.webkit.org/show_bug.cgi?id=28616
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._checkWarning):
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Array Formatter Shows Extra Properties
+        https://bugs.webkit.org/show_bug.cgi?id=28615
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
+        Backgrounds and Borders] Add support for the "contain" value for 
+        background-size
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
+        Borders] Add support for the "cover" value for background-size
+
+        Return contain or cover when appropriate, and otherwise do what we 
+        used to do.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Accept contain and cover as valid values for background-size.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+        Handle setting the size and the sizeLength if appropriate.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+
+        Added new keywords contain and cover.
+        * css/CSSValueKeywords.in:
+
+        Use just sizeLength instead of size to match old behavior.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
+        a LengthSize (the equivalent of what m_size used to be). I got rid 
+        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
+        struct, FillSize that can be used to set or get m_size and 
+        m_sizeLength both at once. 
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize):
+        (WebCore::FillSize::operator==):
+        (WebCore::FillSize::operator!=):
+        (WebCore::FillLayer::sizeLength):
+        (WebCore::FillLayer::size):
+        (WebCore::FillLayer::isSizeSet):
+        (WebCore::FillLayer::setSizeType):
+        (WebCore::FillLayer::setSizeLength):
+        (WebCore::FillLayer::setSize):
+        (WebCore::FillLayer::clearSize):
+        (WebCore::FillLayer::initialFillSizeType):
+        (WebCore::FillLayer::initialFillSizeLength):
+        (WebCore::FillLayer::initialFillSize):
+
+        This is all boiler-plate stuff to adjust to the new size() vs. 
+        sizeType() vs. sizeLength() distinction.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundSizeType):
+        (WebCore::InheritedFlags::backgroundSizeLength):
+        (WebCore::InheritedFlags::maskSize):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setBackgroundSizeLength):
+        (WebCore::InheritedFlags::setMaskSize):
+
+        Definition for EBackgroundSizeType.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47580.
+
+        [Qt] Adjust the files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Test: platform/mac/accessibility/aria-grouping-roles.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Unreviewed trivial comment fix.
+
+        Update a bug link in a comment due to bugzilla amnesia.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+
+2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        HTML5 media elements do not fire waiting events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=28335
+
+        Fire the waiting event before seeking, and fix a case where firing of
+        the seeked event is missed when the ready state is changed during
+        a seek.
+
+        Added video-waiting-seeking.html into manual tests because not
+        all platforms allow seeking into non-buffered ranges.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): add support for
+        waiting event when seeking.
+        (WebCore::HTMLMediaElement::finishSeek): send seeked event
+        whenever seeking finishes.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
+        new function.
+        * html/HTMLMediaElement.h:
+        * manual-tests/video-waiting-seeking.html: Added.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix more cases of
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        If the border box is empty, simply avoid painting instead of trying to
+        clip to the empty path.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot a svn add for a patch I landed.  :-(
+
+        * storage/SQLTransactionClient.cpp: Added.
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
+        Auto scroll speed is faster than in IE, Firefox.
+        
+        Changed pan scrolling speed to match Firefox's algorithm.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for assert in Chromium page cycler:  drawRect() was re-using
+        an SkPaint, but not resetting it before calling
+        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
+        CL fixes drawRect(), and re-enables the assert.
+        http://bugs.webkit.org/show_bug.cgi?id=28172
+        http://crbug.com/19797
+
+        Covered by Chromium page cycler tests.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
+        
+        Revert r47535 which introduced this.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupWndProc):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crashes on sites with lots of images
+        https://bugs.webkit.org/show_bug.cgi?id=28473
+
+        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
+        CachedResource is still referring to it, so it may get deleted before
+        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Added assert to verify the resource
+        being revalidated is physically in the cache.
+        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
+        resource to the revalidated resource.  This allows for proper lifetime management of the
+        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
+        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
+        process of being validated (or else they can get added twice: Once through the normal mechanism
+        and then again during revalidateResource).
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
+        who the validating resource (or proxy) is.
+
+        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
+        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
+        as well.
+        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
+        and added a comment about the assert.
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
+        is still being referred to by it and the code it robust to this being switched to a new proxy
+        resource without it being cleared first.
+        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+
+2009-08-20  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix "Chromium RTL autocomplete popup is not layout correctly".
+        https://bugs.webkit.org/show_bug.cgi?id=27889
+
+        The complete fix of the issue consists 2 parts: the patch in webkit
+        and the patch in Chromium's own code.
+
+        This webkit patch only affects Chromium autofill. It
+        1. introduces a new flag in WebCore::PopupContainerSettings to
+           distinguish whether the width of the drop-down should be restricted
+           or not.
+           For autofill, the width of the drop-down is restricted to
+           be the same as that of the input field (the new flag is set in
+           Chromium's own code). But width is not restricted for <select> (same as before).
+        2. introduce a new flag in WebCore::PopContainerSettings to
+           indicate what heuristics to use when displaying text in drop-down menu.
+           For autofill, use drop-down item's directionality to display drop-down items.
+           Previously, drop-down item is displayed in the its first strong
+           directional character's directionality.
+           (drop-down item's directionality is set in Chromium's own code.
+           It is set the same as the directionality of the element. 
+           For autofill, it is the same directionality as that of the input field.)
+           For <select>, still use the text's first strong directional character's
+           directionality to display the text.
+
+
+        Since the patch only affects the chromium client, not webcore part or
+        other clients. No automatic tests is possible.
+
+        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
+        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
+        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
+        * platform/chromium/PopupMenuChromium.h: 
+        (WebCore::PopupItem::PopupItem): style change.
+        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
+        distinguish whether to restrict width of list box and 
+        in what directionality to display the text in drop-down.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
+        Pan Scrolling can scroll while showing the middlePanScroll icon.
+        
+        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
+        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
+        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
+        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
+        the off by one error.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
+        layoutBlockChild.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Made subframeForHitTargetNode a public static method, so WebView can call it
+        during hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::subframeForTargetNode):
+        * page/EventHandler.h:
+
+2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubberstamped by Kevin Ollivier.
+
+        Check for null bundle before attempting to use it.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath): Add null check on return of
+          CFBundleGetBundleWithIdentifier.
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+
+        Added fast/repaint/inline-block-overflow.html and updated another test.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
+        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
+        RenderBox has not been updated to the new values yet.
+        
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
+        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
+        value around if a box-shadow goes away.
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Another attempt to fix Chromium build.
+
+        * WebCore.gypi: now use the correct name of the image file.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Make the Windows build even fixeder
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix after the last change
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace many manually-released CFTypeRefs with RetainPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=28498
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromMIMEType):
+        (WebCore::MIMETypeFromCocoaType):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::setHTTPBody):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+
+2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Output actual values of counters in showTree
+        https://bugs.webkit.org/show_bug.cgi?id=28481
+
+        No new tests because this patch just improves debugging outputs.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add file missed in last check-in.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Adds new icons to the Web Inspector for Local Storage,
+        Session Storage and Cookies.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28470
+
+        Reviewed by Eric Seidel.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/domStorage.png: Removed.
+        * inspector/front-end/Images/localStorage.png: Added.
+        * inspector/front-end/Images/sessionStorage.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        HTML5 media elements must fire 'loadend' progress event
+        https://bugs.webkit.org/show_bug.cgi?id=28419
+
+        * dom/EventNames.h:
+            Define loadend.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onloadend.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Post 'loadend' immediately after 'abort'.
+        (WebCore::HTMLMediaElement::noneSupported):
+            Post 'loadend' immediately after 'error'.
+        (WebCore::HTMLMediaElement::mediaEngineError):
+            Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Post 'loadend' immediately after 'load'.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Post 'loadend' immediately after 'abort'.
+
+2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
+        https://bugs.webkit.org/show_bug.cgi?id=28474
+
+        This patch fixes a crash when indenting at right after a table.
+        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
+        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
+
+        Test: editing/execCommand/indent-right-after-table.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+
+2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Render disabled mute button during an error or if no audio is present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28475
+
+        Covered by existing layout tests:
+        media/video-controls-visible-audio-only.html
+        media/video-no-audio.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
+        toolbar go blank
+        and
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
+        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
+        adjust the radii in case the sides of the rectangle are smaller than sum
+        of the radii, so that the gradient background matches the border (which
+        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
+        to avoid clipping to an empty path.
+        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
+        GraphicContext::save() down to avoid a save/restore imbalance in the
+        early return case.
+
+        * rendering/RenderThemeSafari.cpp: Made the same changes.
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk][REGRESSION] XHR test failures after r45558
+        https://bugs.webkit.org/show_bug.cgi?id=27143
+
+        Disable sniffing if it's explicitly requested. Updated patch
+        originally by Gustavo Noronha.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::statusWillBeHandledBySoup):
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::startHttp):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Swap the pixels since QImage expect ARGB while ImageData
+        stores them as RGBA.
+
+        This fixes the fast/canvas/canvas-copyPixels.html test.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+
+2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [v8] Use atomic string caching for createElement
+        Extend atomic string caching to createElement.  Fix a bug in idl
+        parser that caused incorrect parsing if a function argument
+        attribute list contained a comma.
+        https://bugs.webkit.org/show_bug.cgi?id=28449
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
+        * dom/Document.idl:
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47515.
+
+        [Qt] There is no Phonon::MediaObject::hasAudio() function.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+
+2009-08-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28483
+        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
+        Widget* instead of void* to avoid the need for manual casting to Widget*
+        at the callsite.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/ScriptController.h:
+
+2009-08-19  David Levin  <levin@chromium.org>
+
+        Unreviewed speculative build fix for qt.
+
+        * page/OriginAccessEntry.cpp:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
+               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
+               http/tests/xmlhttprequest/origin-whitelisting-https.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
+               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
+
+        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
+        testing via layout tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.blk: Ditto.
+
+        * page/SecurityOrigin.h: Implement origin access whitelists.
+        (WebCore::originAccessMap): Static getter for access whitelists.
+        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
+        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
+        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
+
+        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
+        * page/OriginAccessEntry.cpp: Ditto.
+
+2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-precomp headers build fix.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+
+2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Disable a bad SKIA assert
+        https://bugs.webkit.org/show_bug.cgi?id=28482
+
+        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
+        When this was pulled into Chromium, it started breaking the page cycler. 
+        Disable it again until we can figure out what's going on.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        queryCommandState('underline') returns false if the selected text is also bold and italic
+        https://bugs.webkit.org/show_bug.cgi?id=11022
+
+        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
+        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
+        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
+        and also u, s, and strike tags.
+
+        Test: editing/style/text-decoration-state.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
+        (WebCore::stateUnderline): Ditto.
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - Fix <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
+        SW_SHOWNOACTIVATE to ShowWindow.
+        
+        (WebCore::PopupWndProc):
+        Prevent mouse activation from activating the window.
+
+2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Images flash as you hover them on http://www.atebits.com/scribbles/
+        <rdar://problem/7143958>
+        
+        Tag images with the device colorspace with the colorspace of the main display, rather than
+        GenericRGB, so that composited images color-match those rendered via Core Graphics.
+        
+        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Initialize m_scrollCorner.
+
+        (WebCore::FrameView::~FrameView):
+        Assert that m_scrollCorner is null.
+
+        (WebCore::FrameView::detachCustomScrollbars):
+        Destroy m_scrollCorner.
+
+        (WebCore::FrameView::invalidateScrollCorner):
+        Invalidate the scroll corner.
+        
+        (WebCore::FrameView::updateScrollCorner):
+        Create/destroy the scroll corner.
+        
+        (WebCore::FrameView::paintScrollCorner):
+        Paint the scroll corner.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::isFrameViewScrollCorner):
+        Return whether a RenderScrollbarPart is the frame view scroll corner.
+        
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        Go ahead and update the scroll corner.
+        
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        Pass the scroll corner rect to invalidateRect.
+        
+        (WebCore::ScrollView::scrollCornerRect):
+        Return the scroll corner rect.
+        
+        * platform/ScrollView.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        If this scrollbar part is the frame view scroll corner, invalidate it.
+
+2009-08-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feComponentTransfer needs to be implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=27768]
+
+        Implementation of SVG Filter feComponentTransfer.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        (WebCore::FEComponentTransfer::apply):
+
+2009-08-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7141522> Incorrect layout of product table at henry.com
+
+        Test: fast/block/basic/quirk-percent-height-table-cell.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
+        percentage-height children of auto-height blocks to look for an ancestor
+        with non-auto height and compute their height based on it. The change is
+        that if that ancestor is a table cell, it is ignored and the percent
+        height computes to zero (just like in strict mode). This matches Firefox
+        and IE.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add 'icu::' qualifier when refering to ICU C+names to the other
+        file with this issue missed in the previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
+
+2009-08-19  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix for Skia).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] Remove setFont indirection
+        https://bugs.webkit.org/show_bug.cgi?id=28453
+
+        Remove the indirection and just set the font in Font::drawGlyphs.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::scaledFont):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: When adding style selector, generate default name based
+        on id / class / type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28468
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::topvisibleOverflow):
+        (WebCore::InlineFlowBox::bottomvisibleOverflow):
+        (WebCore::InlineFlowBox::leftvisibleOverflow):
+        (WebCore::InlineFlowBox::rightvisibleOverflow):
+        (WebCore::InlineFlowBox::visibleOverflowRect):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::visibleOverflowRect):
+        (WebCore::RenderBox::topvisibleOverflow):
+        (WebCore::RenderBox::bottomvisibleOverflow):
+        (WebCore::RenderBox::leftvisibleOverflow):
+        (WebCore::RenderBox::rightvisibleOverflow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::visibleOverflowRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+
+2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Sound button appears in controller with movies that have no audio
+        https://bugs.webkit.org/show_bug.cgi?id=28464
+
+        Test: media/video-no-audio.html
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayer::hasVideo):
+            Make const.
+        (WebCore::MediaPlayer::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+            Add hasAudio.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/QTMovieWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasAudio):
+            Ditto.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::disabled):
+            New, return true if media element doesn't have audio.
+        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
+            Renderer is not needed if element has no audio.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::disabled):
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            Return MediaUIPartDisabledFlag if node is disabled.
+            
+
+2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Removed the two unnecessary overridden willValidate() methods introduced
+        in r47444.
+
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Allow dumping dangling nodes to the console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28458
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.setDetachedRoot):
+        (WebInspector.childNodeCountUpdated):
+        (InspectorController.pushNodeToFrontend):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+
+2009-08-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27464
+        Implement application cache online whitelist wildcard flag
+
+        Test: http/tests/appcache/whitelist-wildcard.html
+
+        A "*" in NETWORK section means that network loading needn't be blocked.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
+        (WebCore::ApplicationCache::allowsAllNetworkRequests):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+
+2009-08-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
+        
+        Get rid of method swizzling entirely. This created problems when lower level
+        Foundation code would call into our own swizzled method.
+        
+        * platform/network/mac/ResourceHandleMac.mm: 
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (-[NSURLResponse adjustMIMETypeIfNecessary]):
+
+2009-08-19  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        Reviewed by Anders Carlsson.
+
+        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
+        Windows about multiply-defined JSHTMLDataListElement symbols
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
+        from the build (just like we do for the other generated bindings
+        files) so that we don't get warnings about multiply-defined symbols in
+        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
+        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
+        reorder a few files.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Add 'icu::' qualifier when refering to ICU C+names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
+        move the addition of overflow from children into a separate pass after the height of the section has been
+        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
+        (Not a a correctness issue, just a memory issue.)
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Remove bogus dependency rules for built sources that derive
+        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
+        header files should be generated regardless of whether the source
+        file changed or not. We should only rely on the *.in files being
+        changed.
+
+        * GNUmakefile.am:
+
+2009-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        convert FormatBlock candidate tag list from if chain to hash lookup
+        https://bugs.webkit.org/show_bug.cgi?id=28448
+
+        No behavior change, just cleanup.
+
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update GraphicsContextSkia's version of drawLine to make use of the shared
+        adjustLineToPixelBoundaries function and elimination overlapping code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28446
+        Custom request headers shouldn't be sent with cross-origin preflight request
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
+               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
+        that they shouldn't be sent, and Firefox doesn't send them.
+
+2009-08-18  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings for Desktop Notifications feature.
+        https://bugs.webkit.org/show_bug.cgi?id=28271
+
+        * WebCore.gypi: 
+        added notification files to build (all still behind a flag that's not on)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        added special case in DOMWindow/AppCache style for named event handlers
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
+        * notifications/Notification.h:
+        made event handler routines public (as they are in DOMWindow, eg) for
+        binding access.
+        * notifications/NotificationCenter.idl:
+        needed to make methods V8Custom to support different behaviors in 
+        worker/page context in chromium. 
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+        needed to make these methods public as well so chromium can inject
+        the notification presenter into the worker thread.
+
+2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Implement HTML5 nav element
+        https://bugs.webkit.org/show_bug.cgi?id=27937
+
+        <nav> should behave essentially the same as <div> for parsing
+        etc. This is implemented by the changes below.
+        
+        Tests: fast/html/nav-element.html
+
+        * css/html.css:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::blockTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLTagNames.in:
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152727>
+
+        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCustomScrollbars):
+        Check if the frame view or any of its subviews have custom scroll bars.
+        
+        (WebCore::FrameView::updateControlTints):
+        Go ahead and update control tints if the frame view has custom scroll bars.
+        
+        * page/FrameView.h:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the SharedTimer file for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28126
+
+        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::instance):
+        (WebCore::SharedTimerHaiku::start):
+        (WebCore::SharedTimerHaiku::stop):
+        (WebCore::SharedTimerHaiku::Filter):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Release build fix.
+
+        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
+        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getIdentifierValue):
+
+2009-08-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More work on making DOM classes start with reference count of 1
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        Some related clean-up and preparation steps so the subsequent
+        patches will be as small as possible.
+
+        * WebCore.base.exp: Sorted this file.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        Use nameAttr instead of the name function.
+
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/objc/DOM.mm: Sorted includes.
+        * dom/Document.cpp: Ditto.
+
+        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
+        * dom/StyledElement.h: Ditto.
+
+        * dom/make_names.pl: Changed default of createWithNew to 0.
+        Eventually all elements will be created with create instead of new.
+
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+        * wml/WMLTagNames.in:
+        Added createWithNew for every tag. We'll remove it as we convert
+        element classes to use create.
+
+        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
+        * html/HTMLFrameElement.h: Ditto.
+
+        * html/HTMLEmbedElement.cpp: Removed many attribute get and
+        set functions.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPlugInElement.h: Ditto.
+
+        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
+        set functions.
+        (WebCore::HTMLFrameElementBase::location): Changed to use
+        srcAttr instead of src.
+        * html/HTMLFrameElementBase.h: Removed many attribute get and set
+        functions.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        Use srcAttr and typeAttr instead of setSrc and setType.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
+        of name -- this avoids an extra AtomicString round trip and a little
+        ref count churn too.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to support loading.
+        https://bugs.webkit.org/show_bug.cgi?id=28342
+
+        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        Forwards load requests to an arbitrary document from the list of worker's documents.
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Posts responses back to the shared worker thread.
+
+2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        StyleChange::init needs clean up before fixing the bug 23892
+        https://bugs.webkit.org/show_bug.cgi?id=27749
+
+        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
+        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+
+        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
+        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
+        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+
+        No test is added since there is no change in behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
+        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
+        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
+        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
+        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing a DB file naming bug in Chromium. The origin should come
+        before the DB name in the file name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28331
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding four image-specific files to WebCore:
+        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/haiku/IconHaiku.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/haiku/ImageBufferData.h: Added.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/haiku/ImageHaiku.cpp: Added.
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getBBitmap):
+
+2009-08-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
+        Backgrounds and Borders] Drop the prefix from background-size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::ensurePropertyMap):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to forward exceptions to parent documents
+        https://bugs.webkit.org/show_bug.cgi?id=28320
+
+        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+
+        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        Cleaned up bitrot - added missing include.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::postExceptionTask):
+        Callback used to deliver exceptions to a document.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        Forwards exceptions to all parent documents for presentation to the user.
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        Forwards console messages to all parent documents for presentation to the user.
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Grabs the mutex before accessing workerDocuments.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Grabs the mutex before accessing workerDocuments.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        Call FrameLoaderClient::shouldLoadMediaElementURL.
+        
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
+        Return true by default.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        openDatabase() should not execute any SQL statement on the
+        database it's trying to open, unless there are no other open
+        handles to the same database. Otherwise, we might run into a
+        deadlock.
+
+        Test: storage/open-database-while-transaction-in-progress.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=28207
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feBlend implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+
+        Implementation of SVG Filter feBlend.
+
+        FilterEffect.cp needed changes to optimize the rendering. With the old code
+        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
+        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
+        PixelArray again. This was unefficient and slow. Now we calculate the requested area
+        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
+        without any drawing operations on GraphicsContext.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::unknown):
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect):
+        * platform/graphics/filters/FilterEffect.h:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter followup: node formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar broken
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28432
+        String::createCFString() returns a non-retained empty string
+
+        No known change in functionality, so no test.
+
+        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
+    
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
+        it doesn't have to.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::deleteOrigin):
+
+2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Support for :valid and :invalid CSS selectors, from HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+
+        Tests: fast/css/pseudo-invalid-001.html
+               fast/css/pseudo-invalid-002.html
+               fast/css/pseudo-valid-001.html
+               fast/css/pseudo-valid-002.html
+               fast/css/pseudo-valid-003.html
+               fast/css/pseudo-valid-004.html
+               fast/css/pseudo-valid-005.html
+               fast/css/pseudo-valid-006.html
+               fast/css/pseudo-valid-007.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
+form controls that have different validity states.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        style associated to new pseudo-classes
+        * dom/Element.h:
+        (WebCore::Element::willValidate): pushed up in hierarchy
+        (WebCore::Element::isValidFormControlElement): checks for valid form
+        control elements (wraps ValidityState::valid())
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willValidate): minor clean up
+        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLKeygenElement.h:
+        (WebCore::HTMLKeygenElement::willValidate): added
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::willValidate): added
+        * html/HTMLObjectElement.idl:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+
+2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos
+
+        Replace repeated string of PLATFORM(FOO) with a single define
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+2009-08-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
+        considered part of scrollable overflow.
+
+        This patch takes the engine's concept of overflow and splits it into two types:
+        layout overflow and visual overflow.
+        
+        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
+        in the inline flow case a tall image could spill out of a line box. Examples of 
+        visual overflow are shadows, text stroke (and eventually outline and
+        border-image).
+
+        Three objects tracked overflow before this patch: RenderBlock had 
+        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
+        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
+        overflow using a map that cached four values.
+        
+        This patch takes all of these different overflow models and unifies them into a single
+        new class called RenderOverflow.   This class is now a member variable in RenderBox and
+        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
+        four values, it tracks eight: left/top/right/bottom for layout overflow and 
+        left/top/right/bottom for visual overflow.
+        
+        Overflow computation is now done after layout is finished rather than during layout
+        (when child objects can be churning and moving around).  A number of layout tests progressed
+        by deferring overflow computation to a separate pass.
+        
+        All inline flow boxes now track overflow (and not just the root line box).  This allows
+        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
+        doesn't intersect.  The old code always visited all object on a line if the root line box
+        intersected at all.
+        
+        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
+        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
+        
+        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
+        have one reason for continued existence, and that is that they happen to be used in repaint()
+        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
+        visual overflow anyway, so this change tightens that repaint up.
+        
+        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
+        been changed to use these instead of relying on overflow (which was totally wrong).
+
+        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
+        text children have no effect on the height of a line.  Instead of making the height() of the objects
+        variable and dependent on overflow, the objects now have their full height and get placed on
+        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
+        
+        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
+        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
+        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
+        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
+        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
+        sublayers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::adjustPageHeight):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::topCombinedOverflow):
+        (WebCore::InlineFlowBox::bottomCombinedOverflow):
+        (WebCore::InlineFlowBox::leftCombinedOverflow):
+        (WebCore::InlineFlowBox::rightCombinedOverflow):
+        (WebCore::InlineFlowBox::combinedOverflowRect):
+        (WebCore::InlineFlowBox::topLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::leftLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::topVisualOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::leftVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
+        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowAndReflectionOverflow):
+        (WebCore::RenderBox::addOverflowFromChild):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::addVisualOverflow):
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::combinedOverflowRect):
+        (WebCore::RenderBox::topCombinedOverflow):
+        (WebCore::RenderBox::bottomCombinedOverflow):
+        (WebCore::RenderBox::leftCombinedOverflow):
+        (WebCore::RenderBox::rightCombinedOverflow):
+        (WebCore::RenderBox::layoutOverflowRect):
+        (WebCore::RenderBox::topLayoutOverflow):
+        (WebCore::RenderBox::bottomLayoutOverflow):
+        (WebCore::RenderBox::leftLayoutOverflow):
+        (WebCore::RenderBox::rightLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRect):
+        (WebCore::RenderBox::topVisualOverflow):
+        (WebCore::RenderBox::bottomVisualOverflow):
+        (WebCore::RenderBox::leftVisualOverflow):
+        (WebCore::RenderBox::rightVisualOverflow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderOverflow.h: Added.
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::topLayoutOverflow):
+        (WebCore::RenderOverflow::bottomLayoutOverflow):
+        (WebCore::RenderOverflow::leftLayoutOverflow):
+        (WebCore::RenderOverflow::rightLayoutOverflow):
+        (WebCore::RenderOverflow::topVisualOverflow):
+        (WebCore::RenderOverflow::bottomVisualOverflow):
+        (WebCore::RenderOverflow::leftVisualOverflow):
+        (WebCore::RenderOverflow::rightVisualOverflow):
+        (WebCore::RenderOverflow::setTopLayoutOverflow):
+        (WebCore::RenderOverflow::setBottomLayoutOverflow):
+        (WebCore::RenderOverflow::setLeftLayoutOverflow):
+        (WebCore::RenderOverflow::setRightLayoutOverflow):
+        (WebCore::RenderOverflow::setTopVisualOverflow):
+        (WebCore::RenderOverflow::setBottomVisualOverflow):
+        (WebCore::RenderOverflow::setLeftVisualOverflow):
+        (WebCore::RenderOverflow::setRightVisualOverflow):
+        (WebCore::RenderOverflow::layoutOverflowRect):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::combinedOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForPoint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::adjustPosition):
+        (WebCore::RootInlineBox::verticallyAlignBoxes):
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        (WebCore::RootInlineBox::lineTop):
+        (WebCore::RootInlineBox::lineBottom):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::selectionHeight):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        (WebCore::RootInlineBox::setLineTopBottomPositions):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28431
+        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+
+        Test: http/tests/appcache/auth.html
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
+        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
+        shouldn't ask it, because it's not a document that's loading these resources).
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan and David Hyatt.
+
+        Fix <rdar://problem/7147996>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Update the style of the scroll bars.
+        
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        Calculate the size of the scrollbar and set it as the frame size.
+
+2009-08-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement should fire 'progress' event before 'load'
+        https://bugs.webkit.org/show_bug.cgi?id=28314
+
+        Test: media/progress-event-at-least-one.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Schedule 'progress' event before 'load'.
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+
+        Tests: fast/workers/shared-worker-lifecycle.html-disabled
+               fast/workers/worker-lifecycle.html
+
+        * WebCore.base.exp:
+        Exported WorkerThread::workerThreadCount().
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerThread.cpp:
+        Added tracking of the number of worker threads.
+        (WebCore::threadCountMutex):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        * workers/WorkerThread.h:
+
+2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Add new files I forgot to add in r47424.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement prefetchDNS() function.
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=26915
+
+        Tests: fast/forms/datalist-nonoption-child.html
+               fast/forms/datalist.html
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html.css:
+        * html/CollectionType.h:
+        (WebCore::):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLDataListElement.cpp: Added.
+        (WebCore::HTMLDataListElement::HTMLDataListElement):
+        (WebCore::HTMLDataListElement::~HTMLDataListElement):
+        (WebCore::HTMLDataListElement::checkDTD):
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h: Added.
+        * html/HTMLDataListElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        Test: fast/flexbox/box-orient-button.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::renderName):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Render -webkit-mask via compositing layers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=28414
+        
+        Implement accelerated compositing of -webkit-mask, when combined
+        with already-composited content.
+        
+        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
+        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
+        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
+        
+        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
+        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
+        indicates that just the mask is painting.
+        
+        When painting the composited mask, we need to paint with the normal compositing
+        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
+        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
+        need to make transparency layers.
+        
+        We no longer have to throw video rendering into software because of masks.
+        
+        When a masked element has composited descendants, that element needs to
+        become composited so that the mask can be applied via compositing.
+
+        Tests: compositing/masks/masked-ancestor.html
+               compositing/masks/simple-composited-mask.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::maskLayer):
+        (WebCore::GraphicsLayer::setMaskLayer):
+        (WebCore::GraphicsLayer::paintingPhase):
+        (WebCore::GraphicsLayer::setPaintingPhase):
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setMaskLayer):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateMaskLayer):
+        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::hasMaskLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Layer content misplaced with compositing, z-index and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=28361
+        
+        The foreground GraphicsLayer (used to render element foreground when the element has 
+        negative z-order children) was misplaced when there is a clipping layer (which clips
+        children). The foreground layer is parented under the clipping layer so that the foreground
+        depth-sorts with the layer's children, so its geometry needs to be computed relative to
+        that clipping layer.
+        
+        Also clarified some FIXME comments, and corrected a debug-only layer name.
+
+        Test: compositing/geometry/clipping-foreground.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix leaks of SVGElementInstance seen during regression tests.
+
+        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
+        not updated to have a create method that adopted the initial reference.  This lead to the instances
+        of SVGElementInstance allocated by SVGUseElement being leaked.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+
+2009-08-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
+        Page Cache should support pages with frames.
+
+        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
+          are solely the responsibility of FrameLoader.
+        - Enhance some page cache related Logging to help development.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::identifierForInitialRequest):
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+
+2009-08-17  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Moved implementation of isAfterContent to RenderObject
+        (as inline method to avoid potential performance regressions).
+
+        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
+        (https://bugs.webkit.org/show_bug.cgi?id=28376)
+
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAfterContent):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in WebCore::RenderHTMLCanvas::layout
+        https://bugs.webkit.org/show_bug.cgi?id=12052
+
+        Don't handle run-in if the element is not a block element.
+
+        Test: fast/runin/nonblock-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
+        either of the arguments are not finite.
+
+        According to
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
+        "If any of the arguments to createImageData() or getImageData() are
+        infinite or NaN, or if the createImageData()  method is invoked with
+        only one argument but that argument is null, the method must instead
+        raise a NOT_SUPPORTED_ERR  exception."
+
+        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a way to release the storage lock
+        https://bugs.webkit.org/show_bug.cgi?id=28411
+
+        Two scripts within the same origin that are accessing LocalStorage must not do
+        it simultaneously, according to the spec.  There are some cases, however, where
+        a script might want to override this behavior.  navigator.getStorageUpdates()
+        was added for this reason:
+        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+
+        Add this function to navigator and hook it up to DOM Storage.
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::getStorageUpdates):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::unlock):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
+        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
+        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
+        Windows though so we explicitly include this header from the prefix header when on Windows.
+
+        * WebCorePrefix.h:
+        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix Windows build.
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28401
+        Add support for DNS prefetching with CFNetwork
+
+        This is just an optimization, no behavior change, so no tests.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::clientCallback):
+        (WebCore::prefetchDNS):
+        Use async CFHostStartInfoResolution() for implementation.
+
+2009-08-17  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
+        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+
+        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
+        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+
+        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to a resource on origin A.
+        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+
+        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.h:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::connect): Ditto.
+        * workers/Worker.cpp: Ditto.
+        (WebCore::Worker::Worker): Ditto.
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts): Ditto.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
+        * workers/WorkerScriptLoader.h: 
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+
+2009-08-17  Adam Langley  <agl@google.com>
+
+        Reviewed by Dan Bernstein (relanding of r47157).
+
+        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        This was originally fixed in r47157, however it triggered a bug in
+        Skia which caused Chromium Linux to fail layout tests in debug mode.
+        It was reverted in r47189 while we sorted it out.
+
+        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
+        Chromium's r23523. This is a reland of the original patch.
+
+        No new tests because it's a just typo fix.
+
+        [1] http://code.google.com/p/skia/source/detail?r=321
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Protect ResourceHandle for g_file_query_info_async call, using the
+        same technique we already use for HTTP requests that take the soup
+        path.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
+        appears below the main content
+        https://bugs.webkit.org/show_bug.cgi?id=28350
+
+        A particular version of the MediaWiki software detects WebKit through
+        user agent sniffing and imports a style sheet called KHTMLFixes.css,
+        which contains a single rule that was meant to work around some KHTML
+        bug, but currently has the sole effect of causing the float containing
+        the main article content to extend all the way to the left and thus push
+        down the left navigation pane.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the imported style sheet is the MediaWiki
+        KHTMLFixes.css. If so, remove the offending rule.
+
+2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct crash when processing local cancelled requests.
+
+        No new tests. Existing fast/images/favicon-as-image.html
+        displays the problem.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add check for m_cancelled after
+          performing local-file processing.
+        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
+          check for m_cancelled after performing local-file processing.
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Reverts 47371, since it breaks GTK+.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Allow image decoders to down-sample the image directly
+        to scaled output buffer. This can be enabled/disabled by
+        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
+        Only JPEG and PNG decoders are modified to support it now.
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: fix float literals to avoid casting warnings.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Use OwnPtrs for GraphicsLayers
+        https://bugs.webkit.org/show_bug.cgi?id=28399
+
+        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
+        for their references to GraphicsLayers.
+
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::create):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::graphicsLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::ancestorClippingLayer):
+        (WebCore::RenderLayerBacking::foregroundLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::childForSuperlayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Reset InjectedScript styles cache on document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28390
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._reset):
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
+        resorted includes, renamed "doc" to "document" and fixed formatting.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed functions now unneeded due to use of Reflect to create
+        language bindings.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        Get at usemap attribute directly.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        Get at id attribute directly.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Ditto.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
+        (WebCore::HTMLDocument::setDir): Ditto.
+
+        * html/HTMLElement.cpp: Deleted unused functions.
+        * html/HTMLElement.h: Ditto.
+
+        * html/HTMLImageElement.cpp: Deleted unused functions.
+        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
+        get at usemap attribute directly, but added a FIXME because although
+        it is what the old code did, it looks to not be entirely correct.
+
+        * html/HTMLImageElement.h: Deleted unused functions.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
+        directly.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
+        explicit HTMLNames namespace qualification.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Removed unneeded calls
+        to RefPtr::get.
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Discard DOM Node bindings on any document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28389
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
+        * WebCore.gypi: added missing files
+
+          Implemented Bindings for InspectorController.deleteCookie(name)
+
+        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        (WebCore::JSInspectorBackend::deleteCookie):
+
+          v8 Bindings Stubs
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+          Removed WebInspector.Cookie
+
+        * inspector/front-end/Cookie.js: Removed.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/WebKit.qrc:
+
+          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
+          yet provide access to raw cookies.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
+        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
+        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Interaction with the page through Injected Script (for fallback behavior)
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getCookies):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleProperty): style fix
+        (InjectedScript.getCookies):
+
+          Allow alignment of text inside DataGrids.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGridNode.prototype.createCell):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/inspector.css:
+
+          Added deleteCookie(., ., String name)
+          Modified getRawCookies to return a bool to know if its implemented
+
+        * platform/CookieJar.h:
+
+
+          Implemented deleteCookie for Macs
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+          Stub Implementations for Other Platforms
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind build fix for Leopard.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextCG.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setCompositeOperation):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::save):
+        (WebCore::GraphicsContext::restore):
+        (GraphicsContext::drawText):
+        (GraphicsContext::initFocusRing):
+        (GraphicsContext::focusRingBoundingRect):
+        (GraphicsContext::drawImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::toCairoOperator):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change HTMLAreaElement to use OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=28386
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
+        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
+        instead of deletion followed by assignment.
+        * html/HTMLAreaElement.h: Use OwnArrayPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Fix Windows build.
+
+        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move noResize from HTMLFrameElementBase to HTMLFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=28384
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
+        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
+        here if noresizeAttr is changed. This code was moved here from
+        HTMLFrameElementBase, but I added some FIXME comments.
+        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
+        boolean argument. Moved here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
+        here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
+        noresizeAttr.
+
+        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tweak HTMLFrameElementBase so that m_URL can be private
+        https://bugs.webkit.org/show_bug.cgi?id=28385
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
+        taking an argument.
+        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
+        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLViewSourceDocument should use smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=28378
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
+        pointers any more since RefPtr starts 0 by default.
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
+        types for local variables.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
+        and use a RefPtr of a more specific type for a local variable.
+        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
+        variables, and use RefPtr as well.
+        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
+        RefPtr of a more specific type for a local variable.
+
+        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
+        data member types to RefPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        Convert 4 more classes. These are classes I am going to make other changes
+        to soon, so it's good to have this use of Reflect in the IDL out of the way.
+
+        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Script to create element factory needs changes to accommodate calling create
+        https://bugs.webkit.org/show_bug.cgi?id=28379
+
+        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
+        around names used inside {}. Added new createWithNew property for tags
+        that makes the factory use a create function instead of calling new.
+        Renamed functions with initialize in their name to have default in their
+        name, since they return an array full of default values and don't themselves
+        initialize anything.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        StyledElement should use ASCIICType instead of having its own toHex function
+        https://bugs.webkit.org/show_bug.cgi?id=28377
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        execCommand("InsertHorizontalRule") inserts a broken <hr> element
+        https://bugs.webkit.org/show_bug.cgi?id=28375
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
+        instead of just an HTMLElement.
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <option> element & 'onpick' events - history navigation is broken
+        https://bugs.webkit.org/show_bug.cgi?id=28371
+
+        After selecting an option element with an 'onpick' event associated with a 'go' task,
+        the navigation is executed. When going back in history, the same 'onpick' event is fired
+        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+
+        Test: wml/option-element-onpick-recursion.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::initialized):
+
+2009-08-16  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resource filtering: keyboard Navigation always uses ALL resources
+        https://bugs.webkit.org/show_bug.cgi?id=28231
+        
+        Determine if a resource is selectable on user action.
+        
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling): Changed MIN() to min().
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
+        max() and MIN() to min().
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
+        std::max statement.
+        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Cleanup WMLIntrinsicEventHandling code
+        https://bugs.webkit.org/show_bug.cgi?id=28358
+
+        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h:
+        * wml/WMLTaskElement.h:
+
+2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+
+        - renamed elementId to nodeId in operations on nodes.
+        - added load listeners to frame owners in InspectorDOMAgent.
+        - removed InspectorController::inspectedWindowScriptObjectCleared event.
+        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
+        - removed contentDocument-related logic from ElementsPanel since it is handled in
+            the InspectorDOMAgent.
+        - removed DOM listeners unregistration and corresponding events from InspectorController.
+        - made this.styles 'private' in ElementsPanel.
+        - added TODO for the handleCopy processing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28356
+
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::setTextNodeValue):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument.prototype.addEventListener):
+        (WebInspector.DOMDocument.prototype.removeEventListener):
+        (WebInspector.DOMDocument.prototype._fireDomEvent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.childNodeInserted):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._serializeRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set hoveredDOMNode):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
+        (Node.prototype.enclosingNodeOrSelfWithClass):
+        (isAncestorNode):
+        (firstCommonNodeAncestor):
+        (traverseNextNode):
+        (traversePreviousNode):
+        ():
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Optimize updateFillImages() to not add/remove clients every time
+        https://bugs.webkit.org/show_bug.cgi?id=28334
+
+        Optimize the case where old and new just have a single layer pointing to the same (or no)
+        image.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Implement animations of multiple text-shadows and -webkit-box-shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Test: transitions/multiple-shadow-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make transitions work for position and size of multiple backgrounds and masks.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
+        properties animatable with multiple backgrounds, rather than just animating the first one.
+
+        Tests: transitions/multiple-background-size-transitions.html
+               transitions/multiple-background-transitions.html
+               transitions/multiple-mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
+        (WebCore::FillLayerPropertyWrapper::blend):
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::blend):
+        (WebCore::ensurePropertyMap):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::setXPosition):
+        (WebCore::FillLayer::setYPosition):
+        (WebCore::FillLayer::setSize):
+
+2009-08-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Jan Alonzo.
+
+        Don't crash in fieldset code when WML is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=28012
+
+        Test: fast/wml/html-fieldset-crash.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend): ++brackets
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Try and enable EventSource on Windows.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Setting attribute event listeners to the body does not set them on the window
+        https://bugs.webkit.org/show_bug.cgi?id=28343
+
+        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
+               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
+        (WebCore::HTMLBodyElement::setOnerror): Ditto.
+        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
+        (WebCore::HTMLBodyElement::setOnload): Ditto.
+        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
+        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
+        (WebCore::HTMLBodyElement::setOnonline): Ditto.
+        (WebCore::HTMLBodyElement::setOnresize): Ditto.
+        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
+        (WebCore::HTMLBodyElement::setOnunload): Ditto.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix up some IDL comments.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added implementation of the EventSource object that enables
+        server-sent events from HTML5.
+        http://dev.w3.org/html5/eventsource/
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        Tests: fast/eventsource/eventsource-attribute-listeners.html
+               fast/eventsource/eventsource-constructor.html
+               http/tests/eventsource/eventsource-bad-mime-type.html
+               http/tests/eventsource/eventsource-parse-event-stream.html
+               http/tests/eventsource/eventsource-reconnect.html
+               http/tests/eventsource/eventsource-status-code-states.html
+               http/tests/eventsource/workers/eventsource-simple.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::eventSource):
+        * bindings/js/JSEventSourceConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
+        (WebCore::constructEventSource):
+        (WebCore::JSEventSourceConstructor::getConstructData):
+        * bindings/js/JSEventSourceConstructor.h: Added.
+        (WebCore::JSEventSourceConstructor::classInfo):
+        * bindings/js/JSEventSourceCustom.cpp: Added.
+        (WebCore::JSEventSource::markChildren):
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::eventSource):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toEventSource):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp: Added.
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::~EventSource):
+        (WebCore::EventSource::connect):
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::reconnectTimerFired):
+        (WebCore::EventSource::url):
+        (WebCore::EventSource::readyState):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::scriptExecutionContext):
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        (WebCore::EventSource::dispatchEvent):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::didReceiveData):
+        (WebCore::EventSource::didFinishLoading):
+        (WebCore::EventSource::didFail):
+        (WebCore::EventSource::didFailRedirectCheck):
+        (WebCore::EventSource::parseEventStream):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::dispatchGenericEvent):
+        (WebCore::EventSource::dispatchMessageEvent):
+        (WebCore::EventSource::stop):
+        * page/EventSource.h: Added.
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::):
+        (WebCore::EventSource::setOnopen):
+        (WebCore::EventSource::onopen):
+        (WebCore::EventSource::setOnmessage):
+        (WebCore::EventSource::onmessage):
+        (WebCore::EventSource::setOnerror):
+        (WebCore::EventSource::onerror):
+        (WebCore::EventSource::toEventSource):
+        (WebCore::EventSource::eventListeners):
+        (WebCore::EventSource::refEventTarget):
+        (WebCore::EventSource::derefEventTarget):
+        * page/EventSource.idl: Added.
+        * workers/WorkerContext.idl:
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Minor DOMAgent bugfixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::nodeForId):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Evaluating objects while on a breakpoint dumps string
+        representation instead of live object. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=28280
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+
+2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding two new files to WebCore/platform/haiku:
+        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28129
+
+        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        * platform/haiku/LoggingHaiku.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix GTK build.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
+        directly to make CDATASection and Comment nodes.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        First half, everything except for element classes.
+
+        * GNUmakefile.am: Removed DocPtr.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
+        have to call it explicitly.
+        (WebCore::Attr::create): Added.
+        (WebCore::Attr::setValue): Changed to take AtomicString.
+        (WebCore::Attr::cloneNode): Use create.
+
+        * dom/Attr.h: Added a create function. Made the constructor private,
+        and a lot of other functions private as well.
+
+        * dom/Attribute.cpp:
+        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::create): Added.
+        (WebCore::CDATASection::cloneNode): Use create.
+        (WebCore::CDATASection::virtualCreate): Ditto.
+
+        * dom/CDATASection.h: Added a create function. Made everything private.
+        Removed unneeded destructor declaration.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
+        with a single one that takes ConstructionType.
+
+        * dom/CharacterData.h: Made more functions be protected and private.
+        Made m_data be private.
+
+        * dom/Comment.cpp:
+        (WebCore::Comment::Comment): Got rid of an extra constructor.
+        (WebCore::Comment::create): Added.
+        (WebCore::Comment::cloneNode): Call create.
+
+        * dom/Comment.h: Added a create function. Made everything private.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * dom/ContainerNode.h: Made the constructor protected and passed
+        ConstructionType instead of an isElement boolean.
+
+        * dom/DocPtr.h: Removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
+        and selfOnlyDeref instead of a DocPtr in here.
+        (WebCore::Document::~Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::createDocumentFragment): Call create.
+        (WebCore::Document::createTextNode): Ditto.
+        (WebCore::Document::createComment): Ditto.
+        (WebCore::Document::createCDATASection): Ditto.
+        (WebCore::Document::createProcessingInstruction): Ditto.
+        (WebCore::Document::createEntityReference): Ditto.
+        (WebCore::Document::createEditingTextNode): Ditto.
+        (WebCore::Document::importNode): Call Attr::create.
+        (WebCore::Document::createAttributeNS): Ditto.
+
+        * dom/Document.h: Call adoptRef. Made a lot of functions private and
+        protected and sorted them so public functions come first.
+
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::create): Added.
+        (WebCore::DocumentFragment::cloneNode): Call create.
+        * dom/DocumentFragment.h: Added create.
+
+        * dom/DocumentType.cpp:
+        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
+        (WebCore::DocumentType::cloneNode): Use create.
+        * dom/DocumentType.h:
+        (WebCore::DocumentType::create): Call adoptRef.
+
+        * dom/EditingText.cpp:
+        (WebCore::EditingText::create): Added.
+        * dom/EditingText.h: Added a create function. Made everything private.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
+        the zero reference count behavior for classes derived from Element.
+
+        * dom/EntityReference.cpp:
+        (WebCore::EntityReference::create): Added.
+        (WebCore::EntityReference::cloneNode): Call create.
+        * dom/EntityReference.h: Added create. Made everything private.
+
+        * dom/Node.cpp:
+        (WebCore::Node::initialRefCount): Added. Inline helper function for
+        the constructor.
+        (WebCore::Node::isContainer): Ditto.
+        (WebCore::Node::isElement): Ditto.
+        (WebCore::Node::isText): Ditto.
+        (WebCore::Node::Node): Changed to take a construction type argument.
+        Since m_document is now a normal pointer, added a call to selfOnlyRef.
+        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
+        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
+        (WebCore::Node::appendTextContent): Use the data function instead of
+        calling nodeValue functions, which do the same thing in a roundabout way.
+
+        * dom/Node.h: Made the constructor protected and replaced the multiple
+        arguments iwth a single ConstructionType argument. Sorted the public
+        things first.
+
+        * dom/Notation.h: Made most things private.
+        * dom/Notation.cpp: Removed extra constructor.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::create): Added.
+        (WebCore::ProcessingInstruction::cloneNode): Call create.
+        * dom/ProcessingInstruction.h: Added create function. Made many other
+        members private.
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents): Use DocumentFragment::create.
+
+        * dom/Text.cpp:
+        (WebCore::Text::Text): Updated for base class change.
+        (WebCore::Text::create): Added.
+        (WebCore::Text::splitText): Changed to not require access to m_data.
+        (WebCore::Text::cloneNode): Call create.
+        (WebCore::Text::createRenderer): Call dataImpl.
+        (WebCore::Text::attach): Call data.
+        (WebCore::Text::recalcStyle): Call dataImpl.
+        (WebCore::Text::virtualCreate): Call create.
+        (WebCore::Text::createWithLengthLimit): Call create.
+        (WebCore::Text::formatForDebugger): Call data.
+
+        * dom/Text.h: Added a create function. Made many other members private.
+        Renamed createNew to virtualCreate.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::enterText): Call Text::create.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
+        (WebCore::XMLTokenizer::comment): Call Comment::create.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        Call data instead of string.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertNode): Call DocumentFragment::create.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create): Call adoptRef.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
+        (WebCore::replaceChildrenWithFragment): Call data instead of string.
+        (WebCore::replaceChildrenWithText): Call Text::create.
+        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
+        Text::create.
+        (WebCore::HTMLElement::setOuterText): Call Text::create.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText): Call Text::create.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
+        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
+        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+
+        * html/HTMLViewSourceDocument.h:
+        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
+
+        * loader/FTPDirectoryDocument.h:
+        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
+        * loader/ImageDocument.h:
+        (WebCore::ImageDocument::create): Ditto.
+        * loader/MediaDocument.h:
+        (WebCore::MediaDocument::create): Ditto.
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::create): Ditto.
+        * loader/PluginDocument.h:
+        (WebCore::PluginDocument::create): Ditto.
+        * loader/TextDocument.h:
+        (WebCore::TextDocument::create): Ditto.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
+        (WebCore::Loader::Host::didFail): Ditto.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
+        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText): Use dataImpl instead of string.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
+        (WebCore::RenderTextFragment::previousCharacter): Ditto.
+
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument::create): Use adoptRef.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
+        PassRefPtr.
+
+        * svg/SVGElementInstance.h: Made everything private.
+
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::create): Called adoptRef.
+
+        * xml/XPathNamespace.cpp:
+        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
+        * xml/XPathNamespace.h: Made everything private.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
+        Text::create.
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner document. This is used by
+        AXObjectCache::handleFocusedUIElementChanged().
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
+        to be a static function and to take a pointer to a Page.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Moved the code to generate the next AXID from getAXID() to here. Added
+        a #if to make this non-WIN only, because Windows has its own
+        implementation.
+        (WebCore::AXObjectCache::getAXID):
+        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
+
+        * accessibility/AXObjectCache.h:
+        Add a declaration for Document and Page. Removed the declaration of
+        AccessibilityObject, because we include the header. Reordered the
+        declaration of Node alphabetically. Moved the typedef for AXID to
+        AccessibilityObject. Removed some trailing whitespace. Added a member
+        variable to hold a pointer to the owner Document.
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner Document.
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Added; code moved from AccessiblityRenderObject::focusedUIElement().
+        Returns the focused element with respect to accessibility.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Declare a function to generate an AXID.
+        (WebCore::AXObjectCache::objectFromAXID):
+        Return the AccessibilityObject with the given AXID.
+
+        * accessibility/AccessibilityObject.h:
+        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
+        member use the typedef.
+        (WebCore::AccessibilityObject::axObjectID):
+        Changed the return type to use the typedef.
+        (WebCore::AccessibilityObject::setAXObjectID):
+        Changed the argument type to use the typedef.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        Removed some unneeded #includes.
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
+        call.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        If the Document has no Page, return. If the Page has not focused
+        element (respecting accessibility), return. Assert that the
+        accessibility of the focused element is not ignored, and that the
+        object's AXID will be negative and fit into a LONG when negated.
+        Broadcast a focus event for the object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Pass this when creating the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Remove the improper set of enum WebKitWebViewTargetInfo
+        by grabbing the target infos via m_helper.
+
+        * manual-tests/gtk/copy-htmltext.html: Added.
+        * platform/Pasteboard.h:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::clipboard_get_contents_cb):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix an assertion when bringing up the Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28318
+        
+        The fix for bug 28295 assumed that image clients count the number of times
+        addClient/removeClient is called. That was true for CachedResource clients,
+        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
+        
+        Fix by making CSSImageGeneratorValue count the number of times a client is
+        added/removed.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+
+2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct libcurl crash when downloading local files.
+        https://bugs.webkit.org/show_bug.cgi?id=28312
+
+        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse): New static function that
+          performs the local setting of valid URL and firing didReceiveResponse.
+          This code was moved from writeCallback.
+        (WebCore::writeCallback): Move local file handling to static function
+          (above) and use the function instead.
+        (WebCore::readCallback): Add check
+          for responseFired, and handle as a local file if it was not.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Fix RenderThemeHaiku build.
+        https://bugs.webkit.org/show_bug.cgi?id=28307
+
+        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
+        instead of RenderTheme.h.
+        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
+        before the function.
+        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
+        before the function.
+        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding SharedBufferHaiku to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28309
+
+        * platform/haiku/SharedBufferHaiku.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
+        and functions.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+
+2009-08-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28311
+
+        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-14  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=28134
+
+        No new tests added since Access Control was already well tested and this is a pure refactor.
+
+        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
+        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
+        path.
+
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
+        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
+        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
+        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
+        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
+        * loader/ThreadableLoader.cpp: Ditto.
+        (WebCore::ThreadableLoader::create): Ditto.
+        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
+        * loader/ThreadableLoader.h: Ditto.
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
+        * loader/WorkerThreadableLoader.cpp: Ditto.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
+        * loader/WorkerThreadableLoader.h: Ditto.
+        (WebCore::WorkerThreadableLoader::create): Ditto.
+        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
+        (WebCore::):
+        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
+        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
+        * xml/XMLHttpRequest.h: Ditto.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow Qt API to list and to remove URL schemes that were registered as
+        local URL schemes.
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+
+2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Wrap console objects late (in the frontend) so that injected
+        script was already in place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28297
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/InspectorFrontend.h:
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix logic in RenderObject::updateFillImages() that led to incorrect client
+        counts if an image was used twice in the background-image property.
+        https://bugs.webkit.org/show_bug.cgi?id=28295
+
+        Test: fast/backgrounds/multiple-backgrounds-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+        Simplify the logic to call addClient()/removeClient() for every background
+        image, but go through the new layers first to avoid removing all the
+        clients of an image.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Make sure we override the JSObject createStructure method on those
+        objects that have custom marking routines.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Follow-up to earlier work to remove dependencies on JavaScriptCore.
+
+        * ForwardingHeaders/parser/Parser.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
+        of Parser.h.
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
+        an assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=28279
+
+        Test: fast/flexbox/block-axis.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
+        vertical.
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when removing reflection on an absolutely-positioned image.
+        https://bugs.webkit.org/show_bug.cgi?id=28289
+        
+        Make sure we clean up the reflection layer when removing the reflection,
+        so that the RenderLayer tree does not contain pointers to deleted layers.
+
+        Test: fast/reflections/reflected-img-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::removeReflection):
+        * rendering/RenderLayer.h:
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        misalignment because of float:left of <div> tag
+        https://bugs.webkit.org/show_bug.cgi?id=15869
+
+        One section of http://edgar.sec.gov site draws to the right of the rest
+        of the content
+        <rdar://problem/7135951>
+
+        Tests: fast/block/float/avoidance-percent-width-compat.html
+               fast/block/float/avoidance-percent-width-strict.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
+            avoidance logic in strict mode and in compatibility mode, which
+            matches Firefox and IE. Changed to compute and use the computed
+            width of the child, instead of ignoring non-fixed widths.
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation PositionOptions does not use correct default values.
+        https://bugs.webkit.org/show_bug.cgi?id=27254
+
+        Sets the correct default values for the properties of the PositionOptions object
+        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+
+        Also adds checking to throw an exception if arguments of the incorrect type are
+        passed to Geolocation methods. Adds a layout test to test this. This test should
+        pass on all platforms where Geolocation is implemented.
+
+        Test: fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback): Added. Creates the callback.
+        (WebCore::createPositionErrorCallback): Added. Creates the calback.
+        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
+        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
+        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
+        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create): Modified. Creates object with default values.
+        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
+        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed chromium build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-08-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Merge error in SharedWorker code
+        https://bugs.webkit.org/show_bug.cgi?id=28277
+
+        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
+        No new tests needed.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Removed duplicated functions.
+
+2009-08-13  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Chromium: Show a "Playback Disabled" button on media error.
+        https://bugs.webkit.org/show_bug.cgi?id=28196
+        Use a disabled play button when the media file cannot be played.
+
+        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Utilizes functions that are being called upon drag and drop actions.
+        Uses different GTK clipboards that hold different types
+        of drag data - images, HTML markup, text, URL, URL label.
+        Also clears each clipboard before setting new data to it.
+
+        No new tests - despite some implementations, no new functionality
+        is added until implementations of the GTK drag and drop protocol
+        in WebKit part.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::ClipboardGtk):
+        (WebCore::ClipboardGtk::~ClipboardGtk):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardGtk::declareAndWriteDragImage):
+        (WebCore::ClipboardGtk::writeURL):
+        (WebCore::ClipboardGtk::writeRange):
+        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+
+        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
+        files as Private that are now needed to compile Mac WebKit.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSLazyEventListener.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWebSocketConstructor.cpp:
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        Updated includes.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        Change to not assert if this is called with no listeners.
+        I don't think this was guaranteed before, and we now use
+        this code path when recompiling. Slightly less efficient,
+        but this is a one-time cost when turning on the debugger.
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Change to call Debugger::recompileAllJSFunctions.
+
+2009-08-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
+        onhashchange property cannot be set from javascript.
+
+        Test: fast/loader/onhashchange-attribute-listeners.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onhashchange):
+        (WebCore::HTMLBodyElement::setOnhashchange):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::onhashchange):
+        (WebCore::HTMLFrameSetElement::setOnhashchange):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onhashchange):
+        (WebCore::DOMWindow::setOnhashchange):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
+        RGBColor is cleaned up by the caller.
+        * svg/SVGColor.h:
+
+2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate to DOMAgent (serialized access to DOM).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::nodeForId):
+        (WebCore::JSInspectorBackend::idForNode):
+        (WebCore::JSInspectorBackend::wrapObject):
+        (WebCore::JSInspectorBackend::unwrapObject):
+        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
+        (WebCore::JSInspectorBackend::selectDatabase):
+        (WebCore::JSInspectorBackend::selectDOMStorage):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isObject):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::clearMessages):
+        (WebCore::InspectorBackend::loaded):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::idForNode):
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::unwrapObject):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentElement):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::clearConsoleMessages):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        (WebInspector.ConsoleView.prototype._messagesClicked):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._format):
+        (WebInspector.ConsoleView.prototype._formatfunction):
+        (WebInspector.ConsoleView.prototype._formatdate):
+        (WebInspector.ConsoleView.prototype._formatregexp):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatobject):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.DOMAgent.prototype.nodeForId):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.DOMAgent.prototype._bindNodes):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.setDocument):
+        (InspectorController.getStyles):
+        (InspectorController.getComputedStyle):
+        (InspectorController.getInlineStyle):
+        (InspectorController.applyStyleText):
+        (InspectorController.setStyleText):
+        (InspectorController.toggleStyleEnabled):
+        (InspectorController.applyStyleRuleText):
+        (InspectorController.addStyleSelector):
+        (InspectorController.setStyleProperty):
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        (InspectorController.setPropertyValue):
+        (InspectorController.evaluate):
+        (InspectorController.addInspectedNode):
+        (InspectorController.performSearch):
+        (InspectorController.searchCanceled):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleRuleText):
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._doesSelectorAffectNode):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.evaluate):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.performSearch.matchExactItems):
+        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
+        (InjectedScript.performSearch.matchExactId):
+        (InjectedScript.performSearch):
+        (InjectedScript.performSearch.matchExactTagNames):
+        (InjectedScript.performSearch.matchExactAttributeNames):
+        (InjectedScript.performSearch.matchPartialTagNames):
+        (InjectedScript.performSearch.matchStartOfTagNames):
+        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
+        (InjectedScript.performSearch.matchPartialAttributeValues):
+        (InjectedScript.performSearch.matchStyleSelector):
+        (InjectedScript.performSearch.matchPlainText):
+        (InjectedScript.performSearch.matchXPathQuery):
+        (InjectedScript.performSearch.finishedSearching):
+        (InjectedScript.performSearch.processChunk):
+        (InjectedScript.searchCanceled):
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript._createProxyObject):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.updateFocusedNode):
+        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/utilities.js:
+        (Object.proxyType):
+        * storage/Storage.h:
+        (WebCore::Storage::frame):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
+        newly-allocated RGBColor is cleaned up by the caller.
+        * css/CSSPrimitiveValue.h:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        wrong font size when css font-family includes monospace
+        https://bugs.webkit.org/show_bug.cgi?id=19161
+
+        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
+        WebKit has historically used fixed-width default size any time a
+        font-family includes monospace in the fallback list.
+
+        This patch corrects WebKit's behavior to match Firefox.
+        I also had to fix a bug in WebKit's font-family fallback behavior where
+        child elements would inherit parts of their parents fallback lists.
+
+        This patch is mostly just replacing all cases where we used to check for:
+        fontDescription.genericFontFamily() == MonospaceFamily
+        with:
+        fontDescription.useFixedDefaultSize()
+
+        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
+               fast/css/getComputedStyle/font-family-fallback-reset.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+           Deploy useFixedDefaultSize().  Also fix the bug where child
+           FontDescriptions would carry part of the parent font-family fallback list.
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+           It's no longer alright to just check genericFontFamily(),
+           we have to check to make sure the changed style has a matching useFixedDefaultSize().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::useFixedDefaultSize):
+           Only use the fixed default size if we have one font family and it is "monospace".
+           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
+
+2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubberstamped by Darin Adler.
+
+        Use ASSERT_UNUSED instead of UNUSED_PARAM
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
+        https://bugs.webkit.org/show_bug.cgi?id=28262
+
+        No new tests possible.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] getImageData fails on a given rect bigger than the image rect
+
+        The destination image and the source image was mixed up on creating the
+        imageData.
+
+        This is just a clean up and doesn't affect the current behavior. It's not
+        possible to test this failure in a LayoutTest. Only canvas uses getImageData
+        at the moment and returns before calling getImageData, if the image rect does
+        not contain the requested rect.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding RenderTheme to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28258
+
+        * platform/haiku/RenderThemeHaiku.cpp: Added.
+        (WebCore::RenderThemeHaiku::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
+        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeHaiku::supportsFocusRing):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeHaiku::systemFont):
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::setCheckboxSize):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::setRadioSize):
+        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h: Added.
+        (WebCore::RenderThemeHaiku::supportsHover):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28256
+
+        * platform/haiku/ContextMenuHaiku.cpp:
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::insertItem):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new gesture in Web Inspector to remove breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=19131
+        
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        file, conditionally for "symbian" platform.
+
+        * WebCore.pro:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        wrong calculation of overflow size for flexbox and table
+        https://bugs.webkit.org/show_bug.cgi?id=28064
+
+        RenderFlexibleBox and RenderTable were using the width of overflow
+        to update height of overflow, so height became wrong value and
+        width was not updated. As the corresponding code of RenderBlock
+        was sane, I factored it out and used from RenderFlexibleBox and
+        RenderTable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
+        Windows build in a non-obvious manner.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.idl:
+        * platform/Cookie.h: Removed.
+        * platform/CookieJar.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/mac/CookieJar.mm:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        * platform/network/win/CookieJarWin.cpp:
+        * platform/qt/CookieJarQt.cpp:
+
+2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed: build fix (for r47192), adding new file from
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * inspector/front-end/StatusBarButton.js: Added.
+
+2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduced StatusBarButton class that encapsulates glyphs support.
+        Views updated accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.get statusBarItems):
+        (WebInspector.ProfileView.prototype._updatePercentButton):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/StatusBarButton.js: Added.
+        (WebInspector.StatusBarButton):
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.get disabled):
+        (WebInspector.StatusBarButton.prototype.set disabled):
+        (WebInspector.StatusBarButton.prototype.get title):
+        (WebInspector.StatusBarButton.prototype.set title):
+        (WebInspector.StatusBarButton.prototype.get toggled):
+        (WebInspector.StatusBarButton.prototype.set toggled):
+        (WebInspector.StatusBarButton.prototype.get visible):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
+        * inspector/front-end/inspector.html:
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add shadow support in GraphicsContext::fillRect().
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
+        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for Chromium Linux.
+
+        Rollback r47157 as this broke debug tests of Chromium Linux.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        The chromium build broke due to r47185 which added
+        a cookies array to inspector/InspectorBackend.idl.
+
+        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
+         for the cookies callback.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Cookies in Storage Panel
+        https://bugs.webkit.org/show_bug.cgi?id=27202
+
+          Data Structure for a Cookie. Just Key/Value for Now:
+
+        * inspector/front-end/Cookie.js: Added.
+        (WebInspector.Cookie):
+        (WebInspector.Cookie.prototype.get key):
+        (WebInspector.Cookie.prototype.set key):
+        (WebInspector.Cookie.prototype.get value):
+        (WebInspector.Cookie.prototype.set value):
+
+          A Storage View for Cookies.  Allows for Refresh/Delete:
+
+        * inspector/front-end/CookieItemsView.js: Added.
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
+
+          Include a SidebarSection Section in the Databases Panel:
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
+        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
+        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
+        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
+        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+
+          New "Cookies" Image for the Sidebar:
+
+        * inspector/front-end/Images/cookie.png: Added.
+        * inspector/front-end/inspector.css:
+
+          Include the Added Files where appropriate:
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28246
+
+        * WebCore.pro:
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Mark unused variables to avoid compile failures in -Werror.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
+        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
+        Minor fixes by Eric Seidel and George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+
+        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * css/WCSSPropertyNames.in: Added.
+        * css/WCSSValueKeywords.in: Added.
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Update the canvas renderer's intrinsic size with the zoomed
+        lengths and ensure the intrinsic size is correct when setting
+        an initial style.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26908
+
+        Test: fast/canvas/canvas-zoom.html
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+
+2009-08-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix regression for dragging the media controller thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28211
+
+        Modified the conditions for rejecting events on the media controller
+        to only rejecting mouse events not from the left button.
+
+        Test: media/controls-drag-timebar.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+
+2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixing a deadlock caused by two transactions that run on two
+        different database handles for the same DB. Adding a per-DB thread
+        transaction coordinator that allows the DB thread to run only one
+        transaction per DB file at any given time.
+
+        Adding a regression test for this bug.
+
+        Test: storage/multiple-transactions-on-different-handles.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=27966
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionCoordinator):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionCoordinator):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::debugStepName):
+        (WebCore::SQLTransaction::performNextStep):
+        (WebCore::SQLTransaction::aquireLock):
+        (WebCore::SQLTransaction::lockAquired):
+        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp: Added.
+        * storage/SQLTransactionCoordinator.h: Added.
+
+2009-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
+        https://bugs.webkit.org/show_bug.cgi?id=28194
+
+        * GNUmakefile.am: Added the two new source files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCSSRuleListCustom.cpp: Added.
+        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
+        on rules in the list.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
+        markDOMObjectWrapper on the CSSValue objects that are owned by the
+        declaration as values of the properties.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Added code to handle some
+        cases where nodes are observable because they own objects that
+        in turn have custom properties.
+
+        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
+        for implementation and styleSheets.
+
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
+        for attributes and style.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
+        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
+        on the rendering context.
+
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
+        items in the stylesheet.
+
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::markChildren): Added. Calls
+        markDOMObjectWrapper on stylesheets in the list.
+
+        * css/CSSRuleList.idl: Added CustomMarkFunction.
+        * css/CSSStyleDeclaration.idl: Ditto.
+        * css/StyleSheetList.idl: Ditto.
+        * dom/Element.idl: Ditto.
+        * html/HTMLCanvasElement.idl: Ditto.
+
+        * dom/Element.h: Made everything private that could be.
+        Added access to the attributeMap that does returns
+        the existing map without doing any of the lazy-updating work. This
+        is needed to get at the existing attributes during garbage collection
+        without having side effects.
+
+        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
+        members private. Added renderingContext2D function for use in
+        JSHTMLCanvasElement::markChildren.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
+        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
+        https://bugs.webkit.org/show_bug.cgi?id=28023
+        https://bugs.webkit.org/show_bug.cgi?id=24794
+        
+        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
+        scroll, and use that for pan scrolling.
+
+        Test: platform/win/fast/events/panScroll-nested-divs.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+
+        Added a function for Windows PopupMenu's to return their class name.
+
+         * platform/PopupMenu.h:
+         * platform/win/PopupMenuWin.cpp:
+         (WebCore::PopupMenu::popupClassName):
+
+2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        WINCE PORT: Color and Gradient
+        https://bugs.webkit.org/show_bug.cgi?id=27511
+
+        * platform/graphics/wince/ColorWince.cpp: Added.
+        * platform/graphics/wince/GradientWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        No new tests because it's a just typo fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27458
+        Support for the :default CSS pseudoclass, as per HTML5 spec.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
+
+        Tests: fast/css/pseudo-default-001.html
+               fast/css/pseudo-default-002.html
+               fast/css/pseudo-default-003.html
+               fast/css/pseudo-default-004.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
+        aware that only one default button can be present in a form
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        the :default CSS pseudoclass
+        * dom/Element.h:
+        (WebCore::Element::isDefaultButtonForForm): new method to determine
+        whether a FormControl is a default button for a given form
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::defaultButton): extracts the default button
+        from the form
+        * html/HTMLFormElement.h:
+
+2009-08-12  David Levin  <levin@chromium.org>
+
+        No review, rolling out r47106.
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This patch relied on a new version of v8 which is not available
+        in chromium yet.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26993 : Geolocation::requestPermission()
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        Second patch to allow the Geolocation permission request to chrome to be asynchronous
+        or synchronous. Fixes a bug where callbacks were called twice when permissions
+        are granted synchronously.
+
+        No new tests required.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
+        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
+        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+
+2009-08-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6952336>
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
+
+        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-08-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix [Chromium] drop down menu letter selection, skip selections
+        https://bugs.webkit.org/show_bug.cgi?id=28205
+
+        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
+        event to the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): style change.
+        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
+        a character type event to avoid calling twice for English.
+        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformFont):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::getHaikuStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
+        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
+        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/GraphicsContext.cpp: 
+        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
+        class for Haiku. Adding getHaikuStrokeStyle() function.
+        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
+        this class isn't implemented for the moment.
+        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
+        for Haiku.
+        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
+        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
+        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
+        native pattern type.
+        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding modification to the WebCore/platform/ files to allow
+        the Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
+        class of Haiku.
+        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
+        * platform/DragData.h: Use a BMessage as DragDataRef.
+        * platform/DragImage.h: Use a BBitmap as DragImageRef.
+        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformMenuDescription.h: BMenu is the 
+        PlatformMenuDescription class of Haiku.
+        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
+        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
+        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
+        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
+        so many PLATFORM(HAIKU) were added to these functions.
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
+        invertSenseOfTabsToLinks() function.
+        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
+        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
+        behaves like Cairo or Wx, (not like Skia).
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
+        methods specific to Haiku.
+        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
+        (WebCore::currentSearchLocaleID): Missing function.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the ScrollbarTheme files.
+        https://bugs.webkit.org/show_bug.cgi?id=28125
+
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
+        (buttonWidth):
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
+        (WebCore::ScrollbarThemeHaiku::hasButtons):
+        (WebCore::ScrollbarThemeHaiku::hasThumb):
+        (WebCore::ScrollbarThemeHaiku::backButtonRect):
+        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
+        (WebCore::ScrollbarThemeHaiku::trackRect):
+        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeHaiku::paintButton):
+        (WebCore::ScrollbarThemeHaiku::paintThumb):
+        * platform/haiku/ScrollbarThemeHaiku.h: Added.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28122
+
+        * platform/graphics/haiku/ColorHaiku.cpp: Added.
+        (WebCore::Color::Color):
+        (WebCore::Color::operator rgb_color):
+        (WebCore::focusRingColor):
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BPoint):
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BRect):
+        * platform/graphics/haiku/GradientHaiku.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BPoint):
+        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BRect):
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BSize):
+        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+
+2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Implement Keygen for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/KeygenWince.cpp: Added.
+
+2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Kevin Ollivier.
+
+        Handle crash in wx due to null value passed to strlen in
+        the CString constructor.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):  Check for null return from getenv
+        and use default CString constructor instead.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: simple stubs to make it build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/DragDataWince.cpp: Added.
+        * platform/wince/DragImageWince.cpp: Added.
+        * platform/wince/EditorWince.cpp: Added.
+        * platform/wince/KURLWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCEPORT: FileSystem and FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/FileChooserWince.cpp: Added.
+        * platform/wince/FileSystemWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
+        WinMob devices. We pass the cursor info to application, which so that 
+        can determine what to do.
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/CursorWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+
+2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Pasteboard and SearchPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/PasteboardWince.cpp: Added.
+        * platform/wince/SearchPopupMenuWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/SharedTimerWince.cpp: Added.
+        * platform/wince/SystemTimeWince.cpp: Added.
+
+2009-08-12  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28204
+        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
+
+        * WebCorePrefix.h:
+        Only undefine |try| and |catch| when building Objective-C[++],
+        leaving the C+library definitions intact for C++.
+
+2009-08-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        Tests: fast/events/set-event-in-another-frame.html
+               fast/events/set-event-to-null.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
+            as it currently doesn't support a custom getter 
+            and a v8-specific custom setter simultaneously.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * page/DOMWindow.idl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
+        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+
+        * WebCore.gypi:
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+        Build fix after r47099.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-08-08  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        WINCE PORT: Implement Path for WINCE. Most code can be
+        reused for other ports that don't have native path support
+        https://bugs.webkit.org/show_bug.cgi?id=28188
+
+        Written also by George Staikos (including quadCurve() and bezier())
+
+        * platform/graphics/wince/PathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.h: Added.
+        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        "Double-click to add" new style button does not always show up [quick fix]
+        https://bugs.webkit.org/show_bug.cgi?id=28187
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=28178
+
+        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
+        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
+        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+
+2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=28175
+
+        Call QDir::toNativeSeparators() before the path is passed to the OS.
+
+        Based on work by David Leong.
+        
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::pathByAppendingComponent):
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
+        of getImageData. This changed since r47099.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Explicitly set control tints for Chromium/Mac, since the controls'
+        NSCell(s) lack an NSView and hence their tint isn't updated
+        automatically when the application is activated/deactivated.
+        https://bugs.webkit.org/show_bug.cgi?id=28108
+        http://crbug.com/18199
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::updateNSCellControlTint):
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintButton):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
+        Also optimize by not having to save and restore painter state.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] Fix coding style in GraphicsContextQt.cpp
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+        (WebCore::toQtLineCap):
+        (WebCore::toQtLineJoin):
+        (WebCore::GraphicsContextPlatformPrivate::p):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::pen):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+
+2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann and Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
+        the shadow still does not go well with border radius.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Use AM_V_GEN in a few more places, for less noisy builds.
+
+        * GNUmakefile.am:
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
+        and putImageData of ImageBuffer need support for premultiplied colors.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed Number.bytesToString to support low-resolution output.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28146
+
+        * inspector/front-end/utilities.js:
+        (Number.bytesToString):
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+
+        Webkit uses the runtime patching trick explained by "Feng Yuan" for
+        hooking these paint functions. It currently supports only 32bit assembly
+        code. This patch adds support for 64Bit version. Since inline-assemblies
+        are not supported for 64Bit, we have use a seperate .asm file.
+
+        * WebCore.pro:
+        * plugins/win/PaintHooks.asm: Added.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+            Function signature change.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+
+        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData): Use slightly shorter syntax.
+        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
+        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
+        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
+        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers do not exit when the last parent document exits
+        https://bugs.webkit.org/show_bug.cgi?id=28170
+
+        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+
+        Added vector cache instead of nested hash tables for SharedWorker repository.
+
+        Added SharedWorkerRepository::documentDetached API.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Notifies SharedWorkerRepository when the document is closing.
+        * loader/FrameLoader.cpp:
+        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        (WebCore::SharedWorkerProxy::isClosing):
+        Renamed from closing().
+        (WebCore::SharedWorkerProxy::matches):
+        Added manual equality function to replace old hash lookup.
+        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
+        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Added tracking of the worker's list of documents for lifecycle purposes.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Shuts down the proxy when the last associated document is detached.
+        (WebCore::SharedWorkerProxy::close):
+        Marks the proxy as closed so it is no longer shared with new instances.
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        closing()->isClosing()
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
+        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
+        (WebCore::DefaultSharedWorkerRepository::removeProxy):
+        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
+        (WebCore::DefaultSharedWorkerRepository::documentDetached):
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.h:
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        When returning text through the marker range attributes, the list marker text should
+        also be included. It isn't included by default because a TextIterator is used which
+        only looks at Nodes for text. A list marker does not have a corresponding node,
+        so its text is not returned through accessibility. That is, until now.
+
+        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForRange):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * rendering/RenderListItem.h:
+
+        Make markerText() public so that accessibility code can access it.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
+        merging most of the other ImageSource*.cpp files with it.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
+        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cairo-based Windows port does not handle the https protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=28171.
+
+        No new tests needed.  Existing https tests show this failure
+        for WinCairo builds.
+
+        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
+          definitions for SSL support in cURL.
+        * platform/network/curl/ResourceHandleManager.h: Add new
+          certificate path member variable.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificateBundlePath): New method to retrieve the
+          proper certificate resource bundle path.
+        (WebCore::ResourceHandleManager::initializeHandle): Check for
+          the resource bundle and use if available to activate SSL
+          support.
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28127
+
+        * editing/haiku/EditorHaiku.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/DragDataHaiku.cpp:
+        (WebCore::DragData::createClipboard):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative GTK build fix
+
+        * GNUmakefile.am:
+        Added missing .idl file, and added notifications directory to IDL_PATH.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing build steps for non-debug targets.
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative build fix for Qt build.
+
+        * WebCore.pro: Added /notifications to include path
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds an implementation of desktop notifications, behind the compile-time
+        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
+        API through a NotificationProvider interface, which must provide the services
+        to actually notify the user and manage the desktop.  This provider is injected
+        into WebKit through the ChromeClient for normal page contexts and through the
+        WorkerThread for worker contexts.
+
+        A permissions API is defined on a per-origin basis, which allows a web page
+        to check if its origin is allowed to show desktop notifications, and to request
+        permission for its origin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
+        (WebCore::JSNotificationCenter::requestPermission):
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::JSNotification::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNotification):
+        * dom/EventTarget.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::notificationPresenter):
+        * notifications: Added.
+        * notifications/Notification.cpp: Added.
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::ondisplay):
+        (WebCore::Notification::setOndisplay):
+        (WebCore::Notification::onerror):
+        (WebCore::Notification::setOnerror):
+        (WebCore::Notification::onclose):
+        (WebCore::Notification::setOnclose):
+        (WebCore::Notification::getAttributeEventListener):
+        (WebCore::Notification::setAttributeEventListener):
+        (WebCore::Notification::clearAttributeEventListener):
+        (WebCore::Notification::dispatchDisplayEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::addEventListener):
+        (WebCore::Notification::removeEventListener):
+        (WebCore::Notification::handleEvent):
+        (WebCore::Notification::dispatchEvent):
+        * notifications/Notification.h: Added.
+        (WebCore::Notification::create):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::contents):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::toNotification):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * notifications/Notification.idl: Added.
+        * notifications/NotificationCenter.cpp: Added.
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h: Added.
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::context):
+        (WebCore::NotificationCenter::presenter):
+        * notifications/NotificationCenter.idl: Added.
+        * notifications/NotificationContents.h: Added.
+        (WebCore::NotificationContents::NotificationContents):
+        (WebCore::NotificationContents::icon):
+        (WebCore::NotificationContents::title):
+        (WebCore::NotificationContents::body):
+        * notifications/NotificationPresenter.h: Added.
+        (WebCore::NotificationPresenter::):
+        (WebCore::NotificationPresenter::~NotificationPresenter):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::notificationPresenter):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+
+2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Drawer is Toggling instead of Staying Open
+        https://bugs.webkit.org/show_bug.cgi?id=28115
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
+        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+
+2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
+        https://bugs.webkit.org/show_bug.cgi?id=28180
+
+        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
+        Otherwhise this may lead to crashes related to intrinsic event exeuction.
+
+        Unfortunately select elements aren't testable by the layout tests, so adding
+        a new manual test reproducing the crash.
+
+        * manual-tests/wml/select-onpick-event-crash.wml: Added.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::activeCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+        * wml/WMLPageState.h:
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+
+2009-08-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28073
+        Treat icons with no bit count and no color count as 256-color for
+        purposes of quality ranking.  Also fix a couple cases of a style
+        violation.
+
+        Test: fast/images/icon-0colors.html
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28136
+
+        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+
+        Existing tests are sufficient, as this is only a refactoring.
+
+        * GNUmakefile.am:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.gypi:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerReportingProxy.h to build.
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        Changed constructor to pass WorkerReportingProxy to base class.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
+        * workers/SharedWorkerContext.cpp:
+        * workers/SharedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        Passes WorkerReportingProxy to base class constructor.
+        * workers/SharedWorkerThread.h:
+        Constructor now takes a WorkerReportingProxy.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
+        (WebCore::WorkerContext::close):
+        Now notifies WorkerReportingProxy when the thread is closing.
+        (WebCore::WorkerContext::reportException):
+        Reports exceptions via WorkerReportingProxy.
+        (WebCore::WorkerContext::addMessage):
+        Reports console messages via WorkerReportingProxy.
+        * workers/WorkerContext.h:
+        * workers/WorkerObjectProxy.h:
+        (WebCore::WorkerObjectProxy::workerContextClosed):
+        Default empty implementation for dedicated workers.
+        * workers/WorkerReportingProxy.h: Added.
+        Base interface that contains APIs moved from WorkerObjectProxy.
+        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Updated constructor to accept a WorkerReportingProxy.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerReportingProxy):
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix the Qt build after r47022.
+
+        Use the new markChildren() pattern for marking aggregate/child objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        * bridge/qt/qt_runtime.h:
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the build on the Qt build bot by making the generated JS bindings
+        files depend on the code generator itself.
+
+        * WebCore.pro:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
+
+        Make WebCore use the new iterative marking logic.
+
+        Tests: fast/js/nested-object-gc.html
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::markChildren):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::markChildren):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::markChildren):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::markChildren):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::JSNavigator::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::markChildren):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::markChildren):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::markChildren):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::markAggregate):
+        * dom/NodeFilterCondition.h:
+        (WebCore::NodeFilterCondition::markAggregate):
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        * page/DOMWindow.h:
+        * workers/WorkerContext.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
+        https://bugs.webkit.org/show_bug.cgi?id=28089
+
+        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
+        called by mistake.  This roughly matches the way JSC does it, which is an
+        additional advantage.
+
+        * bindings/v8/NPV8Object.cpp:
+        (npCreateV8ScriptObject):
+        (_NPN_Invoke):
+        (_NPN_InvokeDefault):
+        (_NPN_Evaluate):
+        (_NPN_EvaluateHelper):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearScriptObjects):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectGetProperty):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier):
+        * bindings/v8/npruntime.cpp:
+        * bindings/v8/npruntime_impl.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Change ___Storage.key() to match current spec behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=28112
+
+        The current WebStorage spec says that ___Storage.key() should return null when
+        the index is out of bounds, rather than an exception.  A bunch of logic can be
+        simplified after this change.
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getPropertyNames):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        * storage/Storage.cpp:
+        (WebCore::Storage::key):
+        * storage/Storage.h:
+        * storage/Storage.idl:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::key):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::key):
+        * storage/StorageMap.h:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28087
+
+        Mods for a chrome specific impl of ApplicationCacheHost.
+
+        * The public section of the interface is the same, but we use
+        PLATFORM(CHROMIUM) to identify which parts of the private
+        section are shared. The chrome specific internals are encapsulated
+        in a seperate ApplicationCacheHostInternal class. WebCore common
+        code only contains a forward reference to this class.
+
+        * Cleanup a couple of stale comments.
+
+        * Have window.applicationCache return null to script when the
+        feature is disabled in the preferences.
+        
+        No new tests.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::documentLoader):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Implement GraphicsContext::fillRoundRect() for WINCE port
+        https://bugs.webkit.org/show_bug.cgi?id=27842
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::rectCenterPoint):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawRoundCorner):
+
+2009-08-10  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resources / Graphs should support filtering
+        https://bugs.webkit.org/show_bug.cgi?id=20629
+
+        Introduces a filter bar for resources.
+
+        Thanks to Matt Lilek for the CSS scope bar.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement):
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction after http://trac.webkit.org/changeset/46978
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):  Correct
+         deprecated removeRef to new removeFragmentIdentifier.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Background color formatting lost on enter
+        https://bugs.webkit.org/show_bug.cgi?id=20348
+
+        This patch makes background color be preserved during editing.
+        In particular, editingStyleAtPosition would include the background color when obtaining styles.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
+
+2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Stop sending QEvent::CursorChange to Qt for mouse move.
+
+        Verify if the cursor didn't change in WidgetQt::setCursor,
+        just like the mac port does.
+
+        Thanks to Adriano Rezendo for spotting and debugging the
+        issue.
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-08-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28165
+        Application cache maximum size cannot be set before the database is opened
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
+        open yet.
+
+2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
+        https://bugs.webkit.org/show_bug.cgi?id=28156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8ObjectEventListener.h:
+        (WebCore::V8ObjectEventListener::isObjectListener):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
+        (WebCore::toEventType):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Made static.
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage namespace shutdown code usage of security origin.
+        https://bugs.webkit.org/show_bug.cgi?id=28094
+
+        If a storage namespace is not explicitly closed, be sure to do so on
+        destruction of the object.  In addition, the close call should wait
+        on the background thread finishing its syncing.  (Not doing so is actually
+        a regression from the original LocalStorage code.)
+
+        There's no point to passing in the SecurityOrigin when copying a storage
+        area since what was passed in is exactly what is stored within each
+        storage area.  In addition, the non-copy constructor should take in a
+        PassRefPtr rather than a pointer since that pointer was only passed into
+        the constuctor for RefPtr's anyway.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed, build fix.
+
+        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::canAccessDeck):
+
+2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
+        Fixes linker warnings.        
+        
+        Corrected spelling of JSInspectorBackend.cpp.
+        
+        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove a dead #define.
+
+        * bindings/js/JSDOMBinding.cpp:
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update KURLGoogle for ref* method renames in
+        http://trac.webkit.org/changeset/46978.
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
+            setFragmentIdentifier, respectively.
+        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
+
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
+        for r46989.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+
+2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
+
+        Reviewed by Darin Adler.
+
+        Memory leak in error handling code for SOUP interface
+        https://bugs.webkit.org/show_bug.cgi?id=28144
+
+        Freed memory leaked in error handling code for soup requests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide graceful handling of the situation when an embedder invokes
+        visited link update methods before a Page constructor has been called.
+        https://bugs.webkit.org/show_bug.cgi?id=28149
+
+        * page/Page.cpp:
+        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
+        (WebCore::Page::visitedStateChanged): Ditto.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTKbuild.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-08-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
+
+        * platform/graphics/GlyphBuffer.h: Removed advanceData().
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
+            instead of advanceData() from.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove workaround for older libsoup versions.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Let startHttp validate the URI instead of doing it, with potential
+        crashes, in ::start.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        When empty <input> is focused, getSelection() exposes shadow tree nodes
+        https://bugs.webkit.org/show_bug.cgi?id=15903
+
+        Test: fast/forms/shadow-tree-exposure.html
+
+        * page/DOMSelection.cpp:
+        (WebCore::selectionShadowAncestor): Added.
+        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::focusNode): Ditto.
+        (WebCore::DOMSelection::focusOffset): Ditto.
+        (WebCore::DOMSelection::baseNode): More of the same, but since this
+        is a WebKit-invented property, it does not match Firefox.
+        (WebCore::DOMSelection::baseOffset): Ditto.
+        (WebCore::DOMSelection::extentNode): Ditto.
+        (WebCore::DOMSelection::extentOffset): Ditto.
+        (WebCore::DOMSelection::isCollapsed): Return true even when the
+        selection is a range, if the selection is in the shadow tree.
+        Matches Firefox. Also changed behavior when called and the frame
+        is gone to return true instead of false which makes more sense.
+        (WebCore::DOMSelection::empty): Use clear() just like the other
+        selection-clearing function in this file does.
+        (WebCore::DOMSelection::getRangeAt): Return a range that starts
+        and ends before the shadow ancestor. Matches Firefox.
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make all status bar button images glyph-based.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28124
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
+        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/consoleButtons.png: Removed.
+        * inspector/front-end/Images/dockButtonGlyph.png: Added.
+        * inspector/front-end/Images/dockButtons.png: Removed.
+        * inspector/front-end/Images/enableButtons.png: Removed.
+        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
+        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtons.png: Removed.
+        * inspector/front-end/Images/focusButtonGlyph.png: Added.
+        * inspector/front-end/Images/focusButtons.png: Removed.
+        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
+        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
+        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
+        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
+        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
+        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
+        * inspector/front-end/Images/percentButtonGlyph.png: Added.
+        * inspector/front-end/Images/percentButtons.png: Removed.
+        * inspector/front-end/Images/recordButtonGlyph.png: Added.
+        * inspector/front-end/Images/recordButtons.png: Removed.
+        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtons.png: Removed.
+        * inspector/front-end/Images/undockButtonGlyph.png: Added.
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.createStatusBarButton):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        KURL ref() methods should be fragmentIdentifier() methods 
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        In addition to the renames, also took the chance to replace all use of:
+        setRef(String());
+        with:
+        removeFragmentIdentifier();
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::KURL::prettyURL):
+        (WebCore::equalIgnoringFragmentIdentifier):
+        * platform/KURL.h:
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::hash):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::gotoAnchor):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::urlsMatchItem):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * page/Location.cpp:
+        (WebCore::Location::hash):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::isURLAllowed):
+        * workers/WorkerLocation.cpp:
+        (WebCore::WorkerLocation::hash):
+
+2009-08-10  Andy Shaw <andy.shaw@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
+
+        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
+        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
+        as from Qt through its knowledge of globally registered eventloops.
+
+        There is no unit test for this bug as it would require exporting additional symbols and
+        introduce the synchronous loader as global variable just for the test.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make properties inspection serialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28078
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectRef):
+        (WebInspector.ObjectPropertyRef):
+        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] wml.css lacks <pre> support
+        https://bugs.webkit.org/show_bug.cgi?id=28135
+
+        Add <pre> support for WML.
+        Extended fast/wml/text-emphasis.wml to cover <pre> support.
+
+        * css/wml.css: <pre> section copied from html.css
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Deck access control is completly broken
+        https://bugs.webkit.org/show_bug.cgi?id=27721
+
+        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
+        Added several new layout tests covering local & remote access support.
+
+        In order to detect WML task execution failures from within the WML layout tests a new
+        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
+        error message. Change WML log messages to dump to InspectorClient, just like it's done
+        for HTML - we used to behave like JSMessageSource, which is wrong.
+
+        Tests: http/tests/wml/access-target-domain-deny.html
+               http/tests/wml/access-target-path-deny.html
+               http/tests/wml/access-target.html
+               wml/access-target-deny.html
+               wml/access-target.html
+
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
+        (WebCore::ConsoleMessage::message): Added public method to access the error message.
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
+        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
+        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
+        * page/Console.h:
+        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
+        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        (WebCore::WMLAccessElement::insertedIntoDocument):
+        * wml/WMLAccessElement.h:
+        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
+        (WebCore::reportWMLError):
+        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::normalizedHostName):
+        (WebCore::hostFromURL):
+        (WebCore::urlForHistoryItem):
+        (WebCore::tryAccessHistoryURLs):
+        (WebCore::WMLPageState::processAccessControlData):
+        (WebCore::WMLPageState::resetAccessControlData):
+        (WebCore::WMLPageState::canAccessDeck):
+        (WebCore::WMLPageState::hostIsAllowedToAccess):
+        (WebCore::WMLPageState::pathIsAllowedToAccess):
+        * wml/WMLPageState.h:
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        FrameLoadType / WebFrameLoadType enums are out of sync
+        https://bugs.webkit.org/show_bug.cgi?id=28132
+
+        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
+        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
+
+        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
+
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] manual-tests/wml/onevent-prev.wml crashes
+        https://bugs.webkit.org/show_bug.cgi?id=27722
+
+        Fix intrinsic event execution, leading to crashes.
+        First finish parsing the document, then execute the events. Not the other way round.
+        -> exposes bugs all over the WML layout tests, which relied on that quirk.
+
+        Fixes manual-tests/wml/onevent-prev.wml.
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+
+2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
+        introduced by http://trac.webkit.org/changeset/46956.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * WebCore.gypi: Added ImageBuffer.cpp.
+
+2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Jan Michael Alonzo.
+
+        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
+        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
+
+        * dom/Document.idl:
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter need feColorMatrix implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=27711]
+
+        Adds the filter effect feColorMatrix to SVG filters. 
+
+        There is already a test in the w3c directory.
+        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::matrix):
+        (WebCore::saturate):
+        (WebCore::huerotate):
+        (WebCore::luminance):
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Build fix for Tiger.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        This is an initial implementation for linearRGB and sRGB support for all
+        platforms. Some platforms like Cg support different color spaces
+        natively, others like Qt, Cairo and Skia do not. This patch uses the
+        native implementation of platforms if possible and offers a common version
+        if not.
+
+        Different color spaces are used in SVG Filters. Nearly every Filter test 
+        case is a test for this patch and will be enabled, once Filters are enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/ImageBuffer.cpp: Added.
+        (WebCore::ImageBuffer::transformColorSpace):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        (WebCore::ImageBuffer::create):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::scratchContext):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-08-08  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out r46928, since it wasn't done in accordance with the
+        agreed naming.
+
+        * bindings/gdom/GdomDOMObject.cpp: Removed.
+
+2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Enable accessibility in Gtk DRT
+        https://bugs.webkit.org/show_bug.cgi?id=25989
+
+        Add SPI to get the focused accessible element to be used by DRT.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_focused_element):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the binding generator's include path
+
+        * GNUmakefile.am:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Another attempt to fix windows.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the include path.
+
+        * GNUmakefile.am:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for Qt following r46937.
+
+        * WebCore.pro:
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::advanceData):
+        (WebCore::GlyphBuffer::add):
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: pass unrecognized glyphs to GDI to handle
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-08-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move Canvas related file to a subdirectories
+        https://bugs.webkit.org/show_bug.cgi?id=28026
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/CanvasGradient.cpp: Removed.
+        * html/CanvasGradient.h: Removed.
+        * html/CanvasGradient.idl: Removed.
+        * html/CanvasPattern.cpp: Removed.
+        * html/CanvasPattern.h: Removed.
+        * html/CanvasPattern.idl: Removed.
+        * html/CanvasPixelArray.cpp: Removed.
+        * html/CanvasPixelArray.h: Removed.
+        * html/CanvasPixelArray.idl: Removed.
+        * html/CanvasRenderingContext2D.cpp: Removed.
+        * html/CanvasRenderingContext2D.h: Removed.
+        * html/CanvasRenderingContext2D.idl: Removed.
+        * html/CanvasStyle.cpp: Removed.
+        * html/CanvasStyle.h: Removed.
+        * html/canvas: Added.
+        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
+        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
+        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
+        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
+        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
+        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
+        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
+        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
+        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
+        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
+        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
+        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
+        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
+        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
+
+2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        QtWebkit ignores letter-spacing and word-spacing styles.
+        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
+        class, but the values for these options are not not passed on from
+        the platform independent part of the Font class.
+        Fixed QtWebkit behavior by applying the options to QFont when it is
+        returned via Font::font()
+
+        http://bugs.webkit.org/show_bug.cgi?id=27988
+
+        LayoutTests:
+        fast/css/word-space-extra.html
+        css2.1/t1604-c542-letter-sp-00-b-a.html
+        css2.1/t1604-c541-word-sp-01-b-a.html
+        css1/text_properties/word_spacing.html
+        
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use correct highlight color for listboxes and completion popups.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28090
+
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        Rename activeListBoxSelectionBackgroundColor to
+        platformActiveListBoxSelectionBackgroundColor, so that it actually
+        overrides a virtual method.
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added a fourth bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/PasteboardHaiku.cpp: Added.
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::generalPasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::clear):
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
+        Heavily inspired by Firefox's take on this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27909
+
+        Reviewed by Eric Seidel.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        Tell jpeglib to convert ycck to cmyk and keep cmyk.
+        (WebCore::convertCMYKToRGBA):
+        Added function to convert cmyk to rgb.
+        (WebCore::convertRGBToRGBA):
+        Extracted existing conversion logic into its own function.
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
+        images.
+
+2009-08-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers should be shared
+        https://bugs.webkit.org/show_bug.cgi?id=28058
+
+        Added tracking of shared workers to the SharedWorkerRepository.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
+        (WebCore::SharedWorkerProxy::thread):
+        (WebCore::SharedWorkerProxy::closing):
+        Added flag used to determine whether the worker has closed itself while loading.
+        (WebCore::SharedWorkerProxy::url):
+        (WebCore::SharedWorkerProxy::name):
+        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToDocumentSet):
+        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now handles "worker already loaded" case.
+        (WebCore::SharedWorkerRepository::connect):
+        Delegates to DefaultSharedWorkerRepository::connectToWorker
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Atomic get-or-create operation on the internal tracking HashMap.
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/SharedWorkerRepository.h:
+        Removed instance() API and made constructor private to prevent instantiation.
+        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added four Haiku-specific files for WebCore:
+        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
+        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/PopupMenuHaiku.cpp: Added.
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::updateFromElement):
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+        * platform/haiku/ScreenHaiku.cpp: Added.
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/haiku/SoundHaiku.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added two Haiku-specific files to WebCore:
+        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/TemporaryLinkStubs.cpp: Added.
+        (loadResourceIntoArray):
+        (WebCore::historyContains):
+        (WebCore::supportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::callOnMainThread):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::getSupportedKeySizes):
+        * platform/haiku/WidgetHaiku.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setIsSelected):
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix the problem that isAttribute is set to false for onerror and
+        onmessage in worker custom code.
+        https://bugs.webkit.org/show_bug.cgi?id=28083
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28071
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        selectionHasStyle doesn't handle text-specific properties properly
+        https://bugs.webkit.org/show_bug.cgi?id=27858
+
+        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
+        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
+        regardless of whether the style is also present in their ancestor nodes or not.
+        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
+
+        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
+        at least one text node, rather than at the beginning of selection except on Mac.
+        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
+
+        Test: editing/execCommand/toggle-compound-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
+        * editing/Editor.cpp:
+        (WebCore::):
+        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
+        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
+        * editing/EditorCommand.cpp:
+        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28082
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+
+2009-08-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Cairo-based Windows port does not handle cookies properly
+        https://bugs.webkit.org/show_bug.cgi?id=27414
+
+        curl handles cookies by itself, so using WinINet functions
+        to get and set cookies is wrong.
+
+        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
+        cookies can be implemented later once curl provides an API to
+        get and set cookies.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28074
+
+        V8 bindings for the window.applicationCache attribute.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
+
+2009-08-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Right click on timeline of media controls panel cause seek
+        https://bugs.webkit.org/show_bug.cgi?id=27920
+
+        Add a test simulate the behavior of seeking by right clicking
+        on the time bar of media controls while playing.
+
+        * media/controls-right-click-on-timebar-expected.txt: Added.
+        * media/controls-right-click-on-timebar.html: Added.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        deprecatedCopyInheritableProperties must be replaced by two different functions
+        https://bugs.webkit.org/show_bug.cgi?id=28057
+
+        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
+        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
+        which consists of all CSS properties need to be preserved under editing operations.
+
+        No test is added since this patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::):
+        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
+        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
+        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
+        * editing/ApplyStyleCommand.h:
+        (WebCore::):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
+        * editing/EditCommand.cpp:
+        * editing/EditCommand.h:
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
+        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
+        * editing/markup.cpp:
+        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
+        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
+        (WebCore::createMarkup): Uses editingStyleAtPosition
+
+2009-08-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27250: Geolocation callback function IDL files are superfluous
+        https://bugs.webkit.org/show_bug.cgi?id=27250
+
+        The objects for the Geolocation success and error callbacks are created 'manually' in
+        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
+        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
+        appear on the window object. Hence IDL files for these callbacks are not required.
+
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
+        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
+
+        No new tests required.
+
+        * DerivedSources.make: Modified. Removed reference to IDL files.
+        * WebCore.gypi: Modified. Removed reference to IDL files.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
+        put the idl files back into play regardless of compile time defines.
+
+        * html/TimeRanges.idl:
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
+        from discarding style colour.
+
+        Add tests and remove tests from platform/qt/Skipped that now pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        Tests: fast/forms/menulist-style-color.html
+               fast/forms/text-style-color.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::adjustMenuListStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+
+2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
+        http://trac.webkit.org/changeset/46874 re-landed
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler and George Staikos.
+
+        Add rectToRect convenience function which returns the TransformationMatrix
+        which maps the 'from' rectangle to the 'to' rectangle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28067
+
+        No tests as this would require binding the method to js and since it is static
+        that doesn't seem possible.  Please check the math.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::rectToRect):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the HTML5 hashchange event.
+        https://bugs.webkit.org/show_bug.cgi?id=21605
+
+        Test: fast/loader/hashchange-event.html
+
+        * dom/EventNames.h: Add "hashchange"
+        * html/HTMLAttributeNames.in: Add "onhashchange"
+
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::HashChangeEventTask::HashChangeEventTask):
+        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
+          new fragment identifier is different from the old one, queue a hash change event
+          on the Document.
+
+        Add a window event listener for the hashchange event if onhashchange is encountered:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): 
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+
+        Add a new string utility method that gives "null and empty are equivalent" behavior:
+        * platform/text/PlatformString.h:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.h:
+
+2009-08-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add the initial implementation of the ability to resize the columns in
+        a DataGrid in the Web Inspector. Enables that functionality in both the
+        Profile View and in the Local Storage View.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26182
+        
+        In this version, resizing a column can change the width of at most two
+        columns (the columns to the left and right of the resizer being dragged).
+        
+        Possible changes in future patches:
+        
+        1) Be able to specify the minimum size of a column and the maximum size
+           of a column. If the minimum size is equal to the maximum size, the
+           column can't be resized.
+        2) Make the behavior more in line with the following description:
+        
+        Everything before the column that is resized stays fixed size. The
+        resized column changes sizes. The other columns except the last stay
+        the same size. And the last column adjusts to fit with a minimum size.
+        If the last column is already the minimum, the next to last column
+        shrinks, etc.
+        
+        3) Make it possible to scale the column sizes appropriately when the
+           Web Inspector window gets resized.
+        
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        Once the DataGrid is added to the DOM, update the widths of the
+        DataGrid in order to put the resizers in place.
+        (WebInspector.DOMStorageItemsView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        Store column groups whose widths can later be changed when the columns
+        are resized by the user.
+        Also, keep track of whether the widths of the columns have been
+        initialized.
+        (WebInspector.DataGrid.prototype.updateWidths):
+        Create the resizers for the columns.
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        Didn't actually change anything in this method, just added a comma to
+        the end of the function.
+        (WebInspector.DataGrid.prototype._startResizerDragging):
+        Store the resizer that is currently dragging.
+        (WebInspector.DataGrid.prototype._resizerDragging):
+        Constrain the area that the resizer can be dragged to the column to
+        it's left and right, with some padding added to make sure that the
+        neighboring columns don't disappear.
+        (WebInspector.DataGrid.prototype._endResizerDragging):
+        
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.show):
+        Now that the DataGrid is actually attached to the DOM, update the
+        widths of the DataGrid in order to put the resizers in place.
+        (WebInspector.ProfileView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/inspector.css:
+        Add in a style rule for a resizer in the Data Grid.
+
+2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Back out r46847 and fix the Qt build system to always generate
+        all the JS binding files from IDL files. The generated files
+        have #if feature guards, so the #ifs are not needed in the
+        files using them.
+
+        * WebCore.pro:
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Cannot scroll for box-reflect:right
+        https://bugs.webkit.org/show_bug.cgi?id=27979
+
+        Update m_overflowLeft an m_overflowWidth for reflection just like
+        m_overflowTop and m_overflowHeight.
+
+        Test: fast/reflections/reflection-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        box-shadow's spread is ignored with <table>
+        https://bugs.webkit.org/show_bug.cgi?id=28017
+
+        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+
+        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+
+2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: add support for @font-face
+        https://bugs.webkit.org/show_bug.cgi?id=28015
+        
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+        Modified #ifdefs so that chromium linux can load remote fonts.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
+        
+        (WebCore::RemoteFontStream::RemoteFontStream):
+        (WebCore::RemoteFontStream::~RemoteFontStream):
+        (WebCore::RemoteFontStream::rewind):
+        (WebCore::RemoteFontStream::read):
+
+        New class that implements SkStream interface and wraps wtf's SharedBuffer.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+
+        Added member variables for Linux.
+        
+2009-08-06  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix JPEGImageDecoder.cpp compile error on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=28051
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Adding WebCore support for the waf build system for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * wscript: Added.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Revert 46877 because it broke GTK.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 27956 - AX: roleValue should be cached for performance
+        https://bugs.webkit.org/show_bug.cgi?id=27956
+
+        Caches the role value of an accessibility object instead of calculating it everytime.
+        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+
+        Use generic role setter instead of specific ARIA role setter.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::headingLevel):
+
+        Make headingLevel into instance method so that it can *safely* be called in the constructor.
+
+        (WebCore::AccessibilityObject::setRoleValue):
+        (WebCore::AccessibilityObject::roleValue):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        (WebCore::AccessibilityRenderObject::headingLevel):
+        (WebCore::AccessibilityRenderObject::intValue):
+        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetHeadingLevel):
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Change Noncopyable inheriting to public
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
+        inheriting has been changed to public.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        
+        Add a new Media interface, obtainable via the AbstractView, that can
+        evaluate queries via its matchesMedium() method.
+
+        Test: fast/media/matchmedium-query-api.html
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Add Media.* files to the build.
+
+        * css/Media.cpp: Added.
+        (WebCore::Media::Media):
+        (WebCore::Media::type):
+        (WebCore::Media::matchMedium):
+        * css/Media.h: Added.
+        (WebCore::Media::create):
+        (WebCore::Media::document):
+        * css/Media.idl: Added.
+        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
+
+        * page/AbstractView.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Add a readonly attribute for Media.
+
+2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27455
+        Support for a custom validation message in ValidityState and related
+        form controls.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
+
+        Tests: fast/forms/ValidityState-customError-001.html
+               fast/forms/ValidityState-customError-002.html
+               fast/forms/ValidityState-customError-003.html
+               fast/forms/ValidityState-customError-004.html
+
+        * html/HTMLButtonElement.idl: setCustomValidity DOM method
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): moved down
+        * html/HTMLInputElement.idl: ditto
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
+        validation message
+        (WebCore::ValidityState::customError): validation flag
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying .idl files in to the framework resources directory.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build some more.
+
+        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
+        files and groups in to the appropriate locations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add WebSocket.idl
+        https://bugs.webkit.org/show_bug.cgi?id=27209
+
+        Add WebSocket.idl in WebCore/websockets/.
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.cpp: Added.
+        * bindings/js/JSWebSocketConstructor.h: Added.
+        * bindings/js/JSWebSocketCustom.cpp: Added.
+        * websockets/WebSocket.cpp: Added.
+        * websockets/WebSocket.h: Added.
+        * websockets/WebSocket.idl: Added.
+
+2009-08-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Style cleaning for WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27997
+
+        Cleanup WorkerContextExecutioonProxy related files to follow
+        WebKit coding styles after all V8 binding codes are upstreamed.
+        1) Lower-case the first letter of remaining functins in class
+           WorkerContextExecutionProxy. Update the V8 code generator
+           and all other references accordingly.
+        2) Integrate getConstructor from WorkerContextExecutionProxy
+           to V8DOMWrapper.
+        3) Other misc changes, like removing trailing whitespaces and
+           sorting the include files.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::removeEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionProxy::context):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-06  Darin Adler  <darin@apple.com>
+
+        Fix Mac Leopard debug build.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
+        is always >= 0 and checking causes a warning in the newer versions of gcc.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreview rollout.
+
+        Revert 46840 because it broke the reliability tests.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::context):
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: move style-related utilities into InjectedScript.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
+        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
+        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
+        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeStyle):
+        (InjectedScript._getUniqueStyleProperties):
+        (InjectedScript._getLonghandProperties):
+        (InjectedScript._getShorthandPriority):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertyTreeElement.prototype.get priority):
+        (WebInspector.StylePropertyTreeElement.prototype.get value):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/utilities.js:
+
+2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix, add #ifdef guards around
+        inclusions of shared worker specific files.
+
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        cssgrammar.cpp fails to compile with RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=27952
+
+        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
+        memory allocation 
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase):
+        * platform/text/StringImpl.h: 
+        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
+          function that works with a character pointer and length
+
+2009-08-06  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Created first working implementation of SharedWorkers (execution only, no sharing).
+        https://bugs.webkit.org/show_bug.cgi?id=27927
+
+        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
+        No v8 bindings yet.
+
+        * DerivedSources.cpp:
+        Added shared worker files.
+        * DerivedSources.make:
+        Added shared worker files.
+        * GNUmakefile.am:
+        Added shared worker files.
+        * WebCore.gypi:
+        Added shared worker files.
+        * WebCore.pro:
+        Added shared worker files.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added shared worker files.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added shared worker files.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Added code to convert from EventTarget to correct JS class.
+        (WebCore::toEventTarget):
+        Added code to cast from JS object to appropriate EventTarget impl class.
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        Tweaked the constructor code to pass in the lexical global object like normal workers.
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
+        (WebCore::JSSharedWorkerContext::mark):
+        Custom marking of the onconnect handler.
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSSharedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Added proper conversion to the correct WorkerContext derived class.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Added support for SharedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added shared worker bindings files.
+        * dom/EventNames.h:
+        Added connect event.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorkerContext):
+        Added API for casting to new derived class (SharedWorkerContext).
+        * dom/EventTarget.h:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::resolveURL):
+        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::logException):
+        Refactored exception handling code - moved onerror handling to base class.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        Changed constructor to fire up worker thread.
+        * workers/SharedWorker.h:
+        * workers/SharedWorkerContext.cpp: Added.
+        (WebCore::SharedWorkerContext::SharedWorkerContext):
+        (WebCore::SharedWorkerContext::~SharedWorkerContext):
+        (WebCore::SharedWorkerContext::logException):
+        (WebCore::SharedWorkerContext::addMessage):
+        Placeholder methods until we add support for sending exceptions/messages to console.
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        (WebCore::SharedWorkerContext::thread):
+        * workers/SharedWorkerContext.h: Added.
+        (WebCore::SharedWorkerContext::create):
+        (WebCore::SharedWorkerContext::isSharedWorkerContext):
+        (WebCore::SharedWorkerContext::toSharedWorkerContext):
+        (WebCore::SharedWorkerContext::setOnconnect):
+        (WebCore::SharedWorkerContext::onconnect):
+        (WebCore::SharedWorkerContext::name):
+        * workers/SharedWorkerContext.idl: Added.
+        * workers/SharedWorkerRepository.h: Added.
+        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.cpp: Added.
+        Implementation of core singleton class that will be used to implement sharing.
+        (WebCore::SharedWorkerProxy::setThread):
+        Proxy object used to handle resource loading for a given shared worker.
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Placeholder routines until we implement loading.
+        (WebCore::SharedWorkerConnectTask::create):
+        Creates a task to fire off a connect event on the worker thread.
+        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
+        Added helper object to load the initial script for the worker.
+        (WebCore::SharedWorkerLoader::load):
+        (WebCore::SharedWorkerLoader::notifyFinished):
+        (WebCore::SharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Fires off the worker thread once the script is loaded.
+        (WebCore::SharedWorkerRepository::connect):
+        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
+        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.h: Added.
+        * workers/SharedWorkerThread.cpp: Added.
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        (WebCore::SharedWorkerThread::~SharedWorkerThread):
+        (WebCore::SharedWorkerThread::createWorkerContext):
+        * workers/SharedWorkerThread.h: Added.
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isSharedWorkerContext):
+        (WebCore::WorkerContext::isDedicatedWorkerContext):
+        Added APIs to determine the type of a given context.
+
+2009-08-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Added ENABLE_3D_CANVAS flag to build, default to off
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] windowsKeyCodeForKeyEvent fix
+
+        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2009-08-06  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Remove the dead wince/ directory that should never have gone in.
+
+        * svg/graphics/wince: Removed.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Extract style editing into a separate file that is
+        going to be loaded in page context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/InjectedScript.js: Added.
+        (InjectedScript.applyStyleText):
+        (InjectedScript.setStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript.setStyleRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Remove bug-bait V8Proxy::context()
+        https://bugs.webkit.org/show_bug.cgi?id=27826
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium Linux build.  This function is
+        not used.
+
+        * bindings/v8/OwnHandle.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a weak handle to the original context.  We use that handle
+        to call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Revert http://trac.webkit.org/changeset/46821, which was
+        landed to supplement http://trac.webkit.org/changeset/46816, but
+        now that the latter is reverted, the former needs the same.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Color is only reported in rgb() format; should toggle between rgb() and hex
+        https://bugs.webkit.org/show_bug.cgi?id=13516
+
+          New Class to Parse and Change Between Color Representations:
+
+        * inspector/front-end/Color.js: Added.
+        (WebInspector.Color):
+
+          Representations of Colors in Raw Form. (May be Lazy Loaded):
+
+        (WebInspector.Color.prototype.get shorthex):
+        (WebInspector.Color.prototype.get hex):
+        (WebInspector.Color.prototype.set hex):
+        (WebInspector.Color.prototype.get rgb):
+        (WebInspector.Color.prototype.set rgb):
+        (WebInspector.Color.prototype.get hsl):
+        (WebInspector.Color.prototype.set hsl):
+        (WebInspector.Color.prototype.get nickname):
+        (WebInspector.Color.prototype.set nickname):
+        (WebInspector.Color.prototype.get rgba):
+        (WebInspector.Color.prototype.set rgba):
+        (WebInspector.Color.prototype.get hsla):
+        (WebInspector.Color.prototype.set hsla):
+
+          Helpers and Standard String Representations:
+
+        (WebInspector.Color.prototype.hasShortHex):
+        (WebInspector.Color.prototype.toRgb):
+        (WebInspector.Color.prototype.toHsl):
+        (WebInspector.Color.prototype.toShortHex):
+        (WebInspector.Color.prototype.toHex):
+        (WebInspector.Color.prototype.toRgba):
+        (WebInspector.Color.prototype.toHsla):
+        (WebInspector.Color.prototype.toNickname):
+
+          Conversion Functions to Determine Other Representations:
+          My Sources for all algorithms and sample data:
+          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
+          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
+
+        (WebInspector.Color.prototype.rgbToHex):
+        (WebInspector.Color.prototype.hexToRgb):
+        (WebInspector.Color.prototype.rgbToHsl):
+        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
+        (WebInspector.Color.prototype.hslToRgb):
+        (WebInspector.Color.prototype.rgbaToHsla):
+        (WebInspector.Color.prototype.hslaToRgba):
+
+          Called from the constructor, attempts to parse and will throw an error
+          if it cannot parse.  If simple then the "hex" value is guarenteed.
+          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
+          a nickname in any way (e.g. "transparent", "black") then this is
+          guarenteed to be set as well.
+
+        (WebInspector.Color.prototype.parse):
+
+          Clicking on the swatch will rotate through Color Representations.
+            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
+            Advanced: rgba -> hsla -> nickname? -> (loop around)
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+          Load Color.js:
+
+        * inspector/front-end/inspector.html:
+
+2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Support setting event listeners for message ports in the worker process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28004
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-05  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28022
+
+        Minor fix for media code on chromium/skia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Client side image maps did not handle zoom correctly.
+        Client side image maps did not handle border and padding correctly.
+
+        Test: fast/images/image-map-zoom.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
+        element using the content box and the effective zoom.
+
+2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28027
+        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
+        precomposed Unicode
+
+        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
+        FileSystem.h instead of custom code for getting file size. This adds path normalization
+        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
+        important anyway.
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Include Media into V8 bindings.
+
+        * bindings/v8/DOMObjectsInclude.h: Added Media include.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
+        * bindings/v8/V8Index.cpp: Added decl for V8Media.
+        * bindings/v8/V8Index.h: Added V8Media include.
+
+2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix Windows layout test crashes.
+
+        PluginView::removeFromUnstartedListIfNecessary() would try to remove
+        any unstarted PluginView from the Page's set of unstarted plug-ins,
+        regardless of why the PluginView wasn't started. If we tried to start a
+        plug-in, but it failed to start, we would hit an assertion in
+        Page::removeUnstartedPlugin() that asserts that we would only modify the
+        unstarted plug-ins set if we were not currently starting plug-ins.
+
+        Fix this by having PluginView track whether it's waiting to be started,
+        and to check this before trying to remove itself from the Page's
+        unstarted plug-ins set.
+
+        Reviewed by Darin Adler.
+
+        * page/Page.cpp:
+        (WebCore::Page::removeUnstartedPlugin):
+        Assert that the passed PluginView is in the unstarted set.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        Set that we are not waiting to be started.
+        (WebCore::PluginView::startOrAddtoUnstartedList):
+        Set that we are waiting to be started.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        Check not whether we are started, but whether we are waiting to be
+        started.
+        (WebCore::PluginView::PluginView):
+
+        * plugins/PluginView.h:
+
+2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
+
+       Fix DOM Storage memory leak
+       https://bugs.webkit.org/show_bug.cgi?id=28029
+
+       Forgot to use adoptRef in one place.  This caused the = operator to
+       increment the ref count when it shouldn't have, so StorageAreaImpl's were
+       never freed.
+
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Last patch. Makes all the casts of RenderObject use checked
+        casts instead of using static_cast directly.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::visibleChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::elementRect):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::attach):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::defaultEventHandler):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::addSearchResult):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::parseMappedAttribute):
+        (WebCore::HTMLLIElement::attach):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * page/Frame.cpp:
+        (WebCore::Frame::ownerRenderer):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        * page/wince/FrameWince.cpp:
+        (WebCore::computePageRectsForFrame):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::computeEdgeInfo):
+        (WebCore::RenderFrameSet::setIsResizing):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentsBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+        (WebCore::RenderListItem::explicitValueChanged):
+        * rendering/RenderObject.cpp:
+        (WebCore::updateListMarkerNumbers):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::invalidateCountersInContainer):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderThumb):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::determineSliderThumbState):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::findSVGRootObject):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attach):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::rootInlineBoxForTextContentElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+        Use checked casts.
+
+        * rendering/RenderApplet.h:
+        * rendering/RenderCounter.h:
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMedia.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.h:
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/RenderVideo.h:
+        Added a checked cast. Also made most members protected or private.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.h:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTextControl.h:
+        Made most members protected or private.
+
+        * rendering/RenderInline.cpp:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGImage.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        Removed unneeded destructor.
+
+        * rendering/RenderSVGHiddenContainer.h:
+        Removed unneeded virtual function overrides that did the same as
+        the default and base class.
+
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
+        directly instead of using a function call.
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
+        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
+        all values instead of using a default case.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Removed dependency on casting to types that don't
+        have any public members we need to get at. Instead, use function names to
+        identify the type rather than doing so much overloading. Changed to use
+        checked casts.
+        (WebCore::write): Ditto.
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
+        added a comment about the fact that the code does not do sufficient type
+        checking before doing the cast.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
+        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
+        (WebCore::writeSVGText): Renamed this from write.
+        (WebCore::writeSVGInlineText): Ditto.
+        (WebCore::writeSVGImage): Ditto.
+        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
+        unneeded default arguments.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+        Fix a pair of compiler warnings on the GTK Linux buildbot.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Return multiple icon entries from the ICO decoder as separate frames,
+        sorted by decreasing quality (much like the CG ICO decoder does).
+
+        As a result of this change, we can eliminate the Skia-specific setData()
+        hack that the Chromium port used to select the desired icon size -- now
+        callers can just enumerate the frames and ask for the data from the one
+        they like.
+        
+        Under the hood, the ICO decoder now keeps vectors for a number of things
+        (including directory entries and image decoders) where it used to have
+        single members.  However, callers (that I have seen) will only request
+        one frame from the icon, so practically there aren't going to be lots of
+        instantiated image decoders.
+
+        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
+        * platform/graphics/skia/ImageSourceSkia.h: Removed.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
+        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
+        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
+        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
+        (WebCore::ICOImageDecoder::frameCount): Implement.
+        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
+        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
+        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
+        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
+        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
+        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
+        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27942
+
+        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::reset):
+           Added HTML 4.01 compliant handling of broken webpages that
+           specify more than one selected option for single selection SELECT
+           element, in a manner that emulates Firefox and is similar to IE 7
+
+
+2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        WebCore.pro bugfix
+
+        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+
+        * WebCore.pro:
+
+2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Fix Tiger build breakage.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
+        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+
+        * WebCore.pro:
+
+2009-08-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Keypress should exit from pan scrolling mode.
+        https://bugs.webkit.org/show_bug.cgi?id=28005
+
+        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
+        making it easier for users to back out of an accidental pan scroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):
+        
+2009-08-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
+        https://bugs.webkit.org/show_bug.cgi?id=26787
+
+        Add back missing dragController()->clear() call.
+
+        * manual-tests/drag-caret.html: Added.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Forgot to commit attribute names.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Test: platform/mac/accessibility/aria-valuetext.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        No new features, no new tests. Existing layout tests pass.
+
+        * WebCore.base.exp:
+
+        Export AppliationCacheGroup::storeCopyOfCache
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
+        instead of 'private' headers since they're no longer in the DocumentLoader.h
+        include graph.
+
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+
+        Reinstate the test for manifest.isNull instead of .isEmtpty().
+        Added a FIXME to revisit once the spec gets clarified.
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+
+        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
+        for compile time friendliness, it results in a smaller include graph for files
+        dependent on DocumentLoader.h.
+
+        * loader/FrameLoader.cpp:
+        * loader/MainResourceLoader.cpp:
+        * loader/ResourceLoader.cpp:
+
+        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
+        This was done for readability at the include site. The included files contain appropriate guards,
+        so they're not needed at the include site.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+
+        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
+        (WebCore::ApplicationCacheHost::notifyEventListener):
+        (WebCore::ApplicationCacheHost::status):
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventType):
+        (WebCore::DOMApplicationCache::toEventID):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+
+        Use ApplicationCachHost defined constants for Status and EventIDs.
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27993 - AXSliders are missing required attributes and actions
+        https://bugs.webkit.org/show_bug.cgi?id=27993
+
+        Expose appropriate actions and attributes for sliders.
+
+        Test: platform/mac/accessibility/slider-supports-actions.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::orientation):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in WebCoreStringResource that causes worker script
+        evaluation failed.
+        https://bugs.webkit.org/show_bug.cgi?id=27996
+
+        The fix is to check for the same thread, instead of the main thread.
+        This is because Chromium's workers use v8 in a single thread that is
+        not the main thread.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::atomicString):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions/animations of text-indent.
+
+        Test: transitions/text-indent-transition.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions of min- and max-width, and min- and max-height.
+        https://bugs.webkit.org/show_bug.cgi?id=27990
+
+        Test: transitions/min-max-width-height-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=27964
+
+        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
+        Also fixed an issue where an extra space was being appended to some ARIA labels.
+
+        Test: platform/mac/accessibility/aria-radiobutton-text.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaAccessibilityName):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
+        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Missed a place that expects window.event to be hidden when it shouldn't be.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27958
+
+        Test: platform/mac/accessibility/aria-required.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRequired):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isRequired):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add QWebPluginDatabase API to the Qt API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * WebCore.pro:
+
+2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
+        (as it is the closest match) instead of CompositionMode_SourceOver.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+
+2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Fix crash when converting empty v8 string to atomic webkit string.
+        https://bugs.webkit.org/show_bug.cgi?id=27975
+
+        collection-null-like-arguments.html tests for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        selectionHasStyle needs clean up to fix Bug 27858
+        https://bugs.webkit.org/show_bug.cgi?id=27865
+
+        This patch cleans up selectionStartHasStyle and selectionHasStyle.
+        No test is added because the patch does not change any behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
+        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
+        * editing/Editor.cpp:
+        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
+        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
+        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
+
+2009-08-03  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27906
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [V8] Cache atomic strings in externalized v8 strings
+        https://bugs.webkit.org/show_bug.cgi?id=27762
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::webcoreString):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::toStringResource):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore::):
+        * dom/Document.idl:
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=27957
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * WebCore.pro:
+
+2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium code sometimes isn't sandboxed and needs to access the FS.
+        https://bugs.webkit.org/show_bug.cgi?id=27954
+
+        These changes are the WebKit side of http://codereview.chromium.org/159778 which
+        aims to make LocalStorage persistent.
+
+        This change runs all FileSystem routines through the ChromiumBridge so that
+        WebKitClients can handle them if they choose to.  For now, the only such client
+        will be the one running in the browser process.
+
+        It also adds a method called sandboxEnabled to the Chromium bridge so that the
+        SQLite file system code can shift its behavior depending on whether we're
+        inside a sandbox or not.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileModificationTime):
+        (WebCore::directoryName):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::makeAllDirectories):
+        (WebCore::fileExists):
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-08-03  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=27859
+
+        Implemented the media slider for chromium port. The implementation
+        is using Skia for drawing the thumb and buffered region instead of
+        using any native system controls so different platforms would have
+        the same look and feel.
+
+        No new tests because this is covered by existing tests.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+
+2009-07-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Plumbing and cleanup in advance of returning multiple frames from the
+        ICOImageDecoder:
+        * Make ImageDecoder::frameCount() return a size_t like
+          ImageSource::frameCount() and BitmapImage::frameCount() already do.
+        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
+          size of a particular frame.  Hook all the
+          ImageSource::frameSizeAtIndex() implementations to this.  No
+          ImageDecoder implements this yet; that will come in my next change.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount): returns size_t.
+        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Clarify comment.
+        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
+        (WebCore::ImageDecoder::frameCount): returns size_t.
+        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount): returns size_t.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
+        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
+
+2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that could cause an ASSERT to fail incorrectly, leading
+        to a renderer crash in Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27947
+
+        All tests in storage/ pass.
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::~SQLiteTransaction):
+        (WebCore::SQLiteTransaction::begin):
+
+2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Based on work by Yael Aharon.
+
+        Implement keyboard event forwarding for windowless plugins
+        for the Qt port.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
+        https://bugs.webkit.org/show_bug.cgi?id=27928
+
+        * English.lproj/localizedStrings.js:
+
+          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
+
+        * inspector/front-end/ChangesView.js: Added.
+        (WebInspector.ChangesView):
+        (WebInspector.ChangesView.prototype._clearButtonClicked):
+        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
+        (WebInspector.ChangesView.prototype.attach):
+        (WebInspector.ChangesView.prototype.show):
+        (WebInspector.ChangesView.prototype.hide):
+
+          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
+
+        * inspector/front-end/Console.js: Removed.
+
+          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
+
+        * inspector/front-end/ConsoleView.js: Added.
+
+          Little has changed from its move from Console.js other then support for working with the Drawer.
+
+        * inspector/front-end/Drawer.js: Added.
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.get visibleView):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._safelyRemoveChildren):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+          Allow for multiple views inside the Sliding Drawer.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.renameSelector):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+
+          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+
+        * inspector/front-end/Images/styleIcon.png: Added.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+          Interface with ElementsPanel for generating a Stylesheet of Changes.
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
+        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.get styleChanges):
+        (WebInspector.set styleChanges):
+        (WebInspector._updateChangesCount):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.showConsole):
+        (WebInspector.showChanges):
+
+          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
+
+2009-08-03  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Correct an assert on a PassRefPtr in the v8 svg bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27951
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+
+2009-08-03  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
+        crash w/ stack overflow when same CSS file loaded repeatedly
+
+        Fix crash caused by a stack overflow when repeatedly loading very large
+        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
+        recursively rather than iteratively.
+
+        Test: fast/css/large-list-of-rules-crash.html
+
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSRuleData::~CSSRuleData):
+        (WebCore::CSSRuleDataList::~CSSRuleDataList):
+
+2009-08-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make the DRT APIs to pause transitions and animations work for accelerated animations
+        <https://bugs.webkit.org/show_bug.cgi?id=27627>
+        <rdar://problem/6442932>
+
+        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
+        available to LayoutTests to work with accelerated animations and transitions. Done by sending
+        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
+        
+        I also added an assertion to check that the animation has actually started when we
+        try to pause it, to check that the pause time we compute is valid. This revealed a number
+        of tests that tried to pause before animations started, required some amount of test fixing.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::freezeAtTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::suspendAnimations):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::suspendAnimations):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::suspendAnimations):
+        * rendering/RenderLayerBacking.h:
+
+2009-08-03  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Chromium build by removing PluginView.h from Page.cpp.
+        Chromium doesn't use PluginView and the pointer is never
+        dereferenced so the header doesn't need to be included.
+        https://bugs.webkit.org/show_bug.cgi?id=27946
+
+        No new tests because this is a build fix.
+
+        * page/Page.cpp:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * WebCoreSources.bkl:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27943: Need to implement ARIA role="radiogroup"
+        https://bugs.webkit.org/show_bug.cgi?id=27943
+
+        Test: platform/mac/accessibility/aria-radiogroup.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRadioGroup):
+        (WebCore::AccessibilityObject::selectedRadioButton):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::selectedRadioButton):
+        (WebCore::RoleEntry::):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        HTMLInputElement is not controllable by assistive technologies
+        https://bugs.webkit.org/show_bug.cgi?id=27941
+
+        Test: accessibility/input-slider.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+            Add AccessibilitySlider.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilitySlider and AccessibilitySliderThumb.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+            Add default, do nothing, base class methods.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+            Correct typo.
+
+        * accessibility/AccessibilitySlider.cpp: Added.
+        (WebCore::AccessibilitySlider::AccessibilitySlider):
+        (WebCore::AccessibilitySlider::create):
+        (WebCore::AccessibilitySlider::children):
+        (WebCore::AccessibilitySlider::addChildren):
+        (WebCore::AccessibilitySlider::getAttribute):
+        (WebCore::AccessibilitySlider::valueForRange):
+        (WebCore::AccessibilitySlider::maxValueForRange):
+        (WebCore::AccessibilitySlider::minValueForRange):
+        (WebCore::AccessibilitySlider::changeValue):
+        (WebCore::AccessibilitySlider::setValue):
+        (WebCore::AccessibilitySlider::increment):
+        (WebCore::AccessibilitySlider::decrement):
+        (WebCore::AccessibilitySlider::element):
+        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::create):
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        (WebCore::AccessibilitySliderThumb::size):
+        * accessibility/AccessibilitySlider.h: Added.
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+            SliderThumbRole -> NSAccessibilityValueIndicatorRole
+        (-[AccessibilityObjectWrapper roleDescription]):
+            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+            Minor coding style correction.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+            If attachement view handles press action, don't also call object wrapper.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            New, call object's increment() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            New, call object's decrement() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::thumbRect):
+            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
+        (WebCore::RenderSlider::layout):
+            Move code to thumbRect().
+        * rendering/RenderSlider.h:
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=27940
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
+        disabled
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformStart): Empty stub.
+
+2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27917
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
+
+        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27932
+
+        There's no reason to pay for a virtual function call in this case.  We
+        can just call document() directly because we know that element is a
+        Node*.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSNodeCustom should call document() instead of scriptExecutionContext()
+        https://bugs.webkit.org/show_bug.cgi?id=27931
+
+        We want to call document() because it's in inline function, instead of
+        scriptExecutionContext() because it's a virtual function.  If we have a
+        Node*, then we know that the virtual function will always return the
+        document anyway.
+
+        There are more instance of this bug, but I'd like to start with a small
+        patch and work up.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+
+2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Share implementation of PluginView::userAgent() and userAgentStatic()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        Differences to the original implementation are as follows:
+        
+            - The Win port used to return 0 for userAgentStatic, but now
+              returns the quirk mode MozillaUserAgent as the other ports.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::userAgent):
+        (WebCore::PluginView::userAgentStatic):
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+        
+        Since the plugin has not been started yet (m_isStarted is not set),
+        calling stop() will not have any affect, so we manually unregister
+        in start() before returning.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Join the various versions of PluginView::stop() into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The platform-dependent bits are now ifdef'ed in the shared implementation,
+        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
+        
+        Differences to the original implementation are as follows:
+
+            - The Qt port unregistered the plugin before calling NP_SetWindow
+              with a 0 window handle. Now it's done after (similar to Win)
+
+            - The GTK and Qt ports unregistered the plugin before clearing
+              the m_npWindow.ws_info struct. Now it's done after.
+              
+            - The Win port constructed the DropAllLocks after unsubclassing
+              the window. Now it's done before.
+              
+            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
+              to NP_Destroy (like the Win port). Now all ports do.
+
+            - The Win port did not call PluginView::setCurrentPluginView()
+              before calling to NP-functions. Now it does.     
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: let me *edit* css styles in the web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=27124
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.expand):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
+        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
+        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
+        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
+        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        * inspector/front-end/inspector.css:
+
+2009-07-31  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] check if proxy is present before invoking a handler
+        https://bugs.webkit.org/show_bug.cgi?id=27883 
+
+        Do not invoke handler function if proxy is null pointer (that would lead to access violation
+        anyway)
+
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+
+2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement Elements Panel so that its
+        interaction with DOM is serialized.
+
+        This is a first cut wuth read support for DOM elements
+        tree as well as some limited editing. No properties, no
+        styles, no search capabilities are implemented yet.
+        Set Preferences.useDOMAgent to true in order to try it
+        out, otherwise disabled by default.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27771
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::domAgent):
+        * inspector/InspectorDOMAgent.cpp: Added.
+        * inspector/InspectorDOMAgent.h: Added.
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Callback.js: Added.
+        * inspector/front-end/DOMAgent.js: Added.
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        isContentEditable function in htmlediting.* must be removed
+        https://bugs.webkit.org/show_bug.cgi?id=27870
+
+        This patch removes isContentEditable function in htmlediting.cpp and
+        replaces all usage by calling Node::isContentEditable or its derivatives.
+
+        * editing/AppendNodeCommand.cpp: ditto
+        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
+        * editing/IndentOutdentCommand.cpp: ditto
+        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
+        * editing/InsertNodeBeforeCommand.cpp: ditto
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
+        * editing/htmlediting.cpp: ditto
+        (WebCore::enclosingNodeWithTag): ditto
+        (WebCore::enclosingNodeOfType): ditto
+        (WebCore::canMergeLists): ditto
+        * editing/htmlediting.h: Updated prototype
+
+2009-08-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a message port handle always getting marked as reachable once it gets entangled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27824
+
+        No tests since this only arises with the Chromium multi-process message port implementation
+        which isn't in this repostiory.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Fix Geolocation permission problem
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::requestPermission):
+
+2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added project properties as needed by symbian platform
+
+        * WebCore.pro:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix compiler warning.
+
+        Initialize member variables in the correct order.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix!
+
+        Unreviewed.
+
+        * page/win/PageWin.cpp:
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix.
+
+        Unreviewed.
+
+        * page/Page.cpp:
+        Move setCanStartPlugins() from here...
+        * page/win/PageWin.cpp:
+        (WebCore::Page::setCanStartPlugins):
+        ... to here.
+
+2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
+        background tabs (make Win consistent with Mac)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27855
+
+        Reviewed by Anders Carlsson.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
+        Declare a new function to dispatch failures to start plug-ins.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize new member variable.
+        (WebCore::Page::addUnstartedPlugin):
+        Add the PluginView to the set of unstarted plug-ins.
+        (WebCore::Page::removeUnstartedPlugin):
+        Remove the PluginView from the set of unstarted plug-ins.
+        (WebCore::Page::setCanStartPlugins):
+        If we can now start plug-ins, iterate the set of unstarted plug-ins,
+        starting them. If a plug-in fails to start, dispatch a failed-to-start-
+        plug-in error. Clear the list of unstarted plug-ins.
+
+        * page/Page.h:
+        Added m_canStartPlugins to track whether we can currently start
+        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
+        page that are waiting to be started.
+        (WebCore::Page::canStartPlugins):
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
+        fails, set m_status to reflect this; this used to be set by init(), but
+        start() will not be called by init() if we are delaying start().
+        If NPP_New() succeeds, set m_status to reflect this, and call
+        platformStart().
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        If we cannot start plug-ins, add this view to the Page's list of
+        unstarted plug-ins and return true. Otherwise, call start() and return
+        the result.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        If we've been started or we don't have a Page, return early. Remove
+        ourselves from the Page's list of unstarted plug-ins.
+        (WebCore::PluginView::bindingInstance):
+        If we haven't been started yet, return 0. This matches the Mac
+        behavior.
+        (WebCore::PluginView::setParameters):
+        If we find the "plug-ins page" parameter, record it; it may be used if
+        we fail to start the plug-in.
+        (WebCore::PluginView::PluginView):
+        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
+        with mimeType directly; m_mimeType is now a WebCore::String.
+
+        * plugins/PluginView.h:
+        Made start() public, so Page can call it when we start unstarted
+        plug-ins. Changed m_mimeType from CString to String and added
+        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::pluginsPage):
+        Added for dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::mimeType):
+        Ditto.
+        (WebCore::PluginView::url):
+        Ditto.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
+        and SetWindowRgn() to position the plug-in and set its clip rect if an
+        earlier call to updatePluginWidget() was made before
+        setPlatformPluginWidget() was called to set the plug-in's HWND.
+        (WebCore::PluginView::~PluginView):
+        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
+        the unstarted list if the plug-in is destroyed before it is started.
+        (WebCore::PluginView::init):
+        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
+        cannot be started, to add it to the list of plug-ins waiting to be
+        started. Set m_status to indicate success; this is also set by start(),
+        but that may be delayed, and we don't want the loader to dispatch a
+        failed-to-start-plug-in error when we return from init().
+        (WebCore::PluginView::platformStart):
+        Added; code moved from init(). This is now called by start() to perform
+        any platform-specific tasks that need to take place after the plug-in
+        has started. Added a call to updatePluginWidget() to ensure we position
+        the plug-in and set its clip rect after the plug-in has started.
+        Removed the setting of m_status; start() does this before calling this
+        function (and we assert this at the head of the function).
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add casts for all the RenderTable classes and use them everywhere.
+
+        Also added a few uses in places that were still using static_cast.
+        Also made some virtual member functions private.
+        Also changed RenderTable::m_tableLayout to use OwnPtr.
+
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::rowIndexRange):
+        (WebCore::AccessibilityTableCell::columnIndexRange):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::parentTable):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitTabBeforeNode):
+        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::parseMappedAttribute):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::fullRecalc):
+        (WebCore::shouldScaleColumns):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::collapsedBottomBorder):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        (WebCore::RenderTableRow::layout):
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::recalcCells):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeTextRun):
+        Use checked casts.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
+        (WebCore::RenderTable::addChild): Use checked cast.
+        (WebCore::RenderTable::layout): Ditto.
+        (WebCore::RenderTable::setCellWidths): Ditto.
+        (WebCore::RenderTable::paintObject): Ditto.
+        (WebCore::RenderTable::splitColumn): Ditto.
+        (WebCore::RenderTable::appendColumn): Ditto.
+        (WebCore::RenderTable::colElement): Ditto.
+        (WebCore::RenderTable::recalcSections): Ditto.
+        (WebCore::RenderTable::outerBorderBottom): Ditto.
+        (WebCore::RenderTable::outerBorderLeft): Ditto.
+        (WebCore::RenderTable::outerBorderRight): Ditto.
+        (WebCore::RenderTable::sectionAbove): Ditto.
+        (WebCore::RenderTable::sectionBelow): Ditto.
+
+        * rendering/RenderTable.h: Added checked cast. Made virtual
+        functions private. Changed m_tableLayout to be a OwnPtr.
+
+        * rendering/RenderTableCell.h: Added checked cast.
+        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
+        * rendering/RenderTableRow.h: Ditto.
+        * rendering/RenderTableSection.h: Ditto.
+
+2009-07-31  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
+        Favicons are still loaded when automatic image loading is disabled.
+
+        People who want to avoid loading images generally want to avoid loading all images.
+
+        Test: http/tests/misc/favicon-loads-with-images-disabled.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
+          perform the load if images shouldn't be loading.
+
+2009-07-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        Accelerated animations stutter on pages with lots of animations and 3d transforms
+        https://bugs.webkit.org/show_bug.cgi?id=27884
+        
+        This patch changes the strategy for synchronizing painting view the view,
+        and compositing layer updates. Previously the strategy was to disable screen
+        updates between the time we updated the layer tree, and painted the view. That
+        left screen updates disabled for too long (hundreds of milliseconds) in some
+        cases, causing animation stutter.
+        
+        The new strategy is to batch up changes to the CA layer tree, and commit them
+        all at once just before painting happens (referred to as a "sync" in the code).
+        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
+        the values stored in GraphicsLayer into the CA layer tree at commit time.
+        
+        Compositing layers are then synced in FrameView::paintContents(). However, not
+        all style/layout changes will result in painting; to deal with style changes that
+        touch only compositing properties, we set up a runloop observer that takes care
+        of comitting layer changes when no painting happens.
+
+        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
+
+        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
+        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
+        sync and returns false, since we only want to sync when layout is done.
+        
+        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        Call animationPaused() to notify the graphics layers about animation pausing.
+        
+        * platform/graphics/FloatPoint3D.h:
+        (WebCore::operator==):
+        (WebCore::operator!=): 
+        Add missing comparison operators.
+        
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setOpacity):
+        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
+        
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::AnimationValue:):
+        (WebCore::TransformAnimationValue:):
+        (WebCore::KeyframeValueList:):
+        (WebCore::KeyframeValueList::insert):
+        Cleaned up versions of FloatValue and TransformValue, used to store information
+        about keyframes values.
+
+        (WebCore::GraphicsLayer::contentsRect):
+        (WebCore::GraphicsLayer::setContentsRect):
+        ContentsRect is now a simple setter.
+        
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::removeAnimationsForProperty):
+        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        Simplified animation api.
+        
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        setGeometryOrientation is now just a normal member variable.
+        
+        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
+        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
+        
+        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        Lots of cleanup and refactoring. Main points:
+        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
+        - Bitmask is used to store which properties have changed. More efficient than before.
+        - Simpler animation interface; simple setters are no longer confounded with animations.
+        - Refactored code that creates CA animations, and stores which animations are running.
+
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::size):
+        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
+        contentsLayer.
+        Adapt to GraphicsLayer's simpler animation API.
+        Pass animation pausing through to the graphics layers.
+        contentsBox() is no longer a callback via GraphicsLayerClient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        (WebCore::RenderLayerCompositor::scheduleSync):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
+        notifications, which travel up to WebKit and set up a runloop observer.
+        
+2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Guard needs //'s between #endif and ENABLE(DATAGRID)
+        https://bugs.webkit.org/show_bug.cgi?id=27862
+
+        Compiling this file causes a build break without this change.
+
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation clean up when no longer updating
+        https://bugs.webkit.org/show_bug.cgi?id=27888
+
+        When Geolocation::disconnectFrame() is called, need to call 
+        Document::setUsingGeolocation(false) to mirror the true call 
+        when it is set up.
+
+        When handling an error, and there are no more listeners, call
+        GeolocationService::stopUpdating().
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::handleError):
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by George Staikos.
+
+        Consolidate GeoLocation code to send positions and errors
+        https://bugs.webkit.org/show_bug.cgi?id=27863
+        
+        Create helper methods that will send positions and errors to either
+        one shots or watchers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::sendError):
+        (WebCore::Geolocation::sendErrorToOneShots):
+        (WebCore::Geolocation::sendErrorToWatchers):
+        (WebCore::Geolocation::sendPosition):
+        (WebCore::Geolocation::sendPositionToOneShots):
+        (WebCore::Geolocation::sendPositionToWatchers):
+        * page/Geolocation.h:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out previous change as it might be causing some weirdness in
+        the bots.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix compiler warning.
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+
+        GCC does not like multi-character character constants, so use the
+        explicit numerical value of 'BM' in the enum.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+
+        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
+        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
+        
+        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+
+2009-07-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adele Peterson and Jon Honeycutt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
+        Bug 27828: Title attribute is not respected on option elements
+
+        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+
+        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
+        the popup menu in RenderTextControlSingleLine.
+
+2009-07-30  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Remove ChromeClientChromium::setToolTip().
+        https://bugs.webkit.org/show_bug.cgi?id=27861
+
+        This patch is just to remove a temporarily introduced overloaded empty
+        virtual function. No test is needed.
+
+        * page/chromium/ChromeClientChromium.h:
+
+2009-07-30  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        ApplicationCacheHost refactoring.
+        
+        1) Better encapsulate the interfaces between webcore common code
+        and the appcache system within a new class ApplicationCacheHost.
+
+        2) Use that interface throughout the loader system, replacing inline appcache logic.
+
+        3) Implement the interface in terms of webcore's appcache system.
+
+        4) Add the new files to various makefiles.
+
+        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+
+        No new features, no new tests. The existing layout tests all pass.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        (WebCore::DocumentLoader::setPrimaryLoadComplete):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        (WebCore::MainResourceLoader::didReceiveData):
+        (WebCore::MainResourceLoader::didFinishLoading):
+        (WebCore::MainResourceLoader::didFail):
+        (WebCore::MainResourceLoader::load):
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didFail):
+        * loader/ResourceLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.cpp: Added.
+        * loader/appcache/ApplicationCacheHost.h: Added.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::transferApplicationCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::disconnectFrame):
+        (WebCore::DOMApplicationCache::applicationCacheHost):
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::update):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventName):
+        (WebCore::DOMApplicationCache::toEventType):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::):
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        (WebCore::DOMApplicationCache::~DOMApplicationCache):
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolHostAndPortAreEqual):
+
+2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
+        https://bugs.webkit.org/show_bug.cgi?id=27854
+
+        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
+        they can disappear and then lead to crashes.
+       
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Minor change to earlier commit suggested by Darin Adler.
+        Use the variable rather than dereferencing 'it' again.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Animation with a timing function property in a keyframe eats CPU
+        https://bugs.webkit.org/show_bug.cgi?id=27856
+        <rdar://problem/7104476> Animation demo uses lots of CPU
+        
+        Don't include animation-timing-function in the list of properties to
+        animate in a keyframe animation, because this property is not animated;
+        instead, it describes the timing function to apply to this keyframe.
+        
+        This prevents the animation code from thinking that there's a property
+        that it has to software-animate, and thus firing the animation timer frequently.
+        
+        Not testable because there is no visible impact.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
+        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+
+        * page/animation/KeyframeAnimation.cpp
+        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Apply colour style to buttons that use Theme settings in Qt.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27814
+
+         * platform/qt/RenderThemeQt.cpp:
+         (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make WebCore compile with the new JS number representation.
+
+        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
+        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
+        * bindings/js/ScriptEventListener.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+
+2009-07-30  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Don't try to hash member function pointers, instead use a precomputed value based on the field.
+        https://bugs.webkit.org/show_bug.cgi?id=27843
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
+        (WebCore::PODTypeWrapperCacheInfo::operator==):
+        (WebCore::PODTypeWrapperCacheInfoHash::hash):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix compiler warning.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a way to register V8 extensions for Isolated Worlds only.
+        https://bugs.webkit.org/show_bug.cgi?id=27785
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInNewContext):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8IsolatedWorld.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registerExtension):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Add previously defined out support to PopupMenuQt for marking entries as
+         disabled and for selecting the desired item.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27772
+
+         * platform/qt/PopupMenuQt.cpp:
+         (WebCore::PopupMenu::populate):
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add new toRenderWidget cast and use it everywhere.
+
+        Use checked casts in all the places that were using static_cast
+        but there is a checked cast available.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::widget):
+        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * dom/Document.cpp:
+        (WebCore::widgetForNode):
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::findWidgetRenderer):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::subframeForTargetNode):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/Frame.cpp:
+        (WebCore::isFrameElement):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::getCachedImage):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::getCachedImage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::getCachedImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::addChildToContinuation):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateImageContents):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        Use checked cast instead of static_cast.
+        
+        * rendering/RenderWidget.h: Added toRenderWidget.
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: some files modified to build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27816
+
+        * accessibility/AccessibilityObject.h:
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::registerPopup):
+        (WebCore::PopupWndProc):
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: modified graphics files
+        https://bugs.webkit.org/show_bug.cgi?id=27779
+
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::blend):
+        * platform/graphics/transforms/MatrixTransformOperation.cpp:
+        (WebCore::MatrixTransformOperation::blend):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::operator*):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+
+2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Improve efficiency by rewriting code doing three hash table
+        lookups, which can be replaced by just one as pointed out
+        by Darin Adler.
+
+        Though being slightly less clear, this should be considerable
+        faster.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::remove):
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
+        No functionality change at all.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow to explicitly choose a preferred plugin for a mimetype.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        When the preferred plugin is set for a specific MIME type, it will be
+        always picked up, regardless of its version, quirks etc.
+
+        Client applications may want to use that API to resolve mimetype
+        ambiguity in a custom way, rather than in the default way that is
+        currently used in WebKit.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
+        (WebCore::PluginDatabase::remove):
+        (WebCore::PluginDatabase::clear):
+        * plugins/PluginDatabase.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build with Qt 4.4 after r46535.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+
+2009-07-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Video elements fires another "load" event when attached to DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27623
+
+        Test: media/media-load-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::insertedIntoDocument):
+            Only schedule load when element's network state is NETWORK_EMPTY.
+
+2009-07-30  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Cache v8 strings when converting from WebCore::String to v8 string.
+        https://bugs.webkit.org/show_bug.cgi?id=27655
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8String): now just immediately calls v8ExternalString
+        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
+        v8::String
+        (WebCore::makeExternalString): utilty function to create external v8::String out of
+        WebCore::String
+        (WebCore::getStringCache): static function to access string cache
+        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
+        cache
+        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
+        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
+        string.
+        * bindings/v8/V8Binding.h:
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25535
+        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
+
+        Implement state-changed:checked for radio buttons and checkboxes.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Forgot the 'break'.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Mac build.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Add missing enumeration value to switch.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Workers need to throw an exception when presented with invalid URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=27770
+
+        Tests covered by worker-constructor.html and worker-redirect.html.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        * workers/WorkerScriptLoader.h:
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
+        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
+          only limiting connections while parsing and still trying to figure out stylesheet urls.
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27729
+
+        * page/wince/FrameWince.cpp: Added.
+
+2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=27809
+
+        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
+        To determine that a particular text decoration is present, currentlyHasStyle should refer to
+        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
+        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
+
+        * editing/ApplyStyleCommand.cpp: ditto
+        (WebCore::StyleChange::currentlyHasStyle): ditto
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: changes to platform/text files
+        https://bugs.webkit.org/show_bug.cgi?id=27715
+
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        FIX: HDC leaks in PopupMenuWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27817
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::paint):
+
+2009-07-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27810
+
+        Test: fast/lists/ol-start-parsing.html
+
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
+        and use the value 1 if it failed to parse. Before we were getting toInt's default
+        behavior, which is to return 0.
+
+2009-07-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added foundation work to allow a testing infrastructure for the Web
+        Inspector.
+
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady): Tell the testing
+        harness that the window object is ready.
+        * loader/EmptyClients.h: Empty class support for SVG.
+        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Build fix for windows after landing
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+   
+        Apparently bzero doesn't exist on windows.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+        https://bugs.webkit.org/show_bug.cgi?id=27807
+
+        Moves some accessibility code that was in the Mac file to a more common place so 
+        it can be used by other platforms. 
+        This includes:
+           Making TextMarkerData from a VisiblePosition.
+           Making a VisiblePosition from TextMarkerData.
+           Finding the anchor accessibility object for an arbitrary Node.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::anchorElementForNode):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        (AXAttributedStringAppendText):
+
+2009-07-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Inset box shadows are incorrectly accounted for in visual overflow
+        computations
+        https://bugs.webkit.org/show_bug.cgi?id=27811
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::InlineFlowBox::placeBoxesVertically): Use
+            getBoxShadowVerticalExtent(). Removed duplicate code to get the
+            text-shadow overflow.
+        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Use
+            getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowWidth): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
+            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
+            shadows.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
+            not inset.
+        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
+            shadows.
+        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
+        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
+        * rendering/style/RenderStyle.h:
+
+2009-07-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
+        https://bugs.webkit.org/show_bug.cgi?id=27796
+        
+        Avoid repainting when a layer becomes composited if the renderer is not parented
+        yet, because it makes no sense to do so.
+        
+        If the table row is a repaint container, default to the RenderBox implementation
+        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
+        computation to something that is above the repaint container.
+
+        Test: fast/table/table-row-compositing-repaint-crash.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27791
+        307 redirects of POSTs should use POST, not GET
+
+        Test: http/tests/loading/redirect-methods.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+
+2009-07-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Adding -webkit-animation-play-state back in
+        https://bugs.webkit.org/show_bug.cgi?id=26867
+
+        We've decided to keep -webkit-animation-play-state. So this
+        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
+
+        Test: animations/play-state.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseAnimationPlayState):
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapAnimationPlayState):
+        * css/CSSStyleSelector.h:
+        * platform/animation/Animation.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the default plugin directories and the current directory set of
+        the plugin database as public API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::pluginDirectories):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Font size for current time display in media controls panel
+        is affected by body font size.
+        https://bugs.webkit.org/show_bug.cgi?id=27799
+
+        Fixing the problem of rendering by explicitly setting the font size
+        for the time displays.
+
+        No new tests since this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
+        Style Guidelines as identified by cpp_style.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27613
+
+        * page/ContextMenuController.cpp:
+        (WebCore::openNewWindow):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+
+2009-07-29  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27805
+
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the PluginDatabase::pluginForMIMEType() function as public API.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        It can be used to determine the appropriate plugin for a mime type,
+        without guessing the mimetype from the extension.
+
+        * plugins/PluginDatabase.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        Allow to enable/disable particular plugin packages.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Disabled plugins will not be picked up when looking for a plugin
+        supporting the requested mimetypes.
+
+        Client applications may want to use that API to disable specific
+        plugins.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::PluginPackage):
+        (WebCore::PluginPackage::setEnabled):
+        * plugins/PluginPackage.h:
+        (WebCore::PluginPackage::isEnabled):
+
+2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] Running WML tests in random order multiple times exposes subtle bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27801
+
+        Remove superflous assertions regarding the parent node. Under certain circumstances
+        these can even fire (related to garbage collection while destructing). Fixes random order
+        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
+
+        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
+        WMLPageState::reset() - the history stack should still contain the current card afterwards.
+        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
+
+        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
+        (WebCore::BackForwardList::clearWMLPageHistory):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        (WebCore::WMLDoElement::removedFromDocument):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::insertedIntoDocument):
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        (WebCore::WMLTaskElement::removedFromDocument):
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::removedFromDocument):
+
+2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26848
+        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+        * platform/network/ResourceHandle.h:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media control panel for <video> in MediaDocument is mis-placed
+        https://bugs.webkit.org/show_bug.cgi?id=27798
+
+        Fixing a rendering problem: When <video> is displayed in MediaDocument,
+        the media control panel overlaps with the video by 16 pixels.
+
+        No new tests as this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Chromium.  Those last two patches weren't
+        independent despite the clean merge.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+
+2009-07-29  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        ImageSourceCG makes bad data refs (race condition causes blank images)
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
+        backs the CFDataRef will be long enough.
+
+        No new tests, as this fixes a bug with a race condition that is
+        difficult to trigger.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console should show completions for the command line APIs
+        https://bugs.webkit.org/show_bug.cgi?id=27696
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
+        completions when available.
+        * inspector/front-end/utilities.js:
+        (Object.properties): Added.
+        (Object.sortedProperties):
+
+2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactor the first step of layout in RenderFlexibleBox.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27704
+
+        No new tests as this change is just a refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::gatherFlexChildrenInfo):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix a bug that HTMLOptionElement::value() returns an incorrect
+        value in a case that the element has a label attribute and no
+        value attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27760
+
+        Test: fast/forms/option-value-and-label.html
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::collectOptionLabelOrText):
+        (WebCore::OptionElement::collectOptionInnerText):
+        (WebCore::OptionElement::normalizeText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::text):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=27533
+
+        Instead of getting the context from the frame, we cache the context
+        when the listener is created so that we get the context for the right
+        world.
+
+        Test: http/tests/security/isolatedWorld/click-event.html
+
+        * WebCore.gypi:
+        * bindings/v8/OwnHandle.h: Added.
+        (WebCore::OwnHandle::OwnHandle):
+        (WebCore::OwnHandle::~OwnHandle):
+        (WebCore::OwnHandle::get):
+        (WebCore::OwnHandle::set):
+        (WebCore::OwnHandle::release):
+        (WebCore::OwnHandle::adopt):
+        (WebCore::OwnHandle::swap):
+        (WebCore::OwnHandle::clear):
+        (WebCore::OwnHandle::makeWeak):
+        (WebCore::OwnHandle::weakCallback):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach V8Proxy::context about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27701
+
+        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
+        all callers of this method to make sure they want isolated worlds.  In
+        cases where we really want the main world, I've changed the call to
+        V8Proxy::mainWorldContext(Frame*).
+        
+        The main visible change is to the document.open method when called with
+        more than two arguments.  This design seems more likely to lead to
+        future correct code.
+
+        Test: http/tests/security/isolatedWorld/document-open.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing file.
+
+        * WebCore.pro:
+
+2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/7005077> WER: Crash in
+        WebCore::PluginStream::destroyStream+279 (1310510882)
+
+        Reviewed by Oliver Hunt.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+        Move the "protector" RefPtr out of the block that dispatches
+        notifications and into the function level; if NPN_DestroyStream were
+        called from NPP_NewStream as the comment warns, we would be deleted at
+        the end of the block.
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through the DOM Storage DataGrid when Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27746
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Create New DOM Storage Items via DataGrid
+
+        https://bugs.webkit.org/show_bug.cgi?id=27322
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
+        (WebInspector.CreationDataGridNode): new type of node
+        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
+
+        https://bugs.webkit.org/show_bug.cgi?id=27400
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
+        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
+        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Inspector should support inspect() in the command line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19874
+        rdar://problem/6070225
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
+        (WebInspector.DatabasesPanel.prototype.showDatabase): 
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        The rest of: Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
+        (WebInspector.Console.prototype.addInspectedNode): Added.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Accept autocomplete on 'End' key pressed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27447.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by David Levin.
+
+        [Qt] Build fix after r46502
+        https://bugs.webkit.org/show_bug.cgi?id=27789
+
+        * WebCore.pro: Remove StorageArea.cpp
+
+2009-07-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
+        in -dealloc overrides in DOMObject subclasses.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=27786
+
+        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
+        The only case where this is relevant in WML is error handling. The parsed WML
+        tree fragment is inserted in an XHTML compound error document. This requires
+        removedFromDocument() to be correctly implemented otherwhise we run into
+        trouble (visible when using run-webkit-tests fast/wml --random).
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::registerTask):
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLAnchorElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::removedFromDocument):
+        (WebCore::WMLDoElement::registerTask):
+        (WebCore::WMLDoElement::deregisterTask):
+        * wml/WMLDoElement.h:
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::registerDoElement):
+        (WebCore::WMLEventHandlingElement::deregisterDoElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::removedFromDocument):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::registerPostfieldElement):
+        (WebCore::WMLGoElement::deregisterPostfieldElement):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
+        * wml/WMLIntrinsicEventHandler.h:
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        (WebCore::WMLOnEventElement::registerTask):
+        (WebCore::WMLOnEventElement::deregisterTask):
+        * wml/WMLOnEventElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::removedFromDocument):
+        (WebCore::WMLTaskElement::registerVariableSetter):
+        (WebCore::WMLTaskElement::deregisterVariableSetter):
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::removedFromDocument):
+        * wml/WMLTimerElement.h:
+
+2009-07-28  David Levin  <levin@chromium.org>
+
+        Suggested by Drew Wilson.
+
+        Speculative gtk build fix, follow up to:
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        * GNUmakefile.am:
+
+2009-07-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
+        properties
+        https://bugs.webkit.org/show_bug.cgi?id=27578
+
+        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
+        border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=27584
+
+        Test: fast/borders/border-radius-parsing.html
+
+        Dropped the -webkit- prefix from the individual corner border-radius
+        properties. Added border-radius with the / and 4-value syntax, and
+        maintained -webkit-border-radius with legacy 2-value syntax.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Removed Webkit prefix.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
+            single-corner properties. Call out to parseBorderRadius() to parse
+            border-radius and -webkit-border-radius. 
+        (WebCore::completeBorderRadii): Added this helper function that
+            completes the values for all four corners when fewer than four are
+            specified.
+        (WebCore::CSSParser::parseBorderRadius): Added.
+        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
+            unprefixed property.
+        * css/CSSParser.h:
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
+            for border-radius. Kept the entry for -webkit-border-radius.
+        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
+            single-corenr properties. Added border-radius. Kept
+            -webkit-border-radius because of its conflicting syntax.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap): Ditto.
+
+2009-07-28  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+
+        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        This is just a refactoring, so existing tests suffice.
+
+        * GNUmakefile.am:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.gypi:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.pro:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::addMessage):
+        Forwards console messages to parent document.
+        (WebCore::DedicatedWorkerContext::importScripts):
+        Now sends the updated pending activity status after importing scripts.
+        (WebCore::DedicatedWorkerContext::thread):
+        Helper routine that casts WorkerThread to DedicatedWorkerThread.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::create):
+        * workers/DedicatedWorkerThread.cpp: Added.
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::createWorkerContext):
+        Implementation of the base class factory method to create the appropriate worker context.
+        (WebCore::DedicatedWorkerThread::runEventLoop):
+        Reports pending activity before running the event loop.
+        * workers/DedicatedWorkerThread.h: Added.
+        (WebCore::DedicatedWorkerThread::workerObjectProxy):
+        Moved from base class.
+        * workers/WorkerContext.cpp:
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        Now creates DedicatedWorkerThread.
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        Now is passed a DedicatedWorkerThread.
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Moved workerObjectProxy param into derived class constructor.
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::runEventLoop):
+        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerContext):
+
+2009-07-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix V8NPUtils' handling of UTF8 identifiers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27782
+
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
+            since NPN_GetStringIdentifier() is expecting UTF8.
+
+2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Misc cleanup in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=27517
+
+        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
+        runs in a different process from where the Frame object lives, Chromium passes in NULL
+        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
+        incognito mode does not use the private browsing setting, so that's not a concern.  As for
+        events, I've decided to simply disable them for now.
+
+        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
+        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
+
+        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
+
+        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::privateBrowsingEnabled): Factored out the check.
+        (WebCore::StorageAreaImpl::setItem): Make frame optional.
+        (WebCore::StorageAreaImpl::removeItem): ditto
+        (WebCore::StorageAreaImpl::clear): ditto
+        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
+        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
+
+2009-07-28  Alpha Lam  <hclam@google.com>
+
+        Reviewed by David Levin.
+
+        [chromium] Default UI controls for <video> has rendering problems
+        https://bugs.webkit.org/show_bug.cgi?id=27669
+
+        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
+        it is playing an audio file by changing the style to be 32px
+        tall.
+
+        Also fixes a problem of default styled audio tag that hides the
+        all the time digits by expanding the width to 300px.
+
+        Changed the size and position of the current time and remaining
+        display to give enough space for the hour digit to be shown.
+
+        There are no new tests provided because this is already covered
+        by existing tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix style in PluginPackage and PluginDatabase.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+        (WebCore::PluginDatabase::findPlugin):
+        * plugins/PluginDatabase.h:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::~PluginPackage):
+        (WebCore::PluginPackage::freeLibrarySoon):
+        (WebCore::PluginPackage::freeLibraryTimerFired):
+        (WebCore::PluginPackage::unloadWithoutShutdown):
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+
+2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27769
+        The V8 bindings function V8Proxy::createNewContext can be 
+        called during frame shutdown where the activeDocumentLoader
+        function in FrameLoader can return NULL. Added a check for the
+        same.
+
+        No new tests added as this is an edge case where the V8 
+        bindings code is reentered via NPAPI during shutdown. It is 
+        difficult to write a consistently reproducible test for this.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+
+2009-07-28  Ivan Posva  <iposva@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Associate the CanvasPixelData backing store with the
+        indexed properties of the wrapper object.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27773
+
+        No new tests: Relying on existing Canvas tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Nuke all references to JSWorkerContextBase.lut.h, it was removed
+        back in April.
+
+        * GNUmakefile.am:
+
+2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed references to script generate-webkitversion.pl, and
+        removed duplicated generate-webkitversion.pl
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro:
+        * platform/generate-webkitversion.pl: Removed.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
+        InspectorJSONObject.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27766
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h:
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::ScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newScriptArray):
+        (WebCore::InspectorFrontend::newScriptObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorJSONObject.cpp: Removed.
+        * inspector/InspectorJSONObject.h: Removed.
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution recursion seems to have bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27726
+
+        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
+        Required by the specification - assure it only works in linear order. A setvar element may
+        not depend on the variable state of a following setvar element, only the previous ones.
+
+        Extend wml/variable-reference-valid.html layout test to cover these cases.
+
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::storeVariableState):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Page title doesn't update after variable substitution, if it contained variables
+        https://bugs.webkit.org/show_bug.cgi?id=27725
+
+        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
+        too much, leading to a bug with 1-char variable names, which were not detected properly.
+
+        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
+        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
+
+        * wml/WMLVariables.cpp:
+        (WebCore::containsVariableReference):
+
+2009-07-28  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Simon Hausmann.
+
+        Add WebKit version API to Qt.
+
+        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
+        at compile time and make it available to webkit ports through WebKitVersion.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro: Call generate-webkitversion.pl
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Replace hardcoded separator text with proper separator.
+        Also adjusts include order as per style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27763
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+
+2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Add output directory for VS pre-build steps to enable out-of-tree builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=27700
+
+        The tmp.obj file is now placed in the intermediate build directory.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addInspectedNode):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <do> elements with a <noop> task shouldn't be exposed to the user
+        https://bugs.webkit.org/show_bug.cgi?id=27724
+
+        Fix WMLNoopElement to disable it's parent WMLDoElement, as required by the spec.
+        Moved manual-tests/wml/task-noop-in-do.wml to LayoutTests/fast/wml/task-noop-in-do.wml.
+
+        * manual-tests/wml/task-noop-in-do.wml: Removed.
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable some compiler warnings for the win build
+        https://bugs.webkit.org/show_bug.cgi?id=27709
+
+        * WebCore.pro: Move the msvc options to WebKit.pri
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Tor Arne Vestbø
+
+        Make equality checks for logging channel names ignore casing.
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+
+2009-07-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Refactor ResourceHandleSoup - make start* functions static
+        https://bugs.webkit.org/show_bug.cgi?id=27687
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startData):
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Do not cache the pango layout in the object, since the layout of
+        the page can change between calls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-07-23  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Simplify management of Nodes in weak handles callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=27628
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakNodeCallback):
+
+2009-07-28  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by David Levin.
+
+        Fix error handling of GetIconInfo (returns a bool).
+
+        * platform/win/DragImageWin.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix of <rdar://5015949> Drag Icon is not produced for over sized images.
+        
+        Implemented the createDragImageIconForCachedImage function by using the Windows 
+        SHFILEINFO structure.
+
+        * platform/win/DragImageWin.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Split up V8DOMMap.cpp by class
+        https://bugs.webkit.org/show_bug.cgi?id=27685
+
+        No behavior change.  Just copy-and-paste.
+
+        * WebCore.gypi:
+        * bindings/v8/ChildThreadDOMData.cpp: Added.
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        * bindings/v8/ChildThreadDOMData.h: Added.
+        * bindings/v8/DOMData.cpp: Added.
+        (WebCore::DOMData::DOMData):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::getCurrentMainThread):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMData.h: Added.
+        (WebCore::):
+        * bindings/v8/DOMDataStore.cpp: Added.
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::getDOMWrapperMap):
+        (WebCore::forget):
+        (WebCore::DOMDataStore::weakDOMObjectCallback):
+        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
+        (WebCore::DOMDataStore::weakNodeCallback):
+        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
+        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
+        * bindings/v8/DOMDataStore.h: Added.
+        (WebCore::DOMDataStore::):
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::forgetOnly):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::DOMDataStore::domNodeMap):
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        (WebCore::DOMDataStore::domSvgElementInstanceMap):
+        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
+        * bindings/v8/MainThreadDOMData.cpp: Added.
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        * bindings/v8/MainThreadDOMData.h: Added.
+        * bindings/v8/ScopedDOMDataStore.cpp: Added.
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        * bindings/v8/ScopedDOMDataStore.h: Added.
+        * bindings/v8/StaticDOMDataStore.cpp: Added.
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h: Added.
+        * bindings/v8/V8DOMMap.cpp:
+
+2009-07-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7091036> REGRESSION: Microsoft Messenger crashes during file send/receive due to use of WebKit on non-main thread
+
+        Add a method for detecting if we're being used within Microsoft Messenger.
+
+        * WebCore.base.exp: Export applicationIsMicrosoftMessenger and sort existing entries.
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm:
+        (WebCore::applicationIsMicrosoftMessenger):
+
+2009-07-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Implement EventListener::reportError for V8 event listeners in worker context. 
+        https://bugs.webkit.org/show_bug.cgi?id=27731
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-07-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel and David Levin.
+
+        Re-apply chromium/skia border fix (originally landed in r46157,
+        reverted in r46363), since it was not the cause of the reliability
+        failures in Chromium.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27388
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        createMarkup does not handle CSS properly
+        https://bugs.webkit.org/show_bug.cgi?id=27660
+
+        This patch isolates code that creates markup for styles in addStyleMarkup
+        It also makes all presentational elements (u, s, strike, i, em, b, strong) special ancestor in createMarkup
+        so that we can assume no text decoration style is passed to addStyleMarkup.
+
+        * editing/markup.cpp:
+        (WebCore::propertyMissingOrEqualToNone): Changed the first argument from CSSMutableStyleDecleration to CSSStyleDeclaration
+        (WebCore::isElementPresentational): Used to be elementHasTextDecorationProperty, now supports presentational tags
+        (WebCore::addStyleMarkup): Adds markup for style span and div
+        (WebCore::createMarkup): Uses isElementPresentational and addStyleMarkup
+
+2009-07-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        fix more obvious global object lookups
+        https://bugs.webkit.org/show_bug.cgi?id=27745
+
+        No new tests for these changes.  I believe in many cases
+        testing to be impossible.  Lack of testing justification next to
+        each change below.  The remaining pieces of bug 27634 will all
+        need tests.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument): not testable.
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        (WebCore::JSDataGridColumnList::nameGetter): no testing for this incomplete feature.
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): would require outer frame to trigger an event in the inner frame
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): covered by other tests, always correct to pass the globalObject through.
+        * bindings/js/JSHTMLElementCustom.cpp:
+        (WebCore::JSHTMLElement::pushEventHandlerScope): unclear when this could be triggered.
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::remove): toJS seems superfluous here to begin with.
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode): would require outer frame to trigger inner frame event.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::jsObjectForPluginElement): only used for NPAPI binding, unclear how to test.
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): unclear how to test.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set): unclear how to test/inspector only.
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject): unclear how to test.
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): unclear how to test.
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] 'title' attribute handling not correct for <a> / <anchor> elements
+        https://bugs.webkit.org/show_bug.cgi?id=27720
+
+        Unify title() implementation in WMLElement instead of several copies of the same logic.
+        We forgot WMLAnchorElement/WMLAElement, that lead to bugs. Fixes hovering links in the
+        WML manual-test suite.
+
+        * wml/WMLCardElement.cpp:
+        * wml/WMLCardElement.h:
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::title):
+        * wml/WMLElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLSelectElement.cpp:
+        * wml/WMLSelectElement.h:
+
+2009-07-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Speculative build fix for Windows and WinCE.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-07-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27474
+        Fixes crashes due to renderer getting destroyed in updateLayout.
+        We need to call updateLayout before we call into the renderer.
+        Removed the updateLayout call from RenderTextControl and moved it
+        into the calling sites.
+        
+        Also changes updateLayout to updateLayoutIgnorePendingStylesheets so
+        this works with pending stylesheets. Unfortunately, this seems to be
+        untestable. Loading an external stylesheet and then having an inline
+        script hit this code did not result in an pending stylesheets.
+        
+        The are other cases of this bug in the rendering code. I'll file a 
+        followup bug to audit the calls to updateLayout.
+
+        Test: fast/dom/text-control-crash-on-select.html
+
+        * dom/Document.h:
+        (WebCore::Document::inStyleRecalc): Added so the ASSERTs in updateFocusAppearance
+            and setSelectionRange could deal with cases of reentrancy into updateLayout
+            calls. This happens in a couple layout tests.
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updateSelectionRange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::isTextFieldWithRendererAfterUpdateLayout):
+        (WebCore::HTMLInputElement::setSelectionStart):
+        (WebCore::HTMLInputElement::setSelectionEnd):
+        (WebCore::HTMLInputElement::select):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::rendererAfterUpdateLayout):
+        (WebCore::HTMLTextAreaElement::setSelectionStart):
+        (WebCore::HTMLTextAreaElement::setSelectionEnd):
+        (WebCore::HTMLTextAreaElement::select):
+        (WebCore::HTMLTextAreaElement::setSelectionRange):
+        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
+
+2009-07-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        [V8] Remove parameterless frame/window retrieval methods from V8Proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27737
+
+        Refactoring, no new behavior, covered by existing tests.
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/V8NPUtils.cpp:
+        (convertV8ObjectToNPVariant): Ditto.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve): Ditto.
+        (WebCore::V8Proxy::canAccessPrivate): Ditto.
+        * bindings/v8/V8Proxy.h: Removed parameterless retrieveWindow/retrieveProxy decls.
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Changed to use V8Proxy::retrieveFrameForCurrentContext().
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] 'onpick' intrinsic event handling missing
+        https://bugs.webkit.org/show_bug.cgi?id=27723
+
+        Trigger 'onpick' intrinsic events from WMLOptionElement::setSelectedState().
+        All was in place, just forgot to enable the relevant code.
+
+        Fixes manual-tests/wml/select-onpick-event.wml
+        Test: wml/option-element-onpick.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::setSelectedState):
+
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27735
+        Give a helpful name to JSLock constructor argument
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        (WebCore::JSInspectorBackend::profiles):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::quarantineValue):
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::signature):
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::_commonInit):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::UTF8String):
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addScriptProfile):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getTotalPercent):
+        (WebCore::getSelfPercent):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+        (WebCore::getVisible):
+        (WebCore::getCallUID):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::getString):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::bindingInstance):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+
+2009-07-27  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Make plugin work for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27713
+
+        * plugins/win/PluginDatabaseWin.cpp:
+        (SHGetValue):
+        (PathRemoveFileSpec):
+        (WebCore::addWindowsMediaPlayerPluginDirectory):
+        (WebCore::addMacromediaPluginDirectories):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::wndProc):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+
+2009-07-27  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through Element Attributes and CSS Properties When Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27673
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._startEditing): refactored parameter
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): refactored to remove excess
+        (WebInspector.ElementsTreeElement.prototype._triggerEditAttribute): provide an attribute name and this will start editing it
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted.moveToNextAttributeIfNeeded): move between attributes
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertiesSection.prototype.findTreeElementWithName): search through treeElements for a style property name
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty): initialize a blank property for adding new properties
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): add references to the name and value elements
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCommitted): include the move direction as a parameter to the commit callback
+        (WebInspector.startEditing.element.handleKeyEvent): handle the tab key to specify the move direction
+        (WebInspector.startEditing):
+
+2009-07-27  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Add mapping FontWeight to QFont::Weight values as requested via FIXME.
+        https://bugs.webkit.org/show_bug.cgi?id=27663
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::toQFontWeight):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-07-27  Jakub Wieczorek  <faw217@gmail.com>
+
+         Reviewed by Adam Treat.
+
+         When clearing the plugin database, clear also the timestamp map.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27651
+
+         Currently, if we clear the database, it will still think that it is up
+         to date with the plugin directories so refreshing the database again
+         after changing the search paths may not work.
+
+         * plugins/PluginDatabase.cpp:
+         (WebCore::PluginDatabase::clear):
+
+2009-07-27  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add in trivial implementation of FontPlatformData::description() for
+        linux to fix build bustage in chromium.
+
+        Fix chromium linux build by adding missing function implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=27732
+
+        Tested with a build of chromium on linux.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+
+2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Final correction for WinCairo builds.
+        CoreServices only exists in Apple builds, but
+        some of its internal includes (e.g., <windows.h>) are needed
+        for other Windows targets.
+
+        * WebCorePrefix.h: When building for WinCairo, make sure
+          to include <windows.h>, <stdio.h>, and <ConditionalMacros.h>
+
+2009-07-27  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25552
+        Added new "pattern" attribute to HTMLInputElement and validation code
+        (validity.patternMismatch) as per HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-pattern
+
+        Tests: fast/forms/ValidityState-002.html
+               fast/forms/ValidityState-patternMismatch-001.html
+               fast/forms/ValidityState-patternMismatch-002.html
+               fast/forms/ValidityState-patternMismatch-003.html
+               fast/forms/ValidityState-patternMismatch-004.html
+               fast/forms/ValidityState-patternMismatch-005.html
+               fast/forms/ValidityState-patternMismatch-006.html
+               fast/forms/ValidityState-patternMismatch-007.html
+               fast/forms/pattern-attribute-001.html
+               fast/forms/pattern-attribute-002.html
+               fast/forms/pattern-attribute-003.html
+
+        * html/HTMLAttributeNames.in: pattern attribute
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::patternMismatch): method definition
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::patternMismatch): validation method
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::patternMismatch): validation flag
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Manual WML tests aren't properly working
+        https://bugs.webkit.org/show_bug.cgi?id=27718
+
+        Fix file paths in the manual WML layout tests, remove unneeded tests (already covered by DRT tests).
+        Add missing resources directory and test image. Reformat all testcases to a common style.
+        Add new StartTests.wml file, which should be used as starting point to crawl through the manual tests.
+
+        Filing bugs soon for all tests exposing bugs (7 in total).
+
+        * manual-tests/wml/StartTests.wml: Added.
+        * manual-tests/wml/a-br-element.wml:
+        * manual-tests/wml/a-element.wml:
+        * manual-tests/wml/a-img-element.wml:
+        * manual-tests/wml/access-target.wml:
+        * manual-tests/wml/anchor-br-element.wml:
+        * manual-tests/wml/anchor-element.wml:
+        * manual-tests/wml/anchor-img-element.wml:
+        * manual-tests/wml/card-newcontext-attr.wml:
+        * manual-tests/wml/card-onenterbackward.wml:
+        * manual-tests/wml/card-onenterforward.wml:
+        * manual-tests/wml/card-ontimer.wml:
+        * manual-tests/wml/card-title-attr.wml: Removed.
+        * manual-tests/wml/deck-access-control.wml:
+        * manual-tests/wml/go-element.wml: Removed.
+        * manual-tests/wml/input-emptyok.wml: Removed.
+        * manual-tests/wml/input-format.wml:
+        * manual-tests/wml/onevent-go.wml:
+        * manual-tests/wml/onevent-noop.wml:
+        * manual-tests/wml/onevent-prev.wml:
+        * manual-tests/wml/onevent-refresh.wml:
+        * manual-tests/wml/onevent-shadow.wml:
+        * manual-tests/wml/postfield-get.wml: Removed.
+        * manual-tests/wml/postfield-post.wml: Removed.
+        * manual-tests/wml/resources: Added.
+        * manual-tests/wml/resources/smiley.png: Added.
+        * manual-tests/wml/select-element.wml:
+        * manual-tests/wml/select-onpick-event.wml:
+        * manual-tests/wml/setvar-element.wml:
+        * manual-tests/wml/targetdeck.wml:
+        * manual-tests/wml/task-go-in-anchor.wml:
+        * manual-tests/wml/task-noop-in-do.wml:
+        * manual-tests/wml/task-noop-in-onevent.wml: Removed.
+        * manual-tests/wml/task-prev-in-anchor.wml:
+        * manual-tests/wml/task-refresh-in-anchor.wml:
+        * manual-tests/wml/template-go.wml:
+        * manual-tests/wml/template-onevent.wml: Removed.
+        * manual-tests/wml/template-ontimer.wml:
+        * manual-tests/wml/timer.wml:
+        * manual-tests/wml/variable-substitution.wml:
+
+2009-07-27  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a regression introduced in r42671, which caused the js event 
+        object to be hidden (some websites depend on being able to access it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Make the event object visible to javascript, instead of hidden.
+
+2009-07-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removing a no-op block of code in DatabaseTracker.cpp that
+        should've been removed in the patch for bug 26054.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27666
+
+        All tests in WebCore/storage pass.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase): Removed a no-op
+        block of code that was moved to SQLiteFileSystem.cpp and should
+        have been removed from DatabaseTracker.cpp
+
+2009-07-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix error handling in dedicated worker and worker context.
+        https://bugs.webkit.org/show_bug.cgi?id=27525
+
+        The following problems have been fixed:
+        1) The uncaught runtime script error is not reported using the
+        WorkerGlobalScope object's onerror attribute.
+        2) If the error is still not handled afterwards (onerror attribute
+        is not defined as a function or it returns true), the error should
+        be reported back to the associated Worker object by firing an
+        ErrorEvent.
+        3) If the error is still not handled by the associated Worker
+        object, the error should be reported to the user.
+
+        Test: fast/workers/worker-script-error.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError): adds a function to call
+        EventListener as a function with 3 arguments to report an error.
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::reportException):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        * workers/WorkerMessagingProxy.h:
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] History handling / page cache / loading is buggy and depends on several hacks
+        https://bugs.webkit.org/show_bug.cgi?id=27707
+
+        Redesign WML history/loading handling. In detail:
+
+        - Remove FrameLoader::setForceReloadWmlDeck(). WML used to force a special loading behaviour
+          by calling this method from WMLGoElement & friends - instead teach FrameLoader to detect
+          WML content itself.
+
+          WML content is usually a standalone WML document (isWMLDocument()=true) or as special case
+          an XHTML document which embeds a WML document (that's the way the WML layout tests work).
+          Force WML loading behaviour even for XHTML document which embed WML documents. This only
+          applies to our layout tests, not for any real world site. Though it gives us a perfect
+          way to test the WML loading code even when we're not operating on a standalone WML document.
+
+          Whenever a WMLCardElement is inserted into the document it will check wheter it's inserted
+          in a standalone WML document or wheter the main frame document is different. If it differs
+          the main frame documents' "containsWMLContent" property is set to true.
+
+          -> Make FrameLoader::shouldReload() use the new frameContainsWMLContent() method, which
+             checks if the associated frame document is a WML document or wheter it contains WML content.
+
+        - Change FrameLoader::loadItem() to use the new frameContainsWMLContent() method for 'shouldScroll'
+          detection. WML documents (or those containing WML content) always want new loads even for in-page
+          navigation. No "scroll to anchor" mechanism should apply.
+
+        - Modify FrameLoader::canCachePageContainingThisFrame() to check for !frameContainsWMLContent().
+          WML pages should never be cached, potential security problem due the use of variables (per spec).
+
+        Add two new WML tests which were broken before, testing onenterforward/onenterbackward event handling
+        and history navigation (<prev/> task).
+
+        Tests: wml/enter-card-with-events.html
+               wml/enter-first-card-with-events.html
+
+        * dom/Document.cpp: Initialize new 'm_containsWMLContent' property.
+        (WebCore::Document::Document):
+        * dom/Document.h: Add new helper methods and 'm_containsWMLContent" variable (explained above).
+        (WebCore::Document::setContainsWMLContent):
+        (WebCore::Document::containsWMLContent):
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::clearWMLPageHistory): Renamed from clearWmlPageHistory() & slight cleanup.
+        * history/BackForwardList.h:
+        * loader/FrameLoader.cpp: Rework WML loading behaviour (explained above).
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::frameContainsWMLContent):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * wml/WMLCardElement.cpp: 
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): No need anymore to manually track history length.
+        (WebCore::WMLCardElement::insertedIntoDocument): Handle setting containsWMLContent on the main frame document.
+        * wml/WMLGoElement.cpp: 
+        (WebCore::WMLGoElement::executeTask): Remove call to FrameLoader::setForceReloadWmlDeck()
+        * wml/WMLPageState.cpp: Remove 'm_historyLength' - no need anymore to track history length on our own.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::WMLPageState::dump):
+        (WebCore::WMLPageState::reset):
+        * wml/WMLPageState.h:
+
+2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Fix Chromium build breakage introduced in 46388.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27705
+
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add some more debug logging to PluginViewMac.
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        Remove dead code from the GTK NPAPI implementation.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+
+2009-07-27  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Buildfix on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=27702
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedEndPaint):
+            Constraint of (*endPaint) operand modified from "g" to "m" (memory) in inline 
+            assembly, because with "g" constraint, wrong assembly code generated.
+
+2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebCore bindings: Implement ScriptArray bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27691
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptArray.cpp: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::handleException):
+        (WebCore::ScriptArray::set):
+        (WebCore::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::jsArray):
+        * bindings/v8/ScriptArray.cpp: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::~ScriptArray):
+
+2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Change in r46407 broke Apple Windows build.
+        Switch to WinCairo-only test, to avoid any
+        other platform break.
+
+        * WebCorePrefix.h: 
+
+2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Change in r46407 broke Apple Windows build.
+
+        * WebCorePrefix.h: Use WTF_PLATFORM_CG to decide if
+          CoreServices.h should be included.
+
+2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correction, no review.
+
+        Change in r46195 broke WinCairo build.
+
+        * WebCorePrefix.h: CoreServices should be ignored
+          for non-Apple build.
+
+2009-07-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement the breakpoints sidebar pane.
+        This change adds simple UI support into the existing
+        BreakpointSidebarPane.
+
+        https://bugs.webkit.org/show_bug.cgi?id=11175
+
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set enabled):
+        (WebInspector.Breakpoint.prototype.get label):
+        (WebInspector.Breakpoint.prototype.get id):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane):
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.labelClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.scriptOrResourceForID):
+        * inspector/front-end/inspector.css:
+
+2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas: rotation of 'no-repeat' pattern still has small error
+        https://bugs.webkit.org/show_bug.cgi?id=26749
+
+        Use 1<<22 as steps of no-repeat pattern to make the error less
+        than 0.5.  The previous value may cause 1 pixel errors.
+
+        Add another test to show this bug clearly.
+        Also add png expected image which was missing in the previous patch.
+
+        Test: fast/canvas/image-pattern-rotate.html
+
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-07-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Windows build break due to warning C4819
+        https://bugs.webkit.org/show_bug.cgi?id=27416
+
+        Disable C4819 warning to fix build.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Kevin McCullough.
+
+        Inspector: Keyboard Shortcuts to Switch Panels
+        https://bugs.webkit.org/show_bug.cgi?id=27286
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): save a list of the order of the panels
+        (WebInspector.documentKeyDown): handle the keyboard shortcuts to traverse the panels
+
+2009-07-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        [Qt] Fix build break after r46369
+        https://bugs.webkit.org/show_bug.cgi?id=27680
+
+        * WebCore.pro:
+
+2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=27677
+
+        Substitute variables upon attach() time instead of insertedIntoDocument(). Otherwhise variable substitution
+        won't work during inter-deck jumps (same URL, different fragment). Covered by new test fast/wml/newcontext-same-deck.html.
+
+        * dom/Text.cpp:
+        (WebCore::Text::attach):
+        * dom/Text.h:
+
+2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLDoElement doesn't update its RenderButton object upon attach()
+        https://bugs.webkit.org/show_bug.cgi?id=27676
+
+        WMLDoElement needs to implement attach() and call updateFromElement() on its associated RenderButton.
+        Mimics HTMLButtonElement/HTMLFormControlElement behaviour and fixes several painting/styling issues covered by existing tests in fast/wml.
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::attach):
+        * wml/WMLDoElement.h:
+
+2009-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Fix Windows build breakage introduced in 46390.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Inspector: Properties Should be Sorted more Naturally
+        https://bugs.webkit.org/show_bug.cgi?id=27329
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update): use the displaySort when showing properties
+        (WebInspector.ObjectPropertiesSection.prototype._displaySort): alphaNumerical sort
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): use the displaySort when showing properties
+        * inspector/front-end/utilities.js:
+        (Object.sortedProperties): allow for an optional sorting function in Object.sortedProperties
+
+2009-07-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorController into InspectorController
+        and InspectorBackend. Everything frontend needs from InspectorController
+        will slowly migrate into the InspectorBackend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27541
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSInspectorBackendCustom.cpp: Added.
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::search):
+        (WebCore::JSInspectorBackend::databaseTableNames):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::setting):
+        (WebCore::JSInspectorBackend::setSetting):
+        (WebCore::JSInspectorBackend::wrapCallback):
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        (WebCore::JSInspectorBackend::profiles):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/js/JSInspectorControllerCustom.cpp: Removed.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorBackend):
+        * inspector/InspectorBackend.cpp: Added.
+        * inspector/InspectorBackend.h: Added.
+        (WebCore::InspectorBackend::create):
+        (WebCore::InspectorBackend::inspectorController):
+        * inspector/InspectorBackend.idl: Added.
+        * inspector/InspectorController.idl: Removed.
+        * inspector/front-end/Resource.js:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+
+2009-07-25  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Update WebCore/page/Frame.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27654
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::firstRectForRange):
+        (WebCore::createRegExpForLabels):
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        (WebCore::Frame::matchLabelsAgainstElement):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionStartStylePropertyValue):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::applyEditingStyleToElement):
+        (WebCore::Frame::selectionBounds):
+        (WebCore::Frame::currentForm):
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::clearFormerDOMWindow):
+        (WebCore::Frame::unfocusWindow):
+        (WebCore::Frame::respondToChangedSelection):
+        (WebCore::Frame::documentAtPoint):
+        * page/Frame.h:
+        (WebCore::Frame::create):
+        (WebCore::Frame::displayStringModifiedByEncoding):
+        (WebCore::Frame::pageZoomFactor):
+        (WebCore::Frame::textZoomFactor):
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add functions to print the glyph page trees for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=27671
+
+        * platform/graphics/FontData.h: Defined a description() method.
+
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::showSubtree): Added. Prints the node and
+            its descendants.
+        (showGlyphPageTrees): Added. Prints all glyph page trees.
+        (showGlyphPageTree): Added. Prints the glyph page tree for a given page.
+        * platform/graphics/GlyphPageTreeNode.h:
+
+        * platform/graphics/SegmentedFontData.cpp:
+        (WebCore::SegmentedFontData::description): Added.
+
+        * platform/graphics/SegmentedFontData.h:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::description): Added. Uses the platform data
+            as the description for non-svg, non-custom fonts.
+        * platform/graphics/SimpleFontData.h:
+
+        * platform/graphics/gtk/FontPlatformData.h:
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/mac/FontPlatformData.h:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::description): Added. Returns the
+            description of the CGFont, the size and the synthetic style flags,
+            if set.
+
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/wince/FontPlatformData.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * platform/graphics/wince/FontPlatformData.h:
+
+        * platform/graphics/wx/FontPlatformData.h:
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+2009-07-24  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        SVG and XPath memory leaks in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=27488
+
+        Add proper 'create' methods to SVGPodTypeWrappers and
+        XPathNSResolvers in the V8 bindings to avoid memory leaks.
+
+        Introduce convertToV8Object methods that accept PassRefPtrs and
+        clean up the use of get() and release() on RefPtrs.
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGPODTypeWrapperCreatorForList::create):
+        (WebCore::V8SVGPODTypeWrapperCreatorForList::V8SVGPODTypeWrapperCreatorForList):
+        (WebCore::V8SVGStaticPODTypeWrapper::create):
+        (WebCore::V8SVGStaticPODTypeWrapper::V8SVGStaticPODTypeWrapper):
+        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::create):
+        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::V8SVGStaticPODTypeWrapperWithPODTypeParent):
+        (WebCore::V8SVGStaticPODTypeWrapperWithParent::create):
+        (WebCore::V8SVGStaticPODTypeWrapperWithParent::V8SVGStaticPODTypeWrapperWithParent):
+        (WebCore::V8SVGDynamicPODTypeWrapper::create):
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix of <rdar://6310538> Middle-click panning should be springloaded while dragging
+        https://bugs.webkit.org/show_bug.cgi?id=21794
+        
+        Create two new booleans to determine whether we have done a springloaded pan scroll, and update
+        the name of setPanScrollCursor to updatePanScrollState to more accurately describe what the function
+        does. 
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Initialized two new booleans.
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updatePanScrollState): Renamed from setPanScrollCursor.
+        (WebCore::EventHandler::stopAutoscrollTimer): Clear the pan scrolling in progress flag.
+        (WebCore::EventHandler::handleMouseReleaseEvent): Clear the pan scrolling button pressed flag.
+        * page/EventHandler.h:
+
+2009-07-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27657
+        Add more wince port files to WebCore
+
+        Written by Yong Li  <yong.li@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+
+        * loader/icon/wince/IconDatabaseWince.cpp: Added.
+        * rendering/RenderThemeWince.cpp: Added.
+        * rendering/RenderThemeWince.h: Added.
+        * storage/wince/DatabaseThreadWince.cpp: Added.
+        * storage/wince/DatabaseThreadWince.h: Added.
+        * storage/wince/LocalStorageThreadWince.cpp: Added.
+        * storage/wince/LocalStorageThreadWince.h: Added.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Added.
+
+2009-07-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        execCommand('underline') can modify DOM outside of the contentEditable area
+        https://bugs.webkit.org/show_bug.cgi?id=24333
+
+        highestAncestorWithTextDecoration stops at the closest unsplittable element so that if text-decoration is applied
+        outside of it, we don't accidently modify the style attribute.
+
+        Tests: editing/style/textdecoration-outside-of-rooteditable.html
+               editing/style/textdecoration-outside-of-unsplittable-element.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init):
+        (WebCore::highestAncestorWithTextDecoration):
+
+2009-07-24  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27639
+
+        Fixes false positives when evaluating certain strings that only contain 
+        non-canonical characters.
+
+        Test: http/tests/security/xssAuditor/script-tag-safe.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter):
+        (WebCore::XSSAuditor::findInRequest):
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Changed WorkerContext destructor to not access possibly-freed WorkerThread.
+
+        Failed assertion in WorkerContext::~WorkerContext().
+        https://bugs.webkit.org/show_bug.cgi?id=27665
+
+       * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Removed assertion that relies on WorkerThread still being alive (moved to DedicatedWorkerContext destructor).
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updated code generator to properly generate bindings for WorkerContext exposed functions.
+
+        Storing a reference to WorkerContext.postMessage() and calling it later yields a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=27419
+
+        Test: fast/workers/worker-call.html
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSDedicatedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Functions that convert from JSValue to the appropriate WorkerContext/DedicatedWorkerContext object.
+        * bindings/js/JSWorkerContextBase.h:
+        Added toJS*WorkerContext APIs.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Added code to appropriately check the passed-in this object when invoking functions at global scope.
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Adam Barth.
+
+        Refactor WorkerContext to move DedicatedWorker-specific APIs into DedicatedWorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=27420
+
+        No new tests as the existing tests already provide sufficient coverage (this is just a refactoring with no new functionality).
+
+        * DerivedSources.cpp:
+        Added JSDerivedWorkerContext.cpp
+        * DerivedSources.make:
+        Added DerivedWorkerContext files
+        * GNUmakefile.am:
+        Added DerivedWorkerContext files
+        * WebCore.gypi:
+        Added DerivedWorkerContext files
+        * WebCore.pro:
+        Added DerivedWorkerContext files
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DerivedWorkerContext files
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DerivedWorkerContext files
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp: Added.
+        (WebCore::JSDedicatedWorkerContext::mark):
+        Custom mark function for onmessage event handler.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Supports conversion to JSDedicatedWorkerContext.
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        Moved onmessage mark handling into DedicatedWorkerContext.
+        * bindings/js/WorkerScriptController.cpp:
+        Added appropriate casts to DedicatedWorkerContext for postMessage().
+        (WebCore::WorkerScriptController::initScript):
+        Manually sets up the prototype chain for the worker context.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Changed special case code for WorkerContext to be triggered by new IsWorkerContext attribute.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Changed hard-coded tests for WorkerContext to support DedicatedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added DedicatedWorkerContext.h
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8DedicatedWorkerContext.cpp
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added code to reserve extra fields for V8DedicatedWorkerContext.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8DedicatedWorkerContext.h in addition to V8WorkerContext.h
+        * bindings/v8/V8Index.h:
+        Added DedicatedWorkerContext as a non-node wrapper type.
+        Removed WORKERCONTEXT as a valid template type.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Creates DedicatedWorkerContext instead of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        Returns DedicatedWorkerContext instead of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        Refactored to deal with DedicatedWorkerContext.
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp: Added.
+        Moved onmessage code from V8WorkerContextCustom.cpp
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        Moved onmessage code to V8DedicatedWorkerContextCustom.cpp
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDedicatedWorkerContext):
+        * dom/EventTarget.h:
+        * workers/DedicatedWorkerContext.cpp: Added.
+        Moved DedicatedWorker-only APIs from WorkerContext.
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::reportException):
+        (WebCore::DedicatedWorkerContext::postMessage):
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h: Added.
+        Moved DedicatedWorker-only APIs from WorkerContext.
+        (WebCore::DedicatedWorkerContext::create):
+        (WebCore::DedicatedWorkerContext::toDedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::setOnmessage):
+        (WebCore::DedicatedWorkerContext::onmessage):
+        * workers/DedicatedWorkerContext.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that notifies parent that worker is closing down into DedicatedWorkerContext.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        Exposed closing flag as an API so derived classes can access it.
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        Calls into DedicatedWorkerContext to handle message.
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        Creates a DedicatedWorkerContext when the thread starts up.
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move more callers to using 3 argument toJS
+        https://bugs.webkit.org/show_bug.cgi?id=27661
+
+        No functional changes, thus no tests.
+        These are all the places where we can't yet pass the
+        correct globalObject because we don't have or don't know the right one.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix the last of the x-frame constructor calls to have the right prototype chains
+        https://bugs.webkit.org/show_bug.cgi?id=27645
+
+        Fix the last few constructors to use their stored globalObject pointer when
+        constructing objects instead of the lexicalGlobalObject().
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::constructWebKitPoint):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+
+2009-07-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup exception handling in worker evaluation code.
+        https://bugs.webkit.org/show_bug.cgi?id=27282
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::setException):
+
+2009-07-24  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reverting r46157, since it may be causing problems with Chromium
+        reliability (see http://crbug.com/17569).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27388
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: inspector seems broken in ToT WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=27646
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add the shadow style member to the ShadowData constructor and ==
+        operator
+
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::ShadowData):
+        (WebCore::ShadowData::operator==):
+
+2009-07-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] More V8 bindings changes to use ErrorEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=27630
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-07-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Clean up dependencies on Apple support libraries for non-Apple build.
+        http://bugs.webkit.org/show_bug.cgi?id=27532.
+
+        * platform/graphics/win/SimpleFontDataWin.cpp: Conditionalize references
+          to ApplicationServices.h and WebKitSystemInterface.h
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Another attempted build fix 
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Attempted build fix
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::toJS):
+
+2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Build fix for 64 bit Linux.
+
+        int64_t is long on Linux 64 bit and not long long, thus
+        getFileSize with a int64_t out value fails to build.
+
+        Use a temporary to work around the problem.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::spaceNeeded):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update all CREATE_DOM_*_WRAPPER callers to pass globalObject
+        https://bugs.webkit.org/show_bug.cgi?id=27644
+
+        This is another attempt at making the change for bug 27634 smaller.
+        I included the changes to make_names.pl as well as any file which
+        used CREATE_DOM_*_WRAPPER macros.
+
+        The changes to the construct* functions are what fix the cases in
+        fast/dom/constructed-objects-prototypes.html
+
+        The changes to passing globalObject through CREATE_* are what fix
+        fast/dom/prototype-inheritance-2.html
+
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSDOMBinding.h: updated macros to pass globalObject.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttributeNode): use globalObject() for wrapping return value.
+        (WebCore::JSElement::setAttributeNodeNS): use globalObject() for wrapping return value.
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData): pass globalObject.
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems): use globalObject() for wrapping returned collection items.
+        (WebCore::callHTMLCollection): use globalObject() for wrapping returned collection items.
+        (WebCore::JSHTMLCollection::item): use globalObject() for wrapping returned collection items.
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapper): pass globalObject.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix): use constructors globalObject when constructing
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest): use constructors globalObject when constructing
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::constructXSLTProcessor): use constructors globalObject when constructing
+        * dom/make_names.pl:
+            Pass globalObject through CREATE_* macros and various support functions.
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update CodeGeneratorJS.pm to support passing JSDOMGlobalObject* to toJS calls
+        https://bugs.webkit.org/show_bug.cgi?id=27643
+
+        This is an attempt to make this change as small as possible.
+        I started by including all changes to CodeGeneratorJS.pm from bug 27634,
+        and then made the minimal amount of other changes needed to support that change.
+
+        Most toJS implementations ignore their passed JSDOMGlobalObject.
+        There are stub 2-argument toJS, toJSNewlyCreated implementations to help compiling.
+        All places where it is not clear what we should pass as the global object
+        (or where the global object is simply not available, like for some SVG bindings)
+        we pass deprecatedGlobalObjectForPrototype instead.
+
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): pass the wrong globalObject for now
+        * bindings/js/JSDOMBinding.h:
+            Pass the wrong global object to the CREATE_ macros for now.
+            In the next change we'll come back and pass the correct one.
+            That will require changes to make_names.pl.
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMObjectWithGlobalPointer::~DOMObjectWithGlobalPointer):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS): added to convert 2 arg calls to 3 arg calls to limit the scope of this change.
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::toJS): DOMWindow always uses its own prototype chain.
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapper): pass globalObject to toJS(Document*) to avoid recursion
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::toJS): pass globalObject along
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse): pass wrong globalObject for now.
+        (WebCore::JSSVGMatrix::rotateFromVector): pass wrong globalObject for now.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+            All of these methods need a globalObject, but most SVG binding don't have
+            space for one, so we just pass the lexicalGlobalObject for now.
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter): pass wrong globalObject for now.
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter): pass wrong globalObject for now.
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJS): WorkerContext always uses its own prototype chain since it's a GlobalObject subclass.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+            All generated toJS calls now pass a globalObject.
+            All generated toJS implementations now expect a globalObject.
+            Simplified all the slot casts by using a "castedThis" local.
+            SVG bindings which don't have a globalObject() accessor pass the deprecated lexicalGlobalObject instead.
+            Simplified printing of constructor objects using a $constructorClassName variable.
+            All generated constructor functions follow the construct$className form to match the custom constructors.
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        typing "document.__proto__" in inspector throws exception
+        https://bugs.webkit.org/show_bug.cgi?id=27169
+
+        * inspector/front-end/utilities.js:
+        (Object.type):
+
+2009-07-24  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Anders Carlsson.
+
+        ApplicationCache should have size limit
+        https://bugs.webkit.org/show_bug.cgi?id=22700
+
+        https://lists.webkit.org/pipermail/webkit-dev/2009-May/007560.html
+
+        This change implements a mechanism for limiting the maximum size of
+        the application cache file. When this size is reached, a ChromeClient
+        callback is invoked asynchronously and the saving of the last (failed)
+        cache is retried automatically.
+        
+        This change also extends the ApplicationCacheStorage API by allowing
+        a client to query or modify the application cache without having to
+        load any resources into memory.
+
+        Test: http/tests/appcache/max-size.html
+
+        * WebCore.base.exp:
+        Exports the symbols required by the DumpRenderTree test application.
+        * loader/EmptyClients.h:
+        Adds empty implementation of the new ChromeClient methods.
+        * loader/appcache/ApplicationCache.cpp:
+        * loader/appcache/ApplicationCache.h:
+        Adds the ability to calculate the approximate size of an ApplicationCache object.
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/appcache/ApplicationCacheGroup.h:
+        Invokes the ChromeClient callback when the storage layer runs out of space.
+        After the callback is invoked, we re-attempt to store the newest cache,
+        in case the ChromeClient has freed some space.
+        * loader/appcache/ApplicationCacheResource.cpp:
+        * loader/appcache/ApplicationCacheResource.h:
+        Adds the ability to calculate the approximate size of an ApplicationCacheResource object.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        * loader/appcache/ApplicationCacheStorage.h:
+        Enforces a maximum size for the application cache file.
+        * page/ChromeClient.h:
+        Adds a new callback, invoked when the ApplicationCacheStorage reports that it has
+        reached the maximum size for its database file.
+        * platform/sql/SQLiteDatabase.cpp:
+        * platform/sql/SQLiteDatabase.h:
+        Adds a new method that allows querying for the amount of unused space inside the
+        application cache database file.
+
+2009-07-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Use TextEncoding facilities to convert between UTF16 and UTF8
+        instead of rolling our own solution.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-07-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix confusion in g_substr between length in bytes and length in
+        characters. Was causing crashes in some situations when dealing
+        with non-ASCII text encoded as UTF8.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (g_substr):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Impossible to add an attribute to a node without attributes
+        https://bugs.webkit.org/show_bug.cgi?id=21108
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewButton):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/inspector.css:
+
+2009-07-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adds support for Firebug's magic $0 variable to access inspected node
+        https://bugs.webkit.org/show_bug.cgi?id=17907
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI.{
+            _inspectedNodes, _addInspectedNode, $0, $1, $n}
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged): Stores the inspected node history
+            in _inspectorCommandLineAPI._inspectedNodes
+        (WebInspector.ElementsPanel):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Dragging a resource in the sidebar should drag it's URL
+        https://bugs.webkit.org/show_bug.cgi?id=14410
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Double click on a resource in the sidebar should open that resource in Safari
+        https://bugs.webkit.org/show_bug.cgi?id=14409
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick): open a resource url
+
+2009-07-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Bump pango version requirement to 1.12 and remove unnecessary #ifdefs.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::getDefaultPangoLayout):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/gtk/Language.cpp:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Missing UIString and other localizedString.js fixes
+        https://bugs.webkit.org/show_bug.cgi?id=27288
+
+        * English.lproj/localizedStrings.js:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Should Syntax Highlight JSON
+        https://bugs.webkit.org/show_bug.cgi?id=27503
+
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27624
+
+        * page/DragController.cpp:
+        (WebCore::DragController::~DragController):
+        (WebCore::documentFragmentFromDragData):
+        (WebCore::DragController::dragEnded):
+        (WebCore::DragController::dragEntered):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::dragUpdated):
+        (WebCore::DragController::performDrag):
+        (WebCore::asFileInput):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::delegateDragSourceAction):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::canProcessDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::mayStartDragAtEventLocation):
+        (WebCore::getCachedImage):
+        (WebCore::getImage):
+        (WebCore::prepareClipboardForImageDrag):
+        (WebCore::dragLocForDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        (WebCore::DragController::doImageDrag):
+        (WebCore::DragController::doSystemDrag):
+        (WebCore::DragController::placeDragCaret):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/Chrome.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27608
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::runBeforeUnloadConfirmPanel):
+        (WebCore::Chrome::runJavaScriptAlert):
+        (WebCore::Chrome::runJavaScriptConfirm):
+        (WebCore::Chrome::runJavaScriptPrompt):
+        (WebCore::Chrome::shouldInterruptJavaScript):
+        (WebCore::Chrome::setToolTip):
+        (WebCore::Chrome::requestGeolocationPermissionForFrame):
+        (WebCore::ChromeClient::generateReplacementFile):
+        (WebCore::ChromeClient::paintCustomScrollbar):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/Coordinates.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27614
+
+        * page/Coordinates.cpp:
+        (WebCore::Coordinates::toString):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMSelection.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27614
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::setBaseAndExtent):
+        (WebCore::DOMSelection::modify):
+        (WebCore::DOMSelection::addRange):
+        (WebCore::DOMSelection::deleteFromDocument):
+        * page/DOMSelection.h:
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27618
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::fired):
+        (WebCore::DOMTimer::suspend):
+        (WebCore::DOMTimer::resume):
+        (WebCore::DOMTimer::canSuspend):
+        * page/DOMTimer.h:
+        (WebCore::DOMTimer::minTimerInterval):
+        (WebCore::DOMTimer::setMinTimerInterval):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Classes call DOMObject::mark() explicitly, should call DOMObjectWithGlobal::mark() instead
+        https://bugs.webkit.org/show_bug.cgi?id=27641
+
+        Nothing uses globalObject() yet, but this was causing crashes
+        in the patch for bug 27634.  This is covered by fast/dom/gc-6.html.
+
+        I decided to change these to Base:: instead of DOMObjectWithGlobal::
+        for future-proofing.  All autogenerated classes use a typedef Base
+        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::mark):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::mark):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertySlot):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::mark):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::mark):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::mark):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::mark):
+
+2009-07-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make most DOMObjects hold onto a JSDOMGlobalObject*
+        https://bugs.webkit.org/show_bug.cgi?id=27588
+
+        This change is almost entirely plumbing.  Only one functional
+        change as part of this all (window.document.constructor has the correct prototype)
+        Changes are detailed below.
+
+        inner.document.constructor is fixed because all properties on the window
+        object are created with the correct globalObject (instead of the lexical one).
+        Since all objects now carry a globalObject pointer, when document creates
+        HTMLDocumentConstructor it now has the right globalObject to use.
+
+        Tests:
+          fast/dom/prototype-inheritance.html
+          fast/dom/prototype-inheritance-2.html
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+            Update the comment and add an ignored globalObject argument.
+        * bindings/js/JSDOMBinding.h:
+            Pass a globalObject to all DOMObjects during creation.  Currently it's the wrong global object.
+            Once toJS is passed a globalObject it will be the right one.
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::globalObject): Makes binding generation easier.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history): JSHistory is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        (WebCore::JSDOMWindow::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSHTMLCollectionCustom.cpp: Re-factoring needed to pass globalObject to JSNamedNodesCollection constructor.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::canGetItemsForName):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+             Now passed globalObject.  This is tested by inner.document.forms.testForm.
+             The passed globalObject is still wrong until toJS is fixed.
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+             Add DOMConstructorObject missed by http://trac.webkit.org/changeset/45938
+             This class is not compiled by default, so not testable.
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        * bindings/js/JSSharedWorkerConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+             Make all bindings objects carry a globalObject pointer using DOMObjectWithGlobalPointer.
+             SVG bindings which need a context() pointer do not have enough space for globalObject() too.
+             WorkerContext does not need a globalObject (it is one), so special case it.
+             Make all .constructor calls use the stored globalObject().  This is what fixes window.document.constructor.
+             Make all constructors inherit from DOMConstructorObject for consistency.  Since the auto-bound constructors
+             override createStructure anyway, there is no functional change here.  Just completing work started in r45938.
+
+2009-07-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        WebCore has a few places that don't gracefully handle a null request returned from willSendRequest.
+        https://bugs.webkit.org/show_bug.cgi?id=27595
+
+        Test: http/tests/misc/will-send-request-returns-null-on-redirect.html
+        
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::removeResource): Null-check the request URL.
+        
+        * platform/network/cf/ResourceHandleCFNet.cpp: Ditto, and return null instead of creating an empty one.
+        (WebCore::willSendRequest):
+
+2009-07-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27633 - AXLoadComplete can be fired off to frequently
+        https://bugs.webkit.org/show_bug.cgi?id=27633
+
+        An integration issue left out some curly braces.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2009-07-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        URL appears in back/forward button menu instead of title for items with custom representation
+        https://bugs.webkit.org/show_bug.cgi?id=27586
+        rdar://problem/5060337
+
+        * WebCore.base.exp: Exported DocumentLoader::setTitle for use by Mac WebKit.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didChangeTitle): Tightened code to check if the document
+        loader is the correct one; previously this would never happen because we'd
+        commit the load before any title changes could be registered, but now we can
+        encounter a case where we get a title during a provisional load.
+
+2009-07-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        [CSS3 Backgrounds and Borders] Add support for inset box shadows
+        https://bugs.webkit.org/show_bug.cgi?id=27582
+
+        Test: fast/box-shadow/inset.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Set the ShadowValue’s shadow style to 'inset'
+            as needed.
+
+        * css/CSSParser.cpp:
+        (WebCore::ShadowParseContext::ShadowParseContext): Added style and allowStyle
+            members. Initialize the allowStyle member.
+        (WebCore::ShadowParseContext::commitValue): Pass the style value to the
+            ShadowValue constructor. Reset allowStyle.
+        (WebCore::ShadowParseContext::commitLength): Update allowStyle.
+        (WebCore::ShadowParseContext::commitColor): Ditto.
+        (WebCore::ShadowParseContext::commitStyle): Added. Sets the style member and
+            updates the state.
+        (WebCore::CSSParser::parseShadow): Parse the 'inset' keyword.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the style value from the
+            shadow value and pass it to the ShadowData constructor.
+
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::ShadowValue): Added style.
+        (WebCore::ShadowValue::cssText): Added style.
+
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::create): Added style.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc): Added a blend function for shadow styles. When blending
+            between normal and inset shadows, all intermediate values map to normal.
+        (WebCore::PropertyWrapperShadow::blend): Added normal style to the default
+            shadow.
+            
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintBoxShadow): Added a shadow style parameter,
+            which is passed through to RenderBoxModelObject::paintBoxShadow().
+
+        (WebCore::InlineFlowBox::paintBoxDecorations): Paint inset shadows on top of
+            the background.
+
+        * rendering/InlineFlowBox.h:
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations): Paint inset shadows on top of the
+            background.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Added a shadow style
+            parameter, and code to paint inset shadows.
+
+        * rendering/RenderBoxModelObject.h:
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Paint inset shadows on top of
+            the background.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
+
+        * rendering/style/ShadowData.h:
+        Added a ShadowStyle enum.
+        (WebCore::ShadowData::ShadowData): Add and initialize a style member.
+
+2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build with UNUSED_PARAM(frame) for when ENABLE(3D_RENDERING) is not defined.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        3d-transforms media query needs to look check that accelerated compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=27621
+        
+        When evaluating a media query with '-webkit-transform-3d', we need to check the
+        runtime switch that toggles accererated compositing, and therefore 3D.
+        
+        No test because we can't disable the pref dynamically in DRT.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand('underline') can't remove <U> underlines
+        https://bugs.webkit.org/show_bug.cgi?id=20215
+
+        This patch adds support for u, s, and strike to implicitlyStyledElementShouldBeRemovedWhenApplyingStyle so that
+        WebKit can remove those presentational tags when necessary.
+        It also modifies StyleChange::init not to add "text-decoration: none".  Not only is this style meaningless
+        (does not override inherited styles) but it was also causing WebKit to generate extra spans with this style.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::hasValue): True if the property contains the specified value
+        * css/CSSValueList.h: Updated prototype
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): No longer adds "text-decoration: none"
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): Supports text-decoration-related elements
+
+2009-07-23  Jessie Berlin  <jberlin@apple.com>
+        
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27554
+        Expose the value of text-overflow in getComputedStyle.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-text-overflow.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        Add text-overflow to the list of computedProperties.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Return the value of the text-overflow property.
+
+2009-07-23  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27510
+
+        [S60 QtWebKit] Don't put some intermediate generated files into the final mmp project
+        file for linking. This is a temporary workaround for qmake bug in Symbian port, should 
+        be reverted after qmake is fixed.
+
+        * WebCore.pro:
+
+2009-07-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in running workers in Chrome.
+        https://bugs.webkit.org/show_bug.cgi?id=27620
+
+        The fix is to change V8DOMMap::removeAllDOMObjectsInCurrentThreadHelper
+        to do not call removeObjectsFromWrapperMap for certain types of DOM
+        objects that exist only in main thread.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+
+2009-07-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27572
+        Implement support for background-attachment:local.
+
+        Added new test fast/overflow/overflow-with-local-attachment.html.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillAttachment):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillAttachment):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::attachment):
+        (WebCore::FillLayer::setAttachment):
+        (WebCore::FillLayer::hasFixedImage):
+        (WebCore::FillLayer::initialFillAttachment):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundAttachment):
+        (WebCore::InheritedFlags::maskAttachment):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        copyInheritableProperties and removeComputedInheritablePropertiesFrom should be deprecated
+        https://bugs.webkit.org/show_bug.cgi?id=27325
+
+        This patch deprecates copyInheritableProperties because it has been used for two different purposes:
+        1.  Calculating the typing style.
+        2.  Moving HTML subtrees and seeking to remove redundant styles.
+        These tasks should be broken out into two separate functions.  New code should not use this function.
+
+        It deletes removeComputedInheritablePropertiesFrom because it hasn't been used anywhere.
+
+        There is no test since the patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: removeComputedInheritablePropertiesFrom has been removed
+        (WebCore::CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties): has been renamed from copyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: ditto
+        * editing/DeleteSelectionCommand.cpp: ditto
+        (WebCore::removeEnclosingAnchorStyle): ditto
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): ditto
+        * editing/EditCommand.cpp: ditto
+        (WebCore::EditCommand::styleAtPosition): ditto
+        * editing/RemoveFormatCommand.cpp: ditto
+        (WebCore::RemoveFormatCommand::doApply): ditto
+        * editing/ReplaceSelectionCommand.cpp: ditto
+        (WebCore::handleStyleSpansBeforeInsertion): ditto
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): ditto
+        * editing/markup.cpp: ditto
+        (WebCore::removeEnclosingMailBlockquoteStyle): ditto
+        (WebCore::removeDefaultStyles): ditto
+        (WebCore::createMarkup): ditto
+
+2009-07-22  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Audio element at default width shouldn't have time field.
+        https://bugs.webkit.org/show_bug.cgi?id=27589
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimeDisplayElement::setVisible): Make sure we don't
+        forget to remember the visibility if there is no renderer.
+
+2009-07-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27598 Clean up the 
+        AccessibilityObject class
+
+        Mostly this is just moving empty stubs into the header rather than 
+        muddying the cpp file with them. A few functions were made pure 
+        virtual.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isARIAControl):
+        (WebCore::AccessibilityObject::clickPoint):
+        (WebCore::AccessibilityObject::documentFrameView):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::intValue):
+        (WebCore::AccessibilityObject::layoutCount):
+        (WebCore::AccessibilityObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityObject::focusedUIElement):
+        (WebCore::AccessibilityObject::firstChild):
+        (WebCore::AccessibilityObject::lastChild):
+        (WebCore::AccessibilityObject::previousSibling):
+        (WebCore::AccessibilityObject::nextSibling):
+        (WebCore::AccessibilityObject::parentObjectIfExists):
+        (WebCore::AccessibilityObject::observableObject):
+        (WebCore::AccessibilityObject::linkedUIElements):
+        (WebCore::AccessibilityObject::titleUIElement):
+        (WebCore::AccessibilityObject::ariaRoleAttribute):
+        (WebCore::AccessibilityObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityObject::ariaRoleHasPresentationalChildren):
+        (WebCore::AccessibilityObject::roleValue):
+        (WebCore::AccessibilityObject::ariaAccessiblityName):
+        (WebCore::AccessibilityObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityObject::ariaDescribedByAttribute):
+        (WebCore::AccessibilityObject::accessibilityDescription):
+        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
+        (WebCore::AccessibilityObject::axObjectCache):
+        (WebCore::AccessibilityObject::axObjectID):
+        (WebCore::AccessibilityObject::setAXObjectID):
+        (WebCore::AccessibilityObject::anchorElement):
+        (WebCore::AccessibilityObject::actionElement):
+        (WebCore::AccessibilityObject::boundingBoxRect):
+        (WebCore::AccessibilityObject::selectedTextRange):
+        (WebCore::AccessibilityObject::selectionStart):
+        (WebCore::AccessibilityObject::selectionEnd):
+        (WebCore::AccessibilityObject::url):
+        (WebCore::AccessibilityObject::selection):
+        (WebCore::AccessibilityObject::stringValue):
+        (WebCore::AccessibilityObject::title):
+        (WebCore::AccessibilityObject::helpText):
+        (WebCore::AccessibilityObject::textUnderElement):
+        (WebCore::AccessibilityObject::text):
+        (WebCore::AccessibilityObject::textLength):
+        (WebCore::AccessibilityObject::selectedText):
+        (WebCore::AccessibilityObject::accessKey):
+        (WebCore::AccessibilityObject::widget):
+        (WebCore::AccessibilityObject::widgetForAttachmentView):
+        (WebCore::AccessibilityObject::setFocused):
+        (WebCore::AccessibilityObject::setSelectedText):
+        (WebCore::AccessibilityObject::setSelectedTextRange):
+        (WebCore::AccessibilityObject::setValue):
+        (WebCore::AccessibilityObject::setSelected):
+        (WebCore::AccessibilityObject::makeRangeVisible):
+        (WebCore::AccessibilityObject::childrenChanged):
+        (WebCore::AccessibilityObject::addChildren):
+        (WebCore::AccessibilityObject::hasChildren):
+        (WebCore::AccessibilityObject::selectedChildren):
+        (WebCore::AccessibilityObject::visibleChildren):
+        (WebCore::AccessibilityObject::visiblePositionRange):
+        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
+        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityObject::visiblePositionForPoint):
+        (WebCore::AccessibilityObject::nextVisiblePosition):
+        (WebCore::AccessibilityObject::previousVisiblePosition):
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        (WebCore::AccessibilityObject::indexForVisiblePosition):
+        (WebCore::AccessibilityObject::index):
+        (WebCore::AccessibilityObject::doAXRangeForLine):
+        (WebCore::AccessibilityObject::doAXRangeForIndex):
+        (WebCore::AccessibilityObject::doAXStringForRange):
+        (WebCore::AccessibilityObject::doAXBoundsForRange):
+        (WebCore::AccessibilityObject::updateBackingStore):
+
+2009-07-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fix of <rdar://4877658> Dragging from the area between the horizontal/vertical scrollbars when status bar is showing starts a selection and autoscroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+
+2009-07-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27581
+        Drop the prefix from the box-shadow property.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-07-22  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27289
+        When a mouse click occurs on a scrollbar without a preceding mouse move
+        onto it, the release isn't handled correctly (since
+        EventHandler::m_lastScrollbarUnderMouse isn't set on mouse down, but
+        only on mouse move). (Side comment: That scrollbar-handling code
+        in EventHandler is ugly. It should be fixed properly.)
+
+        Tests: scrollbars/scrollbar-miss-mousemove.html
+               scrollbars/scrollbar-miss-mousemove-disabled.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
+        * page/EventHandler.h:
+
+2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/BarInfo.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27606
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::visible):
+
+2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/Console.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27606
+
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        (WebCore::Console::profile):
+        (WebCore::Console::time):
+
+2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix crashes with the QObject bindings after garbage collection.
+
+        There is one QtInstance per wrapped QObject, and that QtInstance keeps
+        references to cached JSObjects for slots. When those objects get
+        deleted due to GC, then they becoming dangling pointers.
+
+        When a cached member dies, it is now removed from the QtInstance's
+        cache.
+
+        As we cannot track the lifetime of the children, we have to remove
+        them from QtInstance alltogether. They are not cached and were
+        only used for mark(), but we _want_ them to be subject to gc.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Minor coding style cleanup,
+        use qDeleteAll().
+        (JSC::Bindings::QtInstance::removeCachedMethod): New function, to
+        clean m_methods and m_defaultMethod.
+        (JSC::Bindings::QtInstance::mark): Avoid marking already marked objects.
+        (JSC::Bindings::QtField::valueFromInstance): Don't save children for
+        marking.
+        * bridge/qt/qt_instance.h: Declare removeCachedMethod.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod): Call removeCachedMethod
+        with this on the instance.
+
+2009-07-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27599
+        'const unsigned' in return value
+
+        Remove const modifier from unsigned return value, as it does not
+        make sense.
+
+        * dom/ErrorEvent.h:
+
+2009-07-22  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 22784: Improve keyboard navigation of Select elements.
+        Home/End and PageUp/PageDn buttons do not do anything in drop down lists,
+        on non-Mac platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=22784
+        http://code.google.com/p/chromium/issues/detail?id=4576
+
+        New test: LayoutTests/fast/forms/select-popup-pagekeys.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::nextValidIndex): 
+        New utility fn for traversing items of a select's list.
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Added code to handle Home/End and PageUp/PageDn when ARROW_KEYS_POP_MENU is false.
+
+2009-07-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a couple of compiler warnings.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (copySurface):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2009-07-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by David Levin.
+
+        Enable HTML5 Datagrid defines for the Qt build.
+
+        * WebCore.pro:
+
+2009-07-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Make Node wrappers go fast
+        https://bugs.webkit.org/show_bug.cgi?id=27597
+
+        Profiles indicate we're spending a lot of time asking whether we're on
+        the main thread when looking up DOM wrappers for Nodes, but there isn't
+        much point in doing that work because Nodes only exist on the main
+        thread.  I've also added an assert to keep us honest in this regard.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::):
+        (WebCore::getDOMNodeMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::getCurrentMainThread):
+
+2009-07-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove unneeded virtual destructor from ScriptSourceProvider
+        https://bugs.webkit.org/show_bug.cgi?id=27563
+
+        * bindings/js/ScriptSourceProvider.h:
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand('underline' / 'strikeThrough') doesn't work properly with multiple styles in text-decoration
+        https://bugs.webkit.org/show_bug.cgi?id=27476
+
+        executeStrikethrough and executeUnderline were toggling between "line-through" / "underline" and "none".
+        This patch adds executeToggleStyleInList that toggles a style in CSSValueList instead of toggling the entire value.
+        It modifies CSSComputedStyleDeclaration to return CSSValueList instead of CSSPrimitiveValue for text decorations,
+        and adds removeAll member function to CSSValueList.
+
+        Tests: editing/execCommand/toggle-text-decorations.html
+               fast/css/getComputedStyle/getComputedStyle-text-decoration.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderTextDecorationFlagsToCSSValue): Creates a CSSValueList
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Returns a CSSValueList instead of CSSValue
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Text decorations are space separated instead of comma separated
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::removeAll): Removes all values that match the specified value
+        * css/CSSValueList.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame): Apply style to a frame using specified command
+        (WebCore::executeApplyStyle): Uses applyCommandToFrame
+        (WebCore::executeToggleStyleInList): Uses applyCommandToFrame
+        (WebCore::executeToggleStyle): Toggles a style in CSSValueList
+        (WebCore::executeStrikethrough): Uses executeToggleStyleInList
+        (WebCore::executeUnderline): Uses executeToggleStyleInList
+
+2009-07-22  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27174
+        And
+        https://bugs.webkit.org/show_bug.cgi?id=26938
+        
+        Code cleanup. Implements support for detecting attacks transformed by 
+        PHP Magic Quotes/PHP addslashes().
+
+        Tests: http/tests/security/xssAuditor/script-tag-addslashes-backslash.html
+               http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html
+               http/tests/security/xssAuditor/script-tag-addslashes-null-char.html
+               http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isInvalidCharacter):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::normalize): Decodes HTML entities, removes backslashes,
+        and removes control characters that could otherwise cause a discrepancy between
+        the source code of a script and the outgoing HTTP parameters.
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::decodeHTMLEntities):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-07-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Null deref in JSObject::mark due to null xhr wrapper
+        https://bugs.webkit.org/show_bug.cgi?id=27565
+
+        Make event target binding for appcache and xhr behave in the same way as
+        it does for all other events.
+
+        No test as I couldn't make a testcase which was remotely reliable.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+
+2009-07-22  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inform V8 of the amount of WebCore string memory it is keeping alive.
+        https://bugs.webkit.org/show_bug.cgi?id=27537
+
+        V8 uses external strings that are backed by WebCore strings. Since
+        the external strings themselves are small, V8 has no way of
+        knowing how much memory it is actually holding on to. With this
+        change, we inform V8 of the amount of WebCore string data it is
+        holding on to with external strings.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+
+2009-07-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27562
+        Add the finalized versions of background-clip and background-origin.  Remove background-clip from
+        the background shorthand and have it be auto-set based off background-origin's value.
+
+        Three new tests added in fast/backgrounds/size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+2009-07-22  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Hook up V8 bindings for DataGrid elements.
+        https://bugs.webkit.org/show_bug.cgi?id=27383
+        http://code.google.com/p/chromium/issues/detail?id=16730
+
+        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
+        to handle exceptions, check appropriate JS prototypes, and
+        test column-list's item() method as well as array-indexing.
+
+        * WebCore.gypi: Added new source files.
+        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
+        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
+        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
+        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
+        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
+        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
+        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::create):
+        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
+        (WebCore::V8DataGridDataSource::jsDataSource):
+        (WebCore::asV8DataGridDataSource):
+        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
+        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
+        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        pushDownTextDecorationStyleAroundNode needs clean up
+        https://bugs.webkit.org/show_bug.cgi?id=27556
+
+        Cleaned up. pushDownTextDecorationStyleAroundNode traverses tree vertically from highestAncestor to targetNode
+        While traversing, it will apply the specified style to all nodes but targetNode.
+        i.e. the style is applies to all ancestor nodes and their siblings of targetNode.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Cleaned up and added comments
+        * editing/ApplyStyleCommand.h: Updated prototype
+
+2009-07-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Handle any type of line endings in WebCore/css/*CSSPropertyNames.in.
+
+        * DerivedSources.make:
+        * css/makeprop.pl:
+        * css/makevalues.pl:
+
+2009-07-22  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium has a build break after removal of JSRGBColor bindings
+        https://bugs.webkit.org/show_bug.cgi?id=27548
+
+        Fix a build break in Chromium V8 after the JSRGBColor bindings change:
+        https://bugs.webkit.org/show_bug.cgi?id=27242
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-07-22  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: add static functions to FontPlatformData which allow
+        for setting the global font rendering preferences.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27513
+        http://code.google.com/p/chromium/issues/detail?id=12179
+
+        This should not affect any layout tests.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setHinting):
+        (WebCore::FontPlatformData::setAntiAlias):
+        (WebCore::FontPlatformData::setSubpixelGlyphs):
+        (WebCore::FontPlatformData::setupPaint):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+
+2009-07-22  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Move Inspector panels creation into a function to make possible introducing
+        custom panels.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.loaded):
+
+2009-07-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Print console command message upon evaluate
+        selection request; Handle errors in evaluation request
+        properly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27535
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-07-22  Xan Lopez  <xlopez@igalia.com>
+
+        Attempt to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-07-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro: Add RGBColor.cpp to the build, remove JSRGBColor.
+
+2009-07-21  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27494
+
+        Fixes an issue that can cause a crash or unexpected behavior when calling
+        WebCore::ScriptSourceCode::source on a cached script.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/CachedScriptSourceProvider.h: Modified to inherit from 
+        WebCore::ScriptSourceCode.
+        (WebCore::CachedScriptSourceProvider::source):
+        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode): Separated out source provider and
+        rewrote to use WebCore::ScriptSourceProvider.
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/ScriptSourceProvider.h: Added.
+        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
+        (WebCore::ScriptSourceProvider::~ScriptSourceProvider):
+        * bindings/js/StringSourceProvider.h: Modified to inherit from 
+        WebCore::ScriptSourceCode.
+        (WebCore::StringSourceProvider::StringSourceProvider):
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Windows build.
+
+        * DerivedSources.cpp:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Autogenerate Objective-C binding implementation for RGBColor.
+
+        No functionality change.
+
+        * WebCore.xcodeproj/project.pbxproj: 
+        * bindings/objc/DOMRGBColor.mm: Removed.
+        * bindings/scripts/CodeGeneratorObjC.pm: Add logic to convert from
+        WebCore::Color to NSColor*.
+        * css/RGBColor.idl:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27242
+        JSC bindings should use an auto-bound RGBColor class instead of hand-rolled JSRGBColor
+
+        Move the JSC and Objective-C bindings onto using the RGBColor object instead
+        of just an unsigned int. The JSC bindings are now completely autogenerated for
+        this class. (Also removes the last lut from WebCore).
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSRGBColor.cpp: Removed.
+        * bindings/js/JSRGBColor.h: Removed.
+        * bindings/objc/DOM.mm:
+        (-[DOMRGBColor _color]):
+        * bindings/objc/DOMRGBColor.mm:
+        (-[DOMRGBColor dealloc]):
+        (-[DOMRGBColor finalize]):
+        (-[DOMRGBColor red]):
+        (-[DOMRGBColor green]):
+        (-[DOMRGBColor blue]):
+        (-[DOMRGBColor alpha]):
+        (-[DOMRGBColor color]):
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColor):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::getRGBA32Value):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * css/RGBColor.cpp:
+        (WebCore::RGBColor::alpha):
+        * css/RGBColor.h:
+        (WebCore::RGBColor::color):
+        (WebCore::RGBColor::RGBColor):
+        * css/RGBColor.idl:
+        * page/DOMWindow.idl:
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor):
+        * svg/SVGColor.h:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Implement AbstractWorker::dispatchScriptErrorEvent by generating an ErrorEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=27515
+
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+
+2009-07-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move m_context out of generator into a superclass
+        https://bugs.webkit.org/show_bug.cgi?id=27521
+
+        Mostly this is removing code from CodeGeneratorJS
+        and instead using a DOMObjectWithSVGContext superclass in JSDOMBinding.h.
+
+        DOMObjectWithSVGContext.h is its own file so that WebKit doesn't need to
+        know about SVGElement.h (WebKit includes JSDOMBinding.h for some reason).
+
+        I also removed context pointer from SVGZoomEvent since it was never used.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMObjectWithSVGContext.h: Added.
+        (WebCore::DOMObjectWithSVGContext::context):
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-07-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r46142):  editing/execCommand/19087.html & editing/execCommand/19653-1.html fail in Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=27480
+
+        Because m_anchorType : 2 is treated as a signed integer by cl.exe, anchorType() wasn't returning the correct value.
+        We made m_anchorType unsigned so that anchorType() returns the correct value.
+
+        * dom/Position.h:
+        (WebCore::Position::anchorType): statically cast to AnchorType
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add V8 bindings for onerror in WorkerContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27518
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Fix the incorrect patch being landed for bug 27516 that has already been reviewed.
+        https://bugs.webkit.org/show_bug.cgi?id=27516
+
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::setOnerror):
+        (WebCore::WorkerContext::onerror):
+        * workers/WorkerContext.idl:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add onerror to WorkerContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27516
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::setOnerror):
+        (WebCore::WorkerContext::onerror):
+        * workers/WorkerContext.idl:
+
+2009-07-21  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27509
+        Add font-related files for the WinCE port.
+
+        Written by Yong Li <yong.li@torchmobile.com>
+
+        * platform/graphics/wince/FontCacheWince.cpp: Added.
+        * platform/graphics/wince/FontCustomPlatformData.cpp: Added.
+        * platform/graphics/wince/FontCustomPlatformData.h: Added.
+        * platform/graphics/wince/FontPlatformData.cpp: Added.
+        * platform/graphics/wince/FontPlatformData.h: Added.
+        * platform/graphics/wince/FontWince.cpp: Added.
+        * platform/graphics/wince/GlyphPageTreeNodeWince.cpp: Added.
+        * platform/graphics/wince/SimpleFontDataWince.cpp: Added.
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Fix the Windows build, and update the comment on top now that wx uses WebCorePrefix.h too.
+
+        * WebCorePrefix.h:
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        WebCorePrefix.h build fixes for non-Mac and wx / CURL builds.
+
+        * WebCorePrefix.h:
+
+2009-07-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        All DOMConstructorObjects should hold a pointer to the JSDOMGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=27478
+
+        This is just moving code.
+        I've added two new classes: DOMObjectWithGlobalPointer and DOMConstructorWithDocument.
+
+        DOMObjectWithGlobalPointer is a new baseclass for DOMConstructorObject.
+        (It's a baseclass because eventually all DOMObjects will have a global pointer, but
+        I'll be moving them onto DOMObjectWithGlobalPointer in stages.)
+
+        DOMConstructorWithDocument is a new baseclass for the 3 constructor objects
+        which require a backpointer to the Document to function.  I made this a subclass of
+        DOMConstructorObject to make clear that most constructors can hold no-such assumptions
+        about having a back-pointer to the Document (since many constructors can be used from Workers).
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::globalObject):
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMObjectWithGlobalPointer::mark):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::document):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+
+2009-07-21  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27453
+        Initialize isInt when creating a CSSParserValue for a function.
+
+        No change in behavior, so no tests.
+
+        * css/CSSFunctionValue.cpp:
+        (WebCore::CSSFunctionValue::parserValue):
+
+2009-07-20  Jens Alfke  <snej@google.com>
+ 
+         Reviewed by David Levin.
+ 
+         Bug 27448: [Chromium] On Mac, arrow keys should cause Select to pop up its menu.
+         Mac build of Chromium doesn't follow Mac HI guidelines to pop up the menu when
+         an arrow key is pressed.
+         https://bugs.webkit.org/show_bug.cgi?id=27448
+ 
+         No new tests; affects only control response to user input.
+ 
+         * dom/SelectElement.cpp:
+         Changed definition of ARROW_KEYS_POP_MENU to make it true in Mac Chromium,
+         so it will behave compatibly with Mac HI guidelines on pop-up menus.
+         It's not possible to have PLATFORM(MAC) be true in the Mac build of Chromium.
+ 
+2009-07-21  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] popup menus can crash when the selected index is -1
+        https://bugs.webkit.org/show_bug.cgi?id=27275
+
+        Crash reports from users indicate a crash can occur when PopupListBox::isSelectableItem
+        is passed an index of less than 0 (which is possible under certain circumstances). This
+        change prevents such a value from causing a crash by enforcing valid index values passed
+        by all callers of isSelectableItem. isSelectableItem is now a private method of
+        PopupListBox, as there are no external callers.
+
+        Also cleaned up a small amount of code for style and grammar errors.
+
+        No automatic test is provided since we cannot send events to the child window used by
+        the popup menu.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::selectPreviousRow):
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Don't include winsock2.h on wx, it conflicts with wx's inclusion of winsock.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-07-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r46153, r46154, and r46155
+
+        These changes were causing build failures and assertion failures on
+        Windows.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ErrorEvent API.
+        https://bugs.webkit.org/show_bug.cgi?id=27387
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/ErrorEvent.cpp: Added.
+        * dom/ErrorEvent.h: Added.
+        * dom/ErrorEvent.idl: Added.
+        * dom/Event.cpp:
+        (WebCore::Event::isErrorEvent):
+        * dom/Event.h:
+
+2009-07-21  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
+        https://bugs.webkit.org/show_bug.cgi?id=24602
+
+        Remove workaround required for <=libsoup-2.26.1
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-07-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        V8IsolatedWorld keeps a handle to a disposed context
+        https://bugs.webkit.org/show_bug.cgi?id=27397
+
+        Make a copy of the context handle before making it weak.  We don't want
+        to make the original handle weak because we want it to survive for the
+        length of the V8IsolatedWorld::evaluate method.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+
+2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ability to evaluate selection while on break point.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27502
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentKeyDown):
+
+2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Special case ConsolePanel opening since
+        it is a 'fast view'.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27493
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt code to follow the WebKit Coding Style.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::qstring):
+        (WebCore::fixSpacing):
+        * platform/graphics/qt/FontQt43.cpp:
+        (WebCore::generateComponents):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::cursorToX):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtFillRule):
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::paint):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameDurationAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::isEmpty):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QTransform):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::ClipboardQt):
+        (WebCore::ClipboardQt::clearData):
+        (WebCore::ClipboardQt::clearAllData):
+        (WebCore::ClipboardQt::getData):
+        (WebCore::ClipboardQt::setData):
+        (WebCore::ClipboardQt::setDragImage):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        (WebCore::ClipboardQt::writeURL):
+        (WebCore::ClipboardQt::writeRange):
+        (WebCore::ClipboardQt::hasData):
+        * platform/qt/ClipboardQt.h:
+        * platform/qt/ContextMenuItemQt.cpp:
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        * platform/qt/CursorQt.cpp:
+        (WebCore::westPanningCursor):
+        (WebCore::notAllowedCursor):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asFragment):
+        * platform/qt/DragImageQt.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::getFileSize):
+        (WebCore::unloadModule):
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        (WebCore::):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::plainText):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::applyTheme):
+        (WebCore::WorldMatrixTransformer::WorldMatrixTransformer):
+        (WebCore::RenderThemeQt::paintMediaBackground):
+        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScreenQt.cpp:
+        (WebCore::screenRect):
+        (WebCore::usableScreenRect):
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::contextMenu):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::scPart):
+        (WebCore::scrollbarPart):
+        * platform/qt/ScrollbarThemeQt.h:
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (PluginDatabase::defaultPluginDirectories):
+        (PluginDatabase::getPluginPathsInDirectories):
+        (PluginDatabase::isPreferredPluginDirectory):
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::prefetchDNS):
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::String::String):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::TextBreakIterator::following):
+        (WebCore::TextBreakIterator::preceding):
+        (WebCore::WordBreakIteratorQt::first):
+        (WebCore::WordBreakIteratorQt::next):
+        (WebCore::WordBreakIteratorQt::previous):
+        (WebCore::CharBreakIteratorQt::first):
+        (WebCore::CharBreakIteratorQt::next):
+        (WebCore::CharBreakIteratorQt::previous):
+        (WebCore::characterBreakIterator):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::init):
+
+2009-07-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by David Levin.
+
+        Added a first bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/ClipboardHaiku.cpp: Added.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearData):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::files):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::setDragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/ClipboardHaiku.h: Added.
+        (WebCore::ClipboardHaiku::create):
+        (WebCore::ClipboardHaiku::~ClipboardHaiku):
+        * platform/haiku/CookieJarHaiku.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/haiku/CursorHaiku.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::pointerCursor):
+        (WebCore::moveCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::progressCursor):
+        (WebCore::aliasCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+
+2009-07-21  Albert Astals Cid <aacid@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Change #error line not to have a ' (single quote)
+
+        * DerivedSources.cpp:
+
+2009-07-21  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE_RUBY to list of build options
+        https://bugs.webkit.org/show_bug.cgi?id=27324
+
+        Added flag ENABLE_RUBY:
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-07-21  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27467
+        Return an empty path in PlatformContextSkia::currentPathInLocalCoordinates
+        if matrix.invert() fails.  This prevents the use of an uninitialized
+        value in inverseMatrix.
+
+        No new tests added.  Run
+        LayoutTests/svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
+        under valgrind and notice there are no errors.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-07-21  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27388
+
+        Fix dotted and dashed borders on Chromium/skia.  This follows
+        the logic in the Cg path, so results are much closer to Safari now 
+        (some tests won't be exactly the same due to font layout differences).
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Guard access to installedMediaEngines()[0].
+
+        https://bugs.webkit.org/show_bug.cgi?id=27479
+        http://code.google.com/p/chromium/issues/detail?id=16541
+
+        Else where in the file, installedMediaEngines is always checked for
+        being empty because access. This patch adds a case which missed that
+        check.
+
+        This triggered a crash in Chromium:
+            http://www.yakeze.com/chat/example-chromium-crash/
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Allow search entries to render with a CSS border if the RenderTheme
+        doesn't paint them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27466
+        http://code.google.com/p/chromium/issues/detail?id=16958
+
+        <input type="search"> is very much like a text entry except that,
+        currently, if the RenderTheme doesn't deal with it, nothing is
+        rendered. With this patch, the default CSS border is rendered if the
+        RenderTheme requests it.
+
+        This will affect many layout tests, but only for Chromium Linux and
+        those results are not currently in the WebKit tree.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paintBorderOnly):
+
+2009-07-17  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Switch to faster methods to access internal fields.
+        https://bugs.webkit.org/show_bug.cgi?id=27372
+
+        Minor refactoring.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: cache Harfbuzz faces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27473
+
+        Previously, we recreated the Harfbuzz face for each script-run. With
+        this patch, we keep the Harfbuzz face in the FontPlatformData (created
+        as needed) and so they will persist for the duration of the
+        FontPlatformData.
+
+        Shouldn't affect any layout tests. Results in a significant win on the
+        intl2 page cycler time.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::~RefCountedHarfbuzzFace):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::harfbuzzFace):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::create):
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::face):
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::RefCountedHarfbuzzFace):
+        * platform/graphics/chromium/HarfbuzzSkia.h: Added.
+
+2009-07-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r46142): Need to remove showTreeThisForThis
+        https://bugs.webkit.org/show_bug.cgi?id=27475
+
+        Removes showTreeThisForThis
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::appendParagraphIntoNode):
+
+2009-07-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactoring of indentRegion to fix bugs 26816 and 25317
+        https://bugs.webkit.org/show_bug.cgi?id=26816
+        https://bugs.webkit.org/show_bug.cgi?id=25317
+        https://bugs.webkit.org/show_bug.cgi?id=23995 (partially)
+
+        This patch implements appendParagraphIntoNode, a simpler specialized version of moveParagraph
+        and replaces all calls inside indentRegion. The following is the new behavior of indentRegion.
+
+        1. We try to indent as many wrapping nodes as possible.
+           e.g. when indenting "hello" in <div>hello</div>, we try to indent div as well.
+        2. We do not delete any wrapping elements
+           With moveParagraph, we used to remove all wrapping nodes, and replaced with a blockquote.
+           This was causing https://bugs.webkit.org/show_bug.cgi?id=23995 for indentation.
+           With appendParagraphIntoNode, we can preserve all wrapping nodes.
+        3. We only split the tree until the closest block node instead of until the root editable node.
+           This behavioral change fixes the bug 25317.
+        4. When multiple paragraphs are indented, we indent the highest common ancestor within the selection.
+           e.g. when a list is a child node of a div, and the entire div is intended,
+                we enclose the div by a single blockquote.
+
+        Note that new behavior is more consistent with that of Internet Explorer and Firefox.
+        To demonstrate this, the following tests are added.
+
+        Tests: editing/execCommand/indent-div-inside-list.html
+               editing/execCommand/indent-nested-blockquotes.html
+               editing/execCommand/indent-nested-div.html
+               editing/execCommand/indent-second-paragraph-in-blockquote.html
+
+        * editing/IndentOutdentCommand.cpp: prepareBlockquoteLevelForInsertion is removed
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): uses appendParagraphIntoNode now
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): uses appendParagraphIntoNode now
+        (WebCore::IndentOutdentCommand::appendParagraphIntoNode): removes a paragraph and appends it to a new node
+        (WebCore::IndentOutdentCommand::removeUnnecessaryLineBreakAt): removes a break element at the specified position
+        (WebCore::IndentOutdentCommand::indentRegion): exhibits the described behavior
+        * editing/IndentOutdentCommand.h: updated prototype
+
+2009-07-20  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix release builds after r46136
+
+        * dom/Element.cpp:
+
+2009-07-17  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Media Controls: We are specifying the text height, where it is unneeded and the slider is 2px off.
+        https://bugs.webkit.org/show_bug.cgi?id=27380
+
+        Adjust the margin of the slider and remove useless height specification to fix alignement of the media controls.
+
+        * css/mediaControlsQT.css:
+
+2009-07-20  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27468
+        Back out r46060, which caused problems for some Apple developers.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-07-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        When loading a custom view into a frame, the old document is still
+        around
+        <rdar://problem/5145841>
+
+        Safari fires onload before PDF is loaded into the browser
+        <rdar://problem/6618869>
+
+        Test: fast/loader/non-html-load-event.html
+
+        * GNUmakefile.am: Added PlaceholderDocument.{cpp,h}
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * dom/Document.h:
+        (WebCore::Document::setStyleSelector): Added this protected accessor for
+            PlaceholderDocument to use.
+        * dom/Element.cpp:
+        (WebCore::Element::clientWidth): Check whether the document has a
+            renderer.
+        (WebCore::Element::clientHeight): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin): Create a PlaceholderDocument for frames
+            that do not use an HTML view. Do not nullify the content size in
+            that case.
+        (WebCore::FrameLoader::transitionToCommitted): For frames that do not
+            use an HTML view, call receivedFirstData(), which sets up the
+            frame with a new PlaceHolderDocument.
+        * loader/PlaceholderDocument.cpp: Added.
+        (WebCore::PlaceholderDocument::attach): Sets up the style selector but
+            does not create a RenderView.
+        * loader/PlaceholderDocument.h: Added.
+        (WebCore::PlaceholderDocument::create):
+        (WebCore::PlaceholderDocument::PlaceholderDocument):
+
+2009-07-20  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Handle opacity and opacity animations on transform layers in Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=27398
+
+        This makes two changes, and only for Leopard. 
+
+        First, whenever opacity is changed on a layer I propagate the 
+        change into the content layer and all the children if the layer 
+        on which opacity is set is a transform layer (preserve3D is true). 
+        The opacity set is the accumulated opacity from this layer
+        and all its direct ancestor transform layers. Second, I turn off all 
+        hardware opacity animation.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::accumulatedOpacity):
+        (WebCore::GraphicsLayer::distributeOpacity):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setOpacityInternal):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setPreserves3D):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateFloat):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setOpacityInternal):
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
+
+2009-07-20  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27349
+        Add GraphicsContext implementation for the WinCE port.
+
+        Written by Yong Li <yong.li@torchmobile.com>, George Staikos <george.staikos@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+        with trivial style fixes by Adam Treat <adam.treat@torchmobile.com>
+
+        * platform/graphics/wince/GraphicsContextWince.cpp: Added.
+
+2009-07-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium, and stubs
+        for the Mac and Linux VFSs.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27097
+        [Gtk] Segfault when examining an object of ROLE_TABLE via at-spi
+
+        Check that an object is a RenderObject before trying to access its
+        renderer and related node.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-07-20  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] font cache reworking
+        https://bugs.webkit.org/show_bug.cgi?id=27265
+
+        Reimplemented Qt's FontCache in a way that follows the shared one.
+        Now we can release its elements when those became inactive.
+        FontFallbackList had been changed to be able to hold WebCore fonts in its list and to be able to release a FontData what is in the cache.
+
+        No change in behavior, so no tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::): Key type for the cache of FontPlatformData objects.
+        It can be constructed from a FontPlatformData or from a FontDescription. The keys have to be consistent
+        with FontPlatformData::FontPlatformData(const FontDescription&) - if we create the same
+        FontPlatformData from two FontDescription then we have to create the same key from them, and vica versa.
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData): Get a FontDescription and returns a FontPlatformData.
+        (WebCore::FontCache::getCachedFontData): Get a FontPlatformData and returns a SimpleFontData.
+        (WebCore::FontCache::releaseFontData): Get a SimpleFontData and releases it from the cache. Also releases the appropriate FontPlatformData.
+        (WebCore::FontCache::purgeInactiveFontData): Frees inactive elements.
+        (WebCore::FontCache::invalidate): Frees all inactive elements (call purgeInactiveFontData with default argument)
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::family): Getter. It is needed for FontPlatformDataCacheKey.
+        (WebCore::FontPlatformData::bold): Ditto.
+        (WebCore::FontPlatformData::italic): Ditto.
+        (WebCore::FontPlatformData::smallCaps): Ditto.
+        (WebCore::FontPlatformData::pixelSize): Ditto.
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Set m_bold.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26716
+        [Gtk] Each XMLHttpRequest leaks memory.
+
+        Free the SoupURI we create to check the URI. Fix suggested by John
+        Kjellberg.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] On Symbian link against system sqlite3
+        https://bugs.webkit.org/show_bug.cgi?id=27368
+
+        Add an option to force linking against system sqlite3
+        by adding system-sqlite to the CONFIG variable.
+
+        The Symbian specific part of this patch is contributed by 
+        Norbert Leser.
+
+        * WebCore.pro:
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Change the glib version check to check for the first unstable
+        release with g_mapped_file_unref. Otherwise this would be useless
+        until 2.22 is released, a few months from now.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix fast/css/pseudo-required-optional-*.html in the Qt build
+        after r46062.
+
+        These tests triggered a bug in RenderThemeQt where we did not fall back
+        to the unstyled painting of text areas and input fields when they have
+        a styled background.
+
+        Our re-implementation of isControlStyled incorrectly only checked the
+        border for determining whether to style or not. The base-implementation
+        performs the same check, but also includes the background. Removing
+        our implementation fixes the appearance.
+
+        * platform/qt/RenderThemeQt.cpp: Removed isControlStyled reimplementation.
+        * platform/qt/RenderThemeQt.h: Ditto.
+
+2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Add missing (sorted) header files to the HEADERS variable in the qmake
+        .pro file for improved completion in IDEs.
+
+        * WebCore.pro:
+
+2009-07-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Factor V8ConsoleMessage out of V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=27421
+
+        No behavior change.
+
+        * WebCore.gypi:
+        * bindings/v8/V8ConsoleMessage.cpp: Added.
+        (WebCore::V8ConsoleMessage::V8ConsoleMessage):
+        (WebCore::V8ConsoleMessage::dispatchNow):
+        (WebCore::V8ConsoleMessage::dispatchLater):
+        (WebCore::V8ConsoleMessage::processDelayed):
+        (WebCore::V8ConsoleMessage::handler):
+        * bindings/v8/V8ConsoleMessage.h: Added.
+        (WebCore::V8ConsoleMessage::Scope::Scope):
+        (WebCore::V8ConsoleMessage::Scope::~Scope):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::logInfo):
+        (WebCore::reportUnsafeAccessTo):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+        (WebCore::V8Proxy::newInstance):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::processConsoleMessages):
+
+2009-07-19  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Remove unused member variable.
+
+        * svg/SVGPolyElement.h:
+
+2009-07-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLAudioElement: constructor should set "autobuffer" attribute
+        https://bugs.webkit.org/show_bug.cgi?id=27422
+
+        Test: media/audio-constructor-autobuffer.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+            Set 'autobuffer' attribute.
+
+2009-07-19  Thierry Bastian <thierry.bastian@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build with mingw.
+
+        * WebCore.pro: Don't use MSVC commandline options to disable warnings
+        with mingw.
+
+2009-07-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Phase 2: Remove event listener methods from V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=27415
+
+        No behavior change.
+
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::eventListeners):
+        (WebCore::V8Proxy::objectListeners):
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::~V8EventListener):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] soup/ResourceHandleSoup.cpp:533: error: 'g_mapped_file_free' was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=27230
+
+        Use g_mapped_file_unref for GLIB version 2.22 onwards.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add spread radius support to -webkit-box-shadow
+        https://bugs.webkit.org/show_bug.cgi?id=27417
+        rdar://problem/7072267
+
+        Test: fast/box-shadow/spread.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Added a property ID parameter and used it to
+            include the spread length for box-shadow but not for text-shadow.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+            Pass the property ID to valueForShadow().
+
+        * css/CSSParser.cpp:
+        (WebCore::ShadowParseContext::ShadowParseContext): Added property,
+            spread, and allowSpread members. Added a property ID parameter to
+            the constructor. Initialize the property and allowSpread members.
+        (WebCore::ShadowParseContext::allowLength): Added allowSpread.
+        (WebCore::ShadowParseContext::commitValue): Pass the spread value to
+            the ShadowValue constructor. Reset allowSpread.
+        (WebCore::ShadowParseContext::commitLength): Allow spread after blur
+            for the box-shadow property.
+        (WebCore::ShadowParseContext::commitColor): Reset allowSpread.
+        (WebCore::CSSParser::parseShadow): Pass the property ID to
+            ShadowParseContext().
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the spread value from
+            the shadow value and pass it to the ShadowData constructor.
+
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::ShadowValue): Added spread.
+        (WebCore::ShadowValue::cssText): Added spread.
+
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::create): Added spread.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc): Blend the spread value.
+        (WebCore::PropertyWrapperShadow::blend): Added 0 spread to the default
+            shadow.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Account for spread in
+            the visual overflow calculations.
+        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
+        (WebCore::InlineFlowBox::paint): Ditto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Ditto.
+        (WebCore::RenderBlock::overflowWidth): Ditto.
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Ditto.
+        (WebCore::RenderBlock::overflowRect): Ditto.
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Inflate the shadow-
+            casting rect by the shadow spread value. Adjust border radii if
+            necessary.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Account for spread in the
+            visual overflow calculations.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Account for spread.
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Ditto.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Assert that text shadows do not
+            have spread.
+
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::ShadowData): Added spread.
+        (WebCore::ShadowData::operator==): Compare spread.
+        * rendering/style/ShadowData.h:
+        (WebCore::ShadowData::ShadowData): Added spread.
+
+2009-07-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Jan Alonzo.
+
+        Minor FrameLoader.cpp cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=27406
+
+        No behavior change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+
+2009-07-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Move event listener methods from V8Proxy to V8EventListenerList
+        https://bugs.webkit.org/show_bug.cgi?id=27408
+
+        Move some event listener code out of V8Proxy and into the event
+        listener list.
+
+        I'd like to remove these methods from V8Proxy entirely and just expose
+        getters for the lists themselves, but I'll do that in a follow up
+        patch.
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::findWrapper):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::findV8EventListener):
+        (WebCore::V8Proxy::findOrCreateV8EventListener):
+        (WebCore::V8Proxy::removeV8EventListener):
+        (WebCore::V8Proxy::findObjectEventListener):
+        (WebCore::V8Proxy::findOrCreateObjectEventListener):
+        (WebCore::V8Proxy::removeObjectEventListener):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-18  Jeremy Orlow  <jorlow@chromium.org>
+
+        Rubber stamped by Adam Barth.
+
+        Revert https://bugs.webkit.org/show_bug.cgi?id=27383
+        https://bugs.webkit.org/show_bug.cgi?id=27407
+
+        Revert Jens' patch.  I believe he forgot to include a file.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8DataGridDataSource.cpp: Removed.
+        * bindings/v8/V8DataGridDataSource.h: Removed.
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-17  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27405
+
+        Fixes an issue when decoding HTML entities with an unknown named entity that 
+        caused null-characters to be inserted into the decoded result.
+
+        Test: http/tests/security/xssAuditor/link-onclick-ampersand.html
+              http/tests/security/xssAuditor/javascript-link-ampersand.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeHTMLEntities): Added check to conditional so that
+        non-zero entity values are not inserted during decoding process.
+
+2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        <http://webkit.org/b/18363> [GTK] Combo boxes cannot be opened pressing space
+
+        Reviewed by Holger Freyther.
+
+        Add Gtk to platforms that want to open the menulist using the
+        spacebar.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-17  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25523
+        [GTK] The text displayed by push buttons is not exposed to assistive technologies
+
+        Add new public method text() to RenderButton and use it from
+        AccessibilityRenderObject::stringValue().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::text):
+        * rendering/RenderButton.h:
+
+2009-07-17  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Restore proxy retrieval
+        https://bugs.webkit.org/show_bug.cgi?id=27369
+
+        No new tests are needed.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+
+2009-07-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27351
+        Added platform "Symbian" to WEBCORE_NAVIGATOR_PLATFORM
+        Use uname to find the correct platform for Linux.
+
+        * page/NavigatorBase.cpp:
+        (WebCore::NavigatorBase::platform):
+
+2009-07-17  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Hook up V8 bindings for DataGrid elements.
+        https://bugs.webkit.org/show_bug.cgi?id=27383
+        http://code.google.com/p/chromium/issues/detail?id=16730
+
+        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
+        to handle exceptions, check appropriate JS prototypes, and
+        test column-list's item() method as well as array-indexing.
+
+        * WebCore.gypi: Added new source files.
+        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
+        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
+        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
+        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
+        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
+        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
+        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::create):
+        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
+        (WebCore::V8DataGridDataSource::jsDataSource):
+        (WebCore::asV8DataGridDataSource):
+        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
+        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
+        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        StorageArea should only contain methods we intend to proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27181
+
+        Right now, StorageAreaSync takes in a StorageArea* and calls methods
+        like importItem.  Really, StorageAreaSync should be operating directly
+        on StorageAreaImpl* and those methods should be removed from StorageArea
+        since StorageAreaSync should never be attached to anything other than a
+        StorageAreaImpl.
+
+        This was pointed out in the review for
+        https://bugs.webkit.org/show_bug.cgi?id=27072
+
+        Also clean up StorageNamespaceImpl to operate directly on
+        StorageAreaImpl.  Also, get rid of the factory for StorageArea
+        since nothing should ever create a StorageArea directly.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageArea.cpp: Removed.
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::~StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add v8 implementation for DOM Storage ScriptObjectQuarantine.
+        https://bugs.webkit.org/show_bug.cgi?id=27327
+
+        Wrap the storage object with a generic object as is done elsewhere in
+        the file (but continue to hit a NOTIMPLEMENTED if DOM_STORAGE is not
+        enabled.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-07-17  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27394
+        Fix access to global object wrappers after navigation of their
+        frame in the V8 bindings.  This fixes selenium test failures.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-07-17  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build by removing implicit float <-> double conversions.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::constrainedAttachedWindowHeight):
+
+2009-07-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://problem/5712795> Win: Cannot change the height of the docked Web Inspector (14272)
+        https://bugs.webkit.org/show_bug.cgi?id=14272
+        
+        Moved preference setting for attached inspector height and inspector height calculation from
+        WebInspectorClient.mm into InspectorController.cpp, to make this code cross-platform and enable
+        Windows resizing of attached inspector.
+
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+
+2009-07-17  Dan Bernstein  <mitz@apple.com>
+
+        Another attempt at fixing the build after r46063
+
+        * WebCore.xcodeproj/project.pbxproj: Made ExceptionCode.h a private
+            header, because it is now included from htmlediting.h, which is
+            a private header.
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27396
+        Moving cursor in Thai text sometimes jumps over two characters
+
+        Test: editing/text-iterator/thai-cursor-movement.html
+
+        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator): Added a special
+        case for five Thai characters, matching ICU/CLDR changes.
+
+2009-07-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Some constructor objects exposed on Window have the wrong prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=27276
+
+        Several Constructor classes were already being passed a global object
+        during construction, but they were ignoring it for prototype lookup.
+        I've fixed those to use the passed global object instead.
+
+        Most of these Constructor classes should just be auto-generated, but I
+        refrained from changing them over to auto-gen in this patch.
+
+        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
+        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
+        to match existing behavior.
+
+        Test: fast/dom/prototype-inheritance.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
+        (WebCore::deprecatedGetDOMStructure):
+        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webKitPoint): pass "this" for the global object.
+        (WebCore::JSDOMWindow::webKitCSSMatrix): pass "this" for the global object.
+        (WebCore::JSDOMWindow::xsltProcessor): pass "this" for the global object.
+        (WebCore::JSDOMWindow::worker): pass "this" for the global object.
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
+         -- XMLHttpRequest constructor was also missing a length.  Added one.
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-07-17  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * editing/htmlediting.cpp:
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+
+2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix for symbol lookup error.
+
+        Move AbstractWorker from SHARED_WORKERS to WORKERS as Worker derives from it now
+        Changed in http://trac.webkit.org/changeset/46048
+
+        * GNUmakefile.am:
+
+2009-07-17  Ryosuke Niwa  <ryosuke.niwa@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        htmlediting.cpp needs more utility functions to fix the bug 26816
+        https://bugs.webkit.org/show_bug.cgi?id=27038
+
+        In order to fix the bug 26816, we need several utility functions be added to htmlediting.cpp
+
+        No tests because functions haven't been used anywhere yet.
+
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::comparePoint): added const qualifier
+        (WebCore::Range::compareNode): added const qualifier
+        * dom/Range.h:
+        * editing/htmlediting.cpp:
+        (WebCore::unsplittableElementForPosition): find the enclosing unsplittable element (editing root & table cell)
+        (WebCore::positionBeforeNode): added ASSERT(node)
+        (WebCore::positionAfterNode): added ASSERT(node)
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+        (WebCore::createRange): create a range object from two visible positions
+        (WebCore::extendRangeToWrappingNodes): extend range to include nodes that starts and ends at the boundaries
+        (WebCore::canMergeLists): typo
+        (WebCore::indexForVisiblePosition): added const qualifier
+        (WebCore::isVisiblyAdjacent): typo
+        (WebCore::isNodeVisiblyContainedWithin): determine if a node is inside a range or within the visible boundaries of the range
+        * editing/htmlediting.h:
+
+2009-07-17  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25551
+        Added support for the "required" attribute, the valueMissing flag
+        to the ValidityState object and :required/:optional CSS pseudoclasses.
+        Part of HTML5 sec. Forms specs.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-required
+
+        Tests: fast/css/pseudo-required-optional-001.html
+               fast/css/pseudo-required-optional-002.html
+               fast/css/pseudo-required-optional-003.html
+               fast/css/pseudo-required-optional-004.html
+               fast/css/pseudo-required-optional-005.html
+               fast/css/pseudo-required-optional-006.html
+               fast/forms/ValidityState-valueMissing-001.html
+               fast/forms/ValidityState-valueMissing-002.html
+               fast/forms/ValidityState-valueMissing-003.html
+               fast/forms/ValidityState-valueMissing-004.html
+               fast/forms/ValidityState-valueMissing-005.html
+               fast/forms/ValidityState-valueMissing-006.html
+               fast/forms/ValidityState-valueMissing-007.html
+               fast/forms/ValidityState-valueMissing-008.html
+               fast/forms/ValidityState-valueMissing-009.html
+               fast/forms/required-attribute-001.html
+               fast/forms/required-attribute-002.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoRequired/pseudoOptional
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto
+        * dom/Element.h:
+        (WebCore::Element::isOptionalFormControl): check for optional controls
+        (WebCore::Element::isRequiredFormControl): check for required controls
+        * html/HTMLAttributeNames.in: required attribute
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::isOptionalFormControl): ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::required): requiredAttr getter
+        (WebCore::HTMLFormControlElement::setRequired): requiredAttr setter
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): method definition
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing): validation code
+        (WebCore::HTMLInputElement::isRequiredFormControl): ditto
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isOptionalFormControl): ditto
+        * html/HTMLInputElement.idl: required DOM attribute
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::isOptionalFormControl): ditto
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::valueMissing): validation code
+        (WebCore::HTMLTextAreaElement::isOptionalFormControl): ditto
+        (WebCore::HTMLTextAreaElement::isRequiredFormControl): ditto
+        * html/HTMLTextAreaElement.idl: required DOM attribute
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::valueMissing): validation flag
+
+2009-07-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27390 CSS custom 
+        cursor hotspots should work in quirks mode
+        - and corresponding <rdar://problem/6554340>
+
+        Enable hotspots in quirks mode.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Update this manual test to reflect the fact that hotspots are now 
+        expected to work in quirks mode.
+        * manual-tests/css3-cursor-fallback-quirks.html:
+
+2009-07-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27384
+        Random crashes in appcache/update-cache.html test
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Reorder code to avoid using a handle
+        after canceling it.
+
+2009-07-17  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor Worker to derive from AbstractWorker
+        https://bugs.webkit.org/show_bug.cgi?id=26948
+
+        Changed Worker to derive from AbstractWorker, which involved moving
+        AbstractWorker files from being wrapped by ENABLE_SHARED_WORKERS to
+        ENABLE_WORKERS.
+
+        Removed obsolete functionality from the JS/V8 bindings that is now
+        inherited from AbstractWorker.
+
+        * WebCore.pro:
+        Moved AbstractWorker files out of SHARED_WORKERS section and into WORKERS.
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * bindings/js/JSWorkerCustom.cpp:
+        Removed obsolete event listener code (now in base class)
+        (WebCore::JSWorker::mark):
+        No longer need to explicitly mark event listeners (handled by base class).
+        * bindings/v8/V8Index.h:
+        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * bindings/v8/custom/V8CustomBinding.h:
+        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        Removed obsolete event listener code that now lives in the base class.
+        (WebCore::V8WorkerConstructor): Cleaned up legacy style nits.
+        * workers/AbstractWorker.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * workers/AbstractWorker.h:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * workers/Worker.cpp:
+        Removed event listener code (now in base class).
+        (WebCore::Worker::Worker): Now derives from AbstractWorker.
+        (WebCore::Worker::notifyFinished): Calls dispatchLoadErrorEvent on base class.
+        * workers/Worker.h:
+        Removed APIs that now live in the base class.
+        * workers/Worker.idl:
+        Now derives from AbstractWorker.
+        Removed APIs that live in the base class, and added a GenerateToJS flag.
+
+2009-07-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27379
+        Absolutely-positioned elements with a scrollbar wrap prematurely.  Make sure to include
+        the vertical scrollbar width for overflow:scroll elements.
+
+        Added fast/css/positioned-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::calcPrefWidths):
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need a DOM_STORAGE guard in DerivedSroucesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27375
+
+        In https://bugs.webkit.org/show_bug.cgi?id=27360 I added Storage.cpp
+        and StorageEvent.cpp.  Unfortunately, until later this afternoon,
+        DOM_STORAGE is not turned on by default in Chromium, and so these two
+        files are never generated.  This breaks the compile.
+
+        There are no other instances of guards in the file, which puzzles me...
+        but I think adding guards is the right way to go about this.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Added the guard.
+
+2009-07-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496
+
+        Let WebCore always enforce the connection-per-host limit itself.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+
+2009-07-17  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Some transitions don't work correctly on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=27356
+
+        We only have code to do component animation using valueFunction.
+        So on Leopard we always need to do matrix animation in hardware.
+        This fix ensures that. 
+
+        This is currently not testable because it appears only in the
+        hardware animation and we can't yet do pixel tests while 
+        hardware animating.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-07-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK+] Crash in screenAvailable due a null Widget*
+
+        JSDOMWindow::open called screenAvailableRect(0). The other
+        Screen methods can be called with a null widget as well, fix the
+        crashing test by checking for null.
+
+        In screenRect and screenAvailableRect it is not tried to use
+        a default screen as the existing implementation didn't try either
+        in case of not having a toplevel widget.
+
+        LayoutTests/fast/frames/crash-removed-iframe.html caused a crash.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual): New method to get a visual or return zero.
+        (WebCore::screenDepth): Use getVisual.
+        (WebCore::screenDepthPerComponent): Use getVisual.
+        (WebCore::screenIsMonochrome): Use screenDepth which will do the null checking
+        (WebCore::screenRect): Check for !widget.
+        (WebCore::screenAvailableRect): Check for !widget.
+
+2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the include path for the Symbian port
+        https://bugs.webkit.org/show_bug.cgi?id=27358
+
+        * WebCore.pro:
+
+2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make it possible to set the plugin directories from the DRT.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27215
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::installedPlugins): Now optionally takes
+        a populate argument, so we can avoid loading system plugins from the
+        DRT and thus avoid their strerr errors that can make tests fail.
+        (WebCore::PluginDatabase::clear): Make it possible to clear the
+        database. Called from setPluginDirectories.
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setPluginDirectories): Make public
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        PluginViewMac: Stop the plugin when loading fails
+
+        Also, prevent event propagation when in the stopped state
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        PluginViewMac: Allow query and set of drawing and event models
+
+        We now support querying and setting of the drawing and event model,
+        but we still only support the CoreGraphics drawing model, and the
+        Carbon event model.
+
+        If unsupported drawing or event models are detected we show the
+        missing-plugin icon.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Initialize two PluginView members using memset
+
+        m_npWindow is used on all platforms, not just for XP_UNIX,
+        so always initialize it. m_npCgContext on the other hand
+        is only used for XP_MACOSX.
+
+        * plugins/PluginView.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add more debug logging in PluginView
+
+        * plugins/PluginView.cpp: Add debug for setValue
+        * plugins/gtk/PluginViewGtk.cpp: Add debug for getValue
+        * plugins/mac/PluginViewMac.cpp: Add debug for getValue and more
+        * plugins/qt/PluginViewQt.cpp: Add debug for getValue
+        * plugins/win/PluginViewWin.cpp: Add debug for getValue
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Use same license in PluginDebug.cpp as in the original PluginDebug.h
+
+        * plugins/PluginDebug.cpp: Use license from PluginDebug.h
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add more debugging functionality for the WebCore NPAPI layer
+
+        * GNUmakefile.am: Add PluginDebug.cpp
+        * WebCore.gypi: Add PluginDebug.cpp
+        * WebCore.pro: Add PluginDebug.cpp
+        * WebCore.vcproj/WebCore.vcproj: Add PluginDebug.cpp
+        * WebCoreSources.bkl: Add PluginDebug.cpp
+        * plugins/PluginDebug.h: Move errorStrings to PluginDebug.cpp
+        * plugins/PluginDebug.cpp: New file
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build with DOM_STORAGE enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27360
+
+        2 minor changes as noted below:
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Add the generated .cpp files.
+        * storage/StorageAreaImpl.cpp:  #include "DOMWindow.h"
+
+2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
+        https://bugs.webkit.org/show_bug.cgi?id=27206
+        
+        Add ENABLE_WEB_SOCKETS
+
+        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
+        * GNUmakefile.am: add ENABLE_WEB_SOCKETS
+        * WebCore.vcproj/WebCoreCommon.vsprops: add ENABLE_WEB_SOCKETS
+        * WebCore.vcproj/build-generated-files.sh: add ENABLE_WEB_SOCKETS
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a third bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        Adding five files, EventLoopHaiku.cpp, FileChooserHaiku.cpp,
+        FileSystemHaiku.cpp, KeyboardCodes.h and MIMETypeRegistryHaiku.cpp
+
+        * platform/haiku/EventLoopHaiku.cpp: Added.
+        (WebCore::EventLoop::cycle):
+        * platform/haiku/FileChooserHaiku.cpp: Added.
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/haiku/FileSystemHaiku.cpp: Added.
+        (WebCore::fileSystemRepresentation):
+        (WebCore::homeDirectoryPath):
+        (WebCore::openTemporaryFile):
+        (WebCore::closeFile):
+        (WebCore::writeToFile):
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * platform/haiku/KeyboardCodes.h: Added.
+        * platform/haiku/MIMETypeRegistryHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a second bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        Adding four files, ContextMenuHaiku.cpp, ContextMenuItemHaiku.cpp,
+        DragDataHaiku.cpp and DragImageHaiku.cpp
+
+        * platform/haiku/ContextMenuHaiku.cpp: Added.
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenuReceiver::HandleMessage):
+        (WebCore::ContextMenuReceiver::Result):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::~ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::platformDescription):
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/haiku/ContextMenuItemHaiku.cpp: Added.
+        (ContextMenuItem::ContextMenuItem):
+        (ContextMenuItem::~ContextMenuItem):
+        (ContextMenuItem::releasePlatformDescription):
+        (ContextMenuItem::type):
+        (ContextMenuItem::setType):
+        (ContextMenuItem::action):
+        (ContextMenuItem::setAction):
+        (ContextMenuItem::title):
+        (ContextMenuItem::setTitle):
+        (ContextMenuItem::platformSubMenu):
+        (ContextMenuItem::setSubMenu):
+        (ContextMenuItem::setChecked):
+        (ContextMenuItem::setEnabled):
+        (ContextMenuItem::enabled):
+        * platform/haiku/DragDataHaiku.cpp: Added.
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asColor):
+        (WebCore::DragData::createClipboard):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::asFragment):
+        * platform/haiku/DragImageHaiku.cpp: Added.
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::dissolveDragImageToFraction):
+        (WebCore::createDragImageFromImage):
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher and Brett Wilson.
+
+        Refactor Skia implementation of gradients and patterns.
+
+        http://bugs.webkit.org/show_bug.cgi?id=26618
+
+        The following layout tests were breaking on Chromium/Linux:
+
+        LayoutTests/svg/custom/js-late-gradient-creation.svg (bad baseline PNG)
+        LayoutTests/svg/custom/js-late-gradient-and-object.creation.svg
+        LayoutTests/svg/custom/js-late-pattern-creation.svg (bad baseline PNG)
+        LayoutTests/svg/custom/js-late-pattern-and-object-creation.svg
+
+        I could've fixed these the easy way, by copying the same 5
+        lines of code we use everywhere we need patterns or gradients, but
+        I decided to fix it the hard way:  by refactoring the code so that
+        PlatformContextSkia::setupPaintForFilling() and
+        PlatformContextSkia::setupPaintForStroking() do the right thing,
+        and also handle gradients and patterns.
+        
+        This required pushing the gradients and patterns set in 
+        (generic) GraphicsContext::setFillPattern() and friends down into
+        PlatformContextSkia.  For this, I followed the setPlatformXXX()
+        pattern used elsewhere in GraphicsContext, and stubbed them out on
+        the other platforms with #if !PLATFORM(SKIA).  This also required
+        pushing changes to the gradientSpaceTransform from the Gradient into 
+        GradientSkia.
+
+        Since it's a Skia context, I decided to cache the values as
+        SkShaders.  There were existing m_pattern and m_gradient SkShaders,
+        but they were unused, and whose use was ambiguous, so I
+        replaced them with one SkShader each for filling and stroking.
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::State::~State):
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setupPaintForFilling):
+        (PlatformContextSkia::setupPaintForStroking):
+        (PlatformContextSkia::setFillColor):
+        (PlatformContextSkia::setStrokeColor):
+        (PlatformContextSkia::setStrokeShader):
+        (PlatformContextSkia::setFillShader):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::teardown):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added Haiku-specific files for WebCore/platform/image-decoders/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding a new file, ImageDecoderHaiku.cpp.
+
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/page/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding three new files, DragControllerHaiku.cpp, EventHandlerHaiku.cpp
+        and FrameHaiku.cpp
+
+        * page/haiku/DragControllerHaiku.cpp: Added.
+        (WebCore::DragController::isCopyKeyDown):
+        (WebCore::DragController::dragOperation):
+        (WebCore::DragController::maxDragImageSize):
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/haiku/EventHandlerHaiku.cpp: Added.
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/haiku/FrameHaiku.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/editing/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding one new file, EditorHaiku.cpp
+
+        * editing/haiku/EditorHaiku.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/bindings/js/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding a new file, ScriptControllerHaiku.cpp
+
+        * bindings/js/ScriptControllerHaiku.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/platform/text/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding two new files, StringHaiku.cpp
+        and TextBreakIteratorInternalICUHaiku.cpp
+
+        * platform/text/haiku/StringHaiku.cpp: Added.
+        (WebCore::String::String):
+        (WebCore::String::operator BString):
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Added.
+        (WebCore::currentTextBreakLocaleID):
+
+2009-07-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sends the basename of a selected file for non-multipart form submission.
+        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+
+        Test: fast/forms/get-file-upload.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Centralize hidden property names
+        https://bugs.webkit.org/show_bug.cgi?id=27359
+
+        No behavior change.  Just moving these names to a central location.
+        I'll move the rest of our hidden property names as I sweep though the
+        bindings.
+
+        * WebCore.gypi:
+        * bindings/v8/V8HiddenPropertyName.cpp: Added.
+        (WebCore::V8HiddenPropertyName::objectPrototype):
+        (WebCore::V8HiddenPropertyName::isolatedWorld):
+        * bindings/v8/V8HiddenPropertyName.h: Added.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::getHiddenObjectPrototype):
+        (WebCore::V8Proxy::installHiddenObjectPrototype):
+
+2009-07-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r41238) Repainted portion of a scaled image does not line up with full image
+        https://bugs.webkit.org/show_bug.cgi?id=26747
+        rdar://problem/7009243
+
+        Test: fast/repaint/background-misaligned.html
+
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled): Moved a variable definition closer to where
+        it is used.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): In the subimage code path, compute a
+        pixel-aligned source rect, because the subiamge is always pixel-aligned
+        in source space, and adjust the destination rect to preserve the
+        source -> destination mapping. Clip to the (original) destination rect
+        to prevent bleeding out.
+
+2009-07-16  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a sessionStorageEnabled setting to the settings class.
+        https://bugs.webkit.org/show_bug.cgi?id=27318
+
+        Allow LocalStorage to be enabled without enabling SessionStorage at
+        runtime.  There is a settings class setting for localStorage, but not
+        for sessionStorage.  We want to be able to test one of these features
+        without necessarily enabling the other.
+
+        SessionStorage defaults to true so as to not change behavior and
+        because there really aren't any security concerns around SessionStorage
+        (unlike LocalsStorage).  The flag is needed in Chromium only because
+        we want to enable the compile time flag in the default build, but don't
+        want it on by default until it's been thoroughly tested.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):  Check the new flag
+        (WebCore::DOMWindow::localStorage):  A bit of cleanup
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):  Default the flag to true
+        (WebCore::Settings::setSessionStorageEnabled):  Add the new flag
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):  Get the new flag
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Revert 45987.  Tests did not pass on Windows.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Added SHARED_WORKER flag to Windows build files, as well as associated .ccp/.h files.
+        Added missing V8 bindings to the AllInOne file
+
+        https://bugs.webkit.org/show_bug.cgi?id=27321
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing files to build.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added missing V8 bindings (V8AbstractWorker.cpp and V8SharedWorker.cpp)
+        * DerivedSources.cpp
+        Added missing JS bindings (JSAbstractWorker.cpp and JSSharedWorker.cpp)
+
+2009-07-16  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a getter in MessagePortChannel for the PlatformMessagePortChannel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27337
+
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::channel):
+
+2009-07-16  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix tooltip does not get its directionality from its element's directionality.
+        https://bugs.webkit.org/show_bug.cgi?id=24187
+
+        Per mitz's suggestion in comment #6, while getting the plain-text 
+        title, we also get the directionality of the title. How to handle 
+        the directionality is up to clients. Clients could ignore it, 
+        or use attribute or unicode control characters to display the title
+        as what they want.
+
+        WARNING: NO TEST CASES ADDED OR CHANGED
+
+        * WebCore.base.exp: Replace 2 names due to signature change.
+        * loader/EmptyClients.h: 
+        (WebCore::EmptyChromeClient::setToolTip): Add direction as 2nd parameter.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::setToolTip): Calculate tooltip direction as well and pass it to client to take care when display tooltip.
+        * page/ChromeClient.h: Add direction as 2nd parameter to pure virtual function setToolTip().
+        * page/chromium/ChromeClientChromium.h:
+        (WebCore::ChromeClientChromium::setToolTip): Add setToolTip() 
+        temprarily to make chromium compile after pick up this webkit patch.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::spellingToolTip): Besides getting the 
+        spelling tooltip, get its directionality as well.
+        (WebCore::HitTestResult::title): Besides getting the title, 
+        get its directionality as well.
+        * rendering/HitTestResult.h: Add 2 more methods.
+
+2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        [CAIRO] pattern of a canvas-element changes after modifications on canvas-element
+        https://bugs.webkit.org/show_bug.cgi?id=20578
+
+        Copy pixel image in ImageBuffer::image() just like CG and Skia glue.
+
+        Test: fast/canvas/canvas-pattern-modify.html
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (copySurface):
+        (WebCore::ImageBuffer::image):
+
+2009-07-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27353
+        Images mispositioned because of bug in percentage-based relative positioning.
+
+        Added fast/css/nested-floating-relative-position-percentages.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+
+2009-07-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sends the basename of a selected file for non-multipart form submission.
+        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+
+        Test: fast/forms/get-file-upload.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video size sometimes jumps just after the video starts loading
+        https://bugs.webkit.org/show_bug.cgi?id=27352
+
+        Ensure that the media player is at or after the 'HaveMetadata' state so that
+        the instrinsic size is known before we create the layer for video. This avoids
+        a flash caused by computing the video rect using the default intrinsic size, and then
+        re-computing it when that size changes.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::isReadyForRendering):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+
+2009-07-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto.
+        Patch by Brady Eidson and Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496
+        <rdar://problem/7065391> Microsoft Outlook Web Access fails because XHR stream connection blocks script loading/revalidation
+
+        After refreshing a page and when all CachedResources on that page are in validation mode, they got an exemption
+        from the connection-per-host limit.  Removing that exemption makes the test case load smoothly after reloads.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): Remove the resourceIsCacheValidator exemption to the connection-per-host limit.
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] V8IsolatedWorld::evaluate needs to call didCreateIsolatedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=27335
+
+        evaluateInNewContext makes this delegate call.  evaluateInNewWorld
+        needs to make the same call.  This does not appear to be testable with
+        our current technology.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+
+2009-07-15  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a typo: application/atom=xml -> application/atom+xml.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+
+2009-07-16  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27292
+        Improve handling of <canvas> path operations on an empty path.
+        Implement Skia's Path::hasCurrentPoint().
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::hasCurrentPoint):
+
+2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
+        https://bugs.webkit.org/show_bug.cgi?id=26254
+
+        Make it so that setting white-space and word-wrap via CSS
+        overrides the wrap attribute.
+
+        This involves having the shadow div in the textarea inherit
+        the CSS from its parent instead of hard-coding it in
+        RenderTextControlMultiline.
+        
+        Committer note: Earlier I reverted this change because I did it incorrectly
+        by leaving out css/html.css. In the patch, the filename was the old name
+        css/html4.css and that led to my error.
+
+        * css/html.css:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-07-15  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove a local variable that is shadowing a function parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=27309
+
+        No test required as this modification does not change the current behavior.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+
+2009-07-15  Adam Langley  <agl@google.com>
+
+        No review: reverting previous change.
+
+        Revert r45959:
+
+        2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+
+        The Chromium side of this patch was landed in 20839, but broke the build. It
+        was reverted in r20840. Thus, I'm reverting this side of the patch too.
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Removed.
+
+2009-07-15  David Levin  <levin@chromium.org>
+
+        Layout test fix, reverting previous change.
+
+        Reverting r45962 as it caused several layout test failures.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-06-08  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
+        https://bugs.webkit.org/show_bug.cgi?id=26254
+
+        Make it so that setting white-space and word-wrap via CSS
+        overrides the wrap attribute.
+
+        This involves having the shadow div in the textarea inherit
+        the CSS from its parent instead of hard-coding it in
+        RenderTextControlMultiline.
+
+        * css/html4.css:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+
+2009-07-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 25151 - workers that fail to load scripts not firing error event.
+        https://bugs.webkit.org/show_bug.cgi?id=25151
+
+        This fixes the problem that an error event is not fired when the worker
+        script fails to load. Some reasons this may occur are an invalid URL for
+        the worker script or a cross-origin redirect.
+
+        We also moves the code to complete the URL and check its origin from
+        Worker constructor to WorkerScriptLoader loading functions in order to
+        move the exception throwing logic out of the scope of Worker constructor.
+        Due to this change, we also remove the output ExceptionCode parameter
+        in the worker constructor. Corresponding JS/V8 binding codes have been
+        updated to reflect this change.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::toCrossOriginRedirectPolicy):
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::notifyLoadErrorTask):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyError):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::):
+        (WebCore::WorkerScriptLoader::url):
+
+2009-07-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        text-shadow is not drawn for text with transparent colour
+        https://bugs.webkit.org/show_bug.cgi?id=21374
+
+        Test: fast/text/shadow-translucent-fill.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows): If the text fill color is not opaque,
+        paint all shadows separately from the text, by casting them from
+        clipped-out opaque text.
+
+2009-07-15  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * html/HTMLAreaElement.cpp:
+
+2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=27180
+
+        DOM Storage had several unnecessary (and probably unintended)
+        dependencies.  This patch replaces many includes of header files with
+        forward declaration of classes, making some destructors explicit, and
+        taking some factories out of the header files.
+
+        This will allow things like StorageAreaSync to take a StorageAreaImpl*
+        (as it should) rather than a StorageArea* which previously weren't
+        possible because the dependencies were such a tangled mess.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::~LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::~Storage):
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        * storage/StorageSyncManager.h:
+
+2009-07-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incorrect animation when trying to duplicate effect of transform-origin
+        https://bugs.webkit.org/show_bug.cgi?id=27310
+
+        The bug is that matrix animation is being used when animating
+        a list of transform functions that match in the from and to states.
+        This sometimes works. But because of the way CA does matrix animation
+        function lists like the one shown in the testcase animate incorrectly.
+
+        This fixes the bug by always doing component animation
+        as long as the function lists match. This allows CA
+        to animate the components and then recompose the result
+        into the correct matrix.
+
+        Test: animations/transform-origin-vs-functions.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-07-15  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream the V8NPObject and NPV8Object build changes for WebCore.gypi.
+
+        Add upstreamed V8 bindings files into WebCore.gypi so they can be seen
+        downstream
+        https://bugs.webkit.org/show_bug.cgi?id=27274
+
+        Changes the build file for chromium.  Test built the chromium tree
+        to verify.
+
+        * WebCore.gypi:
+
+2009-07-15  Mark Rowe  <mrowe@apple.com>
+
+        I like it when the code compiles.
+
+        * WebCore.base.exp:
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed parseURL to deprecatedParseURL.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue): Renamed.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL): Renamed.
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL): Renamed.
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc): Renamed.
+        * bindings/objc/DOM.mm:
+        (-[DOMElement _getURLAttribute:]): Renamed.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Renamed.
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl): Renamed.
+        * css/CSSHelper.cpp:
+        (WebCore::deprecatedParseURL): Renamed.
+        * css/CSSHelper.h: Renamed and updated comment.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler): Renamed.
+        (WebCore::HTMLAnchorElement::parseMappedAttribute): Renamed.
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseMappedAttribute): Renamed.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Renamed.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::parseMappedAttribute): Renamed.
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute): Renamed.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Renamed.
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute): Renamed.
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::sourceURI): Renamed.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute): Renamed.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute): Renamed.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::parseMappedAttribute): Renamed.
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::parseMappedAttribute): Renamed.
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag): Renamed.
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::processAttribute): Renamed.
+        (WebCore::PreloadScanner::emitCSSRule): Renamed.
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::declareAndWriteDragImage): Renamed.
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage): Renamed.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage): Renamed.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::declareAndWriteDragImage): Renamed.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteImageURL): Renamed.
+        (WebCore::HitTestResult::absoluteMediaURL): Renamed.
+        (WebCore::HitTestResult::absoluteLinkURL): Renamed.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Renamed.
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::sourceURI): Renamed.
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler): Renamed.
+        * wml/WMLImageLoader.cpp:
+        (WebCore::WMLImageLoader::sourceURI): Renamed.
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSHelper.h's parseURL is a function that no one should ever call
+        Part 1: Eliminate callers in the CSS parser.
+        https://bugs.webkit.org/show_bug.cgi?id=26599
+
+        Test: fast/css/uri-token-parsing.html
+
+        * css/CSSHelper.h: Added a comment explaining why nobody should ever call this
+        function. A FIXME suggests a next step, which would be to rename it deprecatedParseURL.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed unneeded call to parseURL;
+        CSSParser::text already takes care of parsing the URI token syntax, and the
+        parseURL function does no good.
+        (WebCore::CSSParser::parseContent): Ditto.
+        (WebCore::CSSParser::parseFillImage): Ditto.
+        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
+        (WebCore::CSSParser::parseBorderImage): Ditto.
+        (WebCore::isCSSWhitespace): Added. Helper function that makes the text function
+        easier to read.
+        (WebCore::CSSParser::text): Tweak logic so that leading and trailing whitespace
+        are both trimmed before removing the quote marks. Changed to use the
+        isCSSWhitespace, isASCIIHexDigit, and toASCIIHexValue functions for clarity.
+
+        * css/CSSParser.h: Removed stray "public:" in this header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::substring): Optimized the case where the substring covers
+        the entire string, so we just share the StringImpl instead of making a new one.
+        This case came up in earlier versions of the CSS parser changes above.
+        (WebCore::StringImpl::substringCopy): Streamlined the logic here and made it
+        not call substring any more. Before, this was relying on the substring function
+        always making a copy of any non-empty substring.
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        After double-clicking a word, using Shift-arrow to select behaves unpredictably
+        https://bugs.webkit.org/show_bug.cgi?id=27177
+        rdar://problem/7034324
+
+        Test: editing/selection/extend-selection-after-double-click.html
+
+        The bug was due to the m_lastChangeWasHorizontalExtension flag, which was not
+        being cleared in many cases where it should have been.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Set m_lastChangeWasHorizontalExtension
+        to false. This catches all sorts of cases that don't flow through the modify function.
+        Before, the flag would reflect the last call to the modify function, which was not
+        necessarily the last selection change.
+        (WebCore::SelectionController::willBeModified): Rearrange function for clarity.
+        Remove code that sets m_lastChangeWasHorizontalExtension; that is now handled elsewhere. 
+        (WebCore::SelectionController::modify): Call setLastChangeWasHorizontalExtension after
+        setSelection when setting up a trial selection controller, since setSelection now
+        clears that flag. Also changed both trial selection controller cases to set the flag,
+        although it's not strictly necessary in both cases. Added code to set
+        m_lastChangeWasHorizontalExtension when extending the selection, which used to be
+        handled in willBeModified. Now we need to do it after the selection change.
+
+2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update DOM Storage files in GYPI file.
+        https://bugs.webkit.org/show_bug.cgi?id=27317
+
+        Need to update DOM Storage files in the GYPI file.  They're pretty out
+        of date and we're on the path towards enabling them for everyone!
+
+        * WebCore.gypi:
+
+2009-07-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26794
+        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        
+        Define YYMALLOC and YYFREE to fastMalloc and fastFree
+        respectively.
+
+        * css/CSSGrammar.y:
+        * xml/XPathGrammar.y:
+
+2009-07-15  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27193
+        Don't run in to anonymous blocks.  No other browsers do this, and our implementation of run-in
+        is effectively broken as a result.
+
+        No new tests. Changed fast/runin/001.html and fast/runin/generated.html to match new behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-07-15  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/js/instanceof-operator.html
+
+        Fix for: Bug 25205 -  XMLHttpRequest instance is not an instanceof XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=25205
+
+        In addition to for XMLHttpRequest, this also fixes for:
+        - Audio
+        - Image
+        - MessageChannel
+        - Option
+        - WebKitCSSMatrix
+        - WebKitPoint
+        - Worker
+        - XSLTProcessor
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMConstructorObject::createStructure):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+
+2009-07-15  Kai Br�ning  <kai@granus.net>
+
+        Reviewed by Dave Hyatt.
+
+        CSS21 attribute selectors not dynamic for xml.
+        https://bugs.webkit.org/show_bug.cgi?id=25072
+
+        Moved the relevant test in StyledElement::attributeChanged()
+        to a new function Element::recalcStyleIfNeededAfterAttributeChanged()
+        so it can be called from both StyledElement::attributeChanged()
+        and Element::attributeChanged().
+        Refactored Element::attributeChanged() into
+        Element::updateAfterAttributeChanged() and
+        Element::recalcStyleIfNeededAfterAttributeChanged(), which are called
+        separately from StyledElement::attributeChanged().
+
+        Test: fast/css/attribute-selector-dynamic.xml
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::updateAfterAttributeChanged):
+        (WebCore::Element::recalcStyleIfNeededAfterAttributeChanged):
+        * dom/Element.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+
+2009-07-15  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Layout test failures for drawImage in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=27311
+
+        Fixing several canvas layout tests failures due to a
+        missing return statement in CanvasRenderingContext2DDrawImage() which
+        was accidentally removed in r45929.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+
+2009-07-15  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26969
+
+        If the httpMethod() of the request passed to SubresourceLoader::create is not
+        supported by the client we must expect to call didFail() while m_loader is still null.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (DocumentThreadableLoader::didFail):Changed.
+
+2009-07-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.base.exp:
+        * css/MediaQueryEvaluator.cpp:
+        * rendering/SVGRenderTreeAsText.cpp:
+        * rendering/style/SVGRenderStyle.cpp:
+        * svg/graphics/SVGPaintServer.cpp:
+
+2009-07-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] drawImage method of HTMLCanvasElement to accept HTMLVideoElement as argument
+        https://bugs.webkit.org/show_bug.cgi?id=27170
+
+        Changed CanvasRenderingContext2DDrawImage() to accept HTMLVideoElement
+        as a parameter of drawImage() for HTMLCanvasElement.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+
+2009-07-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world constructors
+        https://bugs.webkit.org/show_bug.cgi?id=27287
+
+        Don't enter V8Proxy::m_context before creating DOM constructors.
+        Instead, use getWrapperContext to get the right context.
+
+        After this patch, all my tests pass.  I'll enable the feature
+        downstream and land the tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCache):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::installDOMWindow):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::getHiddenObjectPrototype):
+        (WebCore::V8Proxy::installHiddenObjectPrototype):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-15  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        useless null-check statement in visible_units.cpp@logicalStartOfLine
+        https://bugs.webkit.org/show_bug.cgi?id=27154
+
+        Simple fix.
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartOfLine): Doubled honorEditableBoundaryAtOrAfter() call removed.
+
+2009-07-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27304
+        WebKit should provide usage and eligibility information about the page cache.
+
+        * WebCore.base.exp:
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::childFrameCount):
+        * history/CachedFrame.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::frameCount):
+        (WebCore::PageCache::autoreleasedPageCount):
+        * history/PageCache.h:
+        (WebCore::PageCache::pageCount):
+
+2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium's canvas forgets its context after fillText again
+        https://bugs.webkit.org/show_bug.cgi?id=27293
+
+        No new tests because the test for this was already added in
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-07-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27283
+
+        Implement the new 'rem' unit from CSS3.
+
+        Added some rem-* tests in fast/css.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::lex):
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValue::createCSSValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthInt):
+        (WebCore::CSSPrimitiveValue::computeLengthIntForLength):
+        (WebCore::CSSPrimitiveValue::computeLengthShort):
+        (WebCore::CSSPrimitiveValue::computeLengthFloat):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        (WebCore::CSSPrimitiveValue::cssText):
+        (WebCore::CSSPrimitiveValue::parserValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::):
+        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapFillXPosition):
+        (WebCore::CSSStyleSelector::mapFillYPosition):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/CSSStyleSelector.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::device_heightMediaFeatureEval):
+        (WebCore::device_widthMediaFeatureEval):
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        * css/tokenizer.flex:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::usesRemUnits):
+        (WebCore::Document::setUsesRemUnits):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::dashArrayFromRenderingStyle):
+        * svg/graphics/SVGPaintServer.h:
+
+2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Remove extraneous qualifier, accidentally added in http://trac.webkit.org/changeset/45884.
+
+        * bindings/v8/V8DOMWrapper.h: Removed extraneous qualifier.
+
+2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Update bindings for ValiditeState patch.
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove obsolete code from the make system
+        https://bugs.webkit.org/show_bug.cgi?id=27299
+
+        * WebCore.pro:
+
+2009-07-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the build without media elements.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteMediaURL): Add #if ENABLE(VIDEO)
+        markers around the body of the method.
+
+2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Move storeLastActivePanel out of the
+        ifdef ENABLE_JAVASCRIPT_DEBUGGER section in IDL;
+        Add default panel for the first opening of the
+        WebInspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27263
+
+        * inspector/InspectorController.cpp:
+        (InspectorController::setWindowVisible):
+        * inspector/InspectorController.idl:
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Add Reflect and ReflectURL support.
+
+2009-07-14  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        HTMLMediaElement::supportsFullscreen() should return false
+        https://bugs.webkit.org/show_bug.cgi?id=27284
+
+        (Reverting a part of 45875)
+
+        HTMLVideoElement::supportsFullscreen() will properly do the
+        job, and check if the backend supports fullscreen.
+
+        HTMLVideoElement is the only subclass to support fullscreen
+        (conditionnaly). HTMLAudioElement fullscreen is not supported
+        and is a different kind of fullscreen, if it comes to be wanted.
+
+        No test can be done currently given that none of the media
+        backends support fullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen):
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Next step in making DOM attribute getter/setters consistently use AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        This covers eight DOM classes, and for each one of the classes:
+
+        - Changes the IDL to use the Reflect syntax for all simple cases.
+        - Removes unused functions in the classes, mainly newly unused ones that were
+          used for reflection before.
+        - Removes unneeded explicitly defined destructors.
+        - Explicitly declares destructors as virtual.
+        - Removes unneeded includes.
+        - Makes members protected or private rather than public where possible.
+        - Renames "doc" to "document".
+        - Tweaks formatting to match our latest style in a few places.
+        - Improves some FIXME comments.
+
+        Over time we'll want to do this for all HTML DOM classes.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        * html/HTMLAnchorElement.h:
+        (WebCore::HTMLAnchorElement::endTagRequirement):
+        (WebCore::HTMLAnchorElement::tagPriority):
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.cpp:
+        * html/HTMLAppletElement.h:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::parseMappedAttribute):
+        * html/HTMLAreaElement.h:
+        (WebCore::HTMLAreaElement::endTagRequirement):
+        (WebCore::HTMLAreaElement::tagPriority):
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::parseMappedAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::HTMLBaseElement):
+        (WebCore::HTMLBaseElement::removedFromDocument):
+        (WebCore::HTMLBaseElement::process):
+        * html/HTMLBaseElement.h:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.cpp:
+        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
+        * html/HTMLBaseFontElement.h:
+        (WebCore::HTMLBaseFontElement::endTagRequirement):
+        (WebCore::HTMLBaseFontElement::tagPriority):
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.cpp:
+        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
+        * html/HTMLBlockquoteElement.h:
+        (WebCore::HTMLBlockquoteElement::tagPriority):
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::HTMLBodyElement):
+        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
+        * html/HTMLBodyElement.h:
+        (WebCore::HTMLBodyElement::endTagRequirement):
+        (WebCore::HTMLBodyElement::tagPriority):
+        * html/HTMLBodyElement.idl:
+        Made changes as described above.
+
+        * loader/FrameLoader.cpp: Removed unneeded include of HTMLAnchorElement.h.
+
+2009-07-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Reorganize JavaScriptCore headers into:
+        API: include/JavaScriptCore/
+        Private: include/private/JavaScriptCore/
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Change all Noncopyable inheriting visibility to public.
+        https://bugs.webkit.org/show_bug.cgi?id=27225
+
+        Change all Noncopyable inheriting visibility to public because
+        it is needed to the custom allocation framework (bug #20422).
+
+        * bindings/js/GCController.h:
+        * bindings/js/WorkerScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::):
+        * bridge/runtime.h:
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.h:
+        * css/CSSStyleSelector.h:
+        * dom/ClassNames.h:
+        * dom/MessagePortChannel.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerScope.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        * editing/SelectionController.h:
+        * editing/TextIterator.cpp:
+        * history/PageCache.h:
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLParser.h:
+        * html/HTMLParserQuirks.h:
+        * html/PreloadScanner.h:
+        * loader/Cache.h:
+        * loader/CrossOriginPreflightResultCache.h:
+        * loader/FrameLoader.h:
+        * loader/ProgressTracker.h:
+        * loader/ThreadableLoader.h:
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/archive/ArchiveResourceCollection.h:
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconLoader.h:
+        * loader/icon/PageURLRecord.h:
+        * loader/loader.h:
+        * page/ContextMenuController.h:
+        * page/EventHandler.h:
+        * page/FrameTree.h:
+        * page/Page.h:
+        * page/PageGroup.h:
+        * page/PageGroupLoadDeferrer.h:
+        * page/mac/EventHandlerMac.mm:
+        * platform/AutodrainedPool.h:
+        * platform/ContextMenu.h:
+        * platform/EventLoop.h:
+        * platform/HostWindow.h:
+        * platform/Pasteboard.h:
+        * platform/PurgeableBuffer.h:
+        * platform/RunLoopTimer.h:
+        * platform/ThreadGlobalData.h:
+        * platform/ThreadTimers.h:
+        * platform/Timer.h:
+        * platform/TreeShared.h:
+        * platform/graphics/FontData.h:
+        * platform/graphics/GlyphWidthMap.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/skia/GraphicsContextPlatformPrivate.h:
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/mac/LocalCurrentGraphicsContext.h:
+        * platform/network/FormDataBuilder.h:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/text/StringBuffer.h:
+        * platform/text/TextCodec.h:
+        * platform/win/WindowMessageBroadcaster.h:
+        * rendering/CounterNode.h:
+        * rendering/LayoutState.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderView.h:
+        * rendering/TransformState.h:
+        * svg/SVGAnimatedProperty.h:
+        * svg/SynchronizableTypeWrapper.h:
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathParser.h:
+        * xml/XPathPredicate.h:
+        * xml/XPathStep.h:
+
+2009-07-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fails to save document state when navigating away from a page with a
+        reference fragment.
+        https://bugs.webkit.org/show_bug.cgi?id=27281
+
+        Test: fast/history/saves-state-after-fragment-nav.html
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument): Use equalIgnoringRef
+        to compare URLs.
+
+2009-07-14  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Inspector: Remove Unintended Global Variables
+        https://bugs.webkit.org/show_bug.cgi?id=27203
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.animateStyle):
+
+2009-07-14  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Added build stuff and stub for the ValidityState class, part of HTML5
+        section Forms:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+
+        Test: fast/forms/ValidityState-001.html
+
+        * DerivedSources.cpp: Inclusion of ValidityState files
+        * DerivedSources.make: ditto
+        * GNUmakefile.am: ditto
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * html/HTMLButtonElement.idl: validity attribute
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::validity): ValidityState getter
+        * html/HTMLFormControlElement.h: ditto
+        * html/HTMLInputElement.idl: validity attribute
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl: ditto
+        * html/ValidityState.cpp: Added.
+        (WebCore::ValidityState::ValidityState):
+        (WebCore::ValidityState::valid): validation flag
+        * html/ValidityState.h: Added.
+        (WebCore::ValidityState::create): validation flag
+        (WebCore::ValidityState::control): ditto
+        (WebCore::ValidityState::valueMissing): ditto
+        (WebCore::ValidityState::typeMismatch): ditto
+        (WebCore::ValidityState::patternMismatch): ditto
+        (WebCore::ValidityState::tooLong): ditto
+        (WebCore::ValidityState::rangeUnderflow): ditto
+        (WebCore::ValidityState::rangeOverflow): ditto
+        (WebCore::ValidityState::stepMismatch): ditto
+        (WebCore::ValidityState::customError): ditto
+        * html/ValidityState.idl: Added.
+
+2009-07-14  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Outdenting a line inside a blockquote tag does nothing
+        https://bugs.webkit.org/show_bug.cgi?id=25316
+
+        The bug was caused by the code checking whether the blockquote is created by WebKit or not.
+        We simply remove this code to be consistent with Firefox and Internet Explorer.
+        Also, enclosingBlockFlow == enclosingNode in outdentParagraph isn't a sufficient condition to insert
+        the placeholder before the enclosingNode because there could be contents before the current paragraph.
+        Instead, we should split the enclosingNode (which is a blockquote) at the starting position of outdentation.
+        It turned out that this solves the bug 25315 also: https://bugs.webkit.org/show_bug.cgi?id=25315
+
+        Test: editing/execCommand/outdent-regular-blockquote.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::isIndentBlockquote): no longer checks whether a blockquote is created by WebKit or not.
+        (WebCore::IndentOutdentCommand::outdentParagraph): takes care of the case enclosingBlockFlow == enclosingNode
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for Node prototypes
+        https://bugs.webkit.org/show_bug.cgi?id=27277
+
+        This change does two things:
+
+        1) We bypass the wrapper cache in the isolated world.  This is because
+           the wrapper template cache has prototypes that lead to the main
+           world.  We can add a template cache for the isolated world if
+           performance warrants.
+
+        2) We introduce a smarter way to grab the wrapper context for a frame
+           that is aware that proxy <-> context do not stand in one-to-one
+           correspondence.  This generalizes our solution for the node wrapper
+           case to prototypes.
+
+        The net result is that Node wrappers get the right prototypes.  As
+        before, tests to follow.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        (WebCore::V8DOMWrapper::getWrapperContext):
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for Nodes
+        https://bugs.webkit.org/show_bug.cgi?id=27271
+
+        Previously, we keepy a pointer to the DOMMap on V8Proxy, but this
+        caused us to miss the branch in V8DOMMap.cpp for isolated worlds.
+
+        I have tests, but I can't land them until I get this feature under
+        control.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world crash on getting window.location
+        https://bugs.webkit.org/show_bug.cgi?id=27268
+
+        I have a test for this locally, but it requires a compile-time hack to
+        run.  Once I get the feature's stability under control, we can turn the
+        feature on and add the tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+
+2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Correct failing tests after r45875.  The original patch did not
+        test the m_player member for null, causing crashes.  This will
+        happen fairly frequently in real use.  Was this original patch
+        ever tested?
+        https://bugs.webkit.org/show_bug.cgi?id=27246
+
+        Test via existing media tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::supportsFullscreen): Check for null pointer.
+        (WebCore::HTMLMediaElement::supportsSave): Check for null pointer.
+
+2009-07-14  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Explicitly mark the HTML generated for the Mac as being UTF-8 encoded.
+        The Windows clipboard format is explicitly documented as being UTF-8,
+        and all Linux apps assume UTF-8. On the Mac, though, unless otherwise
+        indicated, Windows-1252 is assumed, which is wrong.
+
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=27262
+
+        No new tests.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+
+2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8NPObject.h and V8NPObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=27103
+
+        This just upstreams the files from the chromium code base. Only
+        minor changes to formatting and similar were done, so no testing
+        is required because nothing really changed.  Code verified to compile.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/v8/V8NPObject.cpp: Added.
+        (npObjectInvokeImpl):
+        (npObjectMethodHandler):
+        (npObjectInvokeDefaultHandler):
+        (weakTemplateCallback):
+        (npObjectGetProperty):
+        (npObjectNamedPropertyGetter):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetNamedProperty):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectNamedPropertySetter):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetNamedProperty):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPObject.h: Added.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+
+2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add HTMLMediaElement::supportSave() and a
+        HitTestResult::absoluteMediaURL() functions
+        https://bugs.webkit.org/show_bug.cgi?id=27246
+
+        Added an implementation of supportsSave() into HTMLMediaElement
+        that delegates to MediaPlayerPrivateImpl so that the media engine
+        is able to signal whether or not a media source supports saving.
+
+        Also added a function to HitTestResult that allows for retrieval
+        of the currentSrc associated with the "hit" media element. 
+        
+        These functions are just pipeing with no visible UI change so there
+        are no related layout test changes.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::supportsFullscreen): 
+        (WebCore::HTMLMediaElement::supportsSave):
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::supportsSave):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen):
+        (WebCore::MediaPlayerPrivateInterface::supportsSave):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString):
+        (WebCore::HitTestResult::absoluteMediaURL):
+        * rendering/HitTestResult.h:
+
+2009-07-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Implement Reflect and ReflectURL attribute support.
+        https://bugs.webkit.org/show_bug.cgi?id=27273
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added support for Reflect and ReflectURL attributes.
+
+2009-07-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27266
+        Add hasCurrentPoint() to WebCore::Path.
+        This fixes Skia-based Chromium regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=27187.
+        For Skia, the new method always returns 'true', pending actual implementation.
+        This means Chromium still will differ from Gecko behavior, but at least its Canvas
+        will not be completely broken.
+
+        Existing Canvas Layout Tests should pass in Chromium after this change.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo): insteand of Path::isEmpty() test for hasCurrentPoint().
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo): ditto.
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo): ditto.
+
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        All these files add a Path::hasCurrentPoint() for various platforms.
+
+2009-07-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Upstream RGBColor from src.chromium.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27133
+
+        * WebCore.gypi: Add RGBColor
+        * css/RGBColor.cpp: Added.
+        (WebCore::RGBColor::create):
+        (WebCore::RGBColor::red):
+        (WebCore::RGBColor::green):
+        (WebCore::RGBColor::blue):
+        * css/RGBColor.h: Added.
+        (WebCore::RGBColor::RGBColor):
+
+2009-07-10  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Rename the didCreate/DestroyScriptContext calls to make it
+        clear that that those refer to the frame's contxt.  Add another
+        similar call for when creating contexts via evaluateInNewContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27104
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContextForFrame):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContextForFrame):
+        (WebCore::EmptyFrameLoaderClient::didCreateIsolatedScriptContext):
+        * loader/FrameLoaderClient.h:
+
+2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Revert http://trac.webkit.org/changeset/45864 after
+        breaking of Windows build.
+
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-07-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Cleanup DOM Storage dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=27180
+
+        DOM Storage had several unnecessary (and probably unintended)
+        dependencies.  This patch replaces many includes of header files with
+        forward declaration of classes, making some destructors explicit, and
+        taking some factories out of the header files.
+
+        This will allow things like StorageAreaSync to take a StorageAreaImpl*
+        (as it should) rather than a StorageArea* which previously weren't
+        possible because the dependencies were such a tangled mess.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::~LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::~Storage):
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        * storage/StorageSyncManager.h:
+
+
+2009-07-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26983
+
+        Check to make sure the view is attached to a frame() in the visibleContentsResized()
+        method as it can be triggered before the view is attached by Frame::createView(...)
+        setting various values such as setScrollBarModes(...) for example.  An ASSERT is
+        triggered when a view is layout before being attached to a frame().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::visibleContentsResized):
+        * page/FrameView.h:
+
+2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: show last opened panel when invoking inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27263
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        * inspector/InspectorController.idl:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Speed up access to NodeList length.
+        https://bugs.webkit.org/show_bug.cgi?id=27264
+
+        That's a minimal alternation of the code.
+
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): 1) use AtomicString for comparison, 2) use
+        v8::Integer::New instead of v8::Number::New.
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not do unnecessary conversions from v8::Handle<v8::Value> to
+        v8::Handle<v8::Object> and accompanying changes.
+        https://bugs.webkit.org/show_bug.cgi?id=26953
+
+        Three things:
+
+        1) do not cast from v8::Value to v8::Object if unnecessary---casts are cheap,
+        but are not free (they check for emptiness of handle);
+        2) inline conversion from wrapper to node;
+        3) simplify case to an ASSERT.
+
+        This is just a refactoring, so no new tests are needed.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::convertToSVGPODTypeImpl):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toCanvasStyle):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Straight quotes should match fancy quotes in in-page search
+        https://bugs.webkit.org/show_bug.cgi?id=27217
+
+        Tests: fast/text/find-quotes.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::foldQuoteMark): Added.
+        (WebCore::foldQuoteMarks): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Call foldQuoteMarks on the target string.
+        (WebCore::SearchBuffer::append): Call foldQuoteMarks on characters as they are
+        added to the search buffer.
+
+        * platform/text/CharacterNames.h: Added more quotation mark character names.
+        Sorted character names with the sort tool.
+
+2009-07-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: handle debugger shortcuts while on source frame or on
+        script file selector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27224
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-07-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use standard HashCountedSet instead of a hand rolled one
+        in HTMLDocument.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::addItemToMap):
+        (WebCore::removeItemFromMap):
+        * html/HTMLDocument.h:
+
+2009-07-13  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Implement HTML5 draggable
+        https://bugs.webkit.org/show_bug.cgi?id=26262
+
+        This adds support for the HTML5 draggable attribute and its DOM binding. It maps the draggable property
+        to the CSS properties -webkit-user-drag and -webkit-user-select respectively.
+
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/editing.html#the-draggable-attribute
+
+        Test: fast/html/draggable.html
+
+        * css/html.css:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::draggable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::draggable):
+        (WebCore::HTMLElement::setDraggable):
+        * html/HTMLElement.h:
+        * html/HTMLElement.idl:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::draggable):
+        * html/HTMLImageElement.h:
+
+2009-07-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Image rendered as layer contents looks different from image rendered via CG.
+        <rdar://problem/7048830> 
+        
+        Fix a visible color profile difference between between images rendered via Core Graphics
+        and those rendered via a compositing layer, by assigning the GenericRGB profile to
+        untagged images (which come through as having the DeviceRGB profile) when they are set
+        as layer contents.
+
+        Test: compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27220
+        Assertion failure in createSearcher() (usearch_open() status is U_USING_DEFAULT_WARNING)
+
+        * editing/TextIterator.cpp:
+        (WebCore::createSearcher): Add U_USING_DEFAULT_WARNING as a possible status code
+        in the assertion. Affects only the assertion.
+
+2009-07-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26925
+        <rdar://problem/7027850> URL Fragment Breaks Application Cache Loads
+
+        Test: http/tests/appcache/main-resource-hash.html
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        Remove URL fragment at appcache code borders.
+
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        Assert that there is no URL fragment in URL at key points in appcache code.
+
+2009-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27166
+        rdar://problem/7015857
+        Find for strings composed entirely of spaces doesn't work
+
+        Test: fast/text/find-spaces.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::findPlainText): Removed unneeded special case.
+        The empty string case already works correctly.
+
+2009-07-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Remove NPPVpluginPrivateModeBool, it was removed from the spec.
+        
+        * bridge/npapi.h:
+
+2009-07-13  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27237
+
+        Make V8DOMMap.h compiling with gcc option -Werror=non=virtual-dtor.  
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::WeakReferenceMap):
+        (WebCore::WeakReferenceMap::~WeakReferenceMap):
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove an accidental add of bidi.(cpp|h) to WebCore.gypi.
+
+        * WebCore.gypi: Removed bidi.cpp and bidi.h
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update WebCore.gyp in preparation to hooking it up.
+
+        * WebCore.gypi: Added files that were mid-stream while switching over.
+
+2009-07-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, another small fix for Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-07-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fix Chromium build bustage.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::JavaScriptConsoleMessage::addToPage):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+
+2009-07-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27234
+        <rdar://problem/7054356>
+
+        Add null page check in HTMLDocument::hasFocus.
+
+        Test: fast/dom/HTMLDocument/hasFocus-frameless-crash.html
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::hasFocus): Add page null check.
+        (WebCore::HTMLDocument::createTokenizer): Cleanup page null check.
+
+2009-07-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Disable continuous spell checking in the inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27131
+
+        * inspector/front-end/inspector.html: Added spellcheck="false" to the
+            main-panels and console-prompt containers.
+
+2009-07-13  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: fix assertion when rendering google.com.kh
+
+        https://bugs.webkit.org/show_bug.cgi?id=26924
+
+        Some shapers (i.e. Khmer) will produce cluster logs which report that
+        /no/ code points contributed to certain glyphs. Because of this, we
+        take any code point which contributed to the glyph in question, or any
+        subsequent glyph.  If we run off the end, then we take the last code
+        point.
+
+        Added LayoutTests/fast/text/international/khmar-selection.html
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+
+2009-07-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        spellcheck="false" is ignored
+        <rdar://problem/7054177>
+
+        * editing/Editor.cpp:
+        (WebCore::markMisspellingsOrBadGrammar): Moved code to check the
+            spellcheck attribute from here...
+        (WebCore::Editor::spellCheckingEnabledInFocusedNode): ...to here.
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Bail out
+            if spell chcking is disabled by the spellcheck attribute.
+        * editing/Editor.h:
+
+2009-07-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add new configuration flag for redistributable Windows build.
+        https://bugs.webkit.org/show_bug.cgi=27087
+        
+        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo.vsprops to
+          Debug_Cairo and Release_Cairo builds.
+        * config.h: Check for presence of WIN_CAIRO and select appropriate
+          configuration.  Defaults to standard Apple build.
+
+2009-07-13  Peter Kasting  <pkasting@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Back out previous patch for this bug (too many problems).
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::form):
+        * html/HTMLInputElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.cpp: Removed.
+        * html/ValidityState.h: Removed.
+        * html/ValidityState.idl: Removed.
+
+2009-07-13  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add HTMLAllCollection to WebCore.gypi.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27223
+
+        * WebCore.gypi: Add HTMLAllCollection.
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor.
+        https://bugs.webkit.org/show_bug.cgi?id=27218
+
+        Test: fast/css/matrix-as-function-crash.html
+
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call.
+
+2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-13  Cédric Luthi  <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix NPWindow clip rect in PluginViewMac
+
+        The rect should be in window-coordinates. This bug can be observed
+        with Flash 10 here: http://www.permadi.com/tutorial/cursorTracker/
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix Qt implementation of WebCore::directoryName to return the absolute
+        directory name instead of the base file name.
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::directoryName):
+
+2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix WebCore::Path::isEmpty() for the Qt port to return true
+        if there is no element in the path.
+
+        QPainterPath::isEmpty() returns also true if there is one single
+        MoveTo element inside, which makes sense but doesn't patch Webcore's
+        is-empty definition.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::isEmpty): Use elementCount() == 0.
+
+2009-07-13  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream fixes to NPV8Object.cpp that make ~30 layout tests pass.
+        https://bugs.webkit.org/show_bug.cgi?id=27127
+
+        There were a number of bugs introduced during the last upstreaming
+        effort that broke around 30 layout tests.  This fixes those bugs.
+        It also has compile fixes to match the recent cutting apart of
+        V8Proxy.
+
+        * bindings/v8/NPV8Object.cpp:
+        (freeV8NPObject):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_EvaluateHelper):
+        (NPN_SetException):
+        (NPN_Construct):
+
+2009-07-13  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix memory leak in the V8 binding layer. 
+        https://bugs.webkit.org/show_bug.cgi?id=27163
+
+        Reinitializing the context is not necessary when clearing the proxy for navigation
+        and it will lead us to hold on to an empty context for each frame.
+
+        Test for empty context instead of empty global object handle when
+        updating the document for a context.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::updateDocument):
+
+2009-07-13  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Correct the logic to determine if a V8 callback returns a value.
+        https://bugs.webkit.org/show_bug.cgi?id=27155
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback):
+        - Don't crash if result.IsEmpty().
+
+2009-07-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
+        https://bugs.webkit.org/show_bug.cgi?id=26932
+
+        Initial IDL definition and bindings for SharedWorkers.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Added new files for SharedWorker support.
+        * DerivedSources.make:
+        Added new files for SharedWorker support.
+        * GNUmakefile.am:
+        Added new files for SharedWorker support.
+        * WebCore.gypi:
+        Added new files for SharedWorker support.
+        * WebCore.pro:
+        Added new files for SharedWorker support.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added new files for SharedWorker support.
+        * bindings/js/JSAbstractWorkerCustom.cpp: Added.
+        (WebCore::JSAbstractWorker::mark):
+        Custom mark handler that marks the event listeners.
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        (WebCore::JSAbstractWorker::toJS):
+        Custom toJS handler which differentiates between various subclasses.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        SharedWorker constructor (only enabled when SHARED_WORKERS is
+        enabled).
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        Added support for converting to/from SharedWorkers.
+        * bindings/js/JSSharedWorkerConstructor.cpp: Added.
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        (WebCore::JSSharedWorkerConstructor::getConstructData):
+        * bindings/js/JSSharedWorkerConstructor.h: Added.
+        (WebCore::JSSharedWorkerConstructor::classInfo):
+        * bindings/js/JSSharedWorkerCustom.cpp: Added.
+        (WebCore::JSSharedWorker::mark):
+        Custom mark function that marks the internal MessagePort.
+        * bindings/v8/DOMObjectsInclude.h:
+        Updated to include new header files.
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Added.
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        V8 handlers for add/removeEventListener().
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        Custom constructor for SharedWorker.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorker):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * workers/AbstractWorker.cpp: Added.
+        (WebCore::AbstractWorker::AbstractWorker):
+        Common base class for SharedWorker and (soon) Worker. The functions below were copied from Worker.cpp.
+        This is the first step in refactoring Worker to derive from AbstractWorker to enable code sharing.
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        (WebCore::AbstractWorker::dispatchEvent):
+        (WebCore::AbstractWorker::dispatchLoadErrorEvent):
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+        * workers/AbstractWorker.h: Added.
+        Definitions of functionality shared by Worker.h and SharedWorker.h. In a future patch, Worker will derive from AbstractWorker.
+        (WebCore::AbstractWorker::scriptExecutionContext):
+        (WebCore::AbstractWorker::setOnerror):
+        (WebCore::AbstractWorker::onerror):
+        (WebCore::AbstractWorker::eventListeners):
+        (WebCore::AbstractWorker::refEventTarget):
+        (WebCore::AbstractWorker::derefEventTarget):
+        * workers/AbstractWorker.idl: Added.
+        * workers/SharedWorker.cpp: Added.
+        (WebCore::SharedWorker::SharedWorker):
+        (WebCore::SharedWorker::~SharedWorker):
+        * workers/SharedWorker.h: Added.
+        (WebCore::SharedWorker::create):
+        (WebCore::SharedWorker::port):
+        (WebCore::SharedWorker::toSharedWorker):
+        * workers/SharedWorker.idl: Added.
+
+2009-07-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove prf install target
+        https://bugs.webkit.org/show_bug.cgi?id=27191
+
+        qtwebkit.prf has been removed; this cleans up the related
+        install target as well.
+
+        * WebCore.pro: Remove prf install target
+
+2009-07-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Facebook Chat is broken due to XSS auditor
+        https://bugs.webkit.org/show_bug.cgi?id=27179
+
+        Instead of just using the script's URL as to detect an XSS attack, we
+        now use a bit of context before the URL.  In particular, we use the
+        bytes from the beginning of the attribute name to the end of the
+        attribute value.  In virtually all injection attacks, the attacker
+        would need to supply the attribute name as well as the attribute value.
+        However, in the Facebook false positive, the attribute name is not
+        present in the URL.
+
+        Tests: http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
+               http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
+               http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        * html/HTMLTokenizer.h:
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        * page/XSSAuditor.h:
+
+2009-07-12  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Refactor ConsoleMessage to add MessageType attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=20625
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportException):
+        (WebCore::Document::addMessage):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::reportErrorToConsole):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::endGroup):
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::count):
+        * inspector/InspectorController.h:
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addMessage):
+        (WebInspector.ConsoleMessage): Added type property.
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        (WebInspector.ConsoleMessage.prototype.isEqual):
+        (WebInspector.ConsoleCommandResult):
+        (WebInspector.ConsoleGroup.prototype.addMessage):
+        (WebInspector.ConsoleGroup.prototype._titleClicked):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._addTip):
+        (WebInspector.Resource.prototype._checkWarning):
+        * inspector/front-end/inspector.css: Changed ".console-group-title-level" to ".console-group-title"
+        * inspector/front-end/inspector.js:
+        (WebInspector.addMessageToConsole):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::printAccessDeniedMessage):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::addMessageToConsole):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reportLocalLoadFailed):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        * page/ChromeClient.h:
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        (WebCore::Console::addMessage):
+        (WebCore::Console::error):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::trace):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::warn):
+        * page/Console.h: Added MessageType enum.
+        (WebCore::):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessageTimerFired):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::reportWarning):
+        (WebCore::SVGDocumentExtensions::reportError):
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::reportWMLError):
+        * workers/GenericWorkerTask.h: Added GenericWorkerTask8 for the extra argument.
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::GenericWorkerTask8::GenericWorkerTask8):
+        (WebCore::GenericWorkerTask8::performTask):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::postConsoleMessageTask):
+        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::reportUnsafeUsage):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::parseErrorFunc):
+
+2009-07-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream UndetectableHTMLCollection.idl as HTMLAllCollection.idl.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27132
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * dom/HTMLAllCollection.idl: Added.
+
+2009-07-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector: Duplicate Computation in Autocompletion
+        https://bugs.webkit.org/show_bug.cgi?id=26778
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27196
+        Rename bidi.cpp to RenderBlockLineLayout.cpp and remove bidi.h
+
+        * GNUmakefile.am: Updated.
+        * WebCore.gypi: Updated.
+        * WebCore.pro: Updated.
+        * WebCore.vcproj/WebCore.vcproj: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Updated.
+        * WebCoreSources.bkl: Updated.
+        * rendering/RenderBlock.h: Removed unnecessary forward declaration and
+            updated comments.
+        * rendering/RenderBlockLineLayout.cpp: Copied from WebCore/rendering/bidi.cpp.
+            Removed unnecessary #include statements.
+        (WebCore::BidiRun::BidiRun): Moved here from bidi.h.
+        (WebCore::RenderBlock::layoutInlineChildren): Removed outdated comment.
+        * rendering/bidi.cpp: Removed.
+        * rendering/bidi.h: Removed.
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Image cleanup
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData): Use the data() accessor
+        instead of the m_data member.
+        (WebCore::BitmapImage::dataChanged): Ditto.
+        * platform/graphics/Image.h: Re-ordered #includes and class
+        declarations. Removed the drawPatternCallback() declaration. Made member
+        variables private.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::drawPatternCallback): Changed this from a member function to a
+        static function.
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged): Use the data() accessor
+        instead of the m_data member.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Ditto.
+
+2009-07-12  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27189
+        
+        Fixes insufficient check in XSSAuditor::canSetBaseElementURL that caused 
+        XSSAuditor to incorrectly block HTML Base elements whose base path coincided 
+        with the URL of the page.
+
+        Test: http/tests/security/xssAuditor/base-href-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL): Changed conditional to only call 
+        XSSAuditor::findInRequest() if the host in the page URL disagrees with the host 
+        in the base element URL.
+
+2009-07-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Text searching with ICU should take the user's default locale into account
+        https://bugs.webkit.org/show_bug.cgi?id=27184
+        rdar://problem/6812121
+
+        No simple way to test this since it's dependent on user locale.
+        After this, the user's default locale is used only on Mac.
+
+        * editing/TextIterator.cpp:
+        (WebCore::createSearcher): Pass result of the currentSearchLocaleID
+        function as the locale.
+
+        * platform/text/TextBreakIteratorInternalICU.h: Added declaration of
+        currentSearchLocaleID function.
+
+        * platform/text/android/TextBreakIteratorInternalICU.cpp:
+        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+
+        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
+        (WebCore::textBreakLocalePreference): Added. Returns the value of
+        the AppleTextBreakLocale preference.
+        (WebCore::topLanguagePreference): Added. Returns the value of the
+        first item in the AppleLanguages preference.
+        (WebCore::canonicalLanguageIdentifier): Added. Cover for the
+        CFLocaleCreateCanonicalLanguageIdentifierFromString function.
+        (WebCore::getLocale): Added. Transfers the locale from a CFStringRef
+        into a buffer.
+        (WebCore::getSearchLocale): Added. Calls topLanguagePreference,
+        canonicalLanguageIdentifier, and getLocale.
+        (WebCore::currentSearchLocaleID): Added. Calls getSearchLocale once.
+        (WebCore::getTextBreakLocale): Changed to call
+        textBreakLocalePreference, topLanguagePreference,
+        canonicalLanguageIdentifier, and getLocale.
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+
+2009-07-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Create a PangoLayout that properly represents the visual
+        appearance of the text in the web page so that the line boundary
+        modes of getText{At,Before,After}Offset work correctly.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (UTF16ToUTF8):
+        (g_substr):
+        (convertUniCharToUTF8):
+        (getPangoLayoutForAtk):
+
+2009-07-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 27187 - Match Gecko behaviour for canvas path mutation APIs on an empty path
+        <https://bugs.webkit.org/show_bug.cgi?id=27187>
+
+        Simple API change, check for the empty path and add appropriate point if necessary.
+
+        Test: fast/canvas/canvas-modify-emptyPath.html
+
+        * Info.plist:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+
+2009-07-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLMediaElement.canPlayType "maybe" and "probably" reversed
+        https://bugs.webkit.org/show_bug.cgi?id=27186
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Return "probably" if type has codecs parameter.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Ditto.
+
+2009-07-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        A worker-thread inspired follow-up for:
+        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
+        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Don't perform the XHR compensation when the XHR
+          is running on a worker thread. Accessing the global Cache data structures from a non-main thread is
+          not currently supported.
+
+2009-07-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable support for accelerated compositing and 3d transforms on Leopard.
+        <https://bugs.webkit.org/show_bug.cgi?id=20166>
+        <rdar://problem/6120614>
+
+        Reviewed by Oliver Hunt.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-07-11  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build after r45724.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+
+2009-07-10  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26921
+
+        Implements support for HTML entities, so XSSAuditor can protect against attacks
+        encoded with HTML entities.
+
+        Tests: http/tests/security/xssAuditor/inline-event-HTML-entities.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities.html
+               http/tests/security/xssAuditor/link-onclick-entities.html
+               http/tests/security/xssAuditor/script-tag-entities.html
+               http/tests/security/xssAuditor/script-tag-with-source-entities.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Modified to call WebCore::XSSAuditor::decodeHTMLEntities
+        to decode HTML entities.
+        (WebCore::XSSAuditor::decodeHTMLEntities): Added method to decode HTML entities.
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-07-10  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27007: Build fixes when ICONDATABASE is disabled
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27007>
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.xcodeproj/project.pbxproj: Added IconDatabaseNone.cpp
+        to the project.
+        * loader/icon/IconDatabase.cpp: Added
+        #if ENABLE(ICONDATABASE)/#endif macro guard.
+        * loader/icon/IconDatabase.h: Removed three public methods from
+        #if ENABLE(ICONDATABASE)/#endif macro so that they may be
+        stubbed out in IconDatabaseNone.cpp.
+        * loader/icon/IconDatabaseNone.cpp: Added
+        #if !ENABLE(ICONDATABASE)/#endif macro guard.
+        (WebCore::IconDatabase::importIconURLForPageURL): Added.
+        (WebCore::IconDatabase::importIconDataForIconURL): Added.
+        (WebCore::IconDatabase::shouldStopThreadActivity): Added.
+
+2009-07-10  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27151
+
+        Fixes issue where JavaScript URLs that contain null- and non-null control characters can
+        bypass XSSAuditor.
+
+        Tests: http/tests/security/xssAuditor/javascript-link-control-char.html
+               http/tests/security/xssAuditor/javascript-link-null-char.html
+               http/tests/security/xssAuditor/javascript-link.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Separated out logic for JavaScript URLs from 
+        inline scripts. For JavaScript URLs, calls XSSAuditor::canEvaluateJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Made similar changes to evaluate() as in
+        bindings/js/ScriptController.cpp.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Separated out logic for JavaScript URLs
+        into its own method.
+        * page/XSSAuditor.h:
+
+2009-07-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        WebKit needs a style linting tool
+        https://bugs.webkit.org/show_bug.cgi?id=25884
+
+        Fix bunch of style issues by autofix of cpplint.
+        This patch is created to demonstrate the autofix of cpplint.py.
+
+        No new testcases because it's a style fix
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseMediaQuery):
+        (WebCore::CSSParser::validUnit):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::skipCommaInDashboardRegion):
+        (WebCore::CSSParser::parseDashboardRegions):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::BorderImageParseContext::commitNumber):
+        (WebCore::BorderImageParseContext::commitWidth):
+        (WebCore::BorderImageParseContext::commitRule):
+        (WebCore::BorderImageParseContext::commitBorderImage):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::text):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/MediaList.cpp:
+        (WebCore::MediaList::deleteMedium):
+        * css/MediaQuery.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::parseAspectRatio):
+        * css/MediaQueryEvaluator.h:
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::operator==):
+        * css/WebKitCSSMatrix.h:
+        * dom/Comment.h:
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Document.h:
+        (WebCore::Document::setHasDashboardRegions):
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::nodeName):
+        * dom/DocumentFragment.h:
+        * dom/DynamicNodeList.h:
+        * dom/EditingText.h:
+        * dom/Element.cpp:
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::item):
+        * dom/Node.cpp:
+        (WebCore::Node::nodeValue):
+        (WebCore::Node::nodeIndex):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::create):
+        * dom/Notation.h:
+        * dom/ProcessingInstruction.h:
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        * dom/StyledElement.cpp:
+        (WebCore::toHex):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::~PendingStartElementNSCallback):
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call):
+        (WebCore::PendingCallbacks::):
+        (WebCore::OffsetBuffer::readOutBytes):
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::attributesStartElementNsHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::attributesStartElementNsHandler):
+        (WebCore::XMLTokenizer::parseStartElement):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::pasteAsPlainText):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        * editing/SmartReplaceICU.cpp:
+        (WebCore::addAllCodePoints):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::icon):
+        (WebCore::HistoryItem::adoptVisitCounts):
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setActive):
+        (WebCore::HTMLAnchorElement::isLiveLink):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAudioElement.h:
+        * html/HTMLBRElement.h:
+        * html/HTMLBaseElement.h:
+        * html/HTMLBaseFontElement.h:
+        * html/HTMLDListElement.h:
+        * html/HTMLDirectoryElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::parseMappedAttribute):
+        * html/HTMLHeadElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageElement.h:
+        (WebCore::HTMLImageElement::setLoadManually):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLIsIndexElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::):
+        * html/HTMLMenuElement.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.h:
+        * html/HTMLOListElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::childrenChanged):
+        * html/HTMLParamElement.h:
+        * html/HTMLQuoteElement.h:
+        * html/HTMLStyleElement.h:
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::deleteRow):
+        * html/HTMLTitleElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseNonHTMLText):
+        (WebCore::HTMLTokenizer::parseEntity):
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::write):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.h:
+        * html/TimeRanges.h:
+        (WebCore::TimeRanges::Range::Range):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newInspectorJSONObject):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        * page/Frame.cpp:
+        (WebCore::Frame::jsDefaultStatusBarText):
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::eventActivatedView):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/gtk/DragControllerGtk.cpp:
+        (WebCore::DragController::dragOperation):
+        * page/qt/DragControllerQt.cpp:
+        * page/win/DragControllerWin.cpp:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/win/FrameWin.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventOffsetToThumb):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setVerticalAlignLength):
+        (WebCore::InheritedFlags::setUnicodeBidi):
+        (WebCore::InheritedFlags::setCursor):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+        * rendering/style/SVGRenderStyleDefs.h:
+        * rendering/style/StyleInheritedData.h:
+        (WebCore::StyleInheritedData::operator!=):
+        * storage/DatabaseTask.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.h:
+        * svg/SVGClipPathElement.h:
+        * svg/SVGElementInstance.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::build):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::build):
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::build):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::build):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::build):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::build):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGFESpotLightElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::build):
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::parseMappedAttribute):
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        (WebCore::):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+        (WebCore::SVGPathParser::calculateArc):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGSVGElement.h:
+        * svg/SVGSetElement.h:
+        * svg/SVGSwitchElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::parseMappedAttribute):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::):
+        * svg/SVGViewSpec.cpp:
+        (WebCore::):
+        * svg/animation/SMILTime.cpp:
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        * svg/animation/SVGSMILElement.h:
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::clientMap):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::value):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::value):
+        * workers/WorkerRunLoop.cpp:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XPathPath.h:
+
+2009-07-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7049066>.
+        Update SnowLeopard media controller layout.
+
+        * css/mediaControlsQT.css:
+            Update for new layout.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::movieLoadType):
+            Added to replace isStreaming.
+        * html/HTMLMediaElement.h:
+            Declare movieLoadType, remove isStreaming.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlStatusDisplayElement::update):
+            Use movieLoadType instead of isStreaming.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
+            MediaControlElement is the base class, not HTMLInputElement.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded):
+            Ditto.
+        (WebCore::MediaControlRewindButtonElement::rendererIsNeeded):
+            Don't display rewind button for live streams.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded):
+            MediaControlInputElement is the base class, not HTMLInputElement.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            New, return wkDrawMediaUIPart flags.
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+            Use getMediaUIPartStateFlags.
+
+2009-07-10  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Added build stuff and stub for the ValidityState class, part of HTML5
+        section Forms:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+
+        Test: fast/forms/ValidityState-001.html
+
+        * DerivedSources.cpp: Fix aimed to include ValidityState files
+        * DerivedSources.make: ditto
+        * GNUmakefile.am: ditto
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * html/HTMLButtonElement.idl: "validity" attribute
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp: object getter
+        (WebCore::HTMLFormControlElement::validity):
+        * html/HTMLFormControlElement.h: ditto
+        * html/HTMLInputElement.idl: "validity" attribute
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl: ditto
+        * html/ValidityState.cpp: Added.
+        (WebCore::ValidityState::ValidityState):
+        (WebCore::ValidityState::valid): validation flag
+        * html/ValidityState.h: Added.
+        (WebCore::ValidityState::create): creation routine
+        (WebCore::ValidityState::control): ValidityState's parent getter
+        (WebCore::ValidityState::valueMissing): validation flag
+        (WebCore::ValidityState::typeMismatch): ditto
+        (WebCore::ValidityState::patternMismatch): ditto
+        (WebCore::ValidityState::tooLong): ditto
+        (WebCore::ValidityState::rangeUnderflow): ditto
+        (WebCore::ValidityState::rangeOverflow): ditto
+        (WebCore::ValidityState::stepMismatch): ditto
+        (WebCore::ValidityState::customError): ditto
+        * html/ValidityState.idl: Added.
+
+2009-07-10  Brady Eidson  <beidson@apple.com>
+
+        Style cleanup over my last patch.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-07-10  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::dynamicGlobalObject):
+        * inspector/JavaScriptCallFrame.h: New helper method, used below.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::detach): In the special case
+        where we detach from a window currently executing JavaScript,
+        manually tear down our representation of the JavaScript
+        call stack, since we won't get any more callbacks from JavaScriptCore
+        to automatically tear it down. It's too bad that WebCore is
+        responsible for this kind of tracking -- in the future, it would
+        be nice if more of the breakpoint handling was inside of JavaScriptCore.
+
+2009-07-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
+        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+
+        With this test we ended up going over the maximum-connections-per-host limit that CFNetwork expected.
+        When that happened, the first request that was over the limit ended up in a bizarre state where it 
+        wasn't fully serviced until after the long running XHR was complete.
+
+        Loader and Loader::Host work together to try to not exceed the max-connection limit but non-cache
+        resources - such as XHR - could still end up causing this limit to be exceeded.
+
+        This fix adds a workaround specifically for XHR while we hash out a more thorough solution that will
+        handle this at the resource handle level.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::Host::Host):
+        (WebCore::Loader::Host::nonCacheRequestInFlight):
+        (WebCore::Loader::Host::nonCacheRequestComplete):
+        (WebCore::Loader::Host::servePendingRequests): Take nonCacheRequestsInFlight into account.
+        * loader/loader.h:
+        (WebCore::Loader::Host::processingResource): Take nonCacheRequestsInFlight into account.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): 
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Bump the nonCacheRequestInFlight count.
+        (WebCore::XMLHttpRequest::didFail): Decrement that count if the Loader was notified.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+
+2009-07-10  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak non-Mac build.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::formDidFocus):
+        (WebCore::ChromeClient::formDidBlur):
+
+2009-07-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        The rest of the fix for <rdar://problem/7038831> REGRESSION (TOT): 
+        In Mail, a crash occurs at WebCore::Widget::afterMouseDown() after 
+        clicking To Do's close box
+
+        Make the Widget* in passMouseDownEventToWidget() a RefPtr.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+
+2009-07-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        rename getDOMStructure calls w/o JSGlobalObject* to deprecatedGetDOMStructure
+        https://bugs.webkit.org/show_bug.cgi?id=27157
+
+        This is the first step to fixing
+        https://bugs.webkit.org/show_bug.cgi?id=27088
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGetDOMStructure):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::JSRGBColor::JSRGBColor):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::RuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+
+2009-07-10  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add delegate methods about focus and blur and state change
+        https://bugs.webkit.org/show_bug.cgi?id=27153
+
+        Call the appropriate new ChromeClient methods for focus and blur.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
+        * html/HTMLFormControlElement.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::formDidFocus):
+        (WebCore::EmptyChromeClient::formDidBlur):
+        * page/ChromeClient.h:
+
+2009-07-10  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/7048741> REGRESSION: Error about missing SwMenuX.dll opening pages with Shockwave
+        
+        Use altered search path while loading plug-ins. This modifies the DLL search order
+        to look in the directory containing the plug-in even if a call to SetDllDirectory
+        was previously made. Use of SetDllDirectory removes the current directory from the search path,
+        breaking the previous strategy for locating any dependent DLLs of the plug-in.
+        
+        Reviewed by Jon Honeycutt.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): Use LoadLibraryEx with LOAD_WITH_ALTERED_SEARCH_PATH
+
+2009-07-10  Adam Roben  <aroben@apple.com>
+
+        Sort all our Xcode projects
+
+        Accomplished using sort-Xcode-project-file.
+
+        Requested by Dave Kilzer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-07-10  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: use disabled images for disabled widgets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27106
+
+        Previously, checkboxes and radio controls rendered the same even if disabled.
+        The Chromium side of this change is r20224.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+
+2009-07-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix crash when changing the zoom level in http://iphone.akamai.com/
+        <rdar://problem/7029077>
+
+        RenderLayerBacking's paintIntoLayer() method called updateLayerListsIfNeeded(),
+        which could potentially destroy that compositing layer, causing a crash.
+        Prevent this from happening by not doing a compositing update from paintIntoLayer().
+
+        The existing updateLayerListsIfNeeded() was renamed to updateCompositingAndLayerListsIfNeeded(),
+        and still does the compositing update. The new updateLayerListsIfNeeded() does not touch
+        compositing layers, and is still called from paintIntoLayer().
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateLayerListsIfNeeded):
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
+        * rendering/RenderLayer.h:
+
+2009-07-10  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        Need to remove UsesManualToJSImplementation() in favor of CustomToJS.
+        https://bugs.webkit.org/show_bug.cgi?id=27010
+
+        Added support for CustomToJS IDL attribute to replace the hard-coded class list in UsesManualToJSImplementation().
+
+        This is just a cleanup of existing functionality, so existing LayoutTests adequately cover this patch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Removed UsesManualToJSImplementation(), added support for CustomToJS attribute.
+        * css/CSSRule.idl:
+        * css/CSSValue.idl:
+        * css/StyleSheet.idl:
+        * dom/Document.idl:
+        * dom/Event.idl:
+        * dom/Node.idl:
+        * html/ImageData.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGPathSeg.idl:
+        Added CustomToJS attribute to all the above IDL files.
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        - fix the build by reverting the ill-advised r45711
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+
+2009-07-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Updated WebCore.base.exp to add some needed functions.
+
+        * WebCore.base.exp:
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        - address a review comment from Simon Fraser which I forgot to include
+          in the last check-in
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor): Pass true to getRect() for
+        maximum transform friendliness!
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=27137
+          <rdar://problem/7043124> REGRESSION (r44311): Reproducible crash due
+          to infinite recursion into FrameLoader::gotoAnchor() ->
+          FrameView::layout()
+
+        Test: fast/loader/goto-anchor-infinite-layout.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Moved the code to update layout,
+        find the renderer to scroll to, and scroll from here to methods on
+        FrameView, and replaced it with a call to
+        FrameView::maintainScrollPositionAtAnchor().
+        (WebCore::FrameLoader::completed): Call maintainScrollPositionAtAnchor()
+        instead of setLockedToAnchor().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Removed initialization of
+        m_lockedToAnchor.
+        (WebCore::FrameView::reset): Reset m_maintainScrollPositionAnchor instead
+        of m_lockedToAnchor.
+        (WebCore::FrameView::layout): Removed the code related to scrolling to
+        the anchor from here, because scrolling can trigger events which
+        invalidate the layout, and as such, belongs with the post-layout tasks.
+        (WebCore::FrameView::maintainScrollPositionAtAnchor): Added. When called
+        with a node scrolls the view to the top of that node and maintains it
+        scrolled to the top of the node during subsequent layouts, until
+        this function is called with 0 or other things trigger scrolling.
+        (WebCore::FrameView::scrollRectIntoViewRecursively): Reset
+        m_maintainScrollPositionAnchor.
+        (WebCore::FrameView::setScrollPosition): Ditto.
+        (WebCore::FrameView::scrollToAnchor): Added. Scrolls to the top of
+        m_maintainScrollPositionAnchor, if it is set.
+        (WebCore::FrameView::performPostLayoutTasks): Call scrollToAnchor().
+        (WebCore::FrameView::setWasScrolledByUser): Reset
+        m_maintainScrollPositionAnchor.
+
+        * page/FrameView.h: Removed lockedToAnchor(), setLockedToAnchor(),
+        and m_lockedToAnchor. Added maintainScrollPositionAtAnchor() and
+        m_maintainScrollPositionAnchor.
+
+2009-07-04  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26439
+
+        QtWebKit fails in loading www.nytimes.com in Windows/Linux
+
+        QNetworkReplyHandler is ignoring content associated with 401 error.
+        This causes the XHR response handling to fail.
+
+        Simon: Added also ProxyAuthenticationRequiredError, to handle the same
+        case when going through proxies, as suggested by Prasanth.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Enable HTML 5 Messaging to fix message channel Qt DRT failures in
+        fast/events.
+
+        * WebCore.pro:
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        added InlineBox::isLeaf()
+        firstLeafChild()/lastLeafChild() not virtual and not callable on InlineBox anymore.
+        firstLeafChild()/lastLeafChild() will no longer return a node outside of the given subtree.   
+        Removed firstLeafChildAfterBox()/lastLeafChildBeforeBox()
+        Removed potentially quadratic behavior if all nodes before/after a given box are empty InlineFlowBoxes
+
+        Currently, these methods are called on RootInlineBox objects only, so above changes should not have
+        any observable effect (only the removal of the square performance behavior could apply, 
+        but the conditions for that are probably of a rather theoretical nature).
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nextLeafChild):
+        (WebCore::InlineBox::prevLeafChild):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::isLeaf):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::firstLeafChild):
+        (WebCore::InlineFlowBox::lastLeafChild):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::firstChild):
+        (WebCore::InlineFlowBox::lastChild):
+        (WebCore::InlineFlowBox::isLeaf):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForXPos):
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added InlineBox::baselinePosition() and lineHeight() methods
+        (adapted remaining code accordingly to use those methods)
+
+        No change in functionality.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::baselinePosition):
+        (WebCore::InlineBox::lineHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+
+2009-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 27142 - canPlayType() should return empty string for unsupported content
+        <https://bugs.webkit.org/show_bug.cgi?id=27142>
+
+        Return "" instead of "no" for unsupport media types. 
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement the part of HTML5 spec that deals with parsing of <rp> and <rt> tags
+        in that their end tags are optional if followed by <rp>/<rt>.
+
+        Also specify a new accessibility role "annotation" for <rp> and <rt>.
+
+        Affected code parts are not enclosed in #IF ENABLE(RUBY), since the parsing
+        is not affected by whether ruby is rendered properly or not (in fact, it may 
+        be more profound without ruby layouting, since the contents of <rp> are not hidden).
+
+        Test: fast/ruby/parse-rp.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::endTagRequirement):
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::rpCreateErrorCheck):
+        (WebCore::HTMLParser::rtCreateErrorCheck):
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLParser.h:
+        * html/HTMLTagNames.in:
+
+2009-07-09  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fix for previous commit.
+
+        The change http://trac.webkit.org/changeset/45695 did not correctly
+        enabled GTL and QT build flags. This caused layout tests failure.
+        This is speculative fix for those failures.
+
+        * GNUmakefile.am: added ENABLE_CHANNEL_MESSAGING flag.
+        * WebCore.pro: ditto.
+        * page/DOMWindow.idl: touched to cause recompile.
+        * workers/WorkerContext.idl: ditto.
+
+2009-07-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26903
+
+        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
+        is now implemented for Web Workers and is reasonably stable.
+
+        Tests: fast/events/message-channel-gc-2.html
+               fast/events/message-channel-gc-3.html
+               fast/events/message-channel-gc-4.html
+               fast/events/message-channel-gc.html
+               fast/events/message-channel-listener-circular-ownership.html
+               fast/events/message-port-clone.html
+               fast/events/message-port-constructor-for-deleted-document.html
+               fast/events/message-port-deleted-document.html
+               fast/events/message-port-deleted-frame.html
+               fast/events/message-port-inactive-document.html
+               fast/events/message-port-no-wrapper.html
+               fast/events/message-port.html
+               fast/workers/worker-cloneport.html
+               fast/workers/worker-messageport-gc.html
+               fast/workers/worker-messageport.html
+
+        * Configurations/FeatureDefines.xcconfig: Turned on ENABLE_CHANNEL_MESSAGING.
+        * WebCore/WebCore.vcproj/WebCoreCommon.vsprops: ditto.
+        * WebCore/WebCore.vcproj/build-generated-files.sh: ditto.
+        * WebCore/page/DOMWindow.idl: touch the file to cause re-generation of headers.
+        * WebCore/workers/WorkerContext.idl: ditto.
+
+
+2009-07-09  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Full page zoom breaks remaining and elapsed time display in the <video> controller.
+        https://bugs.webkit.org/show_bug.cgi?id=27123
+
+        We are changing the size of the time remaining and time elapsed field, to
+        automatically hide them, when the controller is too short.
+
+        Because we toggle the size between 0 and the previous value of the
+        controller, we miss any width change that may occur during full page zoom,
+        and we fail to restore a correct width.
+
+        This change fixes that problem by using a cloned style on which we
+        set the width to 0, and restoring the previous style when going back to
+        the normal width.
+
+        We take care about properly using the cloned style or the pseudo style,
+        by overriding styleForElement().
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::styleForElement):
+        (WebCore::MediaControlElement::attach):
+        (WebCore::MediaControlElement::updateStyle):
+        (WebCore::MediaControlInputElement::styleForElement):
+        (WebCore::MediaControlInputElement::attach):
+        (WebCore::MediaControlInputElement::updateStyle):
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+        (WebCore::MediaControlTimeDisplayElement::styleForElement):
+        (WebCore::MediaControlTimeDisplayElement::setVisible):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::shouldShowTimeDisplayControls): Make sure
+        we take in account the zoom level when deciding if we should hide the 
+        ellapsed and remaining time.
+
+2009-07-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix chromium build bustage due to Widget being a RefCounted class.
+        https://bugs.webkit.org/show_bug.cgi?id=27139
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27130 - Need to implement ARIA role="toolbar"
+        https://bugs.webkit.org/show_bug.cgi?id=27130
+
+        Test: platform/mac/accessibility/aria-toolbar.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Upstream WebCore.gypi, the project file for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=27135
+
+        * WebCore.gypi: Added.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        A more robust fix for <rdar://problem/6930280> Reproducible crash at
+        USA Today photo gallery
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginMessageThrottlerWin.cpp:
+        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
+        Protect the PluginView from destruction before calling its window proc.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/6978804> WER #16: Repro Access Violation in
+        WebCore::PluginView::bindingInstance (1310178023)
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::bindingInstance):
+        Protect the PluginView from destruction before calling NPN_GetValue. If
+        the renderer for the PluginView was destroyed during the call, and the
+        PluginView's ref count is now 1, return null.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/6991251> WER #13: Crash in
+        WebKit!WebCore::PluginView::performRequest+203 (1311461169)
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+        Protect the PluginView from destruction before performing a load.
+        Removed some trailing whitespace.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Build fix.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+
+2009-07-09  Beth Dakin and Jon Honeycutt <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make Widget RefCounted to fix or make fixable:
+
+        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs 
+        at WebCore::Widget::afterMouseDown() after clicking To Do's close 
+        box
+        <rdar://problem/6978804> WER #16: Repro Access Violation in 
+        WebCore::PluginView::bindingInstance (1310178023)
+        -and-
+        <rdar://problem/6991251> WER #13: Crash in WebKit!
+        WebCore::PluginView::performRequest+203 (1311461169) 
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::createPlugin):
+        Changed to return PassRefPtr
+        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
+        Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        Make the widget variable a RefPtr. Use .get() when passing it to
+        RenderPart::setWidget().
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        Make the widget variable a RefPtr.
+
+        * loader/FrameLoader.h:
+        Changed the return type of createJavaAppletWidget().
+
+        * loader/FrameLoaderClient.h:
+        Change the return types of createPlugin() and 
+        createJavaAppletWidget().
+
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        No need to call .get() since setWidget() takes a RefPtr.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        children() now returns a HashSet of RefPtrs.
+
+        * page/FrameView.h:
+        Remove inheritance from RefCounted; we pick this up from ScrollView
+        through Widget.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::addChild):
+        addChild() now takes a PassRefPtr and m_children now keeps a 
+        HashSet of RefPtrs.
+
+        * platform/ScrollView.h:
+        ScrollView constructor is now protected.
+        (WebCore::ScrollView::children):
+        m_children is now a HashSet of RefPtrs.
+
+        * platform/Scrollbar.h:
+        Remove inheritance from RefCounted; we pick this up from ScrollView
+        through Widget.
+
+        * platform/Widget.h:
+        Inherit from RefCounted. Cleaned up some whitespace. Make m_widget 
+        a RefPtr.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::create):
+        Adopt the PluginView when returning it.
+
+        * plugins/PluginView.h:
+        Changed create() to return a PassRefPtr.
+
+        * rendering/RenderApplet.cpp:
+        Receive result in a RefPtr when calling createJavaAppletWidget().
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::setWidget): 
+        setWidget() now takes a PassRefPtr. Also removed the manual ref of 
+        FrameViews. This is handled by having m_widget be a RefPtr. Removed 
+        deleteWidget().
+
+        * rendering/RenderPart.h:
+        Removed override of deleteWidget().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+        (WebCore::RenderWidget::setWidget):
+        (WebCore::RenderWidget::paint):
+        (WebCore::RenderWidget::setOverlapTestResult):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        Use .get().
+        (WebCore::RenderWidget::clearWidget):
+        Don't call deleteWidget(). It was removed. 
+
+        * rendering/RenderWidget.h:
+        Removed deleteWidget(). Made m_widget a RefPtr.
+        (WebCore::RenderWidget::widget):
+        Use .get().
+
+2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27129 - AX: possible assertion for a non-native image in accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=27129 
+
+        It's possible for an image that is not really an image to assert, because its renderer
+        is turned into a RenderImage.
+
+        Test: accessibility/non-native-image-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix for SnowLeopard.
+        
+        Avoid using the contentsTransform methods if not on Leopard, because
+        we don't need to call them.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateContentsTransform):
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer setNeedsDisplayInRect:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer setNeedsDisplayInRect:]):
+
+2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Improve the appearance of text in compositing layers when -[CALayer geometryFlipped]
+        is not available.
+        <rdar://problem/6120614>
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsOrientation):
+        (WebCore::GraphicsLayer::contentsOrientation):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        Add a m_contentsOrientation member and getter/setter to control whether
+        the contents of this layer have a transform applied to them before display.
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        New method to return the default contents orientation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::flipTransform):
+        Convenience method to return a transform with a Y flip.
+
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::setSize):
+        After the size changes we have to update the contentsTransform.
+
+        (WebCore::GraphicsLayerCA::setGeometryOrientation):
+        (WebCore::GraphicsLayerCA::geometryOrientation):
+        If -setGeometryFlipped: is not available, use a children transform.
+        
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        Tiled layers have issues with flipped contentsTransform, so just use
+        top-down drawing for them. Call updateContentsTransform() to set the
+        new contents transform after swapping layers.
+        
+        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
+        Use bottom-up when -geometryFlipped is not available, otherwise top-down.
+        
+        (WebCore::GraphicsLayerCA::updateContentsTransform):
+        Set the layer contents transform based on contentsOrientation().
+
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        We have to manually flip contents layers if we're not using -geometryFlipped.
+        
+        * platform/graphics/mac/WebLayer.h:
+        * platform/graphics/mac/WebLayer.mm:
+        Do early return if layerContents is nil. Flip the CTM if the layer has
+        bottom-up coordinates, so that CG sees a CTM with no flip.
+        Do the CGContextRestoreGState() after drawing the debug indicator.
+        
+        (-[WebLayer setNeedsDisplayInRect:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer setNeedsDisplayInRect:]):
+        Need to map the dirty rect through the contentsTransform.
+
+2009-07-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6921671> Visit counter shouldn't be incremented by redirects.
+
+        Can't test this functionality with layout tests.
+
+        * WebCore.base.exp:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::recordVisitAtTime):
+        (WebCore::HistoryItem::visited):
+        * history/HistoryItem.h:
+        Only increase visit count if explicitly told to. Now, some visits change last access time,
+        but do not increase visit count.
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7046098> MediaControllerThemeQT requires QuickTime 7.6.3
+
+        Require QuickTime 7.6.3 or higher to enable the new media controller UI.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-07-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Remove incorrect comment.
+
+        * page/MouseEventWithHitTestResults.h:
+
+2009-07-09  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update the V8 bindings codegenerator to use the RGBColor::create
+        method to handle refcounts for RGBColor objects correctly.
+        
+       * bindings/scripts/CodeGeneratorV8.pm: Use RGBColor::create to create RGBColor objects.
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Crash in RenderMedia::styleDidChange.
+        <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
+        media element (RenderMedia::styleDidChange 115)
+
+        Speculative fix for crash in styleDidChange. Null check controller elements before tell
+        them to update style.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+
+2009-07-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Move V8DOMWrapper to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=27121
+
+        * bindings/v8/V8DOMWrapper.cpp: Added.
+        (WebCore::GetToStringName):
+        (WebCore::ConstructorToString):
+        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::domWrapperType):
+        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
+        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+        (WebCore::V8DOMWrapper::isDOMEventWrapper):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        (WebCore::V8DOMWrapper::htmlElementType):
+        (WebCore::V8DOMWrapper::svgElementType):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
+        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8DOMWrapper.h: Added.
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::wrapCPointer):
+        (WebCore::V8DOMWrapper::extractCPointer):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Crash in setFocusedFrame.
+        <rdar://7032869> Crashing in setFocusedFrame on blogger.com.
+
+        Speculative fix for crasher in setFocusedFrame.  Make sure to ref both frames and fire
+        the events only after the local member has been updated.
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Possible crashes when mouse clicks not dispatched because range input destroyed while 
+        thumb is being dragged (e.g. scrub to end of movie)
+        <rdar://problem/7037494> 
+        https://bugs.webkit.org/show_bug.cgi?id=27101
+
+        Some shadow nodes "capture" all mouse events from mouseDown to mouseUp so they continue to 
+        get mouse events even when the mouse is moved outside of the node. This is done by putting
+        EventHandler into a mode where it sends all mouse events to the node regardless of the
+        actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the
+        node is deleted while in this mode, the mouseUp is never sent and EventHandler continues
+        to try to send events to the deleted node. This sometimes results in a crash, and sometimes
+        in a page that doesn't respond to click events.
+
+        Tests: fast/forms/search-delete-while-cancel-button-clicked.html
+               fast/forms/slider-delete-while-dragging-thumb.html
+               media/audio-delete-while-slider-thumb-clicked.html
+               media/audio-delete-while-step-button-clicked.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlSeekButtonElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+        * rendering/MediaControlElements.h:
+            Declare detach().
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+        * rendering/TextControlInnerElements.h:
+            Declare detach().
+
+2009-07-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enter the Frame's context before creating new objects in setContextDebugId.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27112
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2009-07-09  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * WebCore.pro: Add new storage impl files to the build.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Eric Seidel.
+
+        [V8] Move DOM wrapper functions in V8Proxy to V8DOMWrapper
+        https://bugs.webkit.org/show_bug.cgi?id=27107
+
+        This patch is just renaming.  Code motion will occur next.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::enumerateDOMObjectMap):
+        (WebCore::DOMObjectVisitor::visitDOMWrapper):
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::getConstructor):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8Proxy::retrieveWindow):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::installDOMWindow):
+        (WebCore::setDOMExceptionHelper):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::domWrapperType):
+        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
+        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+        (WebCore::V8DOMWrapper::isDOMEventWrapper):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        (WebCore::V8DOMWrapper::htmlElementType):
+        (WebCore::V8DOMWrapper::svgElementType):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
+        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::wrapCPointer):
+        (WebCore::V8DOMWrapper::extractCPointer):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::toV8):
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGPODTypeUtil::toSVGPODType):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        (WebCore::storageGetter):
+        (WebCore::storageSetter):
+        (WebCore::storageDeleter):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make sure we can click outside the slider thumb and start dragging.
+        https://bugs.webkit.org/show_bug.cgi?id=26229
+
+        Previously we were assuming that if the thumb hasn't been clicked, we
+        wouldn't issue any value change upon dragging.
+
+        We need to handle the two different cases:
+        - Clicked in the thumb, we need to make sure the cursor is always pointing
+        the same slider thumb point.
+        - Clicked outside, the cursor should always be pointing to the center of
+        the thumb.
+
+        For simplicity, we don't remember the original point of the mouse down,
+        but a vector between that point and the thumb.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::SliderThumbElement):
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::mouseEventVectorToThumb): Utility function.
+        * rendering/RenderSlider.h:
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27100
+        <rdar://problem/7042621>
+
+        Don't display "loading" in the <video> controller when
+        there is no src specified.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlStatusDisplayElement::update): The only
+        way to find out if we have an element is currentSrc(). networkState()
+        will always report LOADING according to the spec.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Move V8GCController functions to their own file
+        https://bugs.webkit.org/show_bug.cgi?id=27102
+
+        * bindings/v8/V8GCController.cpp: Added.
+        * bindings/v8/V8GCController.h: Added.
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-08  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Split StorageArea and StorageNamespace into an interface and implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=27072
+
+        I need to split StorageNamespace and StorageArea into an interface and
+        implementation.  In a later patch, I'll implement a proxy interface
+        that'll run inside the Chromium renderer process.
+
+        Additionally, fix the alphabetical ordering of files I recently added
+        in the project files.
+
+        This is a continuation of other refactoring work:
+        https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::~StorageArea):
+        * storage/StorageAreaImpl.cpp: Copied from WebCore/storage/StorageArea.cpp.
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        (WebCore::StorageAreaImpl::length):
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::getItem):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        (WebCore::StorageAreaImpl::contains):
+        (WebCore::StorageAreaImpl::importItem):
+        (WebCore::StorageAreaImpl::securityOrigin):
+        (WebCore::StorageAreaImpl::close):
+        (WebCore::StorageAreaImpl::blockUntilImportComplete):
+        (WebCore::StorageAreaImpl::dispatchStorageEvent):
+        * storage/StorageAreaImpl.h: Copied from WebCore/storage/StorageArea.h.
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+        * storage/StorageNamespaceImpl.cpp: Copied from WebCore/storage/StorageNamespace.cpp.
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h: Copied from WebCore/storage/StorageNamespace.h.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Move garbage collector related functions from V8Proxy to V8GCController
+        https://bugs.webkit.org/show_bug.cgi?id=26967
+
+        This patch just moves the functions around in V8Proxy.  We'll actually
+        move them to a separate file in another patch.
+
+        * bindings/v8/NPV8Object.cpp:
+        (freeV8NPObject):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8GCController::registerGlobalHandle):
+        (WebCore::V8GCController::unregisterGlobalHandle):
+        (WebCore::V8GCController::gcProtect):
+        (WebCore::V8GCController::gcUnprotect):
+        (WebCore::V8Proxy::destroyGlobal):
+        (WebCore::V8Proxy::updateDocumentWrapper):
+        (WebCore::V8Proxy::clearDocumentWrapper):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+
+2009-07-08  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26918
+        
+        Prevents injection of HTML Base tag.
+
+        Tests: http/tests/security/xssAuditor/base-href-control-char.html
+               http/tests/security/xssAuditor/base-href-null-char.html
+               http/tests/security/xssAuditor/base-href-safe.html
+               http/tests/security/xssAuditor/base-href-safe2.html
+               http/tests/security/xssAuditor/base-href-scheme-relative.html
+               http/tests/security/xssAuditor/base-href.html
+
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseMappedAttribute):
+        (WebCore::HTMLBaseElement::process): Modified to call XSSAuditor::canSetBaseElementURL
+        to determine if it is safe to use base element URL.
+        * html/HTMLBaseElement.h: Added field m_hrefAttrValue to store unparsed base element URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        * page/XSSAuditor.h:
+
+2009-07-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 npruntime bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27094
+
+        * bindings/v8/npruntime.cpp: Upstreamed from src.chromium.org.
+        (StringKey::operator==):
+        (StringKey::StringKeyHash::hash):
+        (StringKey::StringKeyHash::equal):
+        (StringKeyHashTraits::constructDeletedValue):
+        (StringKeyHashTraits::isDeletedValue):
+        (getStringIdentifierMap):
+        (getIntIdentifierMap):
+        * bindings/v8/npruntime_impl.h: Upstreamed from src.chromium.org.
+        * bindings/v8/npruntime_internal.h: Upstreamed from src.chromium.org.
+        * bindings/v8/npruntime_priv.h: Upstreamed from src.chromium.org.
+
+2009-07-08  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Extending the PlatformFileHandle definition from PLATFORM(WIN) to
+        PLATFORM(WIN_OS)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27013
+
+        * platform/FileSystem.h:
+
+2009-07-08  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27071
+        
+        Resolves issue when HTTP parameters contain null- and  non-null-control- characters.
+
+        Tests: http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html
+               http/tests/security/xssAuditor/embed-tag-control-char.html
+               http/tests/security/xssAuditor/embed-tag-null-char.html
+               http/tests/security/xssAuditor/embed-tag.html
+               http/tests/security/xssAuditor/link-onclick-control-char.html
+               http/tests/security/xssAuditor/link-onclick-null-char.html
+               http/tests/security/xssAuditor/object-embed-tag-control-char.html
+               http/tests/security/xssAuditor/object-embed-tag-null-char.html
+               http/tests/security/xssAuditor/object-embed-tag.html
+               http/tests/security/xssAuditor/object-tag.html
+               http/tests/security/xssAuditor/script-tag-post-control-char.html
+               http/tests/security/xssAuditor/script-tag-post-null-char.html
+               http/tests/security/xssAuditor/script-tag-with-source-control-char.html
+               http/tests/security/xssAuditor/script-tag-with-source-null-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonNullControlCharacter): Called by XSSAuditor::decodeURL.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL): Added parameters matchNullCharacters,
+        and matchNonNullControlCharacters.
+        (WebCore::XSSAuditor::findInRequest): Added parameters matchNullCharacters,
+        and matchNonNullControlCharacters.
+        * page/XSSAuditor.h:
+
+2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add DerivesSourcesAllInOne.cpp to help with release windows compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=27093
+
+        This is specific for v8, no change in behavior.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added.
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27086
+
+        Make sure the Media controller doesn't fade in for no reason.
+        This is happening because a update() call to the controller
+        panel may reset the opacity to 1.0, given that it reloads the
+        style.
+
+        We also add a different fade in and fade out time to soften
+        the fade out effect.
+
+        No test case because this depends on how the movie is loaded.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::updateControlVisibility): Simplify
+        , and make sure we stop the timer if there is no animation
+        to do.
+        (WebCore::RenderMedia::opacityAnimationTimerFired): 
+        * rendering/RenderMedia.h:
+
+2009-07-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27081: Wrap RunLoopTimerCF.cpp in PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27081>
+
+        Reviewed by Timothy Hatcher.
+
+        * platform/cf/RunLoopTimerCF.cpp: This code is only used on
+        Mac OS X when HAVE(RUNLOOP_TIMER) is enabled, so wrap the code
+        in that macro as well.
+
+2009-07-08  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add -[WebView _isProcessingUserGesture]
+        https://bugs.webkit.org/show_bug.cgi?id=27084
+
+        Rename FrameLoader::userGestureHint() to FrameLoader::isProcessingUserGesture()
+        for clarity.
+
+        * WebCore.base.exp: Add WebCore::FrameLoader::isProcessingUserGesture()
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::processingUserGesture):
+        * loader/FrameLoader.cpp: 
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        * loader/FrameLoader.h:
+
+2009-07-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed (an earlier version) by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27090
+        Remove lockBackForwardList argument from HTMLFormElement::submit()
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        * loader/FrameLoader.h:
+        Don't pass lockBackForwardList around when it's known to be false.
+
+2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix V8 idl codegen to use unique constant names
+        <https://bugs.webkit.org/show_bug.cgi?id=27089>
+
+        Embed the interface name in the global constant names so coagulating all
+        the .cc files into one compile unit works with V8 bindings.
+
+        Nothing added; Still compiles and pass tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-07-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: Add missing #includes for Windows (cURL) build.
+        The <winsock2.h> and <windows.h> headers were not being
+        included in Windows cURL builds.
+
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-07-08  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        WebKit needs a style linting tool
+        https://bugs.webkit.org/show_bug.cgi?id=25884
+
+        Fix bunch of style issues in WebCore/rendering.
+        This patch is created to demonstrate cpplint.py.
+
+        No testcase because it's just a style fixes.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderArena.cpp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::newLine):
+        (WebCore::RenderBlock::floatBottom):
+        (WebCore::RenderBlock::leftBottom):
+        (WebCore::RenderBlock::rightBottom):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::layoutLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexBoxIterator::FlexBoxIterator):
+        (WebCore::FlexBoxIterator::reset):
+        (WebCore::FlexBoxIterator::first):
+        (WebCore::FlexBoxIterator::next):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::borderStartEdgeColor):
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateVisibilityStatus):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::panScroll):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::updateMarqueeStyle):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::localCaretRect):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::outerBorderBottom):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::supportsFocusRing):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addStackContent):
+        * rendering/SVGCharacterLayoutInfo.h:
+        * rendering/TextControlInnerElements.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+
+2009-07-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Reduce complexity of lifetime management in DynamicNodeList caches
+        <https://bugs.webkit.org/show_bug.cgi?id=27068>
+
+        Switch the Cache object used by DynamicNodeList into a normal
+        refcounted object rather than having a weird flag controlled
+        refcounting system, where positive refcount did not automatically
+        imply the cache object would actually still be live.
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::~DynamicNodeList):
+        (WebCore::DynamicNodeList::Caches::Caches):
+        (WebCore::DynamicNodeList::Caches::create):
+        * dom/DynamicNodeList.h:
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::NodeListsNodeData):
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        -webkit-perspective should be a Length
+        https://bugs.webkit.org/show_bug.cgi?id=27066
+        
+        -webkit-perspective should not take a magic valueless number, but should
+        be a normal Length value which responds to zooming. Treat valueless numbers
+        as pixels for backward compatibility.
+        
+        Test: transforms/3d/general/perspective-units.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-07-07  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27047
+
+        We need to make sure that when we reattach, we also reattach
+        the children in every MediaControlElement. Else we may end up
+        having no remaining or elapsed time.
+
+        We have to handle that, because we are using a special shadow
+        tree in the DOM, and that we are ourselves handling
+        attaching/detaching the renderer.
+
+        The strategy here is to try to implement ::attach(), and try
+        to reuse as much code as we can from the super class, including
+        children attachement.
+
+        Test: media/controls-after-reload.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::styleForElement): Code factoring.
+        (WebCore::MediaControlElement::rendererIsNeeded): Code factoring.
+        (WebCore::MediaControlElement::attach): Implement attach
+        and call super class so that children are also attached.
+        (WebCore::MediaControlElement::updateStyle): Use attach()
+        (WebCore::MediaControlInputElement::styleForElement): Code factoring.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Code factoring.
+        (WebCore::MediaControlInputElement::attach): See above.
+        (WebCore::MediaControlInputElement::updateStyle): Use attach()
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls): Directly run attach() on
+        the m_panel, which is a root node for our shadow tree.
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Repaint issue after layer drops out of composited mode.
+        <https://bugs.webkit.org/show_bug.cgi?id=27022>
+
+        RenderLayers cache repaint rects in the form of m_repaintRect and m_outlineBox,
+        and expect these to stay valid from one style change to the next. These rects
+        are relative to the repaint container, so if a layer stops being composited,
+        we need to recompute them.
+        
+        Test: compositing/repaint/layer-repaint-rects.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeRepaintRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
+          <rdar://problem/7030998> Reproducible crash at
+          FontCache::getFontData() when a custom font is used in a pseudo-style
+
+        Test: fast/css/pseudo-cache-stale.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
+        style and the new style, goes over cached pseudo-styles in the old
+        style and re-resolves the same style types off the new style. If any of
+        the new pseudo-styles is different from the currently cached
+        corresponding style, returns true. Otherwise, returns false.
+        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
+        deciding to keep the existing style.
+        * dom/Element.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
+        returns an uncached first-line style based off the given style.
+        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
+        parameter.
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
+        pseudo-styles in the passed-in vector.
+        * rendering/style/RenderStyle.h:
+
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=27042
+          <rdar://problem/7010981> Incomplete painting of newly created floats
+
+        Tests: fast/repaint/float-in-new-block-with-layout-delta.html
+               fast/repaint/float-new-in-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren): If the child has never been
+        laid out before, paint its overhanging floats in addition to itself.
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): Added and
+        initialized a boolean everHadLayout member.
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Paint floats that have
+        never been laid out before and did not move from (0, 0).
+
+2009-07-07  Brady Eidson  <beidson@apple.com>
+
+        Contributions from both Darin Adler and Brady Eidson.
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7024039> REGRESSION (r42158): Back-forward navigation does not work correctly on nytimes.com
+
+        In r42158 we lost some exclusions to making back/forward items for subframe navigations when a main frame
+        navigation was still in progress.
+
+        This patch makes things even better than it used to be by:
+        - Locking back/forward history at the time the navigation is scheduled, not after the load has committed.
+        - Locking back/forward history if *any* ancestor frame is still loading instead of just the main frame.
+
+        Test: fast/loader/subframe-navigate-during-main-frame-load.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Move out the history locking logic into a standalone function so it can be
+          used from multiple sites.
+        (WebCore::mustLockBackForwardList): Returns true if any ancestor frame is still loading.
+        (WebCore::FrameLoader::scheduleLocationChange): Respect mustLockBackForwardList() in addition to the passed in
+          lockBackForwardList flag.
+        (WebCore::FrameLoader::scheduleFormSubmission): Ditto.
+
+2009-07-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream DOMObjectsInclude.h from src.chromium.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27035
+
+        * bindings/v8/DOMObjectsInclude.h: Added.
+
+2009-07-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Relanding r45559, which was rolled back at r45574.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm: Updated a function name in auto-generated bindings.
+        * bindings/v8/V8Binding.cpp: Moved from src.chromium.org.
+        * bindings/v8/V8Binding.h: Contents moved from src.chromium.org.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-07  Gregory Hughes  <gfhughesVO+webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        AX: Some webpages do not send AXLoadComplete
+        https://bugs.webkit.org/show_bug.cgi?id=26995
+
+        When sending the AXLayoutComplete notification it is possible
+        that the AXObjectCache was cleared, resulting in no valid
+        object to send the notification to. This fix ensures that an
+        AX object is created and cached if one does not already exist.
+
+        Not able to add a test because notifications get sent after the layout test is completed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2009-07-06  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27015
+
+        Make sure that the CSS properties letter-spacing, word-spacing,
+        line-height, text-transform, text-indent, text-shadow,
+        text-decoration and color do not affect the media element controls,
+        that display text.
+
+        Controls that display text are only present in when the theme
+        MediaControllerThemeQT is being used.
+
+        Test: media/controls-styling.html
+
+        * css/mediaControlsQT.css:
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::updateStyle): Special case for
+        text-decoration. text-decoration can't be overriden from CSS, because
+        text-decoration is additive for historical reasons.
+
+2009-07-07  Albert Wong  <ajwong@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        Add in missing header fix syntax issue that crept into last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=27027
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make use of geometry information to decide which layers become composited.
+
+        <rdar://problem/7011947>
+        <https://bugs.webkit.org/show_bug.cgi?id=27021>
+        
+        In addition to looking at painting order, also, optionally, take layer
+        overlap into account when deciding which RenderLayers need to be composited.
+
+        No testcase because DRT doesn't dump which layers are composited.
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        Removed the unused CompositingUpdate parameter, and just do an early return
+        when there is no view.
+        
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyNormalFlowList):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::mustOverlapCompositedLayers):
+        (WebCore::RenderLayer::setMustOverlapCompositedLayers):
+        Change "overlay" to "overlap" for consistency with the use of "overlap"
+        elsewhere.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        compositingLayersNeedUpdate() renamed to compositingLayersNeedRebuild().
+        
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Tell the compositor that we started an accelerated animation or transition.
+        
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::compositingLayersNeedRebuild):
+        Renamed, since it's explicitly about changes in hierarchy now.
+        
+        (WebCore::RenderLayerCompositor::setCompositingConsultsOverlap):
+        (WebCore::RenderLayerCompositor::compositingConsultsOverlap):
+        New getter and setter for whether compositing should take overlap into account.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        Add m_compositingConsultsOverlap, re-order some member variables.
+        
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        Whitespace cleanup and method rename.
+        
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        Method and variable renaming.
+        
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        Now we have to run through the layer hierarchy every time if looking
+        at overlap, because changes in layout can now alter compositing behavior.
+        We minimize work by tracking whether we actually need to change the layer
+        hierarchy via needLayerRebuild.
+        
+        (WebCore::RenderLayerCompositor::updateBacking):
+        3D transforms turn off overlap mode.
+        
+        (WebCore::RenderLayerCompositor::layerWasAdded):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        Method rename.
+        
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::overlapsCompositedLayers):
+        Utility methods to add a layer to the overlapMap (computing the absolute
+        bounding box only if we haven't already done so), and testing the map
+        entries.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        If a layer would composite only because it comes after other compositing
+        layers in the painting order, then consult the overlap map to determine whether
+        it overlaps, and thus actually needs to composite.
+        
+        Add layers to the map when they must be composited.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        Only do re-parenting work if the updateHierarchy flag is set.
+        
+        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation):
+        When we start an accelerated transition or animation, we stop looking at
+        overlap because we can no longer guarantee correct front-to-back ordering while the
+        accelerated animation is running.
+
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        Method renames.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setMaximalOutlineSize):
+        Add comment indicating that this could be optimized.
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Speed up creation of V8 wrappers for DOM nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26882
+
+        This patch doesn't require new tests as it a set of refactorings
+        to speed up wrapper creation.  
+
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] textarea height property works only if other property are defined
+        https://bugs.webkit.org/show_bug.cgi?id=18984
+
+        Let WebCore handle textarea's metrics instead of readjusting it RenderthemeGtk.
+
+        Test: fast/forms/textarea-metrics.html
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-07-07  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Antti Koivisto.
+
+        HTML5 Database becomes locked if a transaction is in progress when the page is refreshed.
+        https://bugs.webkit.org/show_bug.cgi?id=25711
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25711 where web
+        storage databases could become locked until the browser is shut
+        down if the page is refreshed whilst a transaction is in progress.
+
+        Test: storage/database-lock-after-reload.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::close): add code to inform the database thread we've closed the database.
+        (WebCore::Database::performOpenAndVerify): add code to inform the database thread we've opened a database.
+        * storage/Database.h:
+        (WebCore::Database::opened): return true iff the underlying sqlite database has been opened but not closed.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread): Before the database thread terminates, close any databases that ran transactions in this thread.
+        (WebCore::DatabaseThread::recordDatabaseOpen): Records a database that executed a transaction in this thread.
+        (WebCore::DatabaseThread::recordDatabaseClosed): Removes a database from the set of open databases.
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getThreadID): return the thread id for the database thread.
+
+2009-07-07  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Paste of rich text from firefox results garbled markup
+        https://bugs.webkit.org/show_bug.cgi?id=26791
+
+        Fix problem with UTF-16 clipboard pasted.
+
+        * manual-tests/gtk/paste-richtext-from-firefox.html: Added.
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-07-07  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Change 'Continue debug' shortcut from F5 to F8 for consistency with Firebug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23849
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+
+2009-07-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update RenderThemeChromiumMac for wkDrawMediaUIPart and wkDrawMediaSlider API
+        change.
+
+        Fix compile RenderThemeChromiumMac.mm due to API changes from r45572
+        https://bugs.webkit.org/show_bug.cgi?id=27018
+
+        This is mainly an API change update to fix the chromium compile.  It
+        also has a small fix of a typo in RenderThemeMac.mm.
+
+        Compilation against the head of chromium trunk passed.  Since this is
+        a compile fix, that should be sufficient.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27002: Build fix when DASHBOARD_SUPPORT is disabled with -Wunused-parameter
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27002>
+
+        Reviewed by Geoff Garen.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
+        Mark gradient as an unused parameter when DASHBOARD_SUPPORT is
+        disabled.
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27001: Fix improper use of PassRefPtr<Node> to RefPtr<Node>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27001>
+
+        Reviewed by Geoff Garen.
+
+        PassRefPtr<> should only be used for arguments to functions that
+        take ownership of the object, or as return values from functions
+        that relinquish ownership of the object.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::increaseSelectionListLevelOrdered): Changed
+        stack-allocated PassRefPtr<Node> to RefPtr<Node> and call
+        release() on returned object.
+        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
+
+2009-07-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7035474> Make new media controller UI default on SnowLeopard
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+            New media controller UI is enabled by default on SnowLeopard.
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Roll out r45559 to fix Chromium canary.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp: Removed.
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::fromWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7008093> Media controller can’t be used to scrub when movie is 
+        narrow — track is too narrow
+
+        Do not show media controller time display elements when the a movie is too narrow.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+            Give current time and time remaining controls a common base class.
+        (WebCore::MediaControlTimeDisplayElement::setVisible):
+            New method, hide and show the element.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia):
+            Initialize m_previousVisible.
+        (WebCore::RenderMedia::layout):
+            Show/hide the time display elements as the movie width changes.
+        (WebCore::RenderMedia::createCurrentTimeDisplay):
+        (WebCore::RenderMedia::createTimeRemainingDisplay):
+            Base class is now MediaControlTimeDisplayElement, not MediaControlElement.
+        (WebCore::RenderMedia::shouldShowTimeDisplayControls):
+            New, decide if time display elements should be visible or not.
+        * rendering/RenderMedia.h:
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27000: Minor clean up to runtime_root.{cpp|h}
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27000>
+
+        Reviewed by Geoff Garen.
+
+        * bridge/runtime_root.cpp: Added blank line between license and
+        the first #include statement.
+        * bridge/runtime_root.h: Added comment to #endif.
+
+2009-07-06  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        generalize the special height treatment for SVG (to be re-used for ruby):
+            renamed InlineBox::m_isSVG to m_hasVirtualHeight
+            renamed InlineBox::isSVG() to hasVirtualHeight()
+            renamed InlineBox::setIsSVG() to setHasVirtualHeight()
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isText):
+        (WebCore::InlineBox::setIsText):
+        (WebCore::InlineBox::isSVGRootInlineBox):
+        (WebCore::InlineBox::hasVirtualHeight):
+        (WebCore::InlineBox::setHasVirtualHeight):
+        (WebCore::InlineBox::virtualHeight):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createFlowBox):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootBox):
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::virtualHeight):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::virtualHeight):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::virtualHeight):
+
+2009-07-06  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r45285): focus rings are black on windows safari
+        https://bugs.webkit.org/show_bug.cgi?id=26821
+        <rdar://problem/7018252>
+
+        Add a mechanism for setting a custom focus ring color, and relocate the 
+        determination of focus ring color to base class RenderTheme.
+
+        No new tests.  Already-existing tests run in pixel mode would have caught this regression
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue): Move the responsibility
+        of determining focus color to base class RenderTheme.
+        * rendering/RenderTheme.cpp:
+        (WebCore::customFocusRingColor): Added static local.
+        (WebCore::RenderTheme::setCustomFocusRingColor): Added
+        (WebCore::RenderTheme::focusRingColor): Use custom color over platform color.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::platformFocusRingColor): default implementation, black color
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Circumstances that lead to returning the RenderThemeWin
+        are the same under which we want to use the focus ring color from SafariTheme.
+        (WebCore::RenderThemeSafari::platformFocusRingColor): Renamed from focusRingColor
+        * rendering/RenderThemeSafari.h:
+
+        Renaming focusRingColor to platformFocusRingColor in these files:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::platformFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::platformFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformFocusRingColor):
+
+        Cleanup leftover from removal of WebCore::Color in r45285 in these files:
+        * WebCore.order:
+        * platform/graphics/Color.h:
+
+2009-07-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 15135: REGRESSION (r19843-r19850): Changing a flexbox's
+        contents makes its container scroll to the top
+        https://bugs.webkit.org/show_bug.cgi?id=15135
+
+        Delay updateing scroll bar of descendants of flexbox until their
+        positions are determined.  In this way we can prevent descendants
+        of flexible boxes from changing positions of their scrollbars
+        using tentative positions.
+
+        Test: fast/flexbox/repaint-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-06  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make unconfirmed IME text affect textarea's value.
+        This matches input and contentEditable elements as well
+        IE and Firefox.
+
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=25061.
+
+        Input elements would go down this code path because it
+        would always get a null compositionNode from frame->editor().
+        Special casing compositionNodes is wrong because we explicitly
+        want unconfirmed IME input in the textarea's value (assuming we
+        want to match IE and Firefox here).
+
+        This change is originally created by Ojan Vafai <ojan@chromium.org> and
+        I just changed its manual tests with an automated test on his behalf.
+
+        Test: platform/mac/editing/input/text-control-ime-input.html
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::text):
+        (WebCore::RenderTextControl::textWithHardLineBreaks):
+
+2009-07-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add the ability for wheel events to latch to a node.
+        
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a bunch of layout test crahses in Chromium caused by a bad usage of DEFINE_STATIC_LOCAL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26997
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Use a regular static declaration instead of DEFINE_STATIC_LOCAL.
+
+2009-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: suggest global properties based on async evaluation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26976
+
+        Before this change, empty string was evaluated to the global object
+        (or scope chain object) synchronously. This is now fixed and global
+        object is evaluated using the same control flow.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.completions):
+        (WebInspector.Console.prototype._evalInInspectedWindow):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._variablesInScope):
+
+2009-07-06  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash when indenting in an empty table cell.
+        https://bugs.webkit.org/show_bug.cgi?id=26872
+
+        The crash is that we would call splitTreeToNode where the node
+        and the nodeToSplitTo were the same node.
+
+        Test: editing/execCommand/indent-empty-table-cell.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        Added an assert in that node and nodeToSplitTo
+        are different nodes to make this assumption explicit.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::isAtUnsplittableElement):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Binding and update some function names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm: Update function names in auto-generated files.
+        * bindings/v8/V8Binding.cpp: Upstreamed from src.chromium.org.
+        * bindings/v8/V8Binding.h: Upstreamed from src.chromium.org.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        Use soup's content sniffing
+        https://bugs.webkit.org/show_bug.cgi?id=26982
+
+        Drop our hackish content sniffing code, and use the new libsoup
+        feature to do that job for us.
+
+        Testing this is in a cross-platform way is not obvious or possible
+        while we are using platform-specific code for sniffing.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-05  Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r40499): fast/dom/cssTarget-crash.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=20342
+
+        Re-added code removed by commit r40499.
+        Without this, both Qt and Mac were crashing while running the test.
+
+        Note that this does not entirely fix the bug. It fixes the WebCore
+        crash, but the test no longer seems to work due to loader changes.
+        So this patch does not reenable the test. The test probably has to
+        be rewritten.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removedFromDocument): Re-added code to
+        set the CSS target of the document to 0.
+
+2009-07-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26943
+
+        When one transition finishes slightly before another the longer
+        one will fire a second time. This is because the second
+        ImplicitAnmation object is culled too early, before its final
+        RenderStyle is in place. This is done by cleanupFinishedAnimations()
+        so I got rid of that method completely and now cleanup each
+        transition or animation at the point where I am setting the final
+        style, or when I detect that the transition or animation has been
+        terminated early (which happens when you remove it from the style).
+
+        Test: transitions/extra-transition.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        Avoid a divide by zero if m_animation->duration() is zero, which can happen
+        if the duration is changed to zero while the animation is running.
+
+2009-07-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert the previous commit because it broke the
+        animations/transition-and-animation-1.html
+        testcase.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-07-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26943
+
+        When one transition finishes slightly before another the longer
+        one will fire a second time. This is because the second 
+        ImplicitAnmation object is culled too early, before its final
+        RenderStyle is in place. This is done by cleanupFinishedAnimations()
+        so I got rid of that method completely and now cleanup each 
+        transition or animation at the point where I am setting the final
+        style, or when I detect that the transition or animation has been
+        terminated early (which happens when you remove it from the style).
+
+        Test: transitions/extra-transition.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        Avoid a divide by zero if m_animation->duration() is zero, which can happen
+        if the duration is changed to zero while the animation is running.
+
+2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26843
+
+        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
+
+        The Metrowerks compiler on the Symbian platform moves the globally
+        defined Hashtables into read-only memory, despite one of the members
+        being mutable. This causes crashes at run-time due to write access to
+        read-only memory.
+
+        Avoid the use of const with this compiler by introducing the
+        JSC_CONST_HASHTABLE macro.
+
+        Based on idea by Norbert Leser.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Use JSC_CONST_HASHTABLE for hash tables
+        define in the bindings.
+
+2009-07-05  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26897 - Dynamic SVG images do not display correctly
+        https://bugs.webkit.org/show_bug.cgi?id=26897
+
+        Use repaint() to fix a rendering problem with a SVG image embedded in xhtml.
+
+        Test: svg/custom/createImageElement2.xhtml
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::imageChanged):
+
+2009-07-05  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26960
+        [Gtk] caret offset not updated when selecting text
+
+        Report the caret offset from the end of the selection so it works
+        correctly for multi-char selections too (ie, anything that is not
+        the zero width caret).
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
+
+2009-07-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed link fix for Qt.
+
+        Fix Qt link error by adding two new localized strings
+
+        In r45474 two new strings got added to LocalizedStrings.h add
+        the definition of them to Qt.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+
+2009-07-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r44670-r44680): Typing is suprisingly slow in password field on reddit.com
+        https://bugs.webkit.org/show_bug.cgi?id=26959
+        rdar://problem/7029882
+
+        The code to handle iteration boundaries was malfunctioning when the boundary was
+        at the edge of a shadow tree. This happens all the time with <input> elements.
+
+        It's not immediately obvious how to make a regression test for this since the
+        symptom was a performance problem, not incorrect behavior. I'll add a test if I
+        figure out a way to make one.
+
+        * editing/TextIterator.cpp:
+        (WebCore::parentCrossingShadowBoundaries): Renamed from parentOrShadowParent.
+        (WebCore::depthCrossingShadowBoundaries): Updated for name change.
+        (WebCore::nextInPreOrderCrossingShadowBoundaries): Added.
+        (WebCore::previousInPostOrderCrossingShadowBoundaries): Added.
+        (WebCore::setUpFullyClippedStack): Updated for name change.
+        (WebCore::TextIterator::TextIterator): Updated for name change. Use
+        nextInPreOrderCrossingShadowBoundaries instead of Range::pastLastNode to fix the bug.
+        (WebCore::TextIterator::advance): Updated for name change.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        Tweaked formatting.
+        (WebCore::SimplifiedBackwardsTextIterator::advance): Ditto. Changed code that
+        initializes m_pastStartNode to use previousInPostOrderCrossingShadowBoundaries.
+        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Tweaked formatting.
+        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
+
+2009-07-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Background audio stops playing when JS GC runs
+        https://bugs.webkit.org/show_bug.cgi?id=26956
+        
+        Ensure we keep the Audio object around while it is playing, so that it
+        doesn't get collected.
+        
+        Not testable because there's no way to know whether the audio keeps
+        playing without holding a reference to it.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+
+2009-07-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26814
+        [Gtk] Caret-moved events are not issued for the correct offset
+        when text is selected forward
+
+        Report the caret offset from the end of the selection, otherwise
+        we'll report the same offset when moving the caret while
+        modififying the selection (eg, with Shift Right).
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-07-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26815
+        [Gtk] text-selection-changed events are not issued for the correct
+        object when the selection spans multiple objects
+
+        Get the focused node from the end of the selection, not the start,
+        so we can detect when we cross object boundaries.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26947
+
+        Fix the media controls hit tests. They may lose click events.
+
+        Test cases already covered in the video-controls-zoomed tests.
+
+        Don't trust wkHitTestMediaUIPart for the tests. We are accurate enough.
+
+        * rendering/RenderThemeMac.h: Remove hitTestMediaControlPart.
+        * rendering/RenderThemeMac.mm: Remove hitTestMediaControlPart.
+
+2009-07-02  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RenderBlock and RenderInline have confusingly named object creation methods:
+        RenderBlock::createRootBox/createRootInlineBox
+        RenderInline::createFlowBox/createInlineFlowBox
+        where the 2nd method in both cases just calls the first and then appends the created object.
+        I therefore renamed those methods to something IMHO more informative:
+        
+        createRootBox()         -> createRootInlineBox()
+        createRootInlineBox()   -> createAndAppendRootInlineBox();
+        createFlowBox()         -> createInlineFlowBox();
+        createInlineFlowBox()   -> createAndAppendInlineFlowBox();
+
+        https://bugs.webkit.org/show_bug.cgi?id=26828
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createRootInlineBox):
+        (WebCore::RenderBlock::createAndAppendRootInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineFlowBox):
+        (WebCore::RenderInline::createAndAppendInlineFlowBox):
+        * rendering/RenderInline.h:
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineFlowBox):
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootInlineBox):
+        * rendering/RenderSVGText.h:
+        * rendering/bidi.cpp:
+        (WebCore::createInlineBoxForRenderer):
+
+2009-07-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix typo in the resource panel enabler caption.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26753
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+
+2009-07-02  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        [Win] HTML5 Drag and drop, dragend is not fired when pressing Esc
+        https://bugs.webkit.org/show_bug.cgi?id=26699
+
+        * manual-tests/drag-escape.html: Added.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dragSourceEndedAt):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26944
+
+        Make sure we support full page zoom in video controls.
+
+        This is tracked by a the video-controls-zoom test case.
+
+        * css/mediaControlsQT.css: Make sure we don't have any inherited margin.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::updateStyle): Propagate the style to the innertext.
+        * rendering/RenderThemeMac.mm: Adjust the painting rect.
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Fix the Gtk build after r45474. The localized strings should
+        have been added there.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26939
+
+        Media controller is rendered badly at http://www.mozilla.com/en-US/firefox/video/firefox-3.5.html
+
+        We fix two things:
+        - We use px instead of em, because px is used everywhere else
+        and because 0.09em hit the font size limit.
+        - We use -webkit-box instead of inline-block because in strict mode
+        inline-block has a different behavior.
+
+        Test: media/controls-strict.html
+
+        * css/mediaControlsQT.css:
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        TextIterator should use hasOverflowClip when checking for overflow instead of looking at the style.
+        https://bugs.webkit.org/show_bug.cgi?id=26942
+
+        * editing/TextIterator.cpp:
+        (WebCore::fullyClipsContents):
+
+2009-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/5230700>
+        Remove local .xhtml file workaround
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): Work around is no longer necessary.
+
+2009-07-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Sort, add functions used by WebKit.
+        
+        * WebCore.base.exp:
+
+2009-07-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        More of <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (webNSURLResponseMIMEType): Give Tiger a chance to query the UTI machinery.
+
+2009-07-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: fix complex text rendering with line break characters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26935
+
+        If the CSS white-space property is inhibiting line breaking, we might
+        find end-of-line characters rendered via the complex text path. Fonts
+        don't provide glyphs for these code points so, if we find one, we
+        simulate the space glyph being interposed in this case.  Because the
+        input is variable-length per code point, we walk the input in step
+        with the output.
+
+        Covered by:
+            LayoutTests/fast/text/international/bidi-linebreak-002.html
+            LayoutTests/fast/text/international/bidi-linebreak-003.html
+            LayoutTests/fast/text/international/hindi-whitespace.html
+
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::stringToGlyphs):
+
+2009-07-02  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26521
+        Expose file size to chromium.
+
+        Implement getFileSize() for Chromium.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getFileSize):
+
+2009-07-02  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        * bindings/v8/V8SVGPODTypeWrapper.h: Lost a space in nested template argument list.
+
+2009-07-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: add missing #include.
+
+        * platform/mac/ThemeMac.mm:
+
+2009-07-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7028682> ThemeMac::paintRadio() throws Obj-C exceptions when zoomed
+
+        Add BEGIN_BLOCK_OBJC_EXCEPTIONS/END_BLOCK_OBJC_EXCEPTIONS guards around code
+        that can possibly throw Objective-C exceptions when drawing Mac form controls.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::inflateControlPaintRect):
+
+2009-07-02  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8SVGPODTypeWrapper.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26907
+
+        * bindings/scripts/CodeGeneratorV8.pm: Update function being renamed in V8SVGPODTypeWrapper.h.
+        * bindings/v8/V8SVGPODTypeWrapper.h: Upstreamed from src.chromium.org.
+
+2009-07-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds an abstraction layer between the DB classes and the file
+        system, which allows us to add our own logic for storing, opening,
+        deleting, etc. databases.
+
+        The patch was tested using the tests in WebCore/storage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26054
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::open): Delegating the job of opening DB files to SQLiteFileSystem to allow use of custom VFSs.
+        * platform/sql/SQLiteFileSystem.cpp: Added.
+        * platform/sql/SQLiteFileSystem.h: Added.
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::directoryName): Implemented.
+        * storage/Database.cpp:
+        (WebCore::Database::databaseSize): The code that returns the size of a DB file moved to SQLiteFileSystem.
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::DatabaseTracker): Added the ability to register a custom SQLite VFS.
+        (WebCore::DatabaseTracker::trackerDatabasePath): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::openTrackerDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::originPath): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::fullPathForDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::usageForDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::deleteOrigin): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::deleteDatabaseFile): DB file-related operations moved to SQLiteFileSystem.
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::diskUsage): DB file-related operations moved to SQLiteFileSystem.
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Always clip replaced elements to border radii.
+        https://bugs.webkit.org/show_bug.cgi?id=26933
+
+        Make sure to always clip replaced elements to border radii, even when overflow is visible.
+        Stop defaulting those elements to overflow:hidden in the UA sheet, since it is now no longer
+        necessary.
+
+        Covered by existing tests (since the UA default changing keeps the behavior exactly the same).
+
+        * css/html.css:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-07-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        convertFromScrollbarToContainingView and friends should be in ScrollView
+        https://bugs.webkit.org/show_bug.cgi?id=26929
+
+        This is breaking Chromium's build because PopupMenuChromium inherits
+        from ScrollView, but these functions are pure virtual in it.  I could
+        put it directly in PopupMenuChromium, but that seems a bit silly since
+        the functions are fairly generic.
+
+        Passes existing layout tests.
+
+        * page/FrameView.cpp:  Remove the 4 functions Hyatt just added
+        (IntRect WebCore::FrameView::convertFromScrollbarToContainingView):
+        (IntRect WebCore::FrameView::convertFromContainingViewToScrollBar):
+        (IntPoint WebCore::FrameView::convertFromScrollbarToContainingView):
+        (IntPoint WebCore::FrameView::convertFromContainingViewToScrollBar):
+        * page/FrameView.h: ditto
+        * platform/ScrollView.cpp:  Move the 4 functions from FrameView here
+        (IntRect WebCore::ScrollView::convertFromScrollbarToContainingView):
+        (IntRect WebCore::ScrollView::convertFromContainingViewToScrollBar):
+        (IntPoint WebCore::ScrollView::convertFromScrollbarToContainingView):
+        (IntPoint WebCore::ScrollView::convertFromContainingViewToScrollBar):
+        * platform/ScrollView.h: ditto
+
+2009-07-02  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26088 - TransparencyWin 
+        doesn't handle errors well at all; revise it to fail silently 
+        (drawing nothing), and bulletproof FontChromiumWin to handle the
+        failure accordingly.
+
+        Tests: fast/text/text-large-negative-letter-spacing-with-opacity.html
+               fast/text/text-letter-spacing.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::TransparencyWin):
+        (WebCore::TransparencyWin::setupLayerForNoLayer):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        (WebCore::TransparencyWin::setupTransformForScaleTransform):
+        (WebCore::TransparencyWin::initializeNewContext):
+        (WebCore::TransparencyWin::compositeOpaqueComposite):
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore::TransparencyWin::platformContext):
+
+2009-07-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Change #import to #include to fix non-ObjC builds.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-07-02  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+        
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (mimeTypeFromUTITree):
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 22119, clicks in the scrollbars of transformed content don't work.  Add new
+        conversion methods for going across parent/child widget boundaries that can be implemented
+        by the FrameView and ScrollbarClient to be transform-aware.
+
+        Test cases added in platform/mac/fast/forms and platform/mac/fast/overflow.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::convertFromScrollbarToContainingView):
+        (WebCore::FrameView::convertFromContainingViewToScrollbar):
+        (WebCore::FrameView::convertFromRenderer):
+        (WebCore::FrameView::convertToRenderer):
+        (WebCore::FrameView::convertToContainingView):
+        (WebCore::FrameView::convertFromContainingView):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::convertToContainingView):
+        (WebCore::Scrollbar::convertFromContainingView):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarClient.h:
+        (WebCore::ScrollbarClient::convertFromScrollbarToContainingView):
+        (WebCore::ScrollbarClient::convertFromContainingViewToScrollbar):
+        * platform/Widget.cpp:
+        (WebCore::Widget::convertFromContainingWindow):
+        (WebCore::Widget::convertToContainingWindow):
+        (WebCore::Widget::convertFromRootToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindowToRoot):
+        (WebCore::Widget::convertToContainingView):
+        (WebCore::Widget::convertFromContainingView):
+        * platform/Widget.h:
+        * platform/graphics/IntPoint.h:
+        (WebCore::IntPoint::move):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromRootToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindowToRoot):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::convertFromScrollbarToContainingView):
+        (WebCore::RenderDataGrid::convertFromContainingViewToScrollbar):
+        * rendering/RenderDataGrid.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
+        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
+        (WebCore::RenderLayer::scrollbarOffset):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::isPointInOverflowControl):
+        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
+        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
+        * rendering/RenderListBox.h:
+
+2009-07-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Simon Fraser.
+
+        - fix <rdar://problem/6933052> SPOD playing video in a div with a box
+          shadow
+
+        Test: fast/box-shadow/transform-fringing.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Clip out the
+        box even if it has an opaque background, but in that case, inset the
+        clip path by 1 pixel, to avoid antialiasing artifacts.
+        Do not inset the clip rect by 1 pixel if the CTM is purely a
+        translation.
+        Move the shadow-casting path away in the non-rounded-rect case (it
+        was already being done in the rounded-rect case), to avoid a black
+        fringe when the CTM is not purely a translation.
+
+2009-07-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
+
+        Walk the CoreTypes UTI tree for extensions with unknown MIME types, using the first MIME type found.
+
+        For many types of text files (such as source code files) this ends up being text/plain.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Tweak the logging output.
+
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (mimeTypeFromUTITree): 
+        (webNSURLResponseMIMEType): Use mimeTypeFromUTITree() to find a UTI-based MIME type for this file's extension.
+        (-[NSURLResponse _webcore_reportedMIMEType]): Return the actual MIME type that CFNetwork gave us.
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6518119>
+
+        Add a rewind button and hide the timeline for live broadcasts when
+        in MediaUI mode.
+
+        * css/CSSPrimitiveValueMappings.h: 
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add the new pseudo element.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): Ditto.
+        * css/CSSSelector.h: 
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
+
+        * css/CSSValueKeywords.in: Ditto.
+        * css/mediaControls.css: Ditto.
+        * css/mediaControlsQT.css: Ditto.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::rewind): New.
+        (WebCore::HTMLMediaElement::returnToRealTime): New.
+        (WebCore::HTMLMediaElement::isStreaming): New.
+        * html/HTMLMediaElement.h:
+
+        * page/mac/WebCoreViewFactory.h: Declare mediaElementLoadingStateText and mediaElementLiveBroadcastStateText.
+
+        * platform/LocalizedStrings.h: Add localized media state messages.
+
+        * platform/ThemeTypes.h: Add the new pseudo element.
+
+        * platform/mac/LocalizedStringsMac.mm: 
+        (WebCore::mediaElementLoadingStateText): Add localized media state.
+        (WebCore::mediaElementLiveBroadcastStateText): Ditto.
+
+        * platform/mac/WebCoreSystemInterface.h: Change BOOL param wkDrawMediaUIPart to an int to support
+           multiple states.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/MediaControlElements.cpp: 
+        (WebCore::MediaControlElement::MediaControlElement): Deal with new elements.
+        (WebCore::MediaControlElement::attachToParent): Ditto.
+        (WebCore::MediaControlElement::update): Ditto.
+        (WebCore::MediaControlElement::updateStyle): Ditto.
+        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::update): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Ditto.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+        (WebCore::MediaControlInputElement::updateStyle): Ditto.
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
+        (WebCore::MediaControlRewindButtonElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlTimelineElement::update): Ditto.
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): Ditto.
+        * rendering/MediaControlElements.h: Ditto.
+
+        * rendering/RenderMedia.cpp: 
+        (WebCore::RenderMedia::styleDidChange): Deal with the new elements.
+        (WebCore::RenderMedia::createPanel): Ditto.
+        (WebCore::RenderMedia::createRewindButton): Ditto.
+        (WebCore::RenderMedia::createReturnToRealtimeButton): Ditto.
+        (WebCore::RenderMedia::createStatusDisplay): Ditto.
+        (WebCore::RenderMedia::createTimelineContainer): Ditto.
+        (WebCore::RenderMedia::createCurrentTimeDisplay): Ditto.
+        (WebCore::RenderMedia::createTimeRemainingDisplay): Ditto.
+        (WebCore::RenderMedia::updateControls): Ditto.
+        (WebCore::RenderMedia::forwardEvent): Ditto.
+        * rendering/RenderMedia.h:
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint): Deal with the new elements.
+
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaRewindButton): Deal with the new elements.
+        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton): Ditto.
+        (WebCore::RenderTheme::paintMediaControlsBackground): Ditto.
+
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaRewindButton): Deal with the new elements.
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton): Ditto.
+        (WebCore::RenderThemeMac::paintMediaControlsBackground): Ditto.
+
+        * rendering/style/RenderStyleConstants.h: Add constants for the new elements.
+
+2009-07-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Small refactoring of MessagePortChannel so that PlatformMessagePortChannel
+        may be defined at the WebKit layer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26905
+
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+        * dom/MessagePortChannel.cpp:
+        * dom/MessagePortChannel.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::createChannel):
+        (WebCore::MessagePortChannel::create):
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+
+2009-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <video> fails to show on http://camendesign.com/code/video_for_everybody
+        <rdar://problem/7026010>
+        https://bugs.webkit.org/show_bug.cgi?id=26919
+
+        Fix an issue introduced in r44961. In that revision we changed to only update
+        compositing layer geometry when all siblings had been laid out (i.e. we pushed
+        the updates one level down). However, that left out the root layer, so this
+        fix ensures that the root layer geometry gets updated at the end.
+
+        Test: compositing/geometry/root-layer-update.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+
+2009-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        <rdar://problem/7026010> <video> fails to show on http://camendesign.com/code/video_for_everybody
+
+        First part of fix: when outline width changes, don't to a synchronous
+        layer update right away, but just set the flag to say that compositing
+        layers need updating. The synchronous layer update left the layer geometries
+        out of whack when it happened in the middle of layout (e.g. when inside ::first-letter).
+        
+        Test: compositing/geometry/outline-change.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setMaximalOutlineSize):
+
+2009-07-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26842
+        Build fix when ENABLE_DATABASE is off
+
+        Move Database.h into ENABLE(DATABASE) guard so toggling ENABLE_DATABASE
+        off does not break builds.
+
+        * bindings/js/ScriptObjectQuarantine.cpp:
+
+2009-07-01  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26899
+        
+        Modified XSSAuditor::decodeURL to only remove null characters so that 
+        it is consistent with the behavior of HTMLTokenizer and prevents 
+        injected scripts that contain control characters. 
+
+        Tests: http/tests/security/xssAuditor/script-tag-control-char.html
+               http/tests/security/xssAuditor/script-tag-null-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL): Modified to only remove null characters. 
+        * page/XSSAuditor.h: Reverted naming of third argument of method XSSAuditor::decodeURL
+        from allowControlCharacters back to allowNullCharacters.
+        * platform/network/ResourceResponseBase.cpp: Reverted back to rev #45003.
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h: Reverted back to rev #45003.  
+
+2009-07-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - supported keyboard shortcuts compatible with Firebug in Scripts Debugger:
+        F5, Ctrl+/ (win,lin), Command+/ (mac) - continue
+        F10, Ctrl+' (win, lin), Command+' (mac) - step over
+        F11, Ctrl+; (win, lin), Command+; (mac) - step into
+        Shift+F11, Ctrl+Shift+; (win, lin), Command+Shift+; (mac) - step out
+
+        - added call stack navigation shortcuts:
+        Ctrl+. - next call frame
+        Ctrl+, - previouse call frame
+
+        https://bugs.webkit.org/show_bug.cgi?id=23849
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.handleKeyEvent):
+        (WebInspector.CallStackSidebarPane.prototype._selectNextCallFrameOnStack):
+        (WebInspector.CallStackSidebarPane.prototype._selectPreviousCallFrameOnStack):
+        (WebInspector.CallStackSidebarPane.prototype._selectedPlacardByIndex):
+        (WebInspector.CallStackSidebarPane.prototype._selectedCallFrameIndex):
+        * inspector/front-end/KeyboardShortcut.js: Added.
+        (WebInspector.KeyboardShortcut):
+        (WebInspector.KeyboardShortcut.makeKey):
+        (WebInspector.KeyboardShortcut.makeKeyFromEvent):
+        (WebInspector.KeyboardShortcut.makeKeyFromCodeAndModifiers_):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-07-01  Daniel Erat  <derat@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: Move the scrollbar thumb on middle-click.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26910
+        http://code.google.com/p/chromium/issues/detail?id=11976
+
+        Tested by building Chrome and checking that the scrollbar moves as expected.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        * platform/chromium/ScrollbarThemeChromiumWin.h:
+
+2009-07-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a preference/setting to toggle whether content sniffing is enabled for file URLs.
+
+        * WebCore.base.exp:
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setLocalFileContentSniffingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::localFileContentSniffingEnabled):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-07-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26909: aria-label needs to be supported
+        https://bugs.webkit.org/show_bug.cgi?id=26909
+
+        Test: accessibility/aria-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * html/HTMLAttributeNames.in:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        More datagrid columns work.  Make sure columns cache both a style for the column header as well
+        as a style for the column background (behind the cells).
+
+        Hook up to CSSStyleSelector methods for obtaining the pseudo styles for columns (stubbed out and
+        unimplemented).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumn):
+        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumnHeader):
+        * css/CSSStyleSelector.h:
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::columnStyle):
+        (WebCore::DataGridColumn::setColumnStyle):
+        (WebCore::DataGridColumn::headerStyle):
+        (WebCore::DataGridColumn::setHeaderStyle):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::recalcStyleForColumn):
+        (WebCore::RenderDataGrid::columnStyle):
+        (WebCore::RenderDataGrid::headerStyle):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        * rendering/RenderDataGrid.h:
+
+2009-07-01  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/7009870> After <audio> movie finishes playing, Pause button fails to change 
+        back to Play button
+
+        Grab onto the current time when QTKit "ended" notification fires and use it as 
+        duration from that point on as QuickTime sometimes refuses to play all the way to
+        the time it reports for duration and buffered. HTMLMediaElement assumes that there
+        more to play in this situation and tries to restart playback, endlessly.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+            Rename m_duration to m_reportedDuration. Declare m_cachedDuration.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+            Rename m_duration to m_reportedDuration. Initialize m_cachedDuration.
+        (WebCore::MediaPlayerPrivate::duration):
+            Return m_cachedDuration once it has been set.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Rename m_duration to m_reportedDuration.
+        (WebCore::MediaPlayerPrivate::didEnd):
+            Set m_cachedDuration to currentTime().
+
+2009-07-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 26900: AX: Manual spell check with Command-; does not bring up suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=26900
+
+        Editable web areas should have a clickpoint that uses where the selection is.
+
+        Test: accessibility/editable-webarea-context-menu-point.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::clickPoint):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-07-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove unused code in SVGTransformList and SVGTransformDistance
+        <https://bugs.webkit.org/show_bug.cgi?id=26891>
+
+        * svg/SVGTransformDistance.cpp:
+        (WebCore::SVGTransformDistance::SVGTransformDistance):
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Begin stubbing out functions for layout, painting and style/geometry caching on columns.  Not enough
+        is implemented for this to do much of anything yet, but it should help keep patch sizes down. :)
+
+        * html/DataGridColumn.cpp:
+        (WebCore::DataGridColumn::columnChanged):
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::style):
+        (WebCore::DataGridColumn::setStyle):
+        (WebCore::DataGridColumn::rect):
+        (WebCore::DataGridColumn::setRect):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::DataGridColumnList):
+        (WebCore::DataGridColumnList::setDataGridNeedsLayout):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::dataGrid):
+        (WebCore::DataGridColumnList::clearDataGrid):
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::findDataGridAncestor):
+        (WebCore::HTMLDataGridColElement::insertedIntoTree):
+        (WebCore::HTMLDataGridColElement::removedFromTree):
+        * html/HTMLDataGridColElement.h:
+        (WebCore::HTMLDataGridColElement::dataGrid):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::~HTMLDataGridElement):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::styleDidChange):
+        (WebCore::RenderDataGrid::recalcStyleForColumns):
+        (WebCore::RenderDataGrid::recalcStyleForColumn):
+        (WebCore::RenderDataGrid::styleForColumn):
+        (WebCore::RenderDataGrid::layout):
+        (WebCore::RenderDataGrid::layoutColumns):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::paintColumnHeader):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+
+2009-07-01  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26807
+        
+        Fixes this address by checking whether frame->document()->decoder() is null. 
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+
+2009-07-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26885
+
+        Correctly reset history length to '0', not '1'. Old relict from early WML days.
+        Add some new WML testcases covering the use of history length (by onenterforward event handling)
+
+        Tests: wml/onenterforward-event.html
+               wml/onenterforward-inline-event.html
+               wml/ontimer-event.html
+ 
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::reset):
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make sure setting attributes on dcol elements properly updates the corresponding DataGridColumn object.
+
+        Added new test in fast/dom/HTMLDataGridElement.
+
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::parseMappedAttribute):
+        * html/HTMLDataGridColElement.h:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/6998524> REGRESSION (r44474): Form text field has focus ring, looks focused,
+        even though the field is not actually focused for keyboard input
+        
+        Add the concept of whether or not the Page is focused by adding a boolean to the focusController.  This allows the
+        focused frame and focused node to both be cached and changed programmatically even when the Page itself doesn't
+        actually happen to have focus at that time.
+
+        * WebCore.base.exp:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::FocusController):
+        (WebCore::FocusController::setFocusedFrame):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+        * page/FocusController.h:
+        (WebCore::FocusController::isFocused):
+
+2009-07-01  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
+        get installed when running make install from the build directory.
+
+        * WebCore.pro:
+
+2009-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Ran WebKitTools/Scripts/generate-qt-inspector-resource to update the
+        qrc file with new png files from the web inspector.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-06-30  Mark Rowe  <mrowe@apple.com>
+
+        Land some code that has a hope of compiling.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-06-30  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Flip back on block caching. Throwing away block data, while 
+        a perceived memory win, is a performance hit in cases where we 
+        are repainting large images (i.e. backgrounds) frequently 
+        (i.e. a flash video playing on top).  
+        <rdar://problem/6933515> REGRESSION(L-SL): Large JPEG images are 
+        decoded on drawing, slowing down painting of sites that frequently 
+        repaint e.g. because of Flash (pandora.com, Starcraft 2)
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-06-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Rename html4.css to html.css, since we target HTML5 now
+        https://bugs.webkit.org/show_bug.cgi?id=26873
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        * css/html.css: Copied from css/html4.css.
+        * css/html4.css: Removed.
+        * css/themeWin.css:
+        * platform/Theme.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * rendering/RenderTheme.h:
+
+2009-06-30  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Define DragImageRef as GdkPixbuf and implement essential
+        functions which manipulate drag images.
+
+        * platform/DragImage.h:
+        * platform/gtk/DragImageGtk.cpp:
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::createDragImageFromImage):
+
+2009-06-30  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace.cpp build issue
+        https://bugs.webkit.org/show_bug.cgi?id=26859
+
+        Moved #endif //ENABLE(DOM_STORAGE) position
+        so that the build doesn't fail.
+        The namespace WebCore was started after the #if ENABLE(DOM_STORAGE)
+        but closed after the #endif.
+
+        * storage/StorageNamespace.cpp:
+
+2009-06-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7020825> HTMLMediaElement should not assume seeking is only possible in 
+        buffered time ranges
+
+        * html/HTMLMediaElement.cpp:
+            Don't ASSERT if the network state goes to Idle when when the ready state is 
+            HaveEnoughData or higher, it is perfectly legal.
+        (WebCore::HTMLMediaElement::setReadyState): 
+            Don't clear m_seeking after posting a 'seeking' event.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::seek):
+            Do nothing when asked to seek to the same time we are already seeking to. Check requested
+            seek time against maxTimeSeekable, not maxTimeLoaded.
+        (WebCore::MediaPlayerPrivate::doSeek):
+            Don't bother stopping a movie that isn't playing. Minor cleanup to make the code more readable.
+        (WebCore::MediaPlayerPrivate::seekTimerFired):
+            Check requested seek time against maxTimeSeekable, not maxTimeLoaded.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            A streaming movie has as much data as it needs once it reaches "playable", so 
+            set the ready state to HaveFutureData. A movie with metadata doesn't drop back 
+            to "have nothing" when seeking. A streaming movie doesn't use the network when paused.
+        (WebCore::MediaPlayerPrivate::timeChanged):
+            It may not be possible to seek to a specific time in a streamed movie but when seeking 
+            in a streaming movie QuickTime sets the time to closest time possible and posts a  
+            timechanged notification, so update m_seekTo so we can detect when the seek completes.
+
+2009-06-30  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26860
+
+        Reviewed by Sam Weinig.
+
+        Blacklist Yahoo Application State plug-in for versions prior to 1.0.0.6.
+        Earlier versions cause corruption crashes.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-06-30  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7005207> <video> in canvas broken with ACCEL_COMPOSITING
+        
+        Fix drawImage of video in CanvasRenderingContext2D when
+        accelerated compositing is enabled. This is done by
+        adding a new paint method to HTMLVideoElement that
+        is only called from canvas, which will create the software
+        renderer if necessary, but otherwise calls the regular
+        paint method. Meanwhile, add logic to the software video
+        renderer so that it can be created without calling repaint
+        every time it sees a new frame.
+        
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paintCurrentFrameInContext):
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::paintCurrentFrameInContext):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::paintCurrentFrameInContext):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        (WebCore::MediaPlayerPrivate::createQTVideoRenderer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
+
+2009-06-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26858
+
+        Get <dcol> elements reflected into the datagrid's column list.  Make sure columns get added/removed
+        properly.  (Attribute changes are still not caught.  That is coming in a separate patch.)
+
+        Added fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
+
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::clear):
+        * html/DataGridColumnList.h:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::findDatagridAncestor):
+        (WebCore::HTMLDataGridColElement::ensureColumn):
+        (WebCore::HTMLDataGridColElement::insertedIntoTree):
+        (WebCore::HTMLDataGridColElement::removedFromTree):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        * html/HTMLDataGridColElement.h:
+        (WebCore::HTMLDataGridColElement::column):
+        (WebCore::HTMLDataGridColElement::setColumn):
+        (WebCore::HTMLDataGridColElement::datagrid):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::dataSource):
+
+2009-06-30  Jeremy Orlow (jorlow@chromium.org)
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26852
+
+        Fix some minor build issues in the v8 bindings.
+
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        (WebCore::storageGetter):
+        (WebCore::storageSetter):
+        (WebCore::storageDeleter):
+        * storage/StorageArea.cpp:
+
+2009-06-30  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: use different fonts for each script run.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26853
+
+        Previously, when rendering complex text, we picked a single font which
+        could render all the glyphs needed for the run. However, this meant
+        that sometimes lines were rendered with, for example, [LATIN, THAI,
+        LATIN] and we could end up with a different font for the Latin parts
+        than for lines without Thai in them.
+
+        With this patch, we pick a font for each script run.
+
+        This change is covered by existing layout tests.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::setupForTextPainting):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+
+2009-06-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt, Dan Bernstein.
+        
+        <rdar://problem/6191676> Redraw issues scrolling overflow:scroll div with compositing
+
+        There are two parts to this fix. First, if a compositing layer has overflow clipping
+        or a mask, then the compositing layer does not need to be sized to encompass all
+        non-composited children.
+        
+        Second, when scrolling, we have to back up to the compositing ancestor and have
+        it reposition descendant compositing layers, because overflow doesn't follow
+        the z-order tree.
+        
+        Test: compositing/overflow/overflow-scroll.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        Pass the UpdateCompositingLayers flag when updating layers after layout, so that
+        we can reposition compositing layers if we're not about to do a layer rebuild.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        Only update compositing layers if the flag is set.
+        
+        (WebCore::RenderLayer::scrollToOffset):
+        Do compositing layer updates from the compositing ancestor in one fell swoop.
+
+        * rendering/RenderLayer.h:
+        Replace the unused FullUpdate flag with one that allows us to specify whether
+        compositing layers should be updated.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+        New param that we can pass to updateCompositingDescendantGeometry to control
+        whether the update goes deep.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        We can return earlier if this is not a self-painting layer.
+        If the layer has overflow clip or a mask, then the composited bounds are just the
+        local bounds, excluding descendants.
+        
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
+        * rendering/RenderLayerCompositor.h:
+        Renamed from updateCompositingChildrenGeometry, and added a flag that allows
+        us to do a deep update.
+
+2009-06-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26764
+        Uncaught NOT_FOUND_ERR: DOMException 8 loading empty text file
+
+        Test: fast/parser/empty-text-resource.html
+
+        * loader/TextDocument.cpp: (WebCore::TextTokenizer::finish): Create document tree if it
+        hasn't been created yet.
+
+2009-06-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Renamed scrollbarUnderPoint to scrollbarAtPoint.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarAtPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+
+2009-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
+
+        <select> elements and other elements the produce popups can keep their popups
+        live across a page load.  If this occurs and the <select> element has an
+        onchange handler it is possible to get into a state where we try to execute
+        JS on a page that no longer has an execution context. 
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+          Be paranoid and add a null check, but assert as well because we shouldn't
+          actually get to this point.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-30  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25435>
+
+        Added support for sending MessagePorts to/from Workers via postMessage().
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::messageChannel):
+        Exposes MessageChannel constructor WorkerContext.
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Now correctly handles being instantiated from within a Worker.
+       * platform/CrossThreadCopier.h:
+        (WebCore::GenericWorkerTaskTraits<PassOwnPtr>):
+        Added support for passing PassOwnPtr as argument to GenericWorkerTask
+       * workers/GenericWorkerTask.h:
+        (WebCore::):
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Added an optional MessagePort argument to postMessage()
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::hasPendingActivity):
+        Workers now report pending activity whenever there are remotely entangled ports.
+        (WebCore::WorkerContext::postMessage):
+        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
+        (WebCore::WorkerContext::dispatchMessage):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        Added an optional MessagePort argument to postMessage()
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated messaging infrastructure to transport an optional MessagePort/MessagePortChannel.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        Added additional postMessage() API that accepts a MessagePort
+        * workers/WorkerObjectProxy.h:
+        Added additional postMessage() API that accepts a MessagePort
+
+2009-06-30  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: Add complex text support on Linux.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25068
+
+        This patch adds complex text support on Linux using Harfbuzz. It's not
+        the fastest code possible: some caching of font tables will certainly
+        be required. However, it's probably the simplest code that works.
+
+        This will require checking in new baselines in the Chromium tree for
+        those layout tests which now pass.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::truncateFixedPointToInteger):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::reset):
+        (WebCore::TextRunWalker::setXOffsetToZero):
+        (WebCore::TextRunWalker::rtl):
+        (WebCore::TextRunWalker::setBackwardsIteration):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::glyphs):
+        (WebCore::TextRunWalker::length):
+        (WebCore::TextRunWalker::xPositions):
+        (WebCore::TextRunWalker::advances):
+        (WebCore::TextRunWalker::width):
+        (WebCore::TextRunWalker::logClusters):
+        (WebCore::TextRunWalker::numCodePoints):
+        (WebCore::TextRunWalker::widthOfFullRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::TextRunWalker::deleteGlyphArrays):
+        (WebCore::TextRunWalker::createGlyphArrays):
+        (WebCore::TextRunWalker::expandGlyphArrays):
+        (WebCore::TextRunWalker::shapeGlyphs):
+        (WebCore::TextRunWalker::setGlyphXPositions):
+        (WebCore::setupForTextPainting):
+        (WebCore::fontPlatformDataForTextRun):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::glyphIndexForXPositionInScriptRun):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/HarfbuzzSkia.cpp: Added.
+        (WebCore::SkiaScalarToHarfbuzzFixed):
+        (WebCore::stringToGlyphs):
+        (WebCore::glyphsToAdvances):
+        (WebCore::canRender):
+        (WebCore::getOutlinePoint):
+        (WebCore::getGlyphMetrics):
+        (WebCore::getFontMetric):
+        (WebCore::harfbuzzSkiaGetTable):
+
+2009-06-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7019799> Slow loading MediaDocument can fall back to plug-in unnecessarily
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Always fall back to a plug-in if m_hasUnsupportedTracks is set.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+            Set m_hasUnsupportedTracks if we disable a track.
+
+2009-06-30  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix inverted if/else that's causing a layout test in src.chromium.org to fail.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26820
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): if (port2), not if (!port2).
+
+2009-06-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6946611> REGRESSION (r30673): Shade10:" D_Snap
+          to Grid" window is clipping
+
+        Added an app-specific quirk to revert the behavior of <link> elements
+        to the way it was before r30673, namely that if the rel attribute
+        is not "stylesheet" but the type attribute contains "text/css", the
+        link behaves as a stylesheet link.
+
+        * WebCore.base.exp: Exported setTreatsAnyTextCSSLinkAsStylesheet().
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process): Check
+            Settings::treatsAnyTextCSSLinkAsStylesheet() and if true, allow a
+            style sheet link if the type contains "text/css".
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+            Initialize m_treatsAnyTextCSSLinkAsStylesheet.
+        (WebCore::Settings::setTreatsAnyTextCSSLinkAsStylesheet): Added.
+        * page/Settings.h:
+        (WebCore::Settings::treatsAnyTextCSSLinkAsStylesheet): Added.
+
+2009-06-30  Adrien Nader  <camaradetux@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix typo in GNUMakefile.am: it reads WebCOre instead of WebCore.
+
+        * GNUmakefile.am:
+
+2009-06-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Turn on ENABLE_DATAGRID so we can run the layout tests.
+
+        * GNUmakefile.am:
+
+2009-06-30  Raju Kunnath  <raju.kunnath@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26752>
+
+        [Qt] Windows release build issue with Qt4.5 due to -GL flag on msvc2005 and msvc2008. 
+
+        * WebCore.pro: Removed -GL compiler option for win32-msvc2005|win32-msvc2008.
+
+2009-06-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Initialize member variables in the right order. Fixes compiler
+        warning.
+
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+
+2009-06-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26831
+        Fix compiler warning in WorkerLoaderProxy.h
+
+        Forward declaration of a class within a class is not allowed,
+        since the compiler can't know if the declaration is legal at that
+        point. This gives the following compiler warning:
+
+        ../../WebCore/workers/WorkerLoaderProxy.h:40: warning: declaration
+        "class WebCore::ScriptExecutionContext::Task" does not declare
+        anything
+
+        Include the full ScriptExecutionHeader header instead.
+
+        * workers/WorkerLoaderProxy.h:
+
+2009-06-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Remove unused function.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+
+2009-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change RenderLayer::updateLayerPositions() to use a bitmask instead of two
+        boolean arguments. FullUpdate is unused at present, but will be used soon.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+
+2009-06-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix one more bad merge in V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26819
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException): setDOMExceptionHelper() instead of convertToV8Object().
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove more unused scons support.
+
+        * SConstruct: Removed.
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix some incorrect create functions.
+
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::create):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::create):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Remove initialize method from DataGridDataSource and add
+        DOMDataGridDataSource.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDataGridDataSource.cpp:
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSHTMLDataGridElementCustom.cpp:
+        (WebCore::JSHTMLDataGridElement::setDataSource):
+        * html/DOMDataGridDataSource.cpp: Added.
+        (WebCore::DOMDataGridDataSource::DOMDataGridDataSource):
+        (WebCore::DOMDataGridDataSource::~DOMDataGridDataSource):
+        * html/DOMDataGridDataSource.h: Added.
+        (WebCore::DOMDataGridDataSource::create):
+        (WebCore::DOMDataGridDataSource::isDOMDataGridDataSource):
+        (WebCore::asDOMDataGridDataSource):
+        * html/DataGridDataSource.h:
+        (WebCore::DataGridDataSource::isDOMDataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.h:
+
+2009-06-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a couple of bad merge items from my previous V8Proxy patch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26813
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::nodeCollectionNamedPropertyGetter):  Fix a bad function name that slipped through.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):  Fix a bad merge that caused a couple of lines of extraneous, breaking code to get in.
+
+2009-06-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26706
+
+        Fixed crash due to dereference of m_toStyle
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
+
+2009-06-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7014813> Ask media engine if a movie is streamed or downloaded.
+
+        * WebCore.base.exp: 
+            Export _wkQTMovieGetType
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Move to keep with other non-callback functions.
+        (WebCore::MediaPlayer::movieLoadType):
+            New, returns the movie type.
+        * platform/graphics/MediaPlayer.h:
+            Declare MovieLoadType enum and movieLoadType method.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::movieLoadType):
+            Default implementation of movieLoadType
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+            Don't base m_isStreaming on protocol, there are other types of streaming movies.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered):
+            Don't assume all streams are unbuffered.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Update m_isStreaming once we have metadata.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+            Tracks that are disabled to begin with shouldn't be included in m_enabledTrackCount.
+        (WebCore::MediaPlayerPrivate::movieLoadType):
+            New, return movie type.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Add wkQTMovieGetType.
+
+2009-06-29  Alice Liu  <alice.liu@apple.com>
+
+        Fixed <rdar://problem/6930280> Reproducible crash at USA Today photo gallery
+
+        Reviewed by Anders Carlsson.
+
+        No test added because the crash requires a flash plugin
+
+        * plugins/win/PluginMessageThrottlerWin.cpp:
+        Rely on the hWnd of the plugin to tell us whether the PluginView has 
+        been deleted during execution of its wndProc.
+        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
+
+2009-06-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26811
+         [Chromium] Remove a flag and functions used to enable workers in runtime.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        <rdar://problem/6976712> Text antialiasing problems when rendering into compositing layers.
+        
+        Improve the appearance of text in compositing layers by making use of
+        CA's layer geometry flipping, rather that doing it ourselves with a flip
+        transform. This allows CG to use font autohinting in the layer text.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        New methods to set whether this layer uses flipped geometry.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setGeometryOrientation):
+        (WebCore::GraphicsLayerCA::geometryOrientation):
+        Subclass in order to call into CA
+        
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        Now that CA is doing the geometry flipping, we no longer need to flip the content
+        layers for image and video manually
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        Turn on flipping on the root layer.
+
+2009-06-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26246
+
+        Implement most WML specific <select> element features.
+        Add 'iname' / 'ivalue' support and support variable references.
+
+        Add two tests covering most select/variable related functionality.
+        Needs more tests when adding full 'iname' / 'ivalue' support (used in conjuction with onpick).
+
+        Tests: http/tests/wml/post-data-to-server.html
+               wml/select-element-variables.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::optionCount): Refactored from HTMLSelectElement::length() for use within HTML & WML.
+        * dom/SelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::length): Use new SelectElement::optionCount() function. (no functional changes for HTML).
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): Activated commented code taking care of WMLSelectElement initialization.
+        * wml/WMLSelectElement.cpp: Add a bunch of new code handling WML specific feature processing.
+        (WebCore::WMLSelectElement::title):
+        (WebCore::WMLSelectElement::formControlName):
+        (WebCore::WMLSelectElement::defaultEventHandler):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        (WebCore::WMLSelectElement::calculateDefaultOptionIndices):
+        (WebCore::WMLSelectElement::selectDefaultOptions):
+        (WebCore::WMLSelectElement::initializeVariables):
+        (WebCore::WMLSelectElement::updateVariables):
+        (WebCore::WMLSelectElement::parseIndexValueString):
+        (WebCore::WMLSelectElement::valueStringToOptionIndices):
+        (WebCore::WMLSelectElement::optionIndicesToValueString):
+        (WebCore::WMLSelectElement::optionIndicesToString):
+        (WebCore::WMLSelectElement::name):
+        (WebCore::WMLSelectElement::value):
+        (WebCore::WMLSelectElement::iname):
+        (WebCore::WMLSelectElement::ivalue):
+        * wml/WMLSelectElement.h:
+
+2009-06-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Put <datagrid> behind an ifdef.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        * bindings/js/JSDataGridDataSource.cpp:
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSHTMLDataGridElementCustom.cpp:
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/DataGridDataSource.h:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+        * rendering/RenderDataGrid.cpp:
+        * rendering/RenderDataGrid.h:
+
+2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat and Adam Roben.
+
+        Fix compilation with MINGW. Ported MSVC inline assembly to
+        GNU inline assembly. Also fixed casting errors where gcc
+        refused to cast a pointer-to-function to a pointer-to-object,
+        without an intermediate cast to a non-pointer type.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+        (WebCore::setUpOffscreenPaintingHooks):
+
+2009-06-26  John Sullivan  <sullivan@apple.com>
+
+        Added Speech submenu to context menu on Mac when there's a non-editable selection
+        (it was already present when there's an editable selection). 
+        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
+
+        Reviewed by Tim Hatcher.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyContextMenuClient::isSpeaking):
+        implemented this new virtual function to return false
+        
+        * page/ContextMenuClient.h:
+        declared this new pure virtual function
+        
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        insert Speech item (after a separator) on Mac when there's selected non-editable text
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
+
+2009-06-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
+          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
+          in MobileMe iDisk Web App
+
+        Test: added a case to fast/dom/Element/scrollWidth.html
+
+        Ensure that scroll{Width, Height} is greater or equal to
+        client{Width, Height}.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Do not make compositing layers for non-self-painting RenderLayers,
+        since these exist only to push a clip onto the clipping stack. If such
+        a layer gets compositied for some other reason, it should not paint.
+        
+        Also ensure that we update composited layer positions correctly
+        inside overflow:scroll layers. We can't assume that the contents
+        are child layers, so we have to go up to the compositing ancestor,
+        and tell it to update all its child layer positions as we do 
+        after layout.
+
+        Tests: compositing/layers-inside-overflow-scroll.html
+               compositing/self-painting-layers.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+
+2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
+        https://bugs.webkit.org/show_bug.cgi?id=23057
+
+        Define these functions for Gtk as well.
+
+        * platform/PurgeableBuffer.h:
+
+2009-06-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26765
+
+        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+
+2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to 
+        try to load it by calling ensureFontLoaded. If it still fails after 
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
+
+        This case happens once in a while during browser shutdown. The browser will 
+        queue a message to the renderer to shutdown, and will then stop answering sync 
+        messages from the renderer. If the renderer is still loading a page during this 
+        time, it might try to call the browser process to ask to load a font. The 
+        browser process will ignore the request, and the font will fail to load, even 
+        after the second try. 
+
+        This is unfortunate, but there is no real risk here, since the renderer will be 
+        going away as soon as it processes another message. 
+
+        This can't be layout tested as it depends on the sandbox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26743 
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+
+2009-06-28  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15457
+
+        Test: plugins/netscape-plugin-map-data-to-src.html
+
+        Fix problems with Real or WMP plugins not displaying because "data" was set
+        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
+        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapDataParamToSrc):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Qt] Build fix after r45290
+        https://bugs.webkit.org/show_bug.cgi?id=26769
+
+        * WebCore.pro:
+
+2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Don't use deprecated GTKsymbols.
+        https://bugs.webkit.org/show_bug.cgi?id=26583
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_new):
+        (gtk_xtbin_destroy):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Fix up previous change. When computeCompositingRequirements() determines
+        that the current layer is composited, it needs to inform its parent
+        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
+        always happen after the previous patch. Clarified the logic here.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
+        correctly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
+        that can clobber the value from an earlier sibling. Add some more comments.
+        
+        Remove a final use of Vector iterators.
+        
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        Move the normalFlowList() processing outside the test for isStackingContext().
+
+2009-06-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        - make paintFillLayerExtended() non-virtual and remove its clipY and
+          clipH parameters
+
+        These parameters were computed and passed along to
+        paintFillLayerExtended in order to vertically constrain the rect fill to
+        the damage rect, because Qt cannot paint tall rectangles (see
+        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
+        is passed along in the PaintInfo, the extra parameters are redundant,
+        and the intersection can just take place in paintFillLayerExtended().
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::paintMaskImages):
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintMask):
+
+2009-06-27  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26762
+
+        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
+        https://bugs.webkit.org/show_bug.cgi?id=21712
+
+        Added few utility functions to htmlediting.h/cpp
+
+        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
+        i.e. there is no visible node between the first and second positions
+
+        canMergeLists checks whether two lists can be merged.
+        It checks the type of list, the editing boundary, and adjacency of the lists.
+
+        Tests: editing/execCommand/indent-nested-lists-1.html
+               editing/execCommand/indent-nested-lists-2.html
+               editing/execCommand/indent-nested-lists-3.html
+               editing/execCommand/indent-nested-lists-4.html
+               editing/execCommand/indent-nested-lists-5.html
+               editing/execCommand/indent-nested-lists-6.html
+               editing/execCommand/indent-nested-lists-7.html
+               editing/execCommand/outdent-nested-lists-1.html
+               editing/execCommand/outdent-nested-lists-2.html
+               editing/execCommand/outdent-nested-lists-3.html
+               editing/execCommand/outdent-nested-lists-4.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingListChild):
+        (WebCore::canMergeLists):
+        (WebCore::isVisibilyAdjacent):
+        * editing/htmlediting.h:
+
+2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix completion when iterating options using Tab.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26722
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override visibleContentRect to handle GTK+'s case, in which
+        scrollbars or equivalent decoration are painted by the parent
+        widget.
+
+        * platform/ScrollView.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+
+2009-06-27  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26708
+        
+        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
+        and UTF-7 encoded payloads.   
+
+        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
+               http/tests/security/xssAuditor/iframe-javascript-url.html
+               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
+               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
+        (WebCore::HTMLTokenizer::parseTag):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
+        as to compare against iFrame javascript URL.
+        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
+        isControlCharacter in ResourceResponseBase.cpp.
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
+        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
+        of iFrame javascript URL.
+        * page/XSSAuditor.h: Added field m_parentFrame.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
+
+        The drawImage(<video>) logic naively assumes that it just needs
+        to check the src attribute of the video element when in fact it
+        needs to look at the url that is being played instead.  Failure
+        to do this means that video provided through source elements 
+        taints the canvas.
+
+        Test: media/video-canvas-source.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/CanvasRenderingContext2D.h:
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26695
+        
+        Added the ability to do scrollbar hit testing in EventHandler, changed the
+        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
+        to scrollbarUnderPoint, and updated all calls to that function.        
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        (WebCore::):
+        * platform/PlatformWheelEvent.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarUnderPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
+        
+        Don't go into compositing mode just for opacity transitions, but they will be
+        hardware acclerated if we're already compositing.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stamped by Dave Levin
+
+        Rename ioCompState to compositingState to better match WebCore coding style.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - revert unintentional project changes from r45277
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
+        the file was deleted from SVN.
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26766
+
+        Change to use array indexing rather than Vector enumerators; the former
+        are preferred style.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
+          as 1 px
+
+        Test: fast/dom/Element/scrollWidth.html
+
+        Changed scrollWidth and scrollHeight to use the same logic for
+        visible overflow boxes that is used for clipped overflow boxes. In
+        particular, borders are not included and
+        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=26725
+
+        Tests: accessibility/aria-disabled.html
+               accessibility/aria-hidden.html
+               accessibility/aria-readonly.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-06-26  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26759
+
+        GIFImageDecoder is broken.
+
+        Make the GIFImageDecoder.repetitionCount function const to match the
+        base class. The mismatched definitions were causing the function to not
+        get called.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-26  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
+
+        The flag should always default to true to avoid it getting set
+        to false in a build with accelerated compositing turned off
+        and then disabling accelerated compositing when subsequently
+        running a build with it turned on.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+
+2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26732
+
+        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
+        combine LocalStorage and SessionStorage into StorageNamespace. The
+        synching code (for LocalStorage) has already been removed, so these
+        classes are now very similar.  All they do is essentially contain a
+        logical grouping of origins that are attached to specific contexts
+        (be it PageGroups for LocalStorage and Page for SessionStorage).
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/DOMWindow.h:
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        (WebCore::Page::setSessionStorage):
+        * page/Page.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/PageGroup.h:
+        * storage/LocalStorage.cpp: Removed.
+        * storage/LocalStorage.h: Removed.
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageThread.cpp:
+        * storage/SessionStorage.cpp: Removed.
+        * storage/SessionStorage.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        (WebCore::StorageArea::importItem):
+        (WebCore::StorageArea::close):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        (WebCore::):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::localStorageNamespaceMap):
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespace::StorageNamespace):
+        (WebCore::StorageNamespace::~StorageNamespace):
+        (WebCore::StorageNamespace::copy):
+        (WebCore::StorageNamespace::storageArea):
+        (WebCore::StorageNamespace::close):
+        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
+
+2009-06-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26623
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp: Added.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        (WebCore::V8Proxy::):
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::frame):
+        (WebCore::V8Proxy::inlineCode):
+        (WebCore::V8Proxy::setInlineCode):
+        (WebCore::V8Proxy::timerCallback):
+        (WebCore::V8Proxy::setTimerCallback):
+        (WebCore::V8Proxy::setEventHandlerLineNumber):
+        (WebCore::V8Proxy::finishedWithEvent):
+        (WebCore::V8Proxy::wrapCPointer):
+        (WebCore::V8Proxy::extractCPointer):
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertDOMWrapperToNode):
+        (WebCore::V8Proxy::convertToV8Object):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::extractCPointerImpl):
+        (WebCore::V8Proxy::utilityContext):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::throwError):
+        (WebCore::toV8):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::~V8EventListener):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::convertBase64):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::createWindow):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7011047> Profiler shows the record button 'on' even
+        though it's finished
+
+        I consolidated the creation of the user initiated profile name into
+        its own function and then called it from console::profile instead of
+        calling startUserInitiatedProfiling().  This way we don't call
+        toggleRecordButton() which turns on the record button.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+
+2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26691
+
+        Cleanup: Move focusRingColor to RenderTheme.
+
+        Most of this CL involves deleting files and removing dead code.
+
+        focusRingColor() is now defined in RenderTheme rather than in
+        misc. places on each port.  The default color is specified as
+        black in renderTheme and ports can override it in their own
+        custom renderThemes.
+
+        Behavior should be identical except for the following cases,
+        this lists platform and what the focus ring color used to be
+        before this cl and the file where it used to be defined:
+
+        Android - red
+        WebCore/platform/android/TemporaryLinkStubs.cpp
+
+        Cairo - aqua focus ring color - 0xFF7DADD9
+        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+
+        wx - red
+        WebCore/platform/wx/TemporaryLinkStubs.cpp
+
+        QT - black
+        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+
+        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
+        * platform/android/TemporaryLinkStubs.cpp:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/chromium/ColorChromium.cpp: Removed.
+        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::oldAquaFocusRingColor):
+        (WebCore::setUsesTestModeFocusRingColor):
+        (WebCore::usesTestModeFocusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/ColorSafari.cpp: Removed.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::focusRingColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::focusRingColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::focusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::focusRingColor):
+        (WebCore::RenderThemeMac::systemColor):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::makeRGBAFromCGColor):
+        (WebCore::RenderThemeSafari::focusRingColor):
+        * rendering/RenderThemeSafari.h:
+
+2009-06-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26761
+        [Chromium] Enable Dedicated Workers in Chromium.
+
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Remove the check that prevented workers from being created w/o a command-line switch.
+        The flag itself and methods will be removed in a subsequent patch, after
+        corresponding change in Chromium.
+
+2009-06-26  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
+        Where the m_mouseDown event was never being set on windows, so the
+        client X and Y coordinates were always being reported as zero in a
+        dragstart handler.
+
+        Test: editing/selection/drag-start-event-client-x-y.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        Set the m_mouseDown event when the mouse press is handled.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::mouseDown):
+        Removed now redundant setting of m_mouseDown.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Tiger build fix
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (swizzleMIMETypeMethodIfNecessary):
+
+2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        Problem updating applicationCache when server returns 304
+        
+        Improve the fix, make the test pass on Tiger.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
+        current item from list.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
+        conditional requests that cannot be cached by network layer cause errors with default cache
+        policy.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
+        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
+        knew about.
+
+        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
+        type mappings that are missing in CoreType's database.
+
+        Test: platform/mac/fast/loader/file-url-mimetypes.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
+          WebCoreURLResponse.
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
+          where we do all MIMEType correction.
+
+        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
+          implementation of MIMEType.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet):
+        (createExtensionToMIMETypeMap):
+        (swizzleMIMETypeMethodIfNecessary):
+        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
+          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
+          implemented in _webcore_MIMEType.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Show the fullscreen button only if the backend has support for it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26661
+
+        No test since this is not reachable via the DOM.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen): new
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
+        (WebCore::MediaPlayer::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.h: new
+        * platform/graphics/MediaPlayerPrivate.h: new
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
+        * rendering/MediaControlElements.h:
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7007776> Controller doesn't automatically update counters when file
+        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+
+        Update the time display when the movie time changes.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26659
+
+        Support hidding a control bar element from the Media element controller.
+
+        Update layout tests since the fullscreen button no longer has a renderer.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
+        is updated properly.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::update): call updateStyle()
+        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
+        or not depending on what rendererIsNeeded() return.
+        * rendering/MediaControlElements.h:
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6968137> Profiler title numbers increment even after a
+        reload.
+
+        - Now the numbers are reset when the profiles are.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+
+2009-06-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7000796>
+        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+
+        Test: editing/inserting/break-blockquote-after-delete.html
+
+        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
+        typing command, keep that flag up to date.
+
+        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
+        was following an open Delete command, which does preserve the typing style.  So we were applying the original
+        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::updatePreservesTypingStyle):
+        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * WebCore.pro:
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts):
+        (WebCore::HistoryItem::weeklyVisitCounts):
+        * history/qt/HistoryItemQt.cpp: Added.
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to String and IntPoint.
+
+        * platform/graphics/IntPoint.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/text/PlatformString.h:
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+
+2009-06-26  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=26757
+
+        * bindings/v8/custom/V8StorageCustom.cpp
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Test: platform/qt/fast/events/event-sender-keydown-frame.html
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Merge scrolling handling code in qt and win port, move it to
+        EventHandler.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
+
+2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26682
+        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
+
+        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
+
+        Test: svg/custom/createImageElement.svg
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty):
+
+2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
+        https://bugs.webkit.org/show_bug.cgi?id=26156
+
+        When in view-source mode, render the contents using HTMLViewSourceDocument
+        regardless it's applicable for any plugin or not.
+
+        Chromium tells WebCore to render the contents of specified URL when
+        view-source: prefix is added to the URL. But currently, DOMImplementation
+        ignores inViewSourceMode() when the MIME type is indicating that the contents
+        are neither texts nor HTML family documents.
+
+        For example, we can check the contents of asf file without launching media
+        player. Rendering contents for view-source:-specified input is not what user
+        expects.
+
+        http://code.google.com/p/chromium/issues/detail?id=10545
+
+        I want to fix this issue by this patch. IMHO, regardless of this Chromium
+        specific issue, I think we should force use of HTMLViewSourceDocument when
+        inViewSourceMode() is specified.
+
+        Test: fast/frames/viewsource-on-image-file.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer):
+        * html/HTMLViewSourceDocument.h:
+
+2009-06-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25529
+        [Gtk] Expected states not exposed to assistive technologies
+
+        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        "Pointer to incomplete class type is not allowed" error with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=26721
+
+        Based on Norbert Leser's work.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
+        to eliminate dependency on the Event class definition
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [Qt] Build fix after r45183
+        https://bugs.webkit.org/show_bug.cgi?id=26748
+
+        * WebCore.pro:
+
+2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        We're already done with the resource, don't try to load it again.
+
+2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/6990481>
+        
+        Handle perspective computation on non-layer objects.
+
+        Test: transforms/3d/general/perspective-non-layer.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26653
+
+        Use flex box in the mediaControls.css style, to nicely scale if a button gets
+        dynamically added or removed.
+
+        Media tests results are affected by this changes.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQT.css:
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26724
+
+        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
+        up into RenderThemeChromiumSkia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26733
+
+        Add V8-only methods to FrameLoaderClient that V8 can use to send
+        out notifications when it creates/destroys a script context.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didCreateScriptContext):
+        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
+        to match WebKit style.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        Add missing include for r45199.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26736
+
+        r45199 added a reference to throwError without including V8Proxy.h
+
+        * bindings/v8/WorkerScriptController.cpp:
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26735
+
+        Fix V8IsolatedWorld to point to the correct include file.
+
+        The deprecated v8_index.h was removed from the Chromium tree in r19291
+        and upstreamed into WebKit with r45193. However V8IsolatedWorld
+        slipped in between the cracks and broke the build.
+
+        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+
+2009-06-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26651
+        
+        Preference is named "WebKitAcceleratedCompositingEnabled"
+        and is a boolean value. When false, prevents compositing layers from
+        being created, which prevents hardware animation from running.
+        Also forces video to do software rendering. Added a cache for
+        the flag in RenderLayerCompositing and made it all work
+        on-the-fly when the flag is changed while a page is loaded.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::setNeedsReapplyStylesInAllFrames):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::acceleratedCompositingEnabled):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasAcceleratedCompositing):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-06-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26701: Implement the missing code for "FIXME: Need to return an
+        exception" in WorkerScriptController::evaluate for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=26701
+
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+
+2009-06-25  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8Index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26495
+
+        * bindings/v8/V8Index.cpp: Added.
+        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
+        * bindings/v8/V8Index.h:
+        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26529
+
+        This is hopefully the last step before our renderers can run
+        cleanly in a chroot.
+
+        WebKit needs to be able to ask for the correct font to use in
+        the case that the current font doesn't include glyphs for
+        certain code points. Currently we make a fontconfig call in our
+        WebKit port to handle this.
+
+        This patch changes this so that the call is sent our via
+        ChromiumBridge.
+
+        http://codereview.chromium.org/132007
+
+        This should not affect any layout tests.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26566
+        Upstream these files from the chromium v8 code.  No tests were
+        affected because this is essentially a code move.
+
+        * bindings/v8/NPV8Object.cpp: Added.
+        (allocV8NPObject):
+        (freeV8NPObject):
+        (listFromVariantArgs):
+        (npIdentifierToV8Identifier):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_Evaluate):
+        (NPN_EvaluateHelper):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        (NPN_SetException):
+        (NPN_Enumerate):
+        (NPN_Construct):
+        * bindings/v8/NPV8Object.h: Added.
+        (PrivateIdentifier::):
+        * bindings/v8/V8NPUtils.cpp: Added.
+        (convertV8ObjectToNPVariant):
+        (convertNPVariantToV8Object):
+        (getStringIdentifier):
+        * bindings/v8/V8NPUtils.h: Added.
+
+2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        Windows Chromium bug fix: save context of destination canvas in
+        TransparencyWin::compositeTextComposite() before the function
+        modifies the context.
+
+        Test: fast/canvas/translate-text.html
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Show the filename and first line for "(program)" in the Profiler/Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=25475
+
+        Add support to associate a sourceURL with an eval()'d string
+        via a @sourceURL comment.  Currently the sourceURL is only available
+        in the script debugger, not in the console or profiler, but it's
+        most needed in the script debugger.
+
+        * English.lproj/localizedStrings.js: added new "(program): %s" string
+        * inspector/front-end/Script.js:
+        (WebInspector.Script): if no sourceURL is available for the Script,
+        search for a comment of the form //@ sourceURL=(url) to use
+        as the sourceURL instead.
+        * manual-tests/inspector/named-evals.html: Added.
+
+2009-06-25  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
+        https://bugs.webkit.org/show_bug.cgi?id=23721
+
+        onchange events fire when a SELECT element has
+        focus and the selectedIndex is updated by script in some way--either
+        during another onchange, onkeypress, onfocus, or timer--and then
+        focus is lost. 
+
+        Fixed by making a separate method for user-driven selectedIndex 
+        changes, leaving scripts to use one which doesn't cause onchange to
+        be queued.
+        
+        Test: fast/forms/select-script-onchange.html
+
+        * dom/SelectElement.cpp: check if the pending change is user driven
+        before calling onchange
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::setSelectedIndex):
+        * dom/SelectElement.h: store whether the pending change is user driven
+        (WebCore::SelectElementData::userDrivenChange):
+        (WebCore::SelectElementData::setUserDrivenChange):
+        * html/HTMLSelectElement.cpp: split into two methods -- script version
+        [non-user-driven] corresponds to IDL defined property name
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        * html/HTMLSelectElement.h: 
+        * rendering/RenderMenuList.cpp: use ByUser method when coming through
+        the renderer
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
+          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add FileList.h include to fix Chromium build.
+
+        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+
+2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
+        https://bugs.webkit.org/show_bug.cgi?id=26489
+
+        Fixed a Typo in a Web Inspector error message.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryError):
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing StorageAreaSync files to the build.
+
+        * WebCore.pro:
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+
+        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+        empty. If we're asked to disambiguate the event into a Char keyboard event,
+        we try to detect this situation and still set the text, to ensure that the
+        general event handling sends a key press event after this disambiguation.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/win/ClipboardWin.cpp:
+        * platform/wx/ClipboardWx.cpp:
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose files in the clipboard in ondrop events
+        https://bugs.webkit.org/show_bug.cgi?id=25916
+
+        Make it possible for applications like gmail to implement
+        drag and drop of attachments onto email messages.
+
+        This patch exposes an event.dataTransfer.files accessor
+        on the drop event.  No information is exposed during dragover.
+        This follows the HTML 5 drag and drop security model:
+        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
+        The test http/tests/security/clipboard/clipboard-file-access.html
+        verifies this behavior.
+
+        Internet Explorer shows historical documentation of supporting
+        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
+        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
+        has removed this reference (as far as I can tell IE never implemented it)
+        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
+        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+
+        I choose not to use IE's getData('File') and instead added .files
+        so that the accessor could have a type, matching WebKit's existing
+        .files accessor on HTMLInputElement.
+
+        Mozilla has equivalent file access:
+        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
+        which also does not return a typed value.
+        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+
+        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
+        have incomplete Clipboard implementations and will require experts from those platforms
+        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+
+        Test: http/tests/security/clipboard/clipboard-file-access.html
+
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::files):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/gtk/ClipboardGtk.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/ClipboardWin.h:
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::files):
+        * platform/wx/ClipboardWx.h:
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, only completing revert of r45144.
+
+        Add back files deleted by r45144.
+
+        * storage/LocalStorageArea.cpp: Added.
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/LocalStorageArea.h: Added.
+        * storage/SessionStorageArea.cpp: Added.
+        (WebCore::SessionStorageArea::copy):
+        (WebCore::SessionStorageArea::SessionStorageArea):
+        (WebCore::SessionStorageArea::itemChanged):
+        (WebCore::SessionStorageArea::itemRemoved):
+        (WebCore::SessionStorageArea::areaCleared):
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.h: Added.
+        (WebCore::SessionStorageArea::create):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, reverting r45144 only.
+
+        Roll out r45144 after 18 test failures appeared on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::~StorageArea):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
+          at UCSC Genome Browser doesn't work because image map prevents img
+          from hit-testing
+
+        Test: fast/replaced/image-map-2.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
+        the image map failed the hit test.
+
+2009-06-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26366
+
+        Refactor V8DOMMap to support isolated worlds.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::):
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::forget):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::weakActiveDOMObjectCallback):
+        (WebCore::weakNodeCallback):
+        (WebCore::weakSVGElementInstanceCallback):
+        (WebCore::weakSVGObjectWithContextCallback):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMDataStoreHandle::getStore):
+        * bindings/v8/V8IsolatedWorld.cpp: Added.
+        (WebCore::getIsolatedWorldKey):
+        (WebCore::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedWorld::evaluate):
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8IsolatedWorld.h: Added.
+        (WebCore::V8IsolatedWorld::getDOMDataStore):
+
+2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26604: Search doesn't work in Web Inspector Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=26604
+
+        Seems like search was damaged in revision 42808.
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.refresh):
+        Here and in other functions: nodes we're searching in are profile data grid
+        nodes, so there is no more need for '_dataGridNode' references.
+        (WebInspector.ProfileView.prototype.searchCanceled):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        Fixed accidental semicolon that caused 'matchesQuery' always return true.
+        (WebInspector.ProfileView.prototype.performSearch):
+        To perform search correctly in the case of bottom up tree, we need to populate
+        the tree, because there's no 1-to-1 correspondence between profile nodes and
+        data grid nodes in this case.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult):
+
+2009-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        <rdar://problem/6450239&6574516>
+    
+        Fix flashing issues caused by compositing layers rendering content before
+        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
+        work for composited layers, we need to use scheduleViewUpdate() to queue
+        up a layout via the run loop observer in WebKit, whenever we know we
+        are going to be painting soon.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26658
+
+        Split the syncing portions of LocalStorageArea into StorageAreaSync.
+        This name will make more sense in the next patch (in this set) when
+        LocalStorageArea and SessionStorageArea are merged to become simply
+        StorageArea.  (Thus the synching portion of StorageArea is in
+        StorageAreaSync.)
+
+        This looks like a big patch, but really all it's doing is splitting
+        code and patching split-related things up.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        * storage/SessionStorageArea.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
+        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build.
+
+        * WebCore.pro:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26696
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave "Messy" Hyatt.
+
+        Little bit of style cleanup.
+
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+
+2009-06-24  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26668: AX: need a way to retrieve the language for an element
+        
+        Provides a way to retrieve the language associated with a specific accessibility element.
+
+        Test: accessibility/language-attribute.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
+
+2009-06-24  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26685
+        Accomodate for backwards-incompatible skia api changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setXfermodeMode):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        * platform/graphics/skia/SkiaUtils.h:
+
+2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Add files that were added in r45093 and r45096
+
+        * GNUmakefile.am:
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Fix 64-bit SnowLeopard build.
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+
+2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26392
+        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=26328
+        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+
+        React to href updates even when there is no renderer, i.e. display=none.
+
+        Tests: svg/custom/js-update-image-and-display.svg
+               svg/custom/js-update-image-and-display2.svg
+               svg/custom/js-update-image-and-display3.svg
+
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+
+2009-06-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26687
+
+        Add basic back-end column support to datagrid.
+
+        Added fast/dom/HTMLDataGridElement/ column tests.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/DataGridColumn.cpp: Added.
+        (WebCore::DataGridColumn::setPrimary):
+        * html/DataGridColumn.h: Added.
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::id):
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::label):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::type):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::sortable):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::sortDirection):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::primary):
+        (WebCore::DataGridColumn::detachFromColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumn.idl: Added.
+        * html/DataGridColumnList.cpp: Added.
+        (WebCore::DataGridColumnList::~DataGridColumnList):
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h: Added.
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::length):
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+        * html/DataGridColumnList.idl: Added.
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::columns):
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::rebuildColumns):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::gridElement):
+
+2009-06-24  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
+        (<rdar://problem/5015942>)
+        Where on windows it was not possible to set an element as the drag
+        image using setDragImage on the dataTransfer object.
+        
+        Does not "fix" the case of dragging a link where the default link image
+        is still used, even when the -webkit-user-drag is set to "element". This
+        is the same behavior as is found on OS X.
+        
+        Added a manual test because it is not possible to check that what is
+        contained in the image snapshot is indeed the requested element.
+
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImageElement):
+        Made getting the raw pointer from the RefPtr a const operation.
+        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::createDragImage):
+        Get an image of the rendered element and its subtree.
+
+2009-06-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26683
+        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
+
+        This change just adds a stub implementation for now to help fix the build.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+
+2009-06-24  David Kilzer  <ddkilzer@apple.com>
+
+        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+
+        Reviewed by Adam Roben.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::deliverNotification): Removed
+        ExceptionCode parameter from togglePlayState().
+        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
+        object to a String when assigning to a KURL variable.
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Save memory by not storing attribute values in member variables, if not absolutely needed.
+        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        (WebCore::WMLDoElement::label):
+        * wml/WMLDoElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        * wml/WMLFieldSetElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::timerFired):
+        (WebCore::WMLTimerElement::start):
+        (WebCore::WMLTimerElement::value):
+        * wml/WMLTimerElement.h:
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Forgot to initialize m_task member variable. Results in crashes sometimes.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include within last patch.
+
+        * manual-tests/wml/card-title-attr.wml: Added.
+
+2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
+ 
+        Reviewed by Nikolas Zimmermann.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
+        Adding WML <card> title attribute handling.
+
+        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
+        * wml/WMLElement.cpp:
+        * wml/WMLCardElement.h: 
+        (WebCore::WMLCardElement::title):
+        * wml/WMLCardElement.cpp:
+        * wml/manual-test/card-title-attr.wml: Manual test  
+ 
+2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build without ENABLE_VIDEO.
+
+        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
+        * html/CanvasRenderingContext2D.h: Ditto.
+
+2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
+        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
+        to just replace the selection, and place the caret at the end of the selection it replaced.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
+
+2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Don't use an unsigned int for intervalInMS because we sometimes initialize
+        it with a negative value.
+
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+2009-06-24  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        The previous checkin had an improper merge.  This fixes the build.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-06-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25922
+        JS setting dropEffect = "none" causes tryDHTMLDrag
+        to return DragOperationNone.  Which is also the value
+        tryDHTMLDrag previously used to indicate JS did not
+        want to handle the drag.
+
+        Make it possible for the DragController::try* methods
+        to return a bool to indicate if javascript accepted
+        or rejected the drag event, separate from the DragOperation.
+
+        Tests:
+        - fast/events/drag-to-navigate.html
+        - fast/events/prevent-drag-to-navigate.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        * page/DragController.h:
+
+2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig and Dave Hyatt.
+
+        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
+        <https://bugs.webkit.org/show_bug.cgi?id=25920>
+
+        Add support for drawing the contents of the video element to the canvas
+        in accordance with the current HTML5 draft.
+
+        Test: media/video-canvas.html
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+          Standard custom bindings stuff we need to do for all canvas methods.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::size): Helper function for finding the size of a video element
+        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
+        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
+          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
+          as we force QT to maintain a single origin.
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paint): 
+            Paint routine on video so we don't have to look at MediaPlayer directly
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Default implementations of hasSingleSecurityOrigin
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+            A video may need a player now even if it is not visible.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+            Always return true due to restrictions we've placed on QT.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
+            In the long term we'd like to cache the HDC, but this will do for now.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            As for Mac we force QT to only allow same origin loads.
+
+2009-06-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: Fix crash with inherited font-size in <option>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26656
+        http://code.google.com/p/chromium/issues/detail?id=14853
+
+        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
+        the <select> handing for Chromium to fix a rendering bug. However,
+        although the font-size is correctly ignored, getRowHeight wasn't
+        updated and so was calculating the height of the rows in an
+        inconsistent manner. This can lead to a crash.
+
+        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowHeight):
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Patch by Antti Koivisto.
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
+
+        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
+        it should always be revalidated upon reload.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+
+2009-06-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
+          EventHandler::passMouseDownEventToWidget()
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
+        -mouseDown: call with calls to Widget::beforeMouseDown() and
+        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
+        being removed from its parent view while the scroller is tracking the
+        mouse.
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
+        Add initial implementation of DataGridDataSource
+
+        - Initial implementation only supports the initialize callback function.
+
+        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDataGridDataSource.cpp: Added.
+        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::initialize):
+        * bindings/js/JSDataGridDataSource.h: Added.
+        (WebCore::JSDataGridDataSource::create):
+        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::jsDataSource):
+        (WebCore::asJSDataGridDataSource):
+        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
+        (WebCore::JSHTMLDataGridElement::listener):
+        (WebCore::JSHTMLDataGridElement::setListener):
+        * html/DataGridDataSource.h: Added.
+        (WebCore::DataGridDataSource::~DataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::initializationTimerFired):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.idl:
+
+2009-06-23  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Justin Garcia.
+
+        Undo the changeset 21212 to fix the regression bug 14062.
+        The changeset 21212 attempted to fix rdar://problem/5002441.
+        The changeset 21212 modified InsertTextCommand::input so as to convert
+        all spaces in text to non-breaking spaces for rdar://problem/5002441.
+        However, the bug was originally caused by rebalanceWhitespaceAt
+        and this workaround introduced a regression bug 14062.
+        Because rebalanceWhitespaceAt appears to behave correctly now,
+        the workaround introduced in 21212 is no longer needed.
+
+        Test: editing/inserting/space-after-removeformat.html
+
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+
+2009-06-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
+        elements width can't be changed with javascript
+
+        This patch both fixes setting the width attribute directly in 
+        JavaScript, and setting the width on the style attribute. 
+
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
+        new width, call setNeedsLayoutAndPrefWidthsRecalc()
+
+        Call calcPrefWidths() on the table cols.
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        
+        Call layoutIfNeeded on the table cols.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
+        table() convenience function.
+        (WebCore::RenderTableCol::calcPrefWidths): Just call 
+        setPrefWidthsDirty(false) on ourself and our children.
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableCol.h:
+
+2009-06-23  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
+        keyword values. When diff is called on a CSSStyleDeclaration, we check
+        the keywordSize to see if font-size matches a keyword value.
+        
+        This ensures that when we diff a CSSMutableStyleDeclaration returned from
+        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
+        correctly identify matching font-sizes.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26279
+
+        Test: editing/inserting/font-size-clears-from-typing-style.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::CSSStyleDeclaration::diff):
+        * css/CSSStyleDeclaration.h:
+
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
+        add a blank line to pasted Facebook content (under
+        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
+
+        - Just added null checks and I will create a new bug to prevent the
+        bad behavior.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix.
+
+        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
+        ACCELERATED_COMPOSITING is not defined.
+
+        * rendering/RenderLayer.cpp:
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24863
+        
+        Fix reflection painting on elements with compositing layers.
+
+        Test: compositing/reflections/reflection-on-composited.html
+
+        * rendering/RenderLayer.h:
+        Add a new PaintLayerPaintingReflection flag which is set while painting inside
+        reflections.
+        (WebCore::RenderLayer::setPaintingInsideReflection):
+        Add a setter so that RenderLayerBacking can call it.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::shouldDoSoftwarePaint):
+        Utility to clarify the logic of when a composited layer should do a software paint.
+        
+        (WebCore::RenderLayer::paintLayer):
+        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
+        Remove transform-related tests from the reflection-painting if test because they appear
+        to be unnecessary.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Add the code to paint reflections to the composited layer painting method.
+        
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Set the PaintLayerPaintingReflection flag.
+
+2009-06-23  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26643
+        Memory cache should respect Cache-Control: no-store
+        
+        Make resources with Cache-Control: no-store uncacheable in the memory cache.
+        They get evicted immediately when all clients are gone and are always
+        reloaded from the server.
+
+        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::play):
+        (QTMovieWin::pause):
+        (QTMovieWin::setRate):
+        (QTMovieWin::setCurrentTime):
+
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
+        after manually quoting blank line then hitting return
+
+        If the insertion point is both the begining and ending visible position
+        then we need to insert at the end instead of the begining, which is what
+        would normally happen if the insertion point was as the begining.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig, and looked over by Eric Carlson.
+
+        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
+
+        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
+          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::webkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::MediaPlayer::MediaPlayer):
+        (WebCore::MediaPlayer::preservesPitch):
+        (WebCore::MediaPlayer::setPreservesPitch):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
+          exact same attributes as before, with pitch preservation being the difference.
+        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
+        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
+        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
+          has been effectively overwritten.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreservesPitch):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWinPrivate::~QTMovieWinPrivate):
+        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
+        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
+        (QTMovieWin::pause): Ditto.
+        (QTMovieWin::setRate): Ditto.
+        (QTMovieWin::setCurrentTime): Ditto.
+        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
+        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
+          but changing the pitch preservation flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6998286> Crash after leaving page with <video>
+        
+        Don't try to post events after going into the page cache.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
+        event timers so we won't try to post events after going into the cache.
+
+2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Simplify the interaction between LocalStorageArea/SessionStorageArea
+        and StorageArea by creating a "blockUntilImportComplete()" function
+        rather than bouncing back and forth between the child and parent
+        classes in a somewhat unintuitive manner.
+
+        This patch also paves the way for LocalStorageArea and
+        SessionStorageArea being merged into one.  It's part of several in a
+        set which are separating syncing (to disk) code from the rest of the
+        implementation so that local storage and session storage's code can be
+        unified.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::blockUntilImportComplete):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        Remove the unused 'haveTransparency' param to paintIntoLayer().
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
+
+        The updatingControlTints() painting pass goes through compositing layer boundaries,
+        so we need to ensure we don't cache clip rects computed with the wrong root by
+        setting temporaryClipRects to true.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        Remove a printf that I left in by mistake.
+
+2009-06-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore side of <rdar://problem/6946094>.
+        
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::setExternalDataObject):
+        * platform/win/ClipboardWin.h:
+
+2009-06-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26650
+
+        Add setFormContentType and setFormData since it is awkward for Chromium
+        to use setFormInfoFromRequest to set the underlying members.  Also, add
+        a clearChildren method that Chromium needs.  These methods are used as
+        part of the Chromium code that serializes a HistoryItem for storing in
+        the browser's session history.
+
+        * history/HistoryItem.cpp:
+        * history/HistoryItem.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
+
+        Test: media/event-attributes.html
+
+        * html/HTMLAttributeNames.in: Add media event attribute names.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
+
+2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build with Phonon.
+
+        The #include <phonon> header no longer exists. And the <Phonon> or
+        <Phonon/Phonon> headers have never existed (neither for us nor for the
+        Phonon sources). You have to select each and every header that you do
+        want now.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Remove duplicated code in Qt & GTK logging initialization
+
+        We now share the getChannelFromName() function in Logging.cpp
+
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/qt/LoggingQt.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename the plugin logging channel to plural form 'Plugins'
+
+        This matches both the other logging channel names, as well as the
+        WebKit logging channel used by Safari/Mac for plugins.
+
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/mac/LoggingMac.mm:
+        * platform/qt/LoggingQt.cpp:
+        * platform/win/LoggingWin.cpp:
+        * plugins/PluginDebug.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix NPAPI mouse translation issues on Mac
+
+        The WindowRef we pass to the plugin refers to the the top level window,
+        so the x and y positions have to be relative to this position, but we
+        have to manually compensate for title bar decorations and other parents
+        of the QWebView since contentsToWindow() only traverses to the QWebView.
+
+        Previously we did this compensation when passing on mouse coordinates to
+        the plugin, which caused various issues with translations such as not
+        being able to close the Flash settings dialog, or the hand cursor not
+        appearing over links.
+
+        We now do the compensation as part of the call to NPP_SetWindow, and
+        then pass mouse coordinates in global context without any compensation,
+        similar to how both Safari and Mozilla does it.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::globalMousePosForPlugin):
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Resolve absolute path to library install_name manually
+
+        Since our target.path is set to the Qt directory (to be able
+        to do 'make install') the 'absolute_library_soname' option
+        to QMake did not do the right thing.
+
+        We now compute the absolute path manually using DESTDIR.
+
+        * WebCore.pro:
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
+        inactive look in background windows
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        Don't short-circuit the "painting" pass that is used to udpate control tints.
+
+2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26567
+        Upstream V8 bindings code generator. With this change, also added interface ancestor
+        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
+        to determine whether an interface is a Node to facilitate proper casting and storage
+        in V8DOMMap.
+
+        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
+            by V8 bindings.
+        * bindings/scripts/CodeGeneratorV8.pm: Added.
+        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
+            parent traversal cases.
+
+2009-06-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add event handler attribute getter/setters to HTMLFrameSetElement
+        as specified in HTML 5.  These match the ones on HTMLBodyElement.
+
+        * dom/Node.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onblur):
+        (WebCore::HTMLFrameSetElement::setOnblur):
+        (WebCore::HTMLFrameSetElement::onerror):
+        (WebCore::HTMLFrameSetElement::setOnerror):
+        (WebCore::HTMLFrameSetElement::onfocus):
+        (WebCore::HTMLFrameSetElement::setOnfocus):
+        (WebCore::HTMLFrameSetElement::onload):
+        (WebCore::HTMLFrameSetElement::setOnload):
+        (WebCore::HTMLFrameSetElement::onbeforeunload):
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
+        (WebCore::HTMLFrameSetElement::onmessage):
+        (WebCore::HTMLFrameSetElement::setOnmessage):
+        (WebCore::HTMLFrameSetElement::onoffline):
+        (WebCore::HTMLFrameSetElement::setOnoffline):
+        (WebCore::HTMLFrameSetElement::ononline):
+        (WebCore::HTMLFrameSetElement::setOnonline):
+        (WebCore::HTMLFrameSetElement::onresize):
+        (WebCore::HTMLFrameSetElement::setOnresize):
+        (WebCore::HTMLFrameSetElement::onstorage):
+        (WebCore::HTMLFrameSetElement::setOnstorage):
+        (WebCore::HTMLFrameSetElement::onunload):
+        (WebCore::HTMLFrameSetElement::setOnunload):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+2009-06-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Added. For use implementing getters
+        for ReflectURL.
+        * dom/Element.h: Added getURLAttribute.
+
+        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
+
+2009-06-22  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
+        objects.
+        https://bugs.webkit.org/show_bug.cgi?id=26626
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
+        of 300x150.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html4.css:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::createRenderer):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp: Added.
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        (WebCore::RenderDataGrid::calcPrefWidths):
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::valueChanged):
+        (WebCore::RenderDataGrid::invalidateScrollbarRect):
+        (WebCore::RenderDataGrid::isActive):
+        * rendering/RenderDataGrid.h: Added.
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+        (WebCore::RenderDataGrid::scrollbarCornerPresent):
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26430
+        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
+        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
+            during window resize when using hardware layers
+        
+        Fix an ordering dependency which caused the compositing position of a layer
+        to be affected by some later sibling, which affected the compositing ancestor's
+        composited bounds.
+        
+        The fix is to only update the compositing positions of layers in some subtree
+        when updateAfterLayout() has been called on all the layers in that subtree,
+        from the ancestor down.
+        
+        Also cache the composited bounds of a RenderLayerBacking, now that we can
+        guarantee that those bounds are accurate.
+        
+        Test: compositing/sibling-positioning.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        (WebCore::RenderLayerBacking::compositedBounds):
+        (WebCore::RenderLayerBacking::setCompositedBounds):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        Add StorageSyncManager.cpp/h
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        In preparation for combining SessionStorage and LocalStorage into a
+        single StorageManager, move the syncing bits out of LocalStorage and
+        into its own class.
+
+        The next step is to combine LocalStorageArea and SessionStorageArea
+        into one.  Then SessionStorage and LocalStorage can be combined.
+
+        Note that combining them will cut down on code paths that must be
+        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
+        write historical sessionStorage to disk when memory is getting tight.
+
+        Also remove a couple bits of cruft including code for quotas which is
+        unnecessary (since a meta-data db is unnecessary since you can just
+        count bytes as you read the local storage databases into memory).
+
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::LocalStorage):
+        (WebCore::LocalStorage::storageArea):
+        (WebCore::LocalStorage::close):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::syncTimerFired):
+        (WebCore::LocalStorageArea::performImport):
+        * storage/LocalStorageArea.h:
+        (WebCore::LocalStorageArea::create):
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::):
+        (WebCore::LocalStorageTask::createImport):
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorage.h:
+        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::StorageSyncManager::create):
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        (WebCore::StorageSyncManager::close):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
+        (WebCore::):
+
+2009-06-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26622
+        Add ChromiumDataObject::copy()
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-06-22  Timothy Hatcher  <timothy@apple.com>
+
+        Add a silhouette image for the enable view of the Resource panel.
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/Images/resourcesSilhouette.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-06-22  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26552
+        Add V8 JS bindings for Audio Constructor.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added a callback declaration for audio ctor to macro.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        Added the whole file.
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26600
+        StringImpl::copy() no longer copies empty string correctly
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
+        static method.
+        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
+
+2009-06-22  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Not auto-testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        This patch is one part of the fix for issue "keyboard selection in
+        Hebrew select element does not work in Windows". The other part of the
+        fix is in chromium's webkit/glue layer.
+        https://bugs.webkit.org/show_bug.cgi?id=25899
+
+        * manual-tests/keyboard_select_non_english.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
+        character type event. "Char" in Windows or "KeyDown" in Mac is character
+        type event.
+        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
+        indicate whether user types multiple characters continuely as a search
+        prefix or not, it should be only assigned when the event is character 
+        type event. 
+
+2009-06-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6115819> Notify of profile start in console
+
+        Put a message in the console that announces that a profile has started,
+        similar to how a console message announces that a profile has finished.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile): Use renamed function.
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        Renamed.
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        New function that logs the message about the profile starting.
+        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
+        * inspector/InspectorController.h:
+        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
+        title if there are multiple profiles, and take into account the fact
+        that titles are displayed twice as much now.
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        * page/Console.cpp:
+        (WebCore::Console::profile): Call new function.
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26615
+
+        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
+        correspond to ones you find on <select> elements.
+
+        Add an expanded property to row elements.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridCellElement.cpp: Added.
+        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
+        (WebCore::HTMLDataGridCellElement::label):
+        (WebCore::HTMLDataGridCellElement::setLabel):
+        (WebCore::HTMLDataGridCellElement::focused):
+        (WebCore::HTMLDataGridCellElement::setFocused):
+        (WebCore::HTMLDataGridCellElement::checked):
+        (WebCore::HTMLDataGridCellElement::setChecked):
+        (WebCore::HTMLDataGridCellElement::indeterminate):
+        (WebCore::HTMLDataGridCellElement::setIndeterminate):
+        (WebCore::HTMLDataGridCellElement::progress):
+        (WebCore::HTMLDataGridCellElement::setProgress):
+        * html/HTMLDataGridCellElement.h: Added.
+        (WebCore::HTMLDataGridCellElement::endTagRequirement):
+        (WebCore::HTMLDataGridCellElement::tagPriority):
+        * html/HTMLDataGridCellElement.idl: Added.
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::autofocus):
+        (WebCore::HTMLDataGridElement::setAutofocus):
+        (WebCore::HTMLDataGridElement::disabled):
+        (WebCore::HTMLDataGridElement::setDisabled):
+        (WebCore::HTMLDataGridElement::size):
+        (WebCore::HTMLDataGridElement::setSize):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        (WebCore::HTMLDataGridRowElement::checkDTD):
+        (WebCore::HTMLDataGridRowElement::expanded):
+        (WebCore::HTMLDataGridRowElement::setExpanded):
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+
+2009-06-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add event handler attribute getter/setters to HTMLBodyElement
+        as specified in HTML 5.
+
+        - Removes erroneous inclusion of the onresize and onunload event
+        handler attributes in Element and Document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::getWindowAttributeEventListener):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
+        virtual, since their behavior for HTMLBodyElement differs from the base
+        implementation.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onblur):
+        (WebCore::HTMLBodyElement::setOnblur):
+        (WebCore::HTMLBodyElement::onerror):
+        (WebCore::HTMLBodyElement::setOnerror):
+        (WebCore::HTMLBodyElement::onfocus):
+        (WebCore::HTMLBodyElement::setOnfocus):
+        (WebCore::HTMLBodyElement::onload):
+        (WebCore::HTMLBodyElement::setOnload):
+        (WebCore::HTMLBodyElement::onbeforeunload):
+        (WebCore::HTMLBodyElement::setOnbeforeunload):
+        (WebCore::HTMLBodyElement::onmessage):
+        (WebCore::HTMLBodyElement::setOnmessage):
+        (WebCore::HTMLBodyElement::onoffline):
+        (WebCore::HTMLBodyElement::setOnoffline):
+        (WebCore::HTMLBodyElement::ononline):
+        (WebCore::HTMLBodyElement::setOnonline):
+        (WebCore::HTMLBodyElement::onresize):
+        (WebCore::HTMLBodyElement::setOnresize):
+        (WebCore::HTMLBodyElement::onstorage):
+        (WebCore::HTMLBodyElement::setOnstorage):
+        (WebCore::HTMLBodyElement::onunload):
+        (WebCore::HTMLBodyElement::setOnunload):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26601
+        Remove disabled code for appcache dynamic entries
+
+        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDOMStringListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
+        * dom/DOMStringList.cpp: Removed.
+        * dom/DOMStringList.h: Removed.
+        * dom/DOMStringList.idl: Removed.
+        * dom/StaticStringList.cpp: Removed.
+        * dom/StaticStringList.h: Removed.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::addResource):
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::dumpType):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeUpdatedType):
+        * loader/appcache/DOMApplicationCache.cpp:
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/DOMWindow.idl:
+
+2009-06-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp:
+        * html/HTMLElementsAllInOne.cpp:
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
+        Japanese can't be input.
+
+        WebKit uses a per-frame input context for most editable fields, and application's global
+        context for password fields, manually controlling secure input state and the list of available
+        input sources.
+
+        We were setting TSMDocument property to disable non-Roman input methods after focus changed
+        to a password field, but before selection was updated. This resulted in the property being
+        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
+        context cached by +[NSApplication updateWindows], we change context based on selection,
+        not on focus.
+
+        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
+        context that we use for password fields - the global one - there is no need to get the active
+        one.
+
+2009-06-22  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt and Eric Seidel.
+
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+
+        Test: scrollbars/scrollbar-crash-on-refresh.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
+
+2009-06-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
+          <rdar://problem/6537777> CSS gradient not repainted when image load
+          completes
+
+        Test: fast/repaint/background-generated.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers): Return true if the layer does not
+        specify a size and the image uses the container size.
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26607
+
+        Add IDL for HTMLDataGridRowElement.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::primary):
+        (WebCore::HTMLDataGridColElement::setPrimary):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::checkDTD):
+        (WebCore::HTMLDataGridElement::multiple):
+        (WebCore::HTMLDataGridElement::setMultiple):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp: Added.
+        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
+        (WebCore::HTMLDataGridRowElement::selected):
+        (WebCore::HTMLDataGridRowElement::setSelected):
+        (WebCore::HTMLDataGridRowElement::focused):
+        (WebCore::HTMLDataGridRowElement::setFocused):
+        * html/HTMLDataGridRowElement.h: Added.
+        (WebCore::HTMLDataGridRowElement::tagPriority):
+        * html/HTMLDataGridRowElement.idl: Added.
+        * html/HTMLTagNames.in:
+
+2009-06-19  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26556
+
+        Fix a crash in case that the QNetworkReply::readReady signal is
+        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
+        QNetworkreply::finished signal is received and processed before
+        QNetworkReply::readReady is processed.
+
+        * manual-tests/qt/unload-alert.html: Added.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::setLoadMode):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::sendQueuedItems):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::):
+
+2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro:
+
+2009-06-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
+        more consistent and to make SVGElement.h be included in the header rather than in
+        every implementation file that includes the header. Added code to use getAttribute
+        and setAttribute directly when the [Reflect] extended attribute is used.
+
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
+        reflect content attributes. Restricting this to one class for now to keep the
+        patch small and start out slowly.
+
+2009-06-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
+        Only expose event handler attributes to elements and documents.
+
+        Test: fast/dom/event-attribute-availability.html
+
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Node.idl:
+
+2009-06-21  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26580
+        
+        Fix to enable XSSAuditor on child windows.
+        
+        Test: http/tests/security/xssAuditor/link-opens-new-window.html
+        
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
+        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
+        to query Settings.
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Speculative windows build fix (idea by Mark Rowe).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Speculative gtk build fix).
+
+        * GNUmakefile.am:
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Speculative tiger build fix and a windows build fix.
+        More fixes may still be in order.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Speculative tiger build fix).
+
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26448>
+        
+        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
+        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread
+        * dom/MessagePort.h:
+        * dom/MessagePortProxyWrapper.h:
+        * dom/default/MessagePortProxy.cpp:
+        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread        
+        (WebCore::MessagePortProxy::hasPendingActivity):
+        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
+        (WebCore::MessagePortProxy::locallyEntangledPort):
+        * dom/default/MessagePortProxy.h:
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
+
+        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
+        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
+        entirely into the platform-dependent proxy.
+
+        Created a thread-safe default PlatformMessagePortChannel implementation.
+
+        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
+        cross-thread MessagePorts work.
+        
+        * GNUMakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+            Added MessagePortChannel/PlatformMessagePortChannel files.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+            Changed ports to not mark their entangled pair as reachable, per the spec.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::~MessagePort):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        (WebCore::MessagePort::messageAvailable):
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::contextDestroyed):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::hasPendingActivity):
+            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
+        * dom/MessagePort.h:
+            Renamed isQueueOpen() to started().
+        * dom/MessagePort.idl:
+            Removed startConversation and onclose.
+        * dom/MessagePortProxy.h: Removed.
+        * dom/MessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+        * dom/MessagePortChannel.h: Added.
+        (WebCore::MessagePortChannel::EventData::message):
+        (WebCore::MessagePortChannel::EventData::channel):
+            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::create):        
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
+            Renamed isQueueOpen() to started().
+        * dom/default/PlatformMessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::entangleIfOpen):
+        (WebCore::MessagePortChannel::disentangle):
+        (WebCore::MessagePortChannel::postMessageToRemote):
+        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::MessagePortChannel::close):
+        (WebCore::MessagePortChannel::isConnectedTo):
+        (WebCore::MessagePortChannel::hasPendingActivity):
+        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::createChannel):
+        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
+        (WebCore::PlatformMessagePortChannel::disentangle):
+        (WebCore::PlatformMessagePortChannel::setRemotePort):
+        (WebCore::PlatformMessagePortChannel::remotePort):
+        (WebCore::PlatformMessagePortChannel::entangledChannel):
+        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
+        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::PlatformMessagePortChannel::isConnectedTo):
+        (WebCore::PlatformMessagePortChannel::close):
+        (WebCore::PlatformMessagePortChannel::closeInternal):
+        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
+        * dom/default/PlatformMessagePortChannel.h: Added.
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        (WebCore::DOMWindow::postMessageTimerFired):
+
+2009-06-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
+          <rdar://problem/5682745> resize: vertical does not restrict to vertical
+          resize
+
+        Test: fast/css/resize-single-axis.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
+        axis.
+
+2009-06-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
+        event.currentTarget for listener registered on window should point to the window object like in Firefox
+
+        Test: fast/events/event-trace.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
+        to it. We previously used the document because DOMWindow was not yet an EventTarget.
+
+2009-06-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
+          resize value not compared
+
+        Test: fast/css/resize-value-compared.html
+
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::operator==): Compare the resize
+        member.
+
+2009-06-19  Alice Liu  <alice.liu@apple.com>
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
+        Repro crash animating GIF if previously used in a closed window's back/forward list
+        Also filed as <rdar://problem/6978362>
+
+        Reviewed by Maciej Stachowiak.
+
+        Can't test this bug with an automated layout test since it requires b/f caching 
+        * manual-tests/animated-gif-bfcache-crash.html: Added.
+        * manual-tests/resources/containsAnimatedGif.html: Added.
+
+        Adding checks for hostWindow() since there is no guarantee that the Page is alive
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        (WebCore::ScrollView::contentsToScreen):
+        (WebCore::ScrollView::screenToContents):
+        (WebCore::ScrollView::wheelEvent):
+
+2009-06-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
+        Shadowing of top and parent
+
+        * page/DOMWindow.idl:
+
+2009-06-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
+        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
+
+        We allow selections to begin within an element that has -webkit-user-select: none set,
+        unless the element is draggable as dragging should take priority over starting a selection.
+
+        Test: editing/selection/user-drag-element-and-user-select-none.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::canStartSelection):
+
+2009-06-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=26528
+        rdar://problem/6985329
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
+        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
+        remove assumption that innerTextElement will never be 0 since RenderTextControl
+        doesn't really guarantee this.
+
+2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY.
+
+        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
+
+        * WebCore.pro:
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26561
+
+        Remove a memcpy by retrieving the already existing copy of a string
+        instead of making a new one.
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::source):
+
+2009-06-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26488
+        No Support for Single Finger or Two Finger Panning in Windows 7
+        
+        The code in WebCore allows us to interpret a Pan gesture as
+        a mousewheel event, and we are able to reuse the scrolling code.
+        Another constructor was created in WheelEventWin which takes data
+        better suited to the pan guesture than what was currently there. 
+        
+        Unable to add tests to simulate touch behavior/gestures.
+
+        * platform/PlatformWheelEvent.h:
+        * platform/win/WheelEventWin.cpp:
+
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
+
+        Fixed a build error, which only shows up in the i386 compile
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
+        video track becomes detached from its controller.
+        
+        When in the media document, the MediaPlayer should not report that it
+        is capable of hardware acceleration, because it renders via a QTMovieView
+        which is already accelerated.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+
+2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Adding XSSAuditor.cpp to the wx build.
+
+        * WebCoreSources.bkl:
+
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26544
+
+        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
+        This is not really testable, since we can't see what the hardware animation is doing.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        An additional fix for Bug 26532: Native functions do not correctly unlink
+        from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
+
+        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
+        accessors, so the type of object you get to wrap a function is the same,
+        regardless of whether the access to the function is cross-frame.
+        
+        This is faster and more idiomatic than what we had before. It also would
+        have avoided Bug 26532 because it would have prevented a conflicting
+        PrototypeFunction from being allocated to wrap postMessage, where a
+        NativeFunctionWrapper had been allocated previously.
+        
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan
+
+        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
+        
+        Fix a crash that could occur in complex content due to timing issues
+        when doing a partial layer tree rebuild which is required when painting;
+        setCompositingParent() could be called with a parent which has not been made
+        compositing yet.
+
+2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix. Adding missing HTMLDataGrid* files to the build.
+
+        * GNUmakefile.am:
+
+2009-06-19  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
+        Make BMPImageReader a standalone class that is used by ICOImageDecoder
+        and BMPImageDecoder to decode individual BMPs within a file.  These
+        decoders now inherit directly from ImageDecoder.
+        
+        This also makes these decoders decode on-demand in isSizeAvailable() and
+        frameBufferAtIndex(), like the other decoders, instead of when setData()
+        is called, like before.  This should provide a speedup on pages
+        containing BMPs that aren't immediately onscreen.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        (WebCore::BMPImageReader::setFailed):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::setBuffer):
+        (WebCore::BMPImageReader::setData):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26555
+
+        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
+        the same API in V8 and JSC.
+
+        * WebCore/bindings/js/ScriptController.cpp:
+        * WebCore/bindings/js/ScriptSourceCode.h:
+        * WebCore/bindings/v8/ScriptController.cpp:
+        * WebCore/page/XSSAuditor.cpp:
+        * WebCore/page/XSSAuditor.h:
+
+2009-06-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26547
+        
+        Implement the IDL interface for HTMLDataGridColElement.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp: Added.
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::label):
+        (WebCore::HTMLDataGridColElement::setLabel):
+        (WebCore::HTMLDataGridColElement::type):
+        (WebCore::HTMLDataGridColElement::setType):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        (WebCore::HTMLDataGridColElement::selected):
+        (WebCore::HTMLDataGridColElement::setSelected):
+        * html/HTMLDataGridColElement.h: Added.
+        (WebCore::HTMLDataGridColElement::endTagRequirement):
+        (WebCore::HTMLDataGridColElement::tagPriority):
+        * html/HTMLDataGridColElement.idl: Added.
+        * html/HTMLDataGridElement.h:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+
+2009-06-19  Chris Evans  <scarybeasts@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        There is no new test because this cannot be tested deterministically.
+        I've not been able to cause a crash at all in the test framework, but
+        I have verified that this is happening in the wild and that the patch
+        fixes the likely cause in the debugger.
+
+        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
+          of our input buffer looking for the end of the comment.
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26536
+
+        Fix external-script-URL-location.html and
+        write-external-script-open.html LayoutTests.
+
+        implicitOpen is called from several places.  We need to setXSSAuditor
+        each time, so I moved the call inside implicitOpen.
+
+        * dom/Document.cpp:
+        (WebCore::Document::open):
+        (WebCore::Document::implicitOpen):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-06-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
+        that Chromium shows only the first filename even if a user selects
+        multiple files for <input type=file multiple>.
+        <https://bugs.webkit.org/show_bug.cgi?id=26502>
+
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+
+2009-06-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
+          to look up a word in Dictionary using command-control-d
+
+        Test: editing/selection/move-by-line-005.html
+
+        The root cause of this bug was searchAheadForBetterMatch() continuing
+        past the first rendered text object after the given object. While we
+        want to skip non-rendered text and empty containers, when we encounter
+        rendered text object, we must return a text box for that object.
+
+        * dom/Position.cpp:
+        (WebCore::searchAheadForBetterMatch):
+
+2009-06-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by David Levin
+
+        https://bugs.webkit.org/show_bug.cgi?id=25657
+
+        Chromium Linux port does not handle non-BMP characters properly.
+        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
+        codepoints out of a UTF-16 input string.
+
+        A manual test is added for non-BMP character rendering,
+        which we can use until a small freely-distributable font
+        covering non-BMP is added to the Webkit source tree.
+
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * manual-tests/non-bmp.html: Added.
+
+2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings: return proper state from the script stack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26512
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+
+2009-06-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Windows build fix.
+        
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+        Build fix after 44825.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
+        <https://bugs.webkit.org/show_bug.cgi?id=26426>
+
+        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
+        The original number cannot be represented by mantissa of float
+        (23bit) so that it caused some error.
+
+        Test: fast/canvas/image-object-in-canvas.html:
+
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+
+2009-06-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26199
+
+        Added an experimental reflective XSS filter.  The filter is disabled by
+        default.
+
+        Test: http/tests/security/xssAuditor/script-tag.html
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * dom/Tokenizer.h:
+        (WebCore::Tokenizer::xssAuditor):
+        (WebCore::Tokenizer::setXSSAuditor):
+        (WebCore::Tokenizer::Tokenizer):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::requestObject):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setXSSAuditorEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::xssAuditorEnabled):
+        * page/XSSAuditor.cpp: Added.
+        (WebCore::isControlCharacter):
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::~XSSAuditor):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h: Added.
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::setXSSAuditorEnabled):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feOffset and objectBoundingBox
+        [https://bugs.webkit.org/show_bug.cgi?id=26441]
+
+        If we use objectBoundingBox for primitiveUnits, the fractions given
+        to dx or dy of feOffset must be multiplied with the referenced objects
+        objectBoundingBox size.
+
+        Test: svg/filters/feOffset.svg
+
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feTile implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=26419]
+
+        Implementation of feTile, a pattern effect for SVG filters. It was
+        necessary to modify FilterEffect since source inputs need a secial
+        logic and we have to identify if an effect is a source input.
+
+        Tests: svg/batik/filters/feTile.svg
+               svg/filters/feTile.svg
+
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isSourceInput):
+        * platform/graphics/filters/SourceAlpha.h:
+        (WebCore::SourceAlpha::isSourceInput):
+        * platform/graphics/filters/SourceGraphic.h:
+        (WebCore::SourceGraphic::isSourceInput):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feMerge implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=26480]
+
+        Added feMerge to the SVG Filter system.
+
+        Test: svg/filters/feMerge.svg
+
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::uniteChildEffectSubregions):
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+
+2009-06-18  Mark Rowe  <mrowe@apple.com>
+
+        Speculative Windows build fix.
+
+        * page/win/FrameCGWin.cpp: Add missing #include.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26425
+        Final refactorings, picking up a few places where BitmapInfo
+        could be used.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        * platform/win/CursorWin.cpp:
+        (WebCore::Cursor::Cursor):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+
+2009-06-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
+        https://bugs.webkit.org/show_bug.cgi?id=26522
+
+        Test: accessibility/non-data-table-cell-title-ui-element.html
+
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::titleUIElement):
+
+2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after recent RenderTheme changes.
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::~RenderThemeWx):
+        (WebCore::RenderTheme::themeForPage):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
+        Attempt to minimize diff of following functional change by first landing
+        non-functional change to:
+        * Make readUintX() public and static (since they will need to be once
+          BMPImageReader is included in *ImageDecoder via composition rather
+          than inheritance).  Add wrappers in each class so callers can be
+          simpler.  In the next patch, these wrappers will be beefed up slightly
+          and the callers will get even simpler.
+        * Change direct setting of m_failed to use setFailed(), since in the
+          next patch much of this code won't even have direct access to m_failed
+        * Add a helper function in ICOImageDecoder to determine the image type
+          instead of simply doing it inline
+        * Rewrap lines that used to be <=80 cols and slipped over it during the
+          original landing of these decoders
+        * Other misc. changes, e.g. adding constructor definitions, reordering
+          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
+          functional effect but minimize the subsequent diff for readability
+
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::getInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16Helper):
+        (WebCore::BMPImageReader::readUint32Helper):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        (WebCore::BMPImageReader::fillRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::decodeImage):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::isBetterEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Fix build bustage.
+
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
+
+        Convert intptr_t to Strings so that we don't loose bits in the
+        conversion to JS.  Previously they were being put into 32bit ints.
+
+        * inspector/InspectorController.cpp: Convert the String back to an
+        intptr_t.
+        (WebCore::InspectorController::addBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
+        truncation.
+        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        * platform/text/PlatformString.h: Implemented the necessary conversion
+        functions to be able to convert to and from an intptr_t.
+        * platform/text/String.cpp: Ditto.
+        (WebCore::String::toIntPtrStrict):
+        (WebCore::String::toIntPtr):
+        (WebCore::charactersToIntPtrStrict):
+        (WebCore::charactersToIntPtr):
+        * platform/text/StringImpl.cpp: Ditto.
+        (WebCore::StringImpl::toIntPtrStrict):
+        (WebCore::StringImpl::toIntPtr):
+        * platform/text/StringImpl.h: Ditto.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Final cleanups in this refactoring:
+        (1) Move WindowsBitmap implementation from CG-specific file to
+            the platform-common GraphicsContextWin.cpp, since it is
+            equally useful on both platforms.
+        (2) Revise the TransformationMatrix logic as suggested by
+            Adam Roben in his review comments to Part #2 of this
+            refactoring.
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
+        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
+        (WebCore::GraphicsContext::createWindowsBitmap):
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
+        Make isSizeAvailable non-const, since it's not logically const (it
+        triggers lazy decoding), and simplify all the implementations (without
+        changing behavior; just make less verbose).  Remove some other
+        inappropriate consts, which enables the removal of all the mutable
+        declarations in the decoders.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::isSizeAvailable):
+        (WebCore::XBMImageDecoder::frameBufferAtIndex):
+        (WebCore::XBMImageDecoder::decode):
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move some common functions out of platform files and into
+        the common implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+        Add a new platform context method (flush) so that the
+        getWindowsContext method can be consolidated into the common
+        GraphicsContextWin.cpp file.
+         
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
+          getWindowContext method.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
+          getWindowContext method and fillWithClearColor methods.
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
+        (WebCore::GraphicsContext::getWindowsContext): Moved
+          from *CairoWin.cpp
+
+2009-06-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove code that I accidentally committed in r44811.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
+        starts sometimes (with hardware acceleration).
+        
+        When deciding which RenderLayers should be composited, when a layer goes into
+        compositing mode we repaint the old location. However, we did that before
+        we'd looked at all the factors that may force a layer to composite, so missed
+        some cases. Fix by doing the repaint once we really know whether it's going
+        to composite.
+
+        Test: compositing/repaint/become-overlay-composited-layer.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
+        the Tiger build where QTMovieLayer does not exist.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+
+2009-06-17  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15189
+        Adds the HTML5 input event support for textarea.
+        
+        Also, moves the oninput attribute parse handling to HTMLElement so that
+        it can be set on any HTML element so that bubbling events can be handled
+        using HTML attribute handlers.
+
+        Test: fast/forms/textarea-input-event.html
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Share code between filterEffects
+        [https://bugs.webkit.org/show_bug.cgi?id=26479]
+
+        Share more code of filter effects. The imageBuffer creation can move to
+        FilterEffect ant every effect asks for the GraphicsContext. Move the
+        drawingRect calculation to FilterEffect.
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingRect):
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26499
+        
+        Support hardware-accelerationed rendering of video elements.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
+        Just move these methods to group the render-related methods together.
+        
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        Call out method to ask the RenderLayerCompositor if presentation of this video
+        can be acclerated. It might say no, if, for example, the video has a reflection.
+        
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
+        
+        * html/HTMLMediaElement.h:
+        Reordered the rendering-related methods, and added two methods related to video
+        acceleration.
+        
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
+        Called by the rendering system when it determines that the video must go into, or
+        fall off of the hardware-accelerated path.
+        
+        (WebCore::MediaPlayer::supportsAcceleratedRendering):
+        Method to say whether the media engine supports accelerated rendering.
+        
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
+        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
+        Moved.
+        
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
+        New methods to ask the client if the rendering system can support accelerated
+        rendering, and to get a GraphicsLayer to plug the movie layer into.
+        
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
+        Forwarding methods from MediaPlayer.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        Methods to create and destroy the QTMovieLayer.
+        
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
+        Methods to clarify the code that decides which of the 3 rendering modes to use.
+        
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        Changed to use the new rendering mode methods.
+        
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        Destroy the layer if we have one.
+        
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+        Small utility method.
+        
+        (WebCore::MediaPlayerPrivate::updateStates):
+        Move the call to setUpVideoRendering() to before we send out the state notifications,
+        so that we will have created the rendering objects already.
+        
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        Return true if we have QTMovieLayer.
+        
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        We've been told that we went into or out of accelerated mode; maybe reset
+        the renderer, and set the layer if we have to.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        We may need to udpate compositing layers if the video went into accelerated mode.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        Add smarts to deal with video, which allows us to avoid extra backing store.
+        
+        (WebCore::RenderLayerBacking::contentsBox):
+        Use the videoBox to use the content layer for video layers.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Poke the RenderVideo if the state changed.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Handle an edge case when the video element itself is a stacking context
+        because of opacity or transform.
+        
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        Allow video to throw us into compositing mode if the media engine supports it.
+        
+        * rendering/RenderLayerCompositor.h:
+        New methods related to video.
+        
+        * rendering/RenderVideo.h:
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer):
+        Call rendererContentChanged() to give the compositor a change to throw the video into
+        compositing mode.
+        
+        (WebCore::RenderVideo::supportsAcceleratedRendering):
+        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
+        (WebCore::RenderVideo::videoGraphicsLayer):
+        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
+
+2009-06-18  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Niko.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26385
+        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
+
+        Also do the isValid check for outer <svg>.
+
+        Test: svg/custom/outer-svg-unknown-feature.svg
+
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+
+2009-06-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
+          apple.com cuts entered text
+
+        Test: fast/forms/search-vertical-alignment.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
+            the search field's inner block.
+
+2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with Symbian WINSCW compiler, which produced
+        multiple definitions of the CSSPrimitiveValue conversion operators.
+
+        It turns out that they are defined inline but not declared inline.
+
+        Adding the inline keyword to the declaration fixes the build.
+
+        * css/CSSPrimitiveValue.h:
+
+2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Simon Hausman.
+
+        Clarify in docs how to compile with debug information.
+
+        * WebCore.pro:
+
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] When writing an URL to the clipboard, save the corresponding title
+        in the mime data as well.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writeURL):
+
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build. Add HTMLDataGridElement.
+
+        * WebCore.pro:
+
+2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix.
+
+        Add HTMLDataGridElement header and IDL to the build script.
+
+        * GNUmakefile.am:
+
+2009-06-18  Chris Evans  <scarybeasts@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Fix 8-digit long hex entities. Fixes bug 26454
+        https://bugs.webkit.org/show_bug.cgi?id=26454
+
+        Test: fast/parser/eightdigithexentity.html
+
+        * html/HTMLTokenizer.cpp: fix off-by-ones.
+
+2009-06-18  David Levin  <levin@chromium.org>
+
+        Fix chromium linux build.
+
+        Fixes a mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+
+2009-06-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26499
+        
+        First step to making video rendering be hardware-accelerated:
+        make <video> elements get self-painting RenderLayers, and add
+        an isVideo() virtual method to RenderObject.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isVideo):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::requiresLayer):
+        (WebCore::RenderVideo::isVideo):
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+
+        (1) Create TransformationMatrix XFORM casting operator, and
+            switch various XFORM structure uses to utilize it.
+        (2) Push concatCTM call to GraphicsContextWin now that the
+            TransformationMatrix can directly create XFORM (rather
+            than converting to CGAffineTransform/cairo_matrix_t first.)
+
+        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Non-CG Windows build fix after @r44758.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderTheme::themeForPage):
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+
+        Refactor use of BITMAPINFO for the new BitmapInfo structure.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/BitmapInfo.cpp: Added.
+        (WebCore::bitmapInfoForSize):
+        (WebCore::BitmapInfo::create):
+        (WebCore::BitmapInfo::createBottomUp):
+        * platform/win/BitmapInfo.h: Added.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+        * platform/win/DragImageCGWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/DragImageCairoWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
+
+        Reviewed by Mark Rowe.
+
+        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
+        an unnecessary parameter name.
+        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Make Settings::shouldPaintNativeControls default to true
+
+        This matches the default up in WebKit (that was changed in r43318).
+
+        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
+        form controls
+        <https://bugs.webkit.org/show_bug.cgi?id=26493>
+
+        Reviewed by Darin Adler and Dave Hyatt.
+
+        No test possible since DRT always uses Mac-style form controls.
+
+        * page/Settings.cpp: Changed the initial value of
+        gShouldPaintNativeControls to true.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
+        flaw here involving querying Settings before it's been initialized.
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Fix chromium windows build.
+
+        A mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
+
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+
+2009-06-17  David Hyatt  <hyatt@apple.com>
+
+        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
+
+        * html/HTMLElementsAllInOne.cpp:
+
+2009-06-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben and Anders Carlsson.
+
+        Stub out the HTMLDataGridElement.
+
+        * DerivedSources.make:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing):
+        * html/HTMLDataGridElement.h: Added.
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::tagPriority):
+        * html/HTMLDataGridElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Fix typo in previous changes.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Remove common code from RenderThemeChromiumWin that is shared with
+        RenderThemeChromiumSkia.
+
+        Also move supportsControlTints to RenderThemeChromiumLinux since it
+        is linux specific.
+
+        There are no tests changed because this just removes functions with
+        duplicate implementations between the base and derived classes.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::getNonClientMetrics):
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::systemFont):
+        (WebCore::RenderThemeChromiumWin::paintCheckbox):
+        (WebCore::RenderThemeChromiumWin::paintRadio):
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::):
+        (WebCore::setSizeIfAuto):
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::brightenColor):
+        (WebCore::paintButtonLike):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumSkia.h:
+        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
+        is mostly a code shuffle.  The non-suffle changes are:
+           1) Creation of a caretBlinkIntervalInternal.
+           2) Moving of some inline functions into the implementation files.
+           3) Changing of defaultGUIFont into a static class constant from a
+              static function.  Also the type is changed to String.
+           4) Changing of defaultFontSize into a static class constant from a
+              static variable in the file scope.
+           5) The static supportsFocus function was collapsed into
+              supportsFocusRing.
+           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::systemColor):
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add a SOFT_LINK_OPTIONAL macro
+
+        This macro is useful when soft-linking functions that are present in
+        only some versions of a particular library (e.g., APIs added in
+        Windows Vista that aren't available on Windows XP).
+
+        Reviewed by Ada Chan.
+
+        * platform/graphics/win/ColorSafari.cpp:
+        (WebCore::focusRingColor):
+        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
+        Also removed an unused call to focusRingColor.isValid().
+
+        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
+        The use of zero-width or zero-height rectangles in generating
+        gradients caused Windows Cairo to crash, and webkitgtk to
+        produce invalid images.
+
+        We now test for NaN in the phase argument, which is calculated
+        using fmodf and can blow up when the width/height values passed
+        are zero.
+
+        Test: fast/gradients/border-image-gradient-sides-and-corners.html
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-06-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to
+        try to load it by calling ensureFontLoaded. If it still fails after
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
+
+        This case happens once in a while during browser shutdown. The browser will
+        queue a message to the renderer to shutdown, and will then stop answering sync
+        messages from the renderer. If the renderer is still loading a page during this
+        time, it might try to call the browser process to ask to load a font. The
+        browser process will ignore the request, and the font will fail to load, even
+        after the second try.
+
+        This is unfortunate, but there is no real risk here, since the renderer will be
+        going away as soon as it processes another message.
+        
+        This can't be layout tested as it depends on the sandbox.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26484
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26482
+        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
+        playing (doesn't resume later)
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setRate): Ditto.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add all the generated JS*.cpp files back to WebCore.vcproj
+
+        They are not compiled by the vcproj directly. Instead they are
+        compiled as part of DerivedSources.cpp. Having them listed in the
+        vcproj makes them be included in Project Find, etc.
+
+        Rubber-stamped in advance by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-06-17  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Don't fire redundant 'change' events for a file upload form.
+        https://bugs.webkit.org/show_bug.cgi?id=26471
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::chooseFiles): Suppress change event if the
+        existing selected files and the incoming selected files are equal.
+        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
+        files.
+
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * platform/KeyboardCodes.h:
+
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * page/Page.h: Forward-declare RenderTheme instead of including
+        RenderTheme.h so that we don't need to make RenderTheme.h a private
+        header for WebKit's benefit.
+
+        * editing/SelectionController.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderObject.cpp:
+        Added #includes of RenderTheme.h.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::create): Added.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
+        parameter.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * page/Page.cpp:
+        (WebCore::Page::Page): Change the initializer order to match the
+        declaration order.
+
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
+
+        Make the Qt implementation of RenderTheme create a theme per page,
+        and use the QStyle associated with the view of each page, in order
+        to make the QWidget setStyle() method work as advertised.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::findFrameLineWidth):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::adjustRepaintRect):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::setButtonPadding):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::setPopupPadding):
+        * platform/qt/RenderThemeQt.h:
+
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Dave Hyatt and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
+
+
+        Create a different RenderTheme per page, so that RenderTheme has
+        access to page specific theming. This is needed for the Qt port, as Qt
+        supports setting the theme (style) per widget.
+
+        This change was suggested and discussed with Dave Hyatt.
+
+        More detailed:
+
+        1) Create a theme per page or one global one, depending on the needs
+           of the platform.
+        2) Add an accesser to the theme from RenderObject.
+        3) Change all uses of the theming to access the theme through
+           RenderObject, using the global default theme as fallback, when the
+           document of RenderObject has no page.
+           When we don't have access to a RenderObject, use the default theme.
+        4) Modify all RenderTheme platform implementations to work with the
+           above changes, still creating only one global theme.
+
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateControlTints):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::theme):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::gtkEntry):
+        (WebCore::RenderThemeGtk::gtkTreeView):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::create):
+        (WebCore::RenderTheme::themeForPage):
+        * platform/qt/RenderThemeQt.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::determineState):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::hitTest):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::theme):
+        * rendering/RenderObject.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::defaultTheme):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeWin.h:
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
+
+        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
+        appears to be fundaementally incorrect - PropertySlots are only used to get
+        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
+        used in the fashion desired here - it only reports the caching type of a
+        write that has been performed.
+
+        (This caused a bug where the put should have triggered a transition, and
+        failed to do so.)
+
+        Removing the faulty case from the optimization leads to a ~0.5% progression
+        on in-browser SunSpider (presumably the very first case was not being hit
+        often, and the simplification here is beneficial).
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::put):
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY, layout tests fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+        This reverts commit r44751.
+
+        Once that change was checked scrollbars/scrollbar-orientation.html started
+        crashing on Windows.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderScrollbar.h:
+
+2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26458
+
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-06-16  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+
+        Test: scrollbars/scrollbar-crash-on-refresh.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
+
+2009-06-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
+        This patch kept the way events were firing as they were before, and Windows events are
+        consistent with Mac.       
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
+        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
+
+2009-06-16  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
+        
+        When revalidating a resource, calling addClient() on one client might cause another to get removed.
+        
+        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
+        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
+        - check if the client is still in the set before invoking didAddClient() for it
+        
+        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
+        reference each other via @imports and reloading.
+
+        * WebCore.base.exp:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::didAddClient):
+        * loader/CachedFont.h:
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::didAddClient):
+        * loader/CachedImage.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::addClient):
+        (WebCore::CachedResource::addClientToSet):
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::didAddClient):
+        * loader/CachedScript.h:
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        * loader/CachedXSLStyleSheet.h:
+
+2009-06-16  Simon Fraser  <simon.fraser@apple.com>
+
+        No Review
+
+        Fix code inside an #ifdef that draws the video framerate.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=26456
+
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
+          handling in Worker constructor for V8 bindings.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
+        Provide an assignment operator to avoid improper reference
+        counts on the Cairo font objects.  This brings the Windows
+        Cairo port in line with the GTKport.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+
+2009-06-16  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
+        the MediaControlInputElement, rather than computing it again
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
+        * html/HTMLMediaElement.h:
+
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
+        state from the button itself and get movie state from HTMLMediaElement.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 26450: Rename values of enum RedirectOriginCheck to make them
+        clearer.
+        https://bugs.webkit.org/show_bug.cgi?id=26450
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-06-16  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
+        https://bugs.webkit.org/show_bug.cgi?id=26449
+        No new tests, covered by purify.
+
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::push):
+
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Test: fast/multicol/columns-shorthand-parsing.html 
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
+        Null Cairo contextwill crash Windows Cairo build.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::syncContext):
+          Add a check for null context before attempting to
+          retrieve the Cairo surface.
+
+2009-06-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26447
+        Fix animated GIF breakage in Cairo/wx ports.
+
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+
+2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by John Sullivan
+        
+        <rdar://problem/6937882>
+        
+        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
+
+        * css/mediaControlsQT.css:
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth and David Levin.
+
+        Bug 26146: Change to use ThreadableLoader to load the worker script
+        in order to check URL origin for redirection.
+        https://bugs.webkit.org/show_bug.cgi?id=26146
+
+        Test: http/tests/workers/worker-redirect.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerImportScriptsClient.cpp: Removed.
+        * workers/WorkerImportScriptsClient.h: Removed.
+        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
+          This to make it more generic so worker script loading could use it.
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::didFinishLoading):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyFinished):
+        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
+          This to make it more generic so worker script loading could use it.
+        * workers/WorkerScriptLoaderClient.h: Added.
+
+2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Use consistent GUID comparison functions.
+        https://bugs.webkit.org/show_bug.cgi?id=26427
+
+        * platform/win/WCDataObject.cpp:
+        (WebCore::WCDataObject::QueryInterface):
+
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix compiler warning.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_class_init):
+
+2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27424
+
+        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
+        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
+
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove dummy AtkStreamableContent implementation.
+
+        It's completely empty, we'll add it back (and conditionally
+        instead of unconditionally) when it does something.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+
+== Rolled over to ChangeLog-2009-06-16 ==
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
deleted file mode 100644
index 1edbf7d..0000000
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ /dev/null
@@ -1,372 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
-
-#include "JSAbstractWorker.cpp"
-#include "JSAttr.cpp"
-#include "JSBarInfo.cpp"
-#include "JSBeforeLoadEvent.cpp"
-#include "JSCanvasGradient.cpp"
-#include "JSCanvasPattern.cpp"
-#include "JSCanvasRenderingContext.cpp"
-#include "JSCanvasRenderingContext2D.cpp"
-#if ENABLE(3D_CANVAS)    
-#include "JSCanvasRenderingContext3D.cpp"
-#endif
-#include "JSCDATASection.cpp"
-#include "JSCharacterData.cpp"
-#include "JSClientRect.cpp"
-#include "JSClientRectList.cpp"
-#include "JSClipboard.cpp"
-#include "JSComment.cpp"
-#include "JSConsole.cpp"
-#include "JSCounter.cpp"
-#include "JSCSSCharsetRule.cpp"
-#include "JSCSSFontFaceRule.cpp"
-#include "JSCSSImportRule.cpp"
-#include "JSCSSMediaRule.cpp"
-#include "JSCSSPageRule.cpp"
-#include "JSCSSPrimitiveValue.cpp"
-#include "JSCSSRule.cpp"
-#include "JSCSSRuleList.cpp"
-#include "JSCSSStyleDeclaration.cpp"
-#include "JSCSSStyleRule.cpp"
-#include "JSCSSStyleSheet.cpp"
-#include "JSCSSValue.cpp"
-#include "JSCSSValueList.cpp"
-#include "JSCSSVariablesDeclaration.cpp"
-#include "JSCSSVariablesRule.cpp"
-#include "JSDatabase.cpp"
-#include "JSDataGridColumn.cpp"
-#include "JSDataGridColumnList.cpp"
-#include "JSDedicatedWorkerContext.cpp"
-#include "JSDocument.cpp"
-#include "JSDocumentFragment.cpp"
-#include "JSDocumentType.cpp"
-#include "JSDOMApplicationCache.cpp"
-#include "JSDOMCoreException.cpp"
-#include "JSDOMImplementation.cpp"
-#include "JSDOMParser.cpp"
-#include "JSDOMSelection.cpp"
-#include "JSDOMWindow.cpp"
-#include "JSElement.cpp"
-#include "JSEntity.cpp"
-#include "JSEntityReference.cpp"
-#include "JSErrorEvent.cpp"
-#include "JSEvent.cpp"
-#include "JSEventException.cpp"
-#include "JSEventSource.cpp"
-#include "JSFile.cpp"
-#include "JSFileList.cpp"
-#include "JSHistory.cpp"
-#include "JSHTMLAllCollection.cpp"
-#include "JSHTMLAnchorElement.cpp"
-#include "JSHTMLAppletElement.cpp"
-#include "JSHTMLAreaElement.cpp"
-#include "JSHTMLAudioElement.cpp"
-#include "JSHTMLBaseElement.cpp"
-#include "JSHTMLBaseFontElement.cpp"
-#include "JSHTMLBlockquoteElement.cpp"
-#include "JSHTMLBodyElement.cpp"
-#include "JSHTMLBRElement.cpp"
-#include "JSHTMLButtonElement.cpp"
-#include "JSHTMLCanvasElement.cpp"
-#include "JSHTMLCollection.cpp"
-#include "JSHTMLDataGridElement.cpp"
-#include "JSHTMLDataGridCellElement.cpp"
-#include "JSHTMLDataGridColElement.cpp"
-#include "JSHTMLDataGridRowElement.cpp"
-#include "JSHTMLDataListElement.cpp"
-#include "JSHTMLDirectoryElement.cpp"
-#include "JSHTMLDivElement.cpp"
-#include "JSHTMLDListElement.cpp"
-#include "JSHTMLDocument.cpp"
-#include "JSHTMLElement.cpp"
-#include "JSHTMLElementWrapperFactory.cpp"
-#include "JSHTMLEmbedElement.cpp"
-#include "JSHTMLFieldSetElement.cpp"
-#include "JSHTMLFontElement.cpp"
-#include "JSHTMLFormElement.cpp"
-#include "JSHTMLFrameElement.cpp"
-#include "JSHTMLFrameSetElement.cpp"
-#include "JSHTMLHeadElement.cpp"
-#include "JSHTMLHeadingElement.cpp"
-#include "JSHTMLHRElement.cpp"
-#include "JSHTMLHtmlElement.cpp"
-#include "JSHTMLIFrameElement.cpp"
-#include "JSHTMLImageElement.cpp"
-#include "JSHTMLInputElement.cpp"
-#include "JSHTMLIsIndexElement.cpp"
-#include "JSHTMLLabelElement.cpp"
-#include "JSHTMLLegendElement.cpp"
-#include "JSHTMLLIElement.cpp"
-#include "JSHTMLLinkElement.cpp"
-#include "JSHTMLMapElement.cpp"
-#include "JSHTMLMarqueeElement.cpp"
-#include "JSHTMLMediaElement.cpp"
-#include "JSHTMLMenuElement.cpp"
-#include "JSHTMLMetaElement.cpp"
-#include "JSHTMLModElement.cpp"
-#include "JSHTMLObjectElement.cpp"
-#include "JSHTMLOListElement.cpp"
-#include "JSHTMLOptGroupElement.cpp"
-#include "JSHTMLOptionElement.cpp"
-#include "JSHTMLOptionsCollection.cpp"
-#include "JSHTMLParagraphElement.cpp"
-#include "JSHTMLParamElement.cpp"
-#include "JSHTMLPreElement.cpp"
-#include "JSHTMLQuoteElement.cpp"
-#include "JSHTMLScriptElement.cpp"
-#include "JSHTMLSelectElement.cpp"
-#include "JSHTMLSourceElement.cpp"
-#include "JSHTMLStyleElement.cpp"
-#include "JSHTMLTableCaptionElement.cpp"
-#include "JSHTMLTableCellElement.cpp"
-#include "JSHTMLTableColElement.cpp"
-#include "JSHTMLTableElement.cpp"
-#include "JSHTMLTableRowElement.cpp"
-#include "JSHTMLTableSectionElement.cpp"
-#include "JSHTMLTextAreaElement.cpp"
-#include "JSHTMLTitleElement.cpp"
-#include "JSHTMLUListElement.cpp"
-#include "JSHTMLVideoElement.cpp"
-#include "JSImageData.cpp"
-#include "JSJavaScriptCallFrame.cpp"
-#include "JSKeyboardEvent.cpp"
-#include "JSLocation.cpp"
-#include "JSMedia.cpp"
-#include "JSMediaError.cpp"
-#include "JSMediaList.cpp"
-#include "JSMessageChannel.cpp"
-#include "JSMessageEvent.cpp"
-#include "JSMessagePort.cpp"
-#include "JSMimeType.cpp"
-#include "JSMimeTypeArray.cpp"
-#include "JSMouseEvent.cpp"
-#include "JSMutationEvent.cpp"
-#include "JSNamedNodeMap.cpp"
-#include "JSNavigator.cpp"
-#include "JSNode.cpp"
-#include "JSNodeFilter.cpp"
-#include "JSNodeIterator.cpp"
-#include "JSNodeList.cpp"
-#include "JSNotation.cpp"
-#include "JSNotificationCenter.cpp"
-#include "JSNotification.cpp"
-#include "JSOverflowEvent.cpp"
-#include "JSPageTransitionEvent.cpp"
-#include "JSPlugin.cpp"
-#include "JSPluginArray.cpp"
-#include "JSProcessingInstruction.cpp"
-#include "JSProgressEvent.cpp"
-#include "JSRange.cpp"
-#include "JSRangeException.cpp"
-#include "JSRect.cpp"
-#include "JSRGBColor.cpp"
-#include "JSScreen.cpp"
-#include "JSSharedWorker.cpp"
-#include "JSSharedWorkerContext.cpp"
-#include "JSSQLError.cpp"
-#include "JSSQLResultSet.cpp"
-#include "JSSQLResultSetRowList.cpp"
-#include "JSSQLTransaction.cpp"
-#include "JSStorage.cpp"
-#include "JSStorageEvent.cpp"
-#include "JSStyleSheet.cpp"
-#include "JSStyleSheetList.cpp"
-#include "JSSVGAElement.cpp"
-#include "JSSVGAltGlyphElement.cpp"
-#include "JSSVGAngle.cpp"
-#include "JSSVGAnimateColorElement.cpp"
-#include "JSSVGAnimatedAngle.cpp"
-#include "JSSVGAnimatedBoolean.cpp"
-#include "JSSVGAnimatedEnumeration.cpp"
-#include "JSSVGAnimatedInteger.cpp"
-#include "JSSVGAnimatedLength.cpp"
-#include "JSSVGAnimatedLengthList.cpp"
-#include "JSSVGAnimatedNumber.cpp"
-#include "JSSVGAnimatedNumberList.cpp"
-#include "JSSVGAnimatedPreserveAspectRatio.cpp"
-#include "JSSVGAnimatedRect.cpp"
-#include "JSSVGAnimatedString.cpp"
-#include "JSSVGAnimatedTransformList.cpp"
-#include "JSSVGAnimateElement.cpp"
-#include "JSSVGAnimateTransformElement.cpp"
-#include "JSSVGAnimationElement.cpp"
-#include "JSSVGCircleElement.cpp"
-#include "JSSVGClipPathElement.cpp"
-#include "JSSVGColor.cpp"
-#include "JSSVGComponentTransferFunctionElement.cpp"
-#include "JSSVGCursorElement.cpp"
-#include "JSSVGDefsElement.cpp"
-#include "JSSVGDescElement.cpp"
-#include "JSSVGDocument.cpp"
-#include "JSSVGElement.cpp"
-#include "JSSVGElementInstance.cpp"
-#include "JSSVGElementInstanceList.cpp"
-#include "JSSVGEllipseElement.cpp"
-#include "JSSVGException.cpp"
-#include "JSSVGFEBlendElement.cpp"
-#include "JSSVGFEColorMatrixElement.cpp"
-#include "JSSVGFEComponentTransferElement.cpp"
-#include "JSSVGFECompositeElement.cpp"
-#include "JSSVGFEDiffuseLightingElement.cpp"
-#include "JSSVGFEDisplacementMapElement.cpp"
-#include "JSSVGFEDistantLightElement.cpp"
-#include "JSSVGFEFloodElement.cpp"
-#include "JSSVGFEFuncAElement.cpp"
-#include "JSSVGFEFuncBElement.cpp"
-#include "JSSVGFEFuncGElement.cpp"
-#include "JSSVGFEFuncRElement.cpp"
-#include "JSSVGFEGaussianBlurElement.cpp"
-#include "JSSVGFEImageElement.cpp"
-#include "JSSVGFEMergeElement.cpp"
-#include "JSSVGFEMergeNodeElement.cpp"
-#include "JSSVGFEMorphologyElement.cpp"
-#include "JSSVGFEOffsetElement.cpp"
-#include "JSSVGFEPointLightElement.cpp"
-#include "JSSVGFESpecularLightingElement.cpp"
-#include "JSSVGFESpotLightElement.cpp"
-#include "JSSVGFETileElement.cpp"
-#include "JSSVGFETurbulenceElement.cpp"
-#include "JSSVGFilterElement.cpp"
-#include "JSSVGFontElement.cpp"
-#include "JSSVGFontFaceElement.cpp"
-#include "JSSVGFontFaceFormatElement.cpp"
-#include "JSSVGFontFaceNameElement.cpp"
-#include "JSSVGFontFaceSrcElement.cpp"
-#include "JSSVGFontFaceUriElement.cpp"
-#include "JSSVGForeignObjectElement.cpp"
-#include "JSSVGGElement.cpp"
-#include "JSSVGGlyphElement.cpp"
-#include "JSSVGGradientElement.cpp"
-#include "JSSVGImageElement.cpp"
-#include "JSSVGLength.cpp"
-#include "JSSVGLengthList.cpp"
-#include "JSSVGLinearGradientElement.cpp"
-#include "JSSVGLineElement.cpp"
-#include "JSSVGMarkerElement.cpp"
-#include "JSSVGMaskElement.cpp"
-#include "JSSVGMatrix.cpp"
-#include "JSSVGMetadataElement.cpp"
-#include "JSSVGMissingGlyphElement.cpp"
-#include "JSSVGNumber.cpp"
-#include "JSSVGNumberList.cpp"
-#include "JSSVGPaint.cpp"
-#include "JSSVGPathElement.cpp"
-#include "JSSVGPathSeg.cpp"
-#include "JSSVGPathSegArcAbs.cpp"
-#include "JSSVGPathSegArcRel.cpp"
-#include "JSSVGPathSegClosePath.cpp"
-#include "JSSVGPathSegCurvetoCubicAbs.cpp"
-#include "JSSVGPathSegCurvetoCubicRel.cpp"
-#include "JSSVGPathSegCurvetoCubicSmoothAbs.cpp"
-#include "JSSVGPathSegCurvetoCubicSmoothRel.cpp"
-#include "JSSVGPathSegCurvetoQuadraticAbs.cpp"
-#include "JSSVGPathSegCurvetoQuadraticRel.cpp"
-#include "JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp"
-#include "JSSVGPathSegCurvetoQuadraticSmoothRel.cpp"
-#include "JSSVGPathSegLinetoAbs.cpp"
-#include "JSSVGPathSegLinetoHorizontalAbs.cpp"
-#include "JSSVGPathSegLinetoHorizontalRel.cpp"
-#include "JSSVGPathSegLinetoRel.cpp"
-#include "JSSVGPathSegLinetoVerticalAbs.cpp"
-#include "JSSVGPathSegLinetoVerticalRel.cpp"
-#include "JSSVGPathSegList.cpp"
-#include "JSSVGPathSegMovetoAbs.cpp"
-#include "JSSVGPathSegMovetoRel.cpp"
-#include "JSSVGPatternElement.cpp"
-#include "JSSVGPoint.cpp"
-#include "JSSVGPointList.cpp"
-#include "JSSVGPolygonElement.cpp"
-#include "JSSVGPolylineElement.cpp"
-#include "JSSVGPreserveAspectRatio.cpp"
-#include "JSSVGRadialGradientElement.cpp"
-#include "JSSVGRect.cpp"
-#include "JSSVGRectElement.cpp"
-#include "JSSVGRenderingIntent.cpp"
-#include "JSSVGScriptElement.cpp"
-#include "JSSVGSetElement.cpp"
-#include "JSSVGStopElement.cpp"
-#include "JSSVGStringList.cpp"
-#include "JSSVGStyleElement.cpp"
-#include "JSSVGSVGElement.cpp"
-#include "JSSVGSwitchElement.cpp"
-#include "JSSVGSymbolElement.cpp"
-#include "JSSVGTextContentElement.cpp"
-#include "JSSVGTextElement.cpp"
-#include "JSSVGTextPathElement.cpp"
-#include "JSSVGTextPositioningElement.cpp"
-#include "JSSVGTitleElement.cpp"
-#include "JSSVGTransform.cpp"
-#include "JSSVGTransformList.cpp"
-#include "JSSVGTRefElement.cpp"
-#include "JSSVGTSpanElement.cpp"
-#include "JSSVGUnitTypes.cpp"
-#include "JSSVGUseElement.cpp"
-#include "JSSVGViewElement.cpp"
-#include "JSSVGZoomEvent.cpp"
-#include "JSText.cpp"
-#include "JSTextEvent.cpp"
-#include "JSTextMetrics.cpp"
-#include "JSTimeRanges.cpp"
-#include "JSTreeWalker.cpp"
-#include "JSUIEvent.cpp"
-#include "JSValidityState.cpp"
-#include "JSWebKitAnimationEvent.cpp"
-#include "JSWebKitCSSKeyframeRule.cpp"
-#include "JSWebKitCSSKeyframesRule.cpp"
-#include "JSWebKitCSSTransformValue.cpp"
-#include "JSWebKitCSSMatrix.cpp"
-#include "JSWebKitPoint.cpp"
-#include "JSWebKitTransitionEvent.cpp"
-#include "JSWebSocket.cpp"
-#include "JSWheelEvent.cpp"
-#include "JSWorker.cpp"
-#include "JSWorkerContext.cpp"
-#include "JSWorkerLocation.cpp"
-#include "JSWorkerNavigator.cpp"
-#include "JSXMLHttpRequest.cpp"
-#include "JSXMLHttpRequestException.cpp"
-#include "JSXMLHttpRequestProgressEvent.cpp"
-#include "JSXMLHttpRequestUpload.cpp"
-#include "JSXMLSerializer.cpp"
-#include "JSXPathEvaluator.cpp"
-#include "JSXPathException.cpp"
-#include "JSXPathExpression.cpp"
-#include "JSXPathNSResolver.cpp"
-#include "JSXPathResult.cpp"
-#include "JSXSLTProcessor.cpp"
-#include "UserAgentStyleSheetsData.cpp"
-
-// On MSVC, including StaticConstructors.h causes all global objects not to be
-// automatically initialized by the C runtime. This is useful in some specific
-// cases (e.g., the *Names.cpp files), but can be dangerous in others. We don't
-// want StaticConstructors.h to "pollute" all the source files we #include here
-// accidentally, so we'll throw an error whenever any file includes it.
-#ifdef StaticConstructors_h
-#error Do not include any file in DerivedSources.cpp that includes StaticConstructors.h
-#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h
new file mode 100644
index 0000000..115db06
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringBuilder_h
+#define WebCore_FWD_StringBuilder_h
+#include <JavaScriptCore/StringBuilder.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h
new file mode 100644
index 0000000..94167a4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_UStringImpl_h
+#define WebCore_FWD_UStringImpl_h
+#include <JavaScriptCore/UStringImpl.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
new file mode 100644
index 0000000..89432a8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WeakGCMap_h
+#define WebCore_FWD_WeakGCMap_h
+#include <JavaScriptCore/WeakGCMap.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
new file mode 100644
index 0000000..e87f8f2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WeakGCPtr_h
+#define WebCore_FWD_WeakGCPtr_h
+#include <JavaScriptCore/WeakGCPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
deleted file mode 100644
index bb6ed9a..0000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_PtrAndFlags_h
-#define WebCore_FWD_PtrAndFlags_h
-#include <JavaScriptCore/PtrAndFlags.h>
-#endif
-
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
new file mode 100644
index 0000000..72c1194
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringHashFunctions_h
+#define WebCore_FWD_StringHashFunctions_h
+#include <JavaScriptCore/StringHashFunctions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h
new file mode 100644
index 0000000..4667674
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ValueCheck_h
+#define WebCore_FWD_ValueCheck_h
+#include <JavaScriptCore/ValueCheck.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/Info.plist b/src/3rdparty/webkit/WebCore/Info.plist
index 525a372..9c24f98 100644
--- a/src/3rdparty/webkit/WebCore/Info.plist
+++ b/src/3rdparty/webkit/WebCore/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2010 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp b/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp
new file mode 100644
index 0000000..c624acb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore21GeolocationController13errorOccurredEPNS_16GeolocationErrorE
+__ZN7WebCore21GeolocationController15positionChangedEPNS_19GeolocationPositionE
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp b/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp
new file mode 100644
index 0000000..296c8aa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
+__ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Video.exp b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
index 5d35698..da79150 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.Video.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
@@ -1,14 +1,17 @@
-__ZN7WebCore16HTMLMediaElement4playEv
-__ZN7WebCore16HTMLMediaElement5pauseEv
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZN7WebCore16HTMLMediaElement12endScrubbingEv
+__ZN7WebCore16HTMLMediaElement14beginScrubbingEv
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement4playEb
+__ZN7WebCore16HTMLMediaElement5pauseEb
+__ZN7WebCore16HTMLMediaElement6rewindEf
 __ZN7WebCore16HTMLMediaElement8setMutedEb
 __ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement6rewindEf
-__ZN7WebCore16HTMLMediaElement10screenRectEv
 __ZNK7WebCore16HTMLMediaElement11currentTimeEv
 __ZNK7WebCore16HTMLMediaElement13platformMediaEv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZNK7WebCore16HTMLMediaElement21processingUserGestureEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index c0baaf4..27b9085 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -1,8 +1,6 @@
 {
     'variables': {
         'webcore_bindings_idl_files': [
-
-            #IDL files
             'css/CSSCharsetRule.idl',
             'css/CSSFontFaceRule.idl',
             'css/CSSImportRule.idl',
@@ -20,10 +18,10 @@
             'css/CSSVariablesDeclaration.idl',
             'css/CSSVariablesRule.idl',
             'css/Counter.idl',
-            'css/Media.idl',
             'css/MediaList.idl',
-            'css/RGBColor.idl',
             'css/Rect.idl',
+            'css/RGBColor.idl',
+            'css/StyleMedia.idl',
             'css/StyleSheet.idl',
             'css/StyleSheetList.idl',
             'css/WebKitCSSKeyframeRule.idl',
@@ -38,6 +36,8 @@
             'dom/ClientRectList.idl',
             'dom/Clipboard.idl',
             'dom/Comment.idl',
+            'dom/CompositionEvent.idl',
+            'dom/CustomEvent.idl',
             'dom/DOMCoreException.idl',
             'dom/DOMImplementation.idl',
             'dom/Document.idl',
@@ -65,41 +65,49 @@
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
             'dom/PageTransitionEvent.idl',
+            'dom/PopStateEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
             'dom/RangeException.idl',
             'dom/Text.idl',
             'dom/TextEvent.idl',
+            'dom/Touch.idl',
+            'dom/TouchEvent.idl',
+            'dom/TouchList.idl',
             'dom/TreeWalker.idl',
             'dom/UIEvent.idl',
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'html/canvas/CanvasActiveInfo.idl',
-            'html/canvas/CanvasArray.idl',
-            'html/canvas/CanvasArrayBuffer.idl',
-            'html/canvas/CanvasBuffer.idl',
-            'html/canvas/CanvasByteArray.idl',
-            'html/canvas/CanvasFloatArray.idl',
-            'html/canvas/CanvasFramebuffer.idl',
+            'html/Blob.idl',
+            'html/canvas/WebGLActiveInfo.idl',
+            'html/canvas/WebGLArray.idl',
+            'html/canvas/WebGLArrayBuffer.idl',
+            'html/canvas/WebGLBuffer.idl',
+            'html/canvas/WebGLByteArray.idl',
+            'html/canvas/WebGLContextAttributes.idl',
+            'html/canvas/WebGLFloatArray.idl',
+            'html/canvas/WebGLFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
-            'html/canvas/CanvasIntArray.idl',
+            'html/canvas/WebGLIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
-            'html/canvas/CanvasProgram.idl',
-            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/WebGLProgram.idl',
+            'html/canvas/WebGLRenderbuffer.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/CanvasRenderingContext3D.idl',
-            'html/canvas/CanvasShader.idl',
-            'html/canvas/CanvasShortArray.idl',
-            'html/canvas/CanvasUnsignedByteArray.idl',
-            'html/canvas/CanvasUnsignedIntArray.idl',
-            'html/canvas/CanvasUnsignedShortArray.idl',
-            'html/canvas/CanvasTexture.idl',
+            'html/canvas/WebGLRenderingContext.idl',
+            'html/canvas/WebGLShader.idl',
+            'html/canvas/WebGLShortArray.idl',
+            'html/canvas/WebGLUniformLocation.idl',
+            'html/canvas/WebGLUnsignedByteArray.idl',
+            'html/canvas/WebGLUnsignedIntArray.idl',
+            'html/canvas/WebGLUnsignedShortArray.idl',
+            'html/canvas/WebGLTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
+            'html/DOMFormData.idl',
             'html/File.idl',
             'html/FileList.idl',
             'html/HTMLAllCollection.idl',
@@ -157,6 +165,7 @@
             'html/HTMLParagraphElement.idl',
             'html/HTMLParamElement.idl',
             'html/HTMLPreElement.idl',
+            'html/HTMLProgressElement.idl',
             'html/HTMLQuoteElement.idl',
             'html/HTMLScriptElement.idl',
             'html/HTMLSelectElement.idl',
@@ -178,7 +187,9 @@
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
+            'inspector/InjectedScriptHost.idl',
             'inspector/InspectorBackend.idl',
+            'inspector/InspectorFrontendHost.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
             'notifications/Notification.idl',
@@ -186,8 +197,10 @@
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
+            'page/Coordinates.idl',
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
+            'page/EventSource.idl',
             'page/Geolocation.idl',
             'page/Geoposition.idl',
             'page/History.idl',
@@ -202,12 +215,39 @@
             'plugins/Plugin.idl',
             'plugins/PluginArray.idl',
             'storage/Database.idl',
+            'storage/IDBDatabaseError.idl',
+            'storage/IDBDatabaseException.idl',
+            'storage/IDBDatabaseRequest.idl',
+            'storage/IDBRequest.idl',
+            'storage/IndexedDatabaseRequest.idl',
             'storage/SQLError.idl',
             'storage/SQLResultSet.idl',
             'storage/SQLResultSetRowList.idl',
             'storage/SQLTransaction.idl',
             'storage/Storage.idl',
             'storage/StorageEvent.idl',
+            'websockets/WebSocket.idl',
+            'workers/AbstractWorker.idl',
+            'workers/DedicatedWorkerContext.idl',
+            'workers/SharedWorker.idl',
+            'workers/SharedWorkerContext.idl',
+            'workers/Worker.idl',
+            'workers/WorkerContext.idl',
+            'workers/WorkerLocation.idl',
+            'xml/DOMParser.idl',
+            'xml/XMLHttpRequest.idl',
+            'xml/XMLHttpRequestException.idl',
+            'xml/XMLHttpRequestProgressEvent.idl',
+            'xml/XMLHttpRequestUpload.idl',
+            'xml/XMLSerializer.idl',
+            'xml/XPathEvaluator.idl',
+            'xml/XPathException.idl',
+            'xml/XPathExpression.idl',
+            'xml/XPathNSResolver.idl',
+            'xml/XPathResult.idl',
+            'xml/XSLTProcessor.idl',
+        ],
+        'webcore_svg_bindings_idl_files': [
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -354,26 +394,6 @@
             'svg/SVGViewSpec.idl',
             'svg/SVGZoomAndPan.idl',
             'svg/SVGZoomEvent.idl',
-            'websockets/WebSocket.idl',
-            'workers/AbstractWorker.idl',
-            'workers/DedicatedWorkerContext.idl',
-            'workers/SharedWorker.idl',
-            'workers/SharedWorkerContext.idl',
-            'workers/Worker.idl',
-            'workers/WorkerContext.idl',
-            'workers/WorkerLocation.idl',
-            'xml/DOMParser.idl',
-            'xml/XMLHttpRequest.idl',
-            'xml/XMLHttpRequestException.idl',
-            'xml/XMLHttpRequestProgressEvent.idl',
-            'xml/XMLHttpRequestUpload.idl',
-            'xml/XMLSerializer.idl',
-            'xml/XPathEvaluator.idl',
-            'xml/XPathException.idl',
-            'xml/XPathExpression.idl',
-            'xml/XPathNSResolver.idl',
-            'xml/XPathResult.idl',
-            'xml/XSLTProcessor.idl',
         ],
         'webcore_files': [
 
@@ -396,10 +416,18 @@
             'accessibility/AccessibilityListBoxOption.h',
             'accessibility/AccessibilityMediaControls.cpp',
             'accessibility/AccessibilityMediaControls.h',
+            'accessibility/AccessibilityMenuList.cpp',
+            'accessibility/AccessibilityMenuList.h',
+            'accessibility/AccessibilityMenuListPopup.cpp',
+            'accessibility/AccessibilityMenuListPopup.h',
+            'accessibility/AccessibilityMenuListOption.cpp',
+            'accessibility/AccessibilityMenuListOption.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityRenderObject.cpp',
             'accessibility/AccessibilityRenderObject.h',
+            'accessibility/AccessibilityScrollbar.cpp',
+            'accessibility/AccessibilityScrollbar.h',
             'accessibility/AccessibilitySlider.cpp',
             'accessibility/AccessibilitySlider.h',
             'accessibility/AccessibilityTable.cpp',
@@ -428,8 +456,20 @@
             'accessibility/win/AccessibilityObjectWin.cpp',
             'accessibility/win/AccessibilityObjectWrapperWin.h',
             'accessibility/wx/AccessibilityObjectWx.cpp',
+            'bindings/generic/BindingDOMWindow.h',
+            'bindings/generic/BindingElement.h',
+            'bindings/generic/BindingSecurity.h',
+            'bindings/generic/BindingSecurityBase.cpp',
+            'bindings/generic/BindingSecurityBase.h',
+            'bindings/generic/GenericBinding.h',
+            'bindings/generic/RuntimeEnabledFeatures.cpp',
+            'bindings/generic/RuntimeEnabledFeatures.h',
             'bindings/js/CachedScriptSourceProvider.h',
             'bindings/js/DOMObjectWithSVGContext.h',
+            'bindings/js/DOMObjectHashTableMap.cpp',
+            'bindings/js/DOMObjectHashTableMap.h',
+            'bindings/js/DOMWrapperWorld.cpp',
+            'bindings/js/DOMWrapperWorld.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
             'bindings/js/JSCallbackData.cpp',
@@ -469,6 +509,8 @@
             'bindings/js/JSDataGridDataSource.cpp',
             'bindings/js/JSDataGridDataSource.h',
             'bindings/js/JSDedicatedWorkerContextCustom.cpp',
+            'bindings/js/JSDebugWrapperSet.cpp',
+            'bindings/js/JSDebugWrapperSet.h',
             'bindings/js/JSDocumentCustom.cpp',
             'bindings/js/JSDocumentFragmentCustom.cpp',
             'bindings/js/JSDOMApplicationCacheCustom.cpp',
@@ -482,6 +524,8 @@
             'bindings/js/JSDOMWindowCustom.h',
             'bindings/js/JSDOMWindowShell.cpp',
             'bindings/js/JSDOMWindowShell.h',
+            'bindings/js/JSDOMWrapper.cpp',
+            'bindings/js/JSDOMWrapper.h',
             'bindings/js/JSElementCustom.cpp',
             'bindings/js/JSEventCustom.cpp',
             'bindings/js/JSEventListener.cpp',
@@ -517,11 +561,8 @@
             'bindings/js/JSImageConstructor.cpp',
             'bindings/js/JSImageConstructor.h',
             'bindings/js/JSImageDataCustom.cpp',
-            'bindings/js/JSInspectedObjectWrapper.cpp',
-            'bindings/js/JSInspectedObjectWrapper.h',
-            'bindings/js/JSInspectorCallbackWrapper.cpp',
-            'bindings/js/JSInspectorCallbackWrapper.h',
-            'bindings/js/JSInspectorBackendCustom.cpp',
+            'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSJavaScriptCallFrameCustom.cpp',
             'bindings/js/JSLazyEventListener.cpp',
             'bindings/js/JSLazyEventListener.h',
@@ -539,6 +580,7 @@
             'bindings/js/JSNamedNodesCollection.h',
             'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
+            'bindings/js/JSNodeCustom.h',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
             'bindings/js/JSNodeFilterCustom.cpp',
@@ -550,8 +592,6 @@
             'bindings/js/JSPluginCustom.cpp',
             'bindings/js/JSPluginElementFunctions.cpp',
             'bindings/js/JSPluginElementFunctions.h',
-            'bindings/js/JSQuarantinedObjectWrapper.cpp',
-            'bindings/js/JSQuarantinedObjectWrapper.h',
             'bindings/js/JSRGBColor.cpp',
             'bindings/js/JSRGBColor.h',
             'bindings/js/JSSharedWorkerConstructor.cpp',
@@ -563,14 +603,14 @@
             'bindings/js/JSStorageCustom.h',
             'bindings/js/JSStyleSheetCustom.cpp',
             'bindings/js/JSStyleSheetListCustom.cpp',
+            'bindings/js/JSSVGContextCache.h',
             'bindings/js/JSSVGElementInstanceCustom.cpp',
             'bindings/js/JSSVGLengthCustom.cpp',
             'bindings/js/JSSVGMatrixCustom.cpp',
             'bindings/js/JSSVGPathSegCustom.cpp',
             'bindings/js/JSSVGPathSegListCustom.cpp',
+            'bindings/js/JSSVGPODListCustom.h',
             'bindings/js/JSSVGPODTypeWrapper.h',
-            'bindings/js/JSSVGPointListCustom.cpp',
-            'bindings/js/JSSVGTransformListCustom.cpp',
             'bindings/js/JSTextCustom.cpp',
             'bindings/js/JSTreeWalkerCustom.cpp',
             'bindings/js/JSWebKitCSSMatrixConstructor.cpp',
@@ -593,6 +633,10 @@
             'bindings/js/JSXSLTProcessorConstructor.cpp',
             'bindings/js/JSXSLTProcessorConstructor.h',
             'bindings/js/JSXSLTProcessorCustom.cpp',
+            'bindings/js/JavaScriptProfile.cpp',
+            'bindings/js/JavaScriptProfile.h',
+            'bindings/js/JavaScriptProfileNode.cpp',
+            'bindings/js/JavaScriptProfileNode.h',
             'bindings/js/ScheduledAction.cpp',
             'bindings/js/ScheduledAction.h',
             'bindings/js/ScriptArray.cpp',
@@ -617,8 +661,6 @@
             'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
             'bindings/js/ScriptObject.h',
-            'bindings/js/ScriptObjectQuarantine.cpp',
-            'bindings/js/ScriptObjectQuarantine.h',
             'bindings/js/ScriptSourceCode.h',
             'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
@@ -626,33 +668,42 @@
             'bindings/js/ScriptString.h',
             'bindings/js/ScriptValue.cpp',
             'bindings/js/ScriptValue.h',
+            'bindings/js/ScriptWrappable.h',
             'bindings/js/StringSourceProvider.h',
+            'bindings/js/WebCoreJSClientData.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
             'bindings/ScriptControllerBase.cpp',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
-            'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
+            'bindings/v8/custom/V8BarInfoCustom.cpp',
             'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasArrayCustom.h',
-            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
-            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayCustom.h',
+            'bindings/v8/custom/V8WebGLArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8WebGLByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
-            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
-            'bindings/v8/custom/V8ClientRectListCustom.cpp',
+            'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
+            'bindings/v8/custom/V8CoordinatesCustom.cpp',
+            'bindings/v8/custom/V8CSSRuleCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
-            'bindings/v8/custom/V8CustomBinding.cpp',
-            'bindings/v8/custom/V8CustomBinding.h',
+            'bindings/v8/custom/V8CSSStyleSheetCustom.cpp',
+            'bindings/v8/custom/V8CSSValueCustom.cpp',
+            'bindings/v8/custom/V8CustomCallback.h',
             'bindings/v8/custom/V8CustomEventListener.cpp',
             'bindings/v8/custom/V8CustomEventListener.h',
+            'bindings/v8/custom/V8CustomPositionCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionCallback.h',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementCallback.cpp',
             'bindings/v8/custom/V8CustomSQLStatementCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp',
@@ -665,17 +716,21 @@
             'bindings/v8/custom/V8CustomVoidCallback.h',
             'bindings/v8/custom/V8CustomXPathNSResolver.cpp',
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
+            'bindings/v8/custom/V8DatabaseCallback.cpp',
+            'bindings/v8/custom/V8DatabaseCallback.h',
             'bindings/v8/custom/V8DatabaseCustom.cpp',
             'bindings/v8/custom/V8DataGridColumnListCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
-            'bindings/v8/custom/V8DOMApplicationCacheCustom.cpp',
-            'bindings/v8/custom/V8DOMParserConstructor.cpp',
+            'bindings/v8/custom/V8DOMFormDataCustom.cpp',
+            'bindings/v8/custom/V8DOMSelectionCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
-            'bindings/v8/custom/V8FileListCustom.cpp',
+            'bindings/v8/custom/V8EventSourceConstructor.cpp',
+            'bindings/v8/custom/V8GeolocationCustom.cpp',
+            'bindings/v8/custom/V8HistoryCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
@@ -683,6 +738,7 @@
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
             'bindings/v8/custom/V8HTMLDocumentCustom.cpp',
+            'bindings/v8/custom/V8HTMLElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFormElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
@@ -694,10 +750,12 @@
             'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
-            'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.h',
-            'bindings/v8/custom/V8InspectorBackendCustom.cpp',
+            'bindings/v8/custom/V8IDBRequestCustom.cpp',
+            'bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
             'bindings/v8/custom/V8MessageEventCustom.cpp',
@@ -712,13 +770,18 @@
             'bindings/v8/custom/V8NodeIteratorCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
+            'bindings/v8/custom/V8PopStateEventCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
-            'bindings/v8/custom/V8SVGElementInstanceCustom.cpp',
+            'bindings/v8/custom/V8SVGDocumentCustom.cpp',
+            'bindings/v8/custom/V8SVGElementCustom.cpp',
             'bindings/v8/custom/V8SVGLengthCustom.cpp',
             'bindings/v8/custom/V8SVGMatrixCustom.cpp',
+            'bindings/v8/custom/V8SVGPathSegCustom.cpp',
+            'bindings/v8/custom/V8ScreenCustom.cpp',
             'bindings/v8/custom/V8SharedWorkerCustom.cpp',
+            'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
             'bindings/v8/custom/V8TreeWalkerCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
@@ -728,9 +791,6 @@
             'bindings/v8/custom/V8WorkerCustom.cpp',
             'bindings/v8/custom/V8XMLHttpRequestConstructor.cpp',
             'bindings/v8/custom/V8XMLHttpRequestCustom.cpp',
-            'bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp',
-            'bindings/v8/custom/V8XMLSerializerConstructor.cpp',
-            'bindings/v8/custom/V8XPathEvaluatorConstructor.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
             'bindings/v8/DateExtension.cpp',
             'bindings/v8/DateExtension.h',
@@ -738,14 +798,15 @@
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
             'bindings/v8/DOMDataStore.h',
-            'bindings/v8/DOMObjectsInclude.h',
+            'bindings/v8/DOMWrapperWorld.cpp',
+            'bindings/v8/DOMWrapperWorld.h',
+            'bindings/v8/IsolatedWorld.cpp',
+            'bindings/v8/IsolatedWorld.h',
             'bindings/v8/MainThreadDOMData.cpp',
             'bindings/v8/MainThreadDOMData.h',
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
             'bindings/v8/OwnHandle.h',
-            'bindings/v8/RuntimeEnabledFeatures.cpp',
-            'bindings/v8/RuntimeEnabledFeatures.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
@@ -759,6 +820,8 @@
             'bindings/v8/ScriptCallStack.h',
             'bindings/v8/ScriptController.cpp',
             'bindings/v8/ScriptController.h',
+            'bindings/v8/ScriptDebugServer.cpp',
+            'bindings/v8/ScriptDebugServer.h',
             'bindings/v8/ScriptEventListener.cpp',
             'bindings/v8/ScriptEventListener.h',
             'bindings/v8/ScriptFunctionCall.cpp',
@@ -767,8 +830,9 @@
             'bindings/v8/ScriptInstance.h',
             'bindings/v8/ScriptObject.cpp',
             'bindings/v8/ScriptObject.h',
-            'bindings/v8/ScriptObjectQuarantine.cpp',
-            'bindings/v8/ScriptObjectQuarantine.h',
+            'bindings/v8/ScriptProfile.h',
+            'bindings/v8/ScriptProfiler.cpp',
+            'bindings/v8/ScriptProfiler.h',
             'bindings/v8/ScriptScope.cpp',
             'bindings/v8/ScriptScope.h',
             'bindings/v8/ScriptSourceCode.h',
@@ -779,7 +843,12 @@
             'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/ScriptWrappable.h',
+            'bindings/v8/SerializedScriptValue.cpp',
             'bindings/v8/SerializedScriptValue.h',
+            'bindings/v8/specialization/V8BindingDOMWindow.h',
+            'bindings/v8/specialization/V8BindingState.cpp',
+            'bindings/v8/specialization/V8BindingState.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -794,20 +863,22 @@
             'bindings/v8/V8DataGridDataSource.h',
             'bindings/v8/V8DOMMap.cpp',
             'bindings/v8/V8DOMMap.h',
+            'bindings/v8/V8DOMWindowShell.cpp',
+            'bindings/v8/V8DOMWindowShell.h',
             'bindings/v8/V8DOMWrapper.cpp',
             'bindings/v8/V8DOMWrapper.h',
             'bindings/v8/V8EventListenerList.cpp',
             'bindings/v8/V8EventListenerList.h',
             'bindings/v8/V8GCController.cpp',
             'bindings/v8/V8GCController.h',
+            'bindings/v8/V8GCForContextDispose.cpp',
+            'bindings/v8/V8GCForContextDispose.h',
             'bindings/v8/V8Helpers.cpp',
             'bindings/v8/V8Helpers.h',
             'bindings/v8/V8HiddenPropertyName.cpp',
             'bindings/v8/V8HiddenPropertyName.h',
-            'bindings/v8/V8Index.cpp',
-            'bindings/v8/V8Index.h',
-            'bindings/v8/V8IsolatedWorld.cpp',
-            'bindings/v8/V8IsolatedWorld.h',
+            'bindings/v8/V8IsolatedContext.cpp',
+            'bindings/v8/V8IsolatedContext.h',
             'bindings/v8/V8LazyEventListener.cpp',
             'bindings/v8/V8LazyEventListener.h',
             'bindings/v8/V8NPObject.cpp',
@@ -827,6 +898,9 @@
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
             'bindings/v8/WorkerScriptController.cpp',
+            'bindings/v8/WorldContextHandle.cpp',
+            'bindings/v8/WorldContextHandle.h',
+            'bindings/v8/WrapperTypeInfo.h',
             'bindings/v8/npruntime.cpp',
             'bindings/v8/npruntime_impl.h',
             'bindings/v8/npruntime_internal.h',
@@ -929,33 +1003,33 @@
             'css/FontValue.h',
             'css/MediaFeatureNames.cpp',
             'css/MediaFeatureNames.h',
-            'css/Media.cpp',
-            'css/Media.h',
             'css/MediaList.cpp',
             'css/MediaList.h',
             'css/MediaQuery.cpp',
-            'css/MediaQuery.h',
             'css/MediaQueryEvaluator.cpp',
             'css/MediaQueryEvaluator.h',
             'css/MediaQueryExp.cpp',
             'css/MediaQueryExp.h',
+            'css/MediaQuery.h',
             'css/Pair.h',
             'css/Rect.h',
             'css/RGBColor.cpp',
             'css/RGBColor.h',
-            'css/SVGCSSComputedStyleDeclaration.cpp',
-            'css/SVGCSSParser.cpp',
-            'css/SVGCSSStyleSelector.cpp',
             'css/ShadowValue.cpp',
             'css/ShadowValue.h',
             'css/StyleBase.cpp',
             'css/StyleBase.h',
             'css/StyleList.cpp',
             'css/StyleList.h',
+            'css/StyleMedia.cpp',
+            'css/StyleMedia.h',
             'css/StyleSheet.cpp',
             'css/StyleSheet.h',
             'css/StyleSheetList.cpp',
             'css/StyleSheetList.h',
+            'css/SVGCSSComputedStyleDeclaration.cpp',
+            'css/SVGCSSParser.cpp',
+            'css/SVGCSSStyleSelector.cpp',
             'css/WebKitCSSKeyframeRule.cpp',
             'css/WebKitCSSKeyframeRule.h',
             'css/WebKitCSSKeyframesRule.cpp',
@@ -981,14 +1055,14 @@
             'dom/CDATASection.h',
             'dom/CSSMappedAttributeDeclaration.cpp',
             'dom/CSSMappedAttributeDeclaration.h',
+            'dom/CanvasSurface.cpp',
+            'dom/CanvasSurface.h',
             'dom/CharacterData.cpp',
             'dom/CharacterData.h',
             'dom/CheckedRadioButtons.cpp',
             'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
-            'dom/ClassNames.cpp',
-            'dom/ClassNames.h',
             'dom/ClassNodeList.cpp',
             'dom/ClassNodeList.h',
             'dom/ClientRect.cpp',
@@ -1002,9 +1076,13 @@
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
             'dom/Comment.h',
+            'dom/CompositionEvent.cpp',
+            'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
+            'dom/CustomEvent.cpp',
+            'dom/CustomEvent.h',
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
             'dom/DOMImplementation.h',
@@ -1088,6 +1166,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PopStateEvent.cpp',
+            'dom/PopStateEvent.h',
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
@@ -1114,6 +1194,8 @@
             'dom/SelectElement.h',
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
+            'dom/SpaceSplitString.cpp',
+            'dom/SpaceSplitString.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
             'dom/StaticStringList.cpp',
@@ -1128,6 +1210,11 @@
             'dom/Text.h',
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
+            'dom/Touch.cpp',
+            'dom/Touch.h',
+            'dom/TouchEvent.cpp',
+            'dom/TouchList.cpp',
+            'dom/TouchList.h',
             'dom/Tokenizer.h',
             'dom/TransformSourceLibxslt.cpp',
             'dom/TransformSource.h',
@@ -1139,6 +1226,8 @@
             'dom/UIEvent.h',
             'dom/UIEventWithKeyState.cpp',
             'dom/UIEventWithKeyState.h',
+            'dom/ViewportArguments.cpp',
+            'dom/ViewportArguments.h',
             'dom/WebKitAnimationEvent.cpp',
             'dom/WebKitAnimationEvent.h',
             'dom/WebKitTransitionEvent.cpp',
@@ -1268,52 +1357,62 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
-            'html/canvas/CanvasArray.cpp',
-            'html/canvas/CanvasArray.h',
-            'html/canvas/CanvasArrayBuffer.cpp',
-            'html/canvas/CanvasArrayBuffer.h',
-            'html/canvas/CanvasBuffer.cpp',
-            'html/canvas/CanvasBuffer.h',
-            'html/canvas/CanvasByteArray.cpp',
-            'html/canvas/CanvasByteArray.h',
-            'html/canvas/CanvasFloatArray.cpp',
-            'html/canvas/CanvasFloatArray.h',
-            'html/canvas/CanvasFramebuffer.cpp',
-            'html/canvas/CanvasFramebuffer.h',
+            'html/Blob.cpp',
+            'html/Blob.h',
+            'html/canvas/WebGLArray.cpp',
+            'html/canvas/WebGLArray.h',
+            'html/canvas/WebGLArrayBuffer.cpp',
+            'html/canvas/WebGLArrayBuffer.h',
+            'html/canvas/WebGLBuffer.cpp',
+            'html/canvas/WebGLBuffer.h',
+            'html/canvas/WebGLByteArray.cpp',
+            'html/canvas/WebGLByteArray.h',
+            'html/canvas/WebGLContextAttributes.cpp',
+            'html/canvas/WebGLContextAttributes.h',
+            'html/canvas/WebGLFloatArray.cpp',
+            'html/canvas/WebGLFloatArray.h',
+            'html/canvas/WebGLFramebuffer.cpp',
+            'html/canvas/WebGLFramebuffer.h',
+            'html/canvas/WebGLGetInfo.cpp',
+            'html/canvas/WebGLGetInfo.h',
+            'html/canvas/CanvasContextAttributes.cpp',
+            'html/canvas/CanvasContextAttributes.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
-            'html/canvas/CanvasIntArray.cpp',
-            'html/canvas/CanvasIntArray.h',
+            'html/canvas/WebGLIntArray.cpp',
+            'html/canvas/WebGLIntArray.h',
             'html/canvas/CanvasObject.cpp',
             'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
-            'html/canvas/CanvasProgram.cpp',
-            'html/canvas/CanvasProgram.h',
-            'html/canvas/CanvasRenderbuffer.cpp',
-            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/WebGLProgram.cpp',
+            'html/canvas/WebGLProgram.h',
+            'html/canvas/WebGLRenderbuffer.cpp',
+            'html/canvas/WebGLRenderbuffer.h',
             'html/canvas/CanvasRenderingContext.cpp',
             'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
-            'html/canvas/CanvasRenderingContext3D.cpp',
-            'html/canvas/CanvasRenderingContext3D.h',
-            'html/canvas/CanvasShader.cpp',
-            'html/canvas/CanvasShader.h',
-            'html/canvas/CanvasShortArray.cpp',
-            'html/canvas/CanvasShortArray.h',
+            'html/canvas/WebGLRenderingContext.cpp',
+            'html/canvas/WebGLRenderingContext.h',
+            'html/canvas/WebGLShader.cpp',
+            'html/canvas/WebGLShader.h',
+            'html/canvas/WebGLShortArray.cpp',
+            'html/canvas/WebGLShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
-            'html/canvas/CanvasTexture.cpp',
-            'html/canvas/CanvasTexture.h',
-            'html/canvas/CanvasUnsignedByteArray.cpp',
-            'html/canvas/CanvasUnsignedByteArray.h',
-            'html/canvas/CanvasUnsignedIntArray.cpp',
-            'html/canvas/CanvasUnsignedIntArray.h',
-            'html/canvas/CanvasUnsignedShortArray.cpp',
-            'html/canvas/CanvasUnsignedShortArray.h',
+            'html/canvas/WebGLTexture.cpp',
+            'html/canvas/WebGLTexture.h',
+            'html/canvas/WebGLUniformLocation.cpp',
+            'html/canvas/WebGLUniformLocation.h',
+            'html/canvas/WebGLUnsignedByteArray.cpp',
+            'html/canvas/WebGLUnsignedByteArray.h',
+            'html/canvas/WebGLUnsignedIntArray.cpp',
+            'html/canvas/WebGLUnsignedIntArray.h',
+            'html/canvas/WebGLUnsignedShortArray.cpp',
+            'html/canvas/WebGLUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1321,8 +1420,12 @@
             'html/DataGridColumn.h',
             'html/DOMDataGridDataSource.cpp',
             'html/DOMDataGridDataSource.h',
+            'html/DOMFormData.cpp',
+            'html/DOMFormData.h',
             'html/DataGridColumnList.cpp',
             'html/DataGridColumnList.h',
+            'html/DateComponents.cpp',
+            'html/DateComponents.h',
             'html/File.cpp',
             'html/File.h',
             'html/FileList.cpp',
@@ -1461,6 +1564,8 @@
             'html/HTMLPlugInImageElement.h',
             'html/HTMLPreElement.cpp',
             'html/HTMLPreElement.h',
+            'html/HTMLProgressElement.cpp',
+            'html/HTMLProgressElement.h',
             'html/HTMLQuoteElement.cpp',
             'html/HTMLQuoteElement.h',
             'html/HTMLScriptElement.cpp',
@@ -1504,6 +1609,8 @@
             'html/MediaError.h',
             'html/PreloadScanner.cpp',
             'html/PreloadScanner.h',
+            'html/StepRange.cpp',
+            'html/StepRange.h',
             'html/TextMetrics.h',
             'html/TimeRanges.cpp',
             'html/TimeRanges.h',
@@ -1513,6 +1620,10 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/InjectedScript.cpp',
+            'inspector/InjectedScript.h',
+            'inspector/InjectedScriptHost.cpp',
+            'inspector/InjectedScriptHost.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1525,19 +1636,20 @@
             'inspector/InspectorDOMStorageResource.h',
             'inspector/InspectorFrontend.cpp',
             'inspector/InspectorFrontend.h',
+            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.cpp',
+            'inspector/InspectorFrontendClientLocal.h',
+            'inspector/InspectorFrontendHost.cpp',
+            'inspector/InspectorFrontendHost.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
             'inspector/InspectorTimelineAgent.cpp',
             'inspector/InspectorTimelineAgent.h',
+            'inspector/InspectorWorkerResource.h',
             'inspector/JavaScriptCallFrame.cpp',
             'inspector/JavaScriptCallFrame.h',
-            'inspector/JavaScriptDebugListener.h',
-            'inspector/JavaScriptDebugServer.cpp',
-            'inspector/JavaScriptDebugServer.h',
-            'inspector/JavaScriptProfile.cpp',
-            'inspector/JavaScriptProfile.h',
-            'inspector/JavaScriptProfileNode.cpp',
-            'inspector/JavaScriptProfileNode.h',
+            'inspector/ScriptBreakpoint.h',
+            'inspector/ScriptDebugListener.h',
             'inspector/TimelineRecordFactory.cpp',
             'inspector/TimelineRecordFactory.h',
             'loader/appcache/ApplicationCache.cpp',
@@ -1695,7 +1807,6 @@
             'page/chromium/DragControllerChromium.cpp',
             'page/chromium/EventHandlerChromium.cpp',
             'page/chromium/FrameChromium.cpp',
-            'page/chromium/FrameChromium.h',
             'page/gtk/DragControllerGtk.cpp',
             'page/gtk/EventHandlerGtk.cpp',
             'page/gtk/FrameGtk.cpp',
@@ -1732,6 +1843,7 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
+            'page/ContextMenuProvider.h',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1745,6 +1857,8 @@
             'page/EditorClient.h',
             'page/EventHandler.cpp',
             'page/EventHandler.h',
+            'page/EventSource.cpp',
+            'page/EventSource.h',
             'page/FocusController.cpp',
             'page/FocusController.h',
             'page/FocusDirection.h',
@@ -1757,6 +1871,13 @@
             'page/FrameView.h',
             'page/Geolocation.cpp',
             'page/Geolocation.h',
+            'page/GeolocationController.cpp',
+            'page/GeolocationController.h',
+            'page/GeolocationControllerClient.h',
+            'page/GeolocationError.h',
+            'page/GeolocationPosition.h',
+            'page/GeolocationPositionCache.cpp',
+            'page/GeolocationPositionCache.h',
             'page/Geoposition.h',
             'page/HaltablePlugin.h',
             'page/History.cpp',
@@ -1793,6 +1914,8 @@
             'page/SecurityOriginHash.h',
             'page/Settings.cpp',
             'page/Settings.h',
+            'page/SpatialNavigation.h',
+            'page/SpatialNavigation.cpp',
             'page/UserContentURLPattern.cpp',
             'page/UserContentURLPattern.h',
             'page/UserScript.h',
@@ -1806,6 +1929,7 @@
             'page/WorkerNavigator.h',
             'page/XSSAuditor.cpp',
             'page/XSSAuditor.h',
+            'page/ZoomMode.h',
             'platform/animation/Animation.cpp',
             'platform/animation/Animation.h',
             'platform/animation/AnimationList.cpp',
@@ -1841,6 +1965,8 @@
             'platform/chromium/FramelessScrollView.cpp',
             'platform/chromium/FramelessScrollView.h',
             'platform/chromium/FramelessScrollViewClient.h',
+            'platform/chromium/GeolocationServiceChromium.cpp',
+            'platform/chromium/GeolocationServiceChromium.h',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
             'platform/chromium/KeyboardCodesPosix.h',
@@ -1861,6 +1987,8 @@
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
             'platform/chromium/ScrollbarThemeChromiumLinux.cpp',
+            'platform/chromium/ScrollbarThemeChromiumMac.h',
+            'platform/chromium/ScrollbarThemeChromiumMac.mm',
             'platform/chromium/ScrollbarThemeChromiumWin.cpp',
             'platform/chromium/SearchPopupMenuChromium.cpp',
             'platform/chromium/SharedTimerChromium.cpp',
@@ -1890,6 +2018,7 @@
             'platform/graphics/cg/FloatRectCG.cpp',
             'platform/graphics/cg/FloatSizeCG.cpp',
             'platform/graphics/cg/GradientCG.cpp',
+            'platform/graphics/cg/GraphicsContext3DCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.cpp',
             'platform/graphics/cg/GraphicsContextPlatformPrivateCG.h',
             'platform/graphics/cg/ImageBufferCG.cpp',
@@ -1947,6 +2076,11 @@
             'platform/graphics/filters/FEComposite.h',
             'platform/graphics/filters/FEGaussianBlur.cpp',
             'platform/graphics/filters/FEGaussianBlur.h',
+            'platform/graphics/filters/Filter.h',
+            'platform/graphics/filters/FilterEffect.cpp',
+            'platform/graphics/filters/FilterEffect.h',
+            'platform/graphics/filters/ImageBufferFilter.cpp',
+            'platform/graphics/filters/ImageBufferFilter.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -1974,17 +2108,18 @@
             'platform/graphics/gtk/VideoSinkGStreamer.h',
             'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
-            'platform/graphics/mac/CoreTextController.cpp',
-            'platform/graphics/mac/CoreTextController.h',
+            'platform/graphics/mac/ComplexTextController.cpp',
+            'platform/graphics/mac/ComplexTextController.h',
+            'platform/graphics/mac/ComplexTextControllerATSUI.cpp',
+            'platform/graphics/mac/ComplexTextControllerCoreText.cpp',
             'platform/graphics/mac/FloatPointMac.mm',
             'platform/graphics/mac/FloatRectMac.mm',
             'platform/graphics/mac/FloatSizeMac.mm',
             'platform/graphics/mac/FontCacheMac.mm',
+            'platform/graphics/mac/FontComplexTextMac.cpp',
             'platform/graphics/mac/FontCustomPlatformData.cpp',
             'platform/graphics/mac/FontCustomPlatformData.h',
             'platform/graphics/mac/FontMac.mm',
-            'platform/graphics/mac/FontMacATSUI.mm',
-            'platform/graphics/mac/FontMacCoreText.cpp',
             'platform/graphics/mac/FontPlatformData.h',
             'platform/graphics/mac/FontPlatformDataMac.mm',
             'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
@@ -2005,6 +2140,8 @@
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
             'platform/graphics/MediaPlayer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
             'platform/graphics/qt/ColorQt.cpp',
@@ -2045,10 +2182,17 @@
             'platform/graphics/skia/GradientSkia.cpp',
             'platform/graphics/skia/GraphicsContextPlatformPrivate.h',
             'platform/graphics/skia/GraphicsContextSkia.cpp',
+            'platform/graphics/skia/GraphicsContext3DSkia.cpp',
+            'platform/graphics/skia/GraphicsLayerSkia.cpp',
+            'platform/graphics/skia/GraphicsLayerSkia.h',
             'platform/graphics/skia/ImageBufferSkia.cpp',
             'platform/graphics/skia/ImageSkia.cpp',
             'platform/graphics/skia/IntPointSkia.cpp',
             'platform/graphics/skia/IntRectSkia.cpp',
+            'platform/graphics/skia/LayerRendererSkia.cpp',
+            'platform/graphics/skia/LayerRendererSkia.h',
+            'platform/graphics/skia/LayerSkia.cpp',
+            'platform/graphics/skia/LayerSkia.h',
             'platform/graphics/skia/NativeImageSkia.cpp',
             'platform/graphics/skia/NativeImageSkia.h',
             'platform/graphics/skia/PathSkia.cpp',
@@ -2061,6 +2205,8 @@
             'platform/graphics/skia/SkiaUtils.cpp',
             'platform/graphics/skia/SkiaUtils.h',
             'platform/graphics/skia/TransformationMatrixSkia.cpp',
+            'platform/graphics/transforms/AffineTransform.cpp',
+            'platform/graphics/transforms/AffineTransform.h',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
             'platform/graphics/transforms/Matrix3DTransformOperation.h',
@@ -2174,12 +2320,13 @@
             'platform/graphics/GlyphBuffer.h',
             'platform/graphics/GlyphPageTreeNode.cpp',
             'platform/graphics/GlyphPageTreeNode.h',
-            'platform/graphics/GlyphWidthMap.cpp',
-            'platform/graphics/GlyphWidthMap.h',
+            'platform/graphics/GlyphMetricsMap.cpp',
+            'platform/graphics/GlyphMetricsMap.h',
             'platform/graphics/Gradient.cpp',
             'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
             'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.cpp',
             'platform/graphics/GraphicsContext3D.h',
             'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
@@ -2283,8 +2430,6 @@
             'platform/image-decoders/png/PNGImageDecoder.h',
             'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-decoders/wx/ImageDecoderWx.cpp',
-            'platform/image-decoders/xbm/XBMImageDecoder.cpp',
-            'platform/image-decoders/xbm/XBMImageDecoder.h',
             'platform/image-decoders/zlib/crc32.h',
             'platform/image-decoders/zlib/deflate.h',
             'platform/image-decoders/zlib/inffast.h',
@@ -2359,17 +2504,6 @@
             'platform/network/cf/AuthenticationCF.h',
             'platform/network/cf/AuthenticationChallenge.h',
             'platform/network/cf/DNSCFNet.cpp',
-            'platform/network/cf/FormDataStreamCFNet.cpp',
-            'platform/network/cf/FormDataStreamCFNet.h',
-            'platform/network/cf/ResourceError.h',
-            'platform/network/cf/ResourceErrorCF.cpp',
-            'platform/network/cf/ResourceHandleCFNet.cpp',
-            'platform/network/cf/ResourceRequest.h',
-            'platform/network/cf/ResourceRequestCFNet.cpp',
-            'platform/network/cf/ResourceRequestCFNet.h',
-            'platform/network/cf/ResourceResponse.h',
-            'platform/network/cf/ResourceResponseCFNet.cpp',
-            'platform/network/cf/ResourceResponseCFNet.h',
             'platform/network/cf/SocketStreamError.h',
             'platform/network/cf/SocketStreamHandle.h',
             'platform/network/cf/SocketStreamHandleCFNet.cpp',
@@ -2441,6 +2575,7 @@
             'platform/network/win/ResourceHandleWin.h',
             'platform/network/AuthenticationChallengeBase.cpp',
             'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
             'platform/network/Credential.cpp',
             'platform/network/Credential.h',
             'platform/network/DNS.h',
@@ -2505,7 +2640,7 @@
             'platform/qt/SharedBufferQt.cpp',
             'platform/qt/SharedTimerQt.cpp',
             'platform/qt/SoundQt.cpp',
-            'platform/qt/TemporaryLinkStubs.cpp',
+            'platform/qt/TemporaryLinkStubsQt.cpp',
             'platform/qt/WheelEventQt.cpp',
             'platform/qt/WidgetQt.cpp',
             'platform/sql/SQLValue.cpp',
@@ -2575,7 +2710,7 @@
             'platform/text/StringImpl.cpp',
             'platform/text/StringImpl.h',
             'platform/text/TextBoundaries.h',
-            'platform/text/TextBoundariesICU.cpp',
+            'platform/text/TextBoundaries.cpp',
             'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
             'platform/text/TextBreakIteratorInternalICU.h',
@@ -2755,6 +2890,8 @@
             'platform/ScrollbarThemeComposite.cpp',
             'platform/ScrollbarThemeComposite.h',
             'platform/SearchPopupMenu.h',
+            'platform/SecureTextInput.cpp',
+            'platform/SecureTextInput.h',
             'platform/SharedBuffer.cpp',
             'platform/SharedBuffer.h',
             'platform/SharedTimer.h',
@@ -2775,6 +2912,7 @@
             'platform/Widget.cpp',
             'platform/Widget.h',
             'plugins/chromium/PluginDataChromium.cpp',
+            'plugins/chromium/PluginDataChromium.h',
             'plugins/gtk/PluginDataGtk.cpp',
             'plugins/gtk/PluginPackageGtk.cpp',
             'plugins/gtk/PluginViewGtk.cpp',
@@ -2782,7 +2920,7 @@
             'plugins/gtk/xembed.h',
             'plugins/mac/PluginDataMac.mm',
             'plugins/mac/PluginPackageMac.cpp',
-            'plugins/mac/PluginViewMac.cpp',
+            'plugins/mac/PluginViewMac.mm',
             'plugins/qt/PluginDataQt.cpp',
             'plugins/qt/PluginPackageQt.cpp',
             'plugins/qt/PluginViewQt.cpp',
@@ -2820,6 +2958,7 @@
             'plugins/PluginStream.h',
             'plugins/PluginView.cpp',
             'plugins/PluginView.h',
+            'plugins/PluginViewNone.cpp',
             'plugins/npapi.cpp',
             'plugins/npfunctions.h',
             'rendering/style/BindingURI.cpp',
@@ -2882,6 +3021,8 @@
             'rendering/style/StyleVisualData.h',
             'rendering/AutoTableLayout.cpp',
             'rendering/AutoTableLayout.h',
+            'rendering/BidiRun.cpp',
+            'rendering/BidiRun.h',
             'rendering/CounterNode.cpp',
             'rendering/CounterNode.h',
             'rendering/EllipsisBox.cpp',
@@ -2896,7 +3037,7 @@
             'rendering/InlineBox.h',
             'rendering/InlineFlowBox.cpp',
             'rendering/InlineFlowBox.h',
-            'rendering/InlineRunBox.h',
+            'rendering/InlineIterator.h',
             'rendering/InlineTextBox.cpp',
             'rendering/InlineTextBox.h',
             'rendering/LayoutState.cpp',
@@ -2924,6 +3065,8 @@
             'rendering/RenderCounter.h',
             'rendering/RenderDataGrid.cpp',
             'rendering/RenderDataGrid.h',
+            'rendering/RenderEmbeddedObject.cpp',
+            'rendering/RenderEmbeddedObject.h',
             'rendering/RenderFieldset.cpp',
             'rendering/RenderFieldset.h',
             'rendering/RenderFileUploadControl.cpp',
@@ -2976,10 +3119,20 @@
             'rendering/RenderPartObject.h',
             'rendering/RenderPath.cpp',
             'rendering/RenderPath.h',
+            'rendering/RenderProgress.cpp',
+            'rendering/RenderProgress.h',
             'rendering/RenderReplaced.cpp',
             'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
+            'rendering/RenderRuby.cpp',
+            'rendering/RenderRuby.h',
+            'rendering/RenderRubyBase.cpp',
+            'rendering/RenderRubyBase.h',
+            'rendering/RenderRubyRun.cpp',
+            'rendering/RenderRubyRun.h',
+            'rendering/RenderRubyText.cpp',
+            'rendering/RenderRubyText.h',
             'rendering/RenderSVGBlock.cpp',
             'rendering/RenderSVGBlock.h',
             'rendering/RenderSVGContainer.cpp',
@@ -2996,8 +3149,15 @@
             'rendering/RenderSVGInlineText.h',
             'rendering/RenderSVGModelObject.cpp',
             'rendering/RenderSVGModelObject.h',
+            'rendering/RenderSVGResource.h',
+            'rendering/RenderSVGResourceClipper.cpp',
+            'rendering/RenderSVGResourceClipper.h',
+            'rendering/RenderSVGResourceMasker.cpp',
+            'rendering/RenderSVGResourceMasker.h',
             'rendering/RenderSVGRoot.cpp',
             'rendering/RenderSVGRoot.h',
+            'rendering/RenderSVGShadowTreeRootContainer.cpp',
+            'rendering/RenderSVGShadowTreeRootContainer.h',
             'rendering/RenderSVGTSpan.cpp',
             'rendering/RenderSVGTSpan.h',
             'rendering/RenderSVGText.cpp',
@@ -3073,12 +3233,17 @@
             'rendering/SVGInlineFlowBox.h',
             'rendering/SVGInlineTextBox.cpp',
             'rendering/SVGInlineTextBox.h',
+            'rendering/SVGMarkerData.h',
+            'rendering/SVGMarkerLayoutInfo.cpp',
+            'rendering/SVGMarkerLayoutInfo.h',
             'rendering/SVGRenderSupport.cpp',
             'rendering/SVGRenderSupport.h',
             'rendering/SVGRenderTreeAsText.cpp',
             'rendering/SVGRenderTreeAsText.h',
             'rendering/SVGRootInlineBox.cpp',
             'rendering/SVGRootInlineBox.h',
+            'rendering/SVGShadowTreeElements.cpp',
+            'rendering/SVGShadowTreeElements.h',
             'rendering/TableLayout.h',
             'rendering/TextControlInnerElements.cpp',
             'rendering/TextControlInnerElements.h',
@@ -3088,10 +3253,17 @@
             'rendering/break_lines.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
+            'storage/chromium/DatabaseObserver.h',
+            'storage/chromium/IndexedDatabase.cpp',
+            'storage/chromium/DatabaseTrackerChromium.cpp',
+            'storage/chromium/QuotaTracker.cpp',
+            'storage/chromium/QuotaTracker.h',
+            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/Database.cpp',
             'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
             'storage/DatabaseAuthorizer.h',
+            'storage/DatabaseCallback.h',
             'storage/DatabaseDetails.h',
             'storage/DatabaseTask.cpp',
             'storage/DatabaseTask.h',
@@ -3100,6 +3272,17 @@
             'storage/DatabaseTracker.cpp',
             'storage/DatabaseTracker.h',
             'storage/DatabaseTrackerClient.h',
+            'storage/IDBDatabaseError.h',
+            'storage/IDBDatabaseException.h',
+            'storage/IDBDatabaseRequest.h',
+            'storage/IDBRequest.cpp',
+            'storage/IDBRequest.h',
+            'storage/IndexedDatabase.cpp',
+            'storage/IndexedDatabase.h',
+            'storage/IndexedDatabaseImpl.cpp',
+            'storage/IndexedDatabaseImpl.h',
+            'storage/IndexedDatabaseRequest.cpp',
+            'storage/IndexedDatabaseRequest.h',
             'storage/LocalStorageTask.cpp',
             'storage/LocalStorageTask.h',
             'storage/LocalStorageThread.cpp',
@@ -3173,8 +3356,10 @@
             'svg/graphics/filters/SVGFETile.h',
             'svg/graphics/filters/SVGFETurbulence.cpp',
             'svg/graphics/filters/SVGFETurbulence.h',
-            'svg/graphics/filters/SVGFilterEffect.cpp',
-            'svg/graphics/filters/SVGFilterEffect.h',
+            'svg/graphics/filters/SVGFilter.cpp',
+            'svg/graphics/filters/SVGFilter.h',
+            'svg/graphics/filters/SVGFilterBuilder.cpp',
+            'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/graphics/filters/SVGLightSource.cpp',
             'svg/graphics/filters/SVGLightSource.h',
             'svg/graphics/filters/SVGPointLightSource.h',
@@ -3195,24 +3380,14 @@
             'svg/graphics/SVGPaintServerSolid.h',
             'svg/graphics/SVGResource.cpp',
             'svg/graphics/SVGResource.h',
-            'svg/graphics/SVGResourceClipper.cpp',
-            'svg/graphics/SVGResourceClipper.h',
             'svg/graphics/SVGResourceFilter.cpp',
             'svg/graphics/SVGResourceFilter.h',
             'svg/graphics/SVGResourceListener.h',
             'svg/graphics/SVGResourceMarker.cpp',
             'svg/graphics/SVGResourceMarker.h',
-            'svg/graphics/SVGResourceMasker.cpp',
-            'svg/graphics/SVGResourceMasker.h',
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
-            'svg/Filter.cpp',
-            'svg/Filter.h',
-            'svg/FilterBuilder.h',
-            'svg/FilterBuilder.cpp',
-            'svg/FilterEffect.cpp',
-            'svg/FilterEffect.h',
             'svg/GradientAttributes.h',
             'svg/LinearGradientAttributes.h',
             'svg/PatternAttributes.h',
@@ -3237,6 +3412,8 @@
             'svg/SVGAnimatedPoints.cpp',
             'svg/SVGAnimatedPoints.h',
             'svg/SVGAnimatedProperty.h',
+            'svg/SVGAnimatedPropertySynchronizer.h',
+            'svg/SVGAnimatedPropertyTraits.h',
             'svg/SVGAnimatedTemplate.h',
             'svg/SVGAnimationElement.cpp',
             'svg/SVGAnimationElement.h',
@@ -3264,6 +3441,7 @@
             'svg/SVGElementInstance.h',
             'svg/SVGElementInstanceList.cpp',
             'svg/SVGElementInstanceList.h',
+            'svg/SVGElementRareData.h',
             'svg/SVGEllipseElement.cpp',
             'svg/SVGEllipseElement.h',
             'svg/SVGException.h',
@@ -3486,9 +3664,9 @@
             'svg/SVGZoomAndPan.h',
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
-            'svg/SynchronizablePropertyController.cpp',
-            'svg/SynchronizablePropertyController.h',
-            'svg/SynchronizableTypeWrapper.h',
+            'websockets/ThreadableWebSocketChannel.cpp',
+            'websockets/ThreadableWebSocketChannel.h',
+            'websockets/ThreadableWebSocketChannelClientWrapper.h',
             'websockets/WebSocket.cpp',
             'websockets/WebSocket.h',
             'websockets/WebSocketChannel.cpp',
@@ -3496,6 +3674,10 @@
             'websockets/WebSocketChannelClient.h',
             'websockets/WebSocketHandshake.cpp',
             'websockets/WebSocketHandshake.h',
+            'websockets/WebSocketHandshakeRequest.cpp',
+            'websockets/WebSocketHandshakeRequest.h',
+            'websockets/WorkerThreadableWebSocketChannel.cpp',
+            'websockets/WorkerThreadableWebSocketChannel.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -3537,6 +3719,8 @@
             'xml/XMLHttpRequest.h',
             'xml/XMLHttpRequestException.h',
             'xml/XMLHttpRequestProgressEvent.h',
+            'xml/XMLHttpRequestProgressEventThrottle.cpp',
+            'xml/XMLHttpRequestProgressEventThrottle.h',
             'xml/XMLHttpRequestUpload.cpp',
             'xml/XMLHttpRequestUpload.h',
             'xml/XMLSerializer.cpp',
@@ -3588,14 +3772,22 @@
 
             'inspector/front-end/inspector.html',
             'inspector/front-end/AbstractTimelinePanel.js',
+            'inspector/front-end/AuditCategories.js',
+            'inspector/front-end/AuditLauncherView.js',
+            'inspector/front-end/AuditResultView.js',
+            'inspector/front-end/AuditRules.js',
+            'inspector/front-end/AuditsPanel.js',
             'inspector/front-end/BottomUpProfileDataGridTree.js',
             'inspector/front-end/Breakpoint.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
             'inspector/front-end/Callback.js',
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/ChangesView.js',
+            'inspector/front-end/Checkbox.js',
             'inspector/front-end/Color.js',
+            'inspector/front-end/ConsolePanel.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/ContextMenu.js',
             'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
@@ -3603,15 +3795,17 @@
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMStorage.js',
-            'inspector/front-end/DOMStorageDataGrid.js',
             'inspector/front-end/DOMStorageItemsView.js',
+            'inspector/front-end/DOMSyntaxHighlighter.js',
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
             'inspector/front-end/ElementsTreeOutline.js',
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
-            'inspector/front-end/InspectorControllerStub.js',
+            'inspector/front-end/InspectorBackendStub.js',
+            'inspector/front-end/InspectorFrontendHostStub.js',
+            'inspector/front-end/InjectedFakeWorker.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3623,7 +3817,7 @@
             'inspector/front-end/Panel.js',
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
-            'inspector/front-end/Popup.js',
+            'inspector/front-end/Popover.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfilesPanel.js',
             'inspector/front-end/ProfileView.js',
@@ -3637,33 +3831,56 @@
             'inspector/front-end/Script.js',
             'inspector/front-end/ScriptsPanel.js',
             'inspector/front-end/ScriptView.js',
+            'inspector/front-end/Section.js',
+            'inspector/front-end/Settings.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
+            'inspector/front-end/SourceCSSTokenizer.js',
             'inspector/front-end/SourceFrame.js',
+            'inspector/front-end/SourceHTMLTokenizer.js',
+            'inspector/front-end/SourceJavaScriptTokenizer.js',
+            'inspector/front-end/SourceTokenizer.js',
             'inspector/front-end/SourceView.js',
             'inspector/front-end/StatusBarButton.js',
             'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
             'inspector/front-end/TestController.js',
+            'inspector/front-end/TextEditorHighlighter.js',
+            'inspector/front-end/TextEditorModel.js',
             'inspector/front-end/TextPrompt.js',
+            'inspector/front-end/TextViewer.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelineOverviewPane.js',
+            'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
             'inspector/front-end/View.js',
             'inspector/front-end/WatchExpressionsSidebarPane.js',
+            'inspector/front-end/WelcomeView.js',
+            'inspector/front-end/WorkersSidebarPane.js',
+            'inspector/front-end/audits.css',
             'inspector/front-end/inspector.css',
             'inspector/front-end/inspectorSyntaxHighlight.css',
+            'inspector/front-end/popover.css',
+            'inspector/front-end/textViewer.css',
         ],
         'webinspector_image_files': [
-
+            'inspector/front-end/Images/auditsIcon.png',
             'inspector/front-end/Images/back.png',
+            'inspector/front-end/Images/breakpointBorder.png',
+            'inspector/front-end/Images/breakpointConditionalBorder.png',
+            'inspector/front-end/Images/breakpointConditionalCounterBorder.png',
+            'inspector/front-end/Images/breakpointCounterBorder.png',
+            'inspector/front-end/Images/breakpointsActivateButtonGlyph.png',
+            'inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png',
             'inspector/front-end/Images/checker.png',
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/consoleIcon.png',
             'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
             'inspector/front-end/Images/databaseTable.png',
@@ -3687,9 +3904,11 @@
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
             'inspector/front-end/Images/errorIcon.png',
             'inspector/front-end/Images/errorMediumIcon.png',
+            'inspector/front-end/Images/errorRedDot.png',
             'inspector/front-end/Images/excludeButtonGlyph.png',
             'inspector/front-end/Images/focusButtonGlyph.png',
             'inspector/front-end/Images/forward.png',
+            'inspector/front-end/Images/gearButtonGlyph.png',
             'inspector/front-end/Images/glossyHeader.png',
             'inspector/front-end/Images/glossyHeaderPressed.png',
             'inspector/front-end/Images/glossyHeaderSelected.png',
@@ -3707,11 +3926,14 @@
             'inspector/front-end/Images/paneSettingsButtons.png',
             'inspector/front-end/Images/pauseOnExceptionButtonGlyph.png',
             'inspector/front-end/Images/percentButtonGlyph.png',
+            'inspector/front-end/Images/popoverArrows.png',
+            'inspector/front-end/Images/popoverBackground.png',
             'inspector/front-end/Images/profileGroupIcon.png',
             'inspector/front-end/Images/profileIcon.png',
             'inspector/front-end/Images/profilesIcon.png',
             'inspector/front-end/Images/profileSmallIcon.png',
             'inspector/front-end/Images/profilesSilhouette.png',
+            'inspector/front-end/Images/programCounterBorder.png',
             'inspector/front-end/Images/radioDot.png',
             'inspector/front-end/Images/recordButtonGlyph.png',
             'inspector/front-end/Images/recordToggledButtonGlyph.png',
@@ -3739,6 +3961,7 @@
             'inspector/front-end/Images/segmentSelected.png',
             'inspector/front-end/Images/segmentSelectedEnd.png',
             'inspector/front-end/Images/sessionStorage.png',
+            'inspector/front-end/Images/spinner.gif',
             'inspector/front-end/Images/splitviewDimple.png',
             'inspector/front-end/Images/splitviewDividerBackground.png',
             'inspector/front-end/Images/statusbarBackground.png',
@@ -3749,6 +3972,13 @@
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
             'inspector/front-end/Images/storageIcon.png',
+            'inspector/front-end/Images/successGreenDot.png',
+            'inspector/front-end/Images/thumbActiveHoriz.png',
+            'inspector/front-end/Images/thumbActiveVert.png',
+            'inspector/front-end/Images/thumbHoriz.png',
+            'inspector/front-end/Images/thumbVert.png',
+            'inspector/front-end/Images/thumbHoverHoriz.png',
+            'inspector/front-end/Images/thumbHoverVert.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3773,11 +4003,9 @@
             'inspector/front-end/Images/timelinePillPurple.png',
             'inspector/front-end/Images/timelinePillRed.png',
             'inspector/front-end/Images/timelinePillYellow.png',
-            'inspector/front-end/Images/tipBalloon.png',
-            'inspector/front-end/Images/tipBalloonBottom.png',
-            'inspector/front-end/Images/tipIcon.png',
-            'inspector/front-end/Images/tipIconPressed.png',
             'inspector/front-end/Images/toolbarItemSelected.png',
+            'inspector/front-end/Images/trackHoriz.png',
+            'inspector/front-end/Images/trackVert.png',
             'inspector/front-end/Images/treeDownTriangleBlack.png',
             'inspector/front-end/Images/treeDownTriangleWhite.png',
             'inspector/front-end/Images/treeRightTriangleBlack.png',
@@ -3789,6 +4017,7 @@
             'inspector/front-end/Images/userInputPreviousIcon.png',
             'inspector/front-end/Images/userInputResultIcon.png',
             'inspector/front-end/Images/warningIcon.png',
+            'inspector/front-end/Images/warningOrangeDot.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
             'inspector/front-end/Images/whiteConnectorPoint.png'
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index c1040e2..48f321b 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -215,11 +215,6 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
-__ZN7WebCore21JavaScriptDebugServer6sharedEv
-__ZN7WebCore21JavaScriptDebugServerC1Ev
-__ZN7WebCore21JavaScriptDebugServerC2Ev
-__ZN7WebCore21JavaScriptDebugServer11pageCreatedEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer28hasListenersInterestedInPageEPNS_4PageE
 __ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
@@ -19747,8 +19742,6 @@ __ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierER
 __ZN7WebCore13MimeTypeArray4itemEj
 __ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8MimeType4typeEv
-__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
-__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
 __ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
 __ZN7WebCore10ClientRectC1Ev
 __ZN7WebCore10ClientRectC2Ev
@@ -19815,7 +19808,6 @@ __ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE6shrinkEm
 __ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
 __ZN7WebCore19InspectorController14enableProfilerEb
-__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
 __ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
 __ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
@@ -19851,8 +19843,6 @@ __ZN7WebCoreL6getURLEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZN7WebCoreL13getLineNumberEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZN7WebCoreL11getChildrenEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
-__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
-__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
 __ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
 __ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
@@ -23799,7 +23789,6 @@ __ZN7WebCore18ScriptFunctionCall14appendArgumentEb
 __ZN7WebCore18ScriptFunctionCall4callEv
 __ZN7WebCore18ScriptFunctionCall4callERbb
 __ZN7WebCore44jsInspectorControllerPrototypeFunctionAttachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
-__ZN7WebCore19InspectorController12attachWindowEv
 __ZN7WebCore19InspectorController21populateScriptObjectsEv
 __ZN7WebCoreL18callSimpleFunctionEPN3JSC9ExecStateERKNS_12ScriptObjectEPKc
 __ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
@@ -23860,7 +23849,6 @@ __ZN7WebCoreL19drawHighlightForBoxERNS_15GraphicsContextERKNS_9FloatQuadES4_S4_S
 __ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
 __ZN7WebCoreL10quadToPathERKNS_9FloatQuadE
 __ZN7WebCore44jsInspectorControllerPrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
-__ZN7WebCore19InspectorController12detachWindowEv
 __ZN7WebCore56jsInspectorControllerPrototypeFunctionMoveByUnrestrictedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
 __ZNK7WebCore19InspectorController12moveWindowByEff
 __ZN7WebCoreL24drawOutlinedQuadWithClipERNS_15GraphicsContextERKNS_9FloatQuadES4_RKNS_5ColorE
@@ -23876,19 +23864,15 @@ __ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
 __ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableDebuggerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
 __ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EE
 __ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_
-__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
 __ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
-__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
 __ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEE
 __ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
 __ZNK7WebCore30JSInspectorControllerPrototype9classInfoEv
 __ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
 __ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHa
-__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
 __ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
 __ZNK3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_E
 __ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEP
@@ -23902,32 +23886,20 @@ __ZN7WebCore21JSInspectorController16addSourceToFrameEPN3JSC9ExecStateERKNS1_7Ar
 __ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
 __ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
-__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
 __ZN7WebCore19JavaScriptCallFrameC2ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
-__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
-__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
 __ZNK3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3getERKl
-__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore19JavaScriptCallFrame6callerEv
 __ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
-__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore46jsInspectorControllerPrototypeFunctionProfilesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore21JSInspectorController8profilesEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableProfilerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
-__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
-__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionStartProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore51jsInspectorControllerPrototypeFunctionStopProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController15disableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
 __ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_E
-__ZN7WebCore21JavaScriptDebugServer17didRemoveListenerEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer21didRemoveLastListenerEv
 __ZN7WebCore5Frame17setIsDisconnectedEb
 __ZN7WebCore19InspectorController11closeWindowEv
 __ZN7WebCoreL19getUniqueIdCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pri b/src/3rdparty/webkit/WebCore/WebCore.pri
new file mode 100644
index 0000000..97ae526
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.pri
@@ -0,0 +1,723 @@
+CONFIG(standalone_package) {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
+} else {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = generated
+}
+
+## Define default features macros for optional components
+## (look for defs in config.h and included files!)
+# Try to locate sqlite3 source
+CONFIG(QTDIR_build) {
+    SQLITE3SRCDIR = $$QT_SOURCE_TREE/src/3rdparty/sqlite/
+} else {
+    SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
+    isEmpty(SQLITE3SRCDIR) {
+        SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
+    }
+}
+
+contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
+}
+
+# turn off SQLITE support if we do not have sqlite3 available
+!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+
+!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
+!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
+!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
+!contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
+!contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
+!contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
+!contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
+!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
+
+# turn on SQLITE support if any of the dependent features are turned on
+!contains(DEFINES, ENABLE_SQLITE=.) {
+  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
+    DEFINES += ENABLE_SQLITE=1
+  } else {
+    DEFINES += ENABLE_SQLITE=0
+  }
+}
+
+!contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=1
+!contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
+#!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
+!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
+!contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
+!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
+!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
+!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
+!contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
+!contains(DEFINES, ENABLE_VIDEO=.): DEFINES += ENABLE_VIDEO=1
+!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
+!contains(DEFINES, ENABLE_SANDBOX=.): DEFINES += ENABLE_SANDBOX=1
+!contains(DEFINES, ENABLE_PROGRESS_TAG=.): DEFINES += ENABLE_PROGRESS_TAG=1
+!contains(DEFINES, ENABLE_BLOB_SLICE=.): DEFINES += ENABLE_BLOB_SLICE=0
+
+greaterThan(QT_MINOR_VERSION, 5) {
+    !contains(DEFINES, ENABLE_3D_RENDERING=.): DEFINES += ENABLE_3D_RENDERING=1
+}
+
+# SVG support
+!contains(DEFINES, ENABLE_SVG=0) {
+    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
+    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
+    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
+    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
+    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
+    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+} else {
+    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+}
+
+# HTML5 media support
+!contains(DEFINES, ENABLE_VIDEO=.): DEFINES += ENABLE_VIDEO=1
+
+# HTML5 datalist support
+!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
+
+# Tiled Backing Store support
+greaterThan(QT_MINOR_VERSION, 5) {
+    !contains(DEFINES, ENABLE_TILED_BACKING_STORE=.): DEFINES += ENABLE_TILED_BACKING_STORE=1
+}
+
+# Nescape plugins support (NPAPI)
+!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
+    unix|win32-*:!embedded:!wince*: {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
+    } else {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+    }
+}
+
+# Web Socket support.
+!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+
+# Disable XSLT support with QtXmlPatterns in the 2.0 release
+!contains(DEFINES, ENABLE_XSLT=.) {
+    DEFINES += ENABLE_XSLT=0
+}
+
+# Bearer management is part of Qt 4.7
+# for older version, check for mobility with bearer 
+!contains(DEFINES, ENABLE_QT_BEARER=.) {
+     !lessThan(QT_MINOR_VERSION, 7) {
+        DEFINES += ENABLE_QT_BEARER=1
+     } else {
+        load(mobilityconfig, true)
+        contains(MOBILITY_CONFIG, bearer) {
+            DEFINES += ENABLE_QT_BEARER=1
+        }
+    }
+}
+
+# Enable touch event support with Qt 4.6
+!lessThan(QT_MINOR_VERSION, 6): DEFINES += ENABLE_TOUCH_EVENTS=1
+
+# Used to compute defaults for the build-webkit script
+CONFIG(compute_defaults) {
+    message($$DEFINES)
+    error("Done computing defaults")
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    contains(DEFINES, ENABLE_XHTMLMP=0) {
+        DEFINES -= ENABLE_XHTMLMP=0
+        DEFINES += ENABLE_XHTMLMP=1
+    }
+}
+
+## Forward enabled feature macros to JavaScript enabled features macros
+FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
+contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0): DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
+contains(DEFINES, ENABLE_DATAGRID=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
+contains(DEFINES, ENABLE_EVENTSOURCE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+contains(DEFINES, ENABLE_DATABASE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
+contains(DEFINES, ENABLE_DATALIST=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATALIST=1
+contains(DEFINES, ENABLE_DOM_STORAGE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
+contains(DEFINES, ENABLE_SHARED_SCRIPT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_SCRIPT=1
+contains(DEFINES, ENABLE_WORKERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
+contains(DEFINES, ENABLE_SHARED_WORKERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
+contains(DEFINES, ENABLE_VIDEO=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
+contains(DEFINES, ENABLE_XPATH=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XPATH=1
+contains(DEFINES, ENABLE_XSLT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
+contains(DEFINES, ENABLE_XBL=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
+contains(DEFINES, ENABLE_FILTERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+contains(DEFINES, ENABLE_WCSS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
+contains(DEFINES, ENABLE_WML=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
+contains(DEFINES, ENABLE_XHTMLMP=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+contains(DEFINES, ENABLE_SVG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
+contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
+contains(DEFINES, ENABLE_WEB_SOCKETS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+contains(DEFINES, ENABLE_TOUCH_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TOUCH_EVENTS=1
+contains(DEFINES, ENABLE_TILED_BACKING_STORE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TILED_BACKING_STORE=1
+
+
+## Derived source generators
+WML_NAMES = $$PWD/wml/WMLTagNames.in
+
+SVG_NAMES = $$PWD/svg/svgtags.in
+
+XLINK_NAMES = $$PWD/svg/xlinkattrs.in
+
+TOKENIZER = $$PWD/css/tokenizer.flex
+
+DOCTYPESTRINGS = $$PWD/html/DocTypeStrings.gperf
+
+CSSBISON = $$PWD/css/CSSGrammar.y
+
+HTML_NAMES = $$PWD/html/HTMLTagNames.in
+
+XML_NAMES = $$PWD/xml/xmlattrs.in
+
+XMLNS_NAMES = $$PWD/xml/xmlnsattrs.in
+
+ENTITIES_GPERF = $$PWD/html/HTMLEntityNames.gperf
+
+COLORDAT_GPERF = $$PWD/platform/ColorData.gperf
+
+WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
+
+WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
+
+DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
+
+XPATHBISON = $$PWD/xml/XPathGrammar.y
+
+contains(DEFINES, ENABLE_SVG=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/SVGCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/SVGCSSValueKeywords.in
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/WCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
+}
+
+STYLESHEETS_EMBED = \
+    $$PWD/css/html.css \
+    $$PWD/css/quirks.css \
+    $$PWD/css/svg.css \
+    $$PWD/css/view-source.css \
+    $$PWD/css/wml.css \
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css \
+    $$PWD/css/themeQtNoListboxes.css \
+    $$PWD/css/themeQtMaemo5.css
+
+IDL_BINDINGS += \
+    css/Counter.idl \
+    css/CSSCharsetRule.idl \
+    css/CSSFontFaceRule.idl \
+    css/CSSImportRule.idl \
+    css/CSSMediaRule.idl \
+    css/CSSPageRule.idl \
+    css/CSSPrimitiveValue.idl \
+    css/CSSRule.idl \
+    css/CSSRuleList.idl \
+    css/CSSStyleDeclaration.idl \
+    css/CSSStyleRule.idl \
+    css/CSSStyleSheet.idl \
+    css/CSSValue.idl \
+    css/CSSValueList.idl \
+    css/CSSVariablesDeclaration.idl \
+    css/CSSVariablesRule.idl \
+    css/MediaList.idl \
+    css/Rect.idl \
+    css/RGBColor.idl \
+    css/StyleMedia.idl \
+    css/StyleSheet.idl \
+    css/StyleSheetList.idl \
+    css/WebKitCSSKeyframeRule.idl \
+    css/WebKitCSSKeyframesRule.idl \
+    css/WebKitCSSMatrix.idl \
+    css/WebKitCSSTransformValue.idl \
+    dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
+    dom/CharacterData.idl \
+    dom/ClientRect.idl \
+    dom/ClientRectList.idl \
+    dom/Clipboard.idl \
+    dom/CDATASection.idl \
+    dom/Comment.idl \
+    dom/CompositionEvent.idl \
+    dom/CustomEvent.idl \
+    dom/DocumentFragment.idl \
+    dom/Document.idl \
+    dom/DocumentType.idl \
+    dom/DOMCoreException.idl \
+    dom/DOMImplementation.idl \
+    dom/Element.idl \
+    dom/Entity.idl \
+    dom/EntityReference.idl \
+    dom/ErrorEvent.idl \
+    dom/Event.idl \
+    dom/EventException.idl \
+#    dom/EventListener.idl \
+#    dom/EventTarget.idl \
+    dom/KeyboardEvent.idl \
+    dom/MouseEvent.idl \
+    dom/MessageChannel.idl \
+    dom/MessageEvent.idl \
+    dom/MessagePort.idl \
+    dom/MutationEvent.idl \
+    dom/NamedNodeMap.idl \
+    dom/Node.idl \
+    dom/NodeFilter.idl \
+    dom/NodeIterator.idl \
+    dom/NodeList.idl \
+    dom/Notation.idl \
+    dom/OverflowEvent.idl \
+    dom/PageTransitionEvent.idl \
+    dom/PopStateEvent.idl \
+    dom/ProcessingInstruction.idl \
+    dom/ProgressEvent.idl \
+    dom/RangeException.idl \
+    dom/Range.idl \
+    dom/Text.idl \
+    dom/TextEvent.idl \
+    dom/Touch.idl \
+    dom/TouchEvent.idl \
+    dom/TouchList.idl \
+    dom/TreeWalker.idl \
+    dom/UIEvent.idl \
+    dom/WebKitAnimationEvent.idl \
+    dom/WebKitTransitionEvent.idl \
+    dom/WheelEvent.idl \
+    html/Blob.idl \
+    html/canvas/WebGLArray.idl \
+    html/canvas/WebGLArrayBuffer.idl \
+    html/canvas/WebGLByteArray.idl \
+    html/canvas/WebGLFloatArray.idl \
+    html/canvas/CanvasGradient.idl \
+    html/canvas/WebGLIntArray.idl \
+    html/canvas/CanvasPattern.idl \
+    html/canvas/CanvasRenderingContext.idl \
+    html/canvas/CanvasRenderingContext2D.idl \
+    html/canvas/WebGLActiveInfo.idl \
+    html/canvas/WebGLBuffer.idl \
+    html/canvas/WebGLContextAttributes.idl \
+    html/canvas/WebGLFramebuffer.idl \
+    html/canvas/WebGLProgram.idl \
+    html/canvas/WebGLRenderbuffer.idl \
+    html/canvas/WebGLRenderingContext.idl \
+    html/canvas/WebGLShader.idl \
+    html/canvas/WebGLShortArray.idl \
+    html/canvas/WebGLTexture.idl \
+    html/canvas/WebGLUniformLocation.idl \
+    html/canvas/WebGLUnsignedByteArray.idl \
+    html/canvas/WebGLUnsignedIntArray.idl \
+    html/canvas/WebGLUnsignedShortArray.idl \
+    html/DataGridColumn.idl \
+    html/DataGridColumnList.idl \
+    html/DOMFormData.idl \
+    html/File.idl \
+    html/FileList.idl \
+    html/HTMLAllCollection.idl \
+    html/HTMLAudioElement.idl \
+    html/HTMLAnchorElement.idl \
+    html/HTMLAppletElement.idl \
+    html/HTMLAreaElement.idl \
+    html/HTMLBaseElement.idl \
+    html/HTMLBaseFontElement.idl \
+    html/HTMLBlockquoteElement.idl \
+    html/HTMLBodyElement.idl \
+    html/HTMLBRElement.idl \
+    html/HTMLButtonElement.idl \
+    html/HTMLCanvasElement.idl \
+    html/HTMLCollection.idl \
+    html/HTMLDataGridElement.idl \
+    html/HTMLDataGridCellElement.idl \
+    html/HTMLDataGridColElement.idl \
+    html/HTMLDataGridRowElement.idl \
+    html/HTMLDataListElement.idl \
+    html/HTMLDirectoryElement.idl \
+    html/HTMLDivElement.idl \
+    html/HTMLDListElement.idl \
+    html/HTMLDocument.idl \
+    html/HTMLElement.idl \
+    html/HTMLEmbedElement.idl \
+    html/HTMLFieldSetElement.idl \
+    html/HTMLFontElement.idl \
+    html/HTMLFormElement.idl \
+    html/HTMLFrameElement.idl \
+    html/HTMLFrameSetElement.idl \
+    html/HTMLHeadElement.idl \
+    html/HTMLHeadingElement.idl \
+    html/HTMLHRElement.idl \
+    html/HTMLHtmlElement.idl \
+    html/HTMLIFrameElement.idl \
+    html/HTMLImageElement.idl \
+    html/HTMLInputElement.idl \
+    html/HTMLIsIndexElement.idl \
+    html/HTMLLabelElement.idl \
+    html/HTMLLegendElement.idl \
+    html/HTMLLIElement.idl \
+    html/HTMLLinkElement.idl \
+    html/HTMLMapElement.idl \
+    html/HTMLMarqueeElement.idl \
+    html/HTMLMediaElement.idl \
+    html/HTMLMenuElement.idl \
+    html/HTMLMetaElement.idl \
+    html/HTMLModElement.idl \
+    html/HTMLObjectElement.idl \
+    html/HTMLOListElement.idl \
+    html/HTMLOptGroupElement.idl \
+    html/HTMLOptionElement.idl \
+    html/HTMLOptionsCollection.idl \
+    html/HTMLParagraphElement.idl \
+    html/HTMLParamElement.idl \
+    html/HTMLPreElement.idl \
+    html/HTMLProgressElement.idl \
+    html/HTMLQuoteElement.idl \
+    html/HTMLScriptElement.idl \
+    html/HTMLSelectElement.idl \
+    html/HTMLSourceElement.idl \
+    html/HTMLStyleElement.idl \
+    html/HTMLTableCaptionElement.idl \
+    html/HTMLTableCellElement.idl \
+    html/HTMLTableColElement.idl \
+    html/HTMLTableElement.idl \
+    html/HTMLTableRowElement.idl \
+    html/HTMLTableSectionElement.idl \
+    html/HTMLTextAreaElement.idl \
+    html/HTMLTitleElement.idl \
+    html/HTMLUListElement.idl \
+    html/HTMLVideoElement.idl \
+    html/ImageData.idl \
+    html/MediaError.idl \
+    html/TextMetrics.idl \
+    html/TimeRanges.idl \
+    html/ValidityState.idl \
+    html/VoidCallback.idl \
+    inspector/InjectedScriptHost.idl \
+    inspector/InspectorBackend.idl \
+    inspector/InspectorFrontendHost.idl \
+    inspector/JavaScriptCallFrame.idl \
+    loader/appcache/DOMApplicationCache.idl \
+    page/BarInfo.idl \
+    page/Console.idl \
+    page/Coordinates.idl \
+    page/DOMSelection.idl \
+    page/DOMWindow.idl \
+    page/EventSource.idl \
+    page/Geolocation.idl \
+    page/Geoposition.idl \
+    page/History.idl \
+    page/Location.idl \
+    page/Navigator.idl \
+    page/PositionError.idl \
+    page/Screen.idl \
+    page/WebKitPoint.idl \
+    page/WorkerNavigator.idl \
+    plugins/Plugin.idl \
+    plugins/MimeType.idl \
+    plugins/PluginArray.idl \
+    plugins/MimeTypeArray.idl \
+    storage/Database.idl \
+    storage/Storage.idl \
+    storage/StorageEvent.idl \
+    storage/SQLError.idl \
+    storage/SQLResultSet.idl \
+    storage/SQLResultSetRowList.idl \
+    storage/SQLTransaction.idl \
+    svg/SVGZoomEvent.idl \
+    svg/SVGAElement.idl \
+    svg/SVGAltGlyphElement.idl \
+    svg/SVGAngle.idl \
+    svg/SVGAnimateColorElement.idl \
+    svg/SVGAnimatedAngle.idl \
+    svg/SVGAnimatedBoolean.idl \
+    svg/SVGAnimatedEnumeration.idl \
+    svg/SVGAnimatedInteger.idl \
+    svg/SVGAnimatedLength.idl \
+    svg/SVGAnimatedLengthList.idl \
+    svg/SVGAnimatedNumber.idl \
+    svg/SVGAnimatedNumberList.idl \
+    svg/SVGAnimatedPreserveAspectRatio.idl \
+    svg/SVGAnimatedRect.idl \
+    svg/SVGAnimatedString.idl \
+    svg/SVGAnimatedTransformList.idl \
+    svg/SVGAnimateElement.idl \
+    svg/SVGAnimateTransformElement.idl \
+    svg/SVGAnimationElement.idl \
+    svg/SVGCircleElement.idl \
+    svg/SVGClipPathElement.idl \
+    svg/SVGColor.idl \
+    svg/SVGComponentTransferFunctionElement.idl \
+    svg/SVGCursorElement.idl \
+    svg/SVGDefsElement.idl \
+    svg/SVGDescElement.idl \
+    svg/SVGDocument.idl \
+    svg/SVGElement.idl \
+    svg/SVGElementInstance.idl \
+    svg/SVGElementInstanceList.idl \
+    svg/SVGEllipseElement.idl \
+    svg/SVGException.idl \
+    svg/SVGFEBlendElement.idl \
+    svg/SVGFEColorMatrixElement.idl \
+    svg/SVGFEComponentTransferElement.idl \
+    svg/SVGFECompositeElement.idl \
+    svg/SVGFEDiffuseLightingElement.idl \
+    svg/SVGFEDisplacementMapElement.idl \
+    svg/SVGFEDistantLightElement.idl \
+    svg/SVGFEFloodElement.idl \
+    svg/SVGFEFuncAElement.idl \
+    svg/SVGFEFuncBElement.idl \
+    svg/SVGFEFuncGElement.idl \
+    svg/SVGFEFuncRElement.idl \
+    svg/SVGFEGaussianBlurElement.idl \
+    svg/SVGFEImageElement.idl \
+    svg/SVGFEMergeElement.idl \
+    svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEMorphologyElement.idl \
+    svg/SVGFEOffsetElement.idl \
+    svg/SVGFEPointLightElement.idl \
+    svg/SVGFESpecularLightingElement.idl \
+    svg/SVGFESpotLightElement.idl \
+    svg/SVGFETileElement.idl \
+    svg/SVGFETurbulenceElement.idl \
+    svg/SVGFilterElement.idl \
+    svg/SVGFontElement.idl \
+    svg/SVGFontFaceElement.idl \
+    svg/SVGFontFaceFormatElement.idl \
+    svg/SVGFontFaceNameElement.idl \
+    svg/SVGFontFaceSrcElement.idl \
+    svg/SVGFontFaceUriElement.idl \
+    svg/SVGForeignObjectElement.idl \
+    svg/SVGGElement.idl \
+    svg/SVGGlyphElement.idl \
+    svg/SVGGradientElement.idl \
+    svg/SVGHKernElement.idl \
+    svg/SVGImageElement.idl \
+    svg/SVGLength.idl \
+    svg/SVGLengthList.idl \
+    svg/SVGLinearGradientElement.idl \
+    svg/SVGLineElement.idl \
+    svg/SVGMarkerElement.idl \
+    svg/SVGMaskElement.idl \
+    svg/SVGMatrix.idl \
+    svg/SVGMetadataElement.idl \
+    svg/SVGMissingGlyphElement.idl \
+    svg/SVGNumber.idl \
+    svg/SVGNumberList.idl \
+    svg/SVGPaint.idl \
+    svg/SVGPathElement.idl \
+    svg/SVGPathSegArcAbs.idl \
+    svg/SVGPathSegArcRel.idl \
+    svg/SVGPathSegClosePath.idl \
+    svg/SVGPathSegCurvetoCubicAbs.idl \
+    svg/SVGPathSegCurvetoCubicRel.idl \
+    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
+    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
+    svg/SVGPathSegCurvetoQuadraticAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticRel.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
+    svg/SVGPathSeg.idl \
+    svg/SVGPathSegLinetoAbs.idl \
+    svg/SVGPathSegLinetoHorizontalAbs.idl \
+    svg/SVGPathSegLinetoHorizontalRel.idl \
+    svg/SVGPathSegLinetoRel.idl \
+    svg/SVGPathSegLinetoVerticalAbs.idl \
+    svg/SVGPathSegLinetoVerticalRel.idl \
+    svg/SVGPathSegList.idl \
+    svg/SVGPathSegMovetoAbs.idl \
+    svg/SVGPathSegMovetoRel.idl \
+    svg/SVGPatternElement.idl \
+    svg/SVGPoint.idl \
+    svg/SVGPointList.idl \
+    svg/SVGPolygonElement.idl \
+    svg/SVGPolylineElement.idl \
+    svg/SVGPreserveAspectRatio.idl \
+    svg/SVGRadialGradientElement.idl \
+    svg/SVGRectElement.idl \
+    svg/SVGRect.idl \
+    svg/SVGRenderingIntent.idl \
+    svg/SVGScriptElement.idl \
+    svg/SVGSetElement.idl \
+    svg/SVGStopElement.idl \
+    svg/SVGStringList.idl \
+    svg/SVGStyleElement.idl \
+    svg/SVGSVGElement.idl \
+    svg/SVGSwitchElement.idl \
+    svg/SVGSymbolElement.idl \
+    svg/SVGTextContentElement.idl \
+    svg/SVGTextElement.idl \
+    svg/SVGTextPathElement.idl \
+    svg/SVGTextPositioningElement.idl \
+    svg/SVGTitleElement.idl \
+    svg/SVGTransform.idl \
+    svg/SVGTransformList.idl \
+    svg/SVGTRefElement.idl \
+    svg/SVGTSpanElement.idl \
+    svg/SVGUnitTypes.idl \
+    svg/SVGUseElement.idl \
+    svg/SVGViewElement.idl \
+    websockets/WebSocket.idl \
+    workers/AbstractWorker.idl \
+    workers/DedicatedWorkerContext.idl \
+    workers/SharedWorker.idl \
+    workers/SharedWorkerContext.idl \
+    workers/Worker.idl \
+    workers/WorkerContext.idl \
+    workers/WorkerLocation.idl \
+    xml/DOMParser.idl \
+    xml/XMLHttpRequest.idl \
+    xml/XMLHttpRequestException.idl \
+    xml/XMLHttpRequestProgressEvent.idl \
+    xml/XMLHttpRequestUpload.idl \
+    xml/XMLSerializer.idl \
+    xml/XPathNSResolver.idl \
+    xml/XPathException.idl \
+    xml/XPathExpression.idl \
+    xml/XPathResult.idl \
+    xml/XPathEvaluator.idl \
+    xml/XSLTProcessor.idl
+
+contains(DEFINES, ENABLE_WML=1) {
+    wmlnames.output = $${WC_GENERATED_SOURCES_DIR}/WMLNames.cpp
+    wmlnames.input = WML_NAMES
+    wmlnames.wkScript = $$PWD/dom/make_names.pl
+    wmlnames.commands = perl -I$$PWD/bindings/scripts $$wmlnames.wkScript --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+    wmlnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/WMLElementFactory.cpp
+    addExtraCompiler(wmlnames)
+}
+
+contains(DEFINES, ENABLE_SVG=1) {
+    # GENERATOR 5-C:
+    svgnames.output = $${WC_GENERATED_SOURCES_DIR}/SVGNames.cpp
+    svgnames.input = SVG_NAMES
+    svgnames.depends = $$PWD/svg/svgattrs.in
+    svgnames.wkScript = $$PWD/dom/make_names.pl
+    svgnames.commands = perl -I$$PWD/bindings/scripts $$svgnames.wkScript --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+    svgnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/SVGElementFactory.cpp $${WC_GENERATED_SOURCES_DIR}/JSSVGElementWrapperFactory.cpp
+    addExtraCompiler(svgnames)
+}
+
+# GENERATOR 5-D:
+xlinknames.output = $${WC_GENERATED_SOURCES_DIR}/XLinkNames.cpp
+xlinknames.wkScript = $$PWD/dom/make_names.pl
+xlinknames.commands = perl -I$$PWD/bindings/scripts $$xlinknames.wkScript --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+xlinknames.input = XLINK_NAMES
+addExtraCompiler(xlinknames)
+
+# GENERATOR 6-A:
+cssprops.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+cssprops.input = WALDOCSSPROPS
+cssprops.wkScript = $$PWD/css/makeprop.pl
+cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $${DASHBOARDSUPPORTCSSPROPERTIES} $${EXTRACSSPROPERTIES} > $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.in && cd $$WC_GENERATED_SOURCES_DIR && perl $$cssprops.wkScript && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssprops.depends = ${QMAKE_FILE_NAME} $${DASHBOARDSUPPORTCSSPROPERTIES} $${EXTRACSSPROPERTIES}
+addExtraCompiler(cssprops)
+
+# GENERATOR 6-B:
+cssvalues.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.c
+cssvalues.input = WALDOCSSVALUES
+cssvalues.wkScript = $$PWD/css/makevalues.pl
+cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.in && cd $$WC_GENERATED_SOURCES_DIR && perl $$cssvalues.wkScript && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssvalues.depends = ${QMAKE_FILE_NAME} $${EXTRACSSVALUES}
+cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.h
+addExtraCompiler(cssvalues)
+
+# GENERATOR 1: IDL compiler
+idl.output = $${WC_GENERATED_SOURCES_DIR}/JS${QMAKE_FILE_BASE}.cpp
+idl.input = IDL_BINDINGS
+idl.wkScript = $$PWD/bindings/scripts/generate-bindings.pl
+idl.commands = perl -I$$PWD/bindings/scripts $$idl.wkScript --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$WC_GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
+idl.depends = $$PWD/bindings/scripts/CodeGenerator.pm \
+              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
+              $$PWD/bindings/scripts/IDLParser.pm \
+              $$PWD/bindings/scripts/IDLStructure.pm \
+              $$PWD/bindings/scripts/InFilesParser.pm
+addExtraCompiler(idl)
+
+# GENERATOR 3: tokenizer (flex)
+tokenizer.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+tokenizer.input = TOKENIZER
+tokenizer.wkScript = $$PWD/css/maketokenizer
+tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$tokenizer.wkScript > ${QMAKE_FILE_OUT}
+addExtraCompiler(tokenizer)
+
+# GENERATOR 4: CSS grammar
+cssbison.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+cssbison.input = CSSBISON
+cssbison.wkScript = $$PWD/css/makegrammar.pl
+cssbison.commands = perl $$cssbison.wkScript ${QMAKE_FILE_NAME} $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}
+cssbison.depends = ${QMAKE_FILE_NAME}
+addExtraCompiler(cssbison)
+
+# GENERATOR 5-A:
+htmlnames.output = $${WC_GENERATED_SOURCES_DIR}/HTMLNames.cpp
+htmlnames.input = HTML_NAMES
+htmlnames.wkScript = $$PWD/dom/make_names.pl
+htmlnames.commands = perl -I$$PWD/bindings/scripts $$htmlnames.wkScript --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
+htmlnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/HTMLElementFactory.cpp $${WC_GENERATED_SOURCES_DIR}/JSHTMLElementWrapperFactory.cpp
+addExtraCompiler(htmlnames)
+
+# GENERATOR 5-B:
+xmlnsnames.output = $${WC_GENERATED_SOURCES_DIR}/XMLNSNames.cpp
+xmlnsnames.input = XMLNS_NAMES
+xmlnsnames.wkScript = $$PWD/dom/make_names.pl
+xmlnsnames.commands = perl -I$$PWD/bindings/scripts $$xmlnsnames.wkScript --attrs $$PWD/xml/xmlnsattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+addExtraCompiler(xmlnsnames)
+
+# GENERATOR 5-C:
+xmlnames.output = $${WC_GENERATED_SOURCES_DIR}/XMLNames.cpp
+xmlnames.input = XML_NAMES
+xmlnames.wkScript = $$PWD/dom/make_names.pl
+xmlnames.commands = perl -I$$PWD/bindings/scripts $$xmlnames.wkScript --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+addExtraCompiler(xmlnames)
+
+# GENERATOR 8-A:
+entities.output = $${WC_GENERATED_SOURCES_DIR}/HTMLEntityNames.c
+entities.input = ENTITIES_GPERF
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${WC_GENERATED_SOURCES_DIR}/HTMLEntityNames.c
+entities.clean = ${QMAKE_FILE_OUT}
+addExtraCompiler(entities)
+
+# GENERATOR 8-B:
+doctypestrings.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+doctypestrings.input = DOCTYPESTRINGS
+doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+doctypestrings.clean = ${QMAKE_FILE_OUT}
+addExtraCompiler(doctypestrings)
+
+# GENERATOR 8-C:
+colordata.output = $${WC_GENERATED_SOURCES_DIR}/ColorData.c
+colordata.input = COLORDAT_GPERF
+colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+addExtraCompiler(colordata)
+
+# GENERATOR 9:
+stylesheets.wkScript = $$PWD/css/make-css-file-arrays.pl
+stylesheets.output = $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheetsData.cpp
+stylesheets.input = stylesheets.wkScript
+stylesheets.commands = perl $$stylesheets.wkScript $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
+stylesheets.depends = $$STYLESHEETS_EMBED
+stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h
+addExtraCompiler(stylesheets, $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h)
+
+# GENERATOR 10: XPATH grammar
+xpathbison.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+xpathbison.input = XPATHBISON
+xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
+xpathbison.depends = ${QMAKE_FILE_NAME}
+addExtraCompiler(xpathbison)
+
+# GENERATOR 11: WebKit Version
+# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
+webkitversion.wkScript = $$PWD/../WebKit/scripts/generate-webkitversion.pl
+webkitversion.output = $${WC_GENERATED_SOURCES_DIR}/WebKitVersion.h
+webkitversion.input = webkitversion.wkScript
+webkitversion.commands = perl $$webkitversion.wkScript --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${WC_GENERATED_SOURCES_DIR}/
+webkitversion.clean = ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/WebKitVersion.h
+webkitversion.wkAddOutputToSources = false
+addExtraCompiler(webkitversion)
+
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 7e57394..981dba2 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -4,7 +4,6 @@ CONFIG += depend_includepath
 
 symbian: {
     TARGET.EPOCALLOWDLLDATA=1
-    TARGET.EPOCHEAPSIZE = 0x20000 0x2000000 // Min 128kB, Max 32MB
     TARGET.CAPABILITY = All -Tcb
     isEmpty(QT_LIBINFIX) {
         TARGET.UID3 = 0x200267C2
@@ -12,6 +11,7 @@ symbian: {
         TARGET.UID3 = 0xE00267C2
     }
     webkitlibs.sources = QtWebKit$${QT_LIBINFIX}.dll
+    CONFIG(QTDIR_build): webkitlibs.sources = $$QMAKE_LIBDIR_QT/$$webkitlibs.sources
     webkitlibs.path = /sys/bin
     vendorinfo = \
         "; Localised Vendor name" \
@@ -25,13 +25,31 @@ symbian: {
     webkitbackup.sources = ../WebKit/qt/symbian/backup_registration.xml
     webkitbackup.path = /private/10202D56/import/packages/$$replace(TARGET.UID3, 0x,)
 
+    contains(QT_CONFIG, declarative) {
+         declarativeImport.sources = $$QT_BUILD_TREE/imports/QtWebKit/qmlwebkitplugin$${QT_LIBINFIX}.dll
+         declarativeImport.sources += ../WebKit/qt/declarative/qmldir
+         declarativeImport.path = c:$$QT_IMPORTS_BASE_DIR/QtWebKit
+         DEPLOYMENT += declarativeImport
+    }
+
     DEPLOYMENT += webkitlibs webkitbackup
 
-    # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
-    # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
-    MMP_RULES += "LINKEROPTION  armcc --rw-base 0xE00000"
+    # Need to guarantee that these come before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE rendering"
+    MMP_RULES += "USERINCLUDE platform/text"
+    symbian-abld|symbian-sbsv2 {
+        # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
+        # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
+        QMAKE_LFLAGS.ARMCC += --rw-base 0xE00000
+        MMP_RULES += ALWAYS_BUILD_AS_ARM
+    }  else {
+        QMAKE_CFLAGS -= --thumb
+        QMAKE_CXXFLAGS -= --thumb
+    }
+    CONFIG(release, debug|release): QMAKE_CXXFLAGS.ARMCC += -OTime -O3
 }
 
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ..
 include($$PWD/../WebKit.pri)
 
 TEMPLATE = lib
@@ -39,36 +57,43 @@ TARGET = QtWebKit
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
-CONFIG(QTDIR_build) {
-    GENERATED_SOURCES_DIR = $$PWD/generated
-    include($$QT_SOURCE_TREE/src/qbase.pri)
+CONFIG(standalone_package) {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = $$PWD/../JavaScriptCore/generated
+
     PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
-    DEFINES *= NDEBUG
 } else {
-    !static: DEFINES += QT_MAKEDLL
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = generated
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = ../JavaScriptCore/generated
 
-    CONFIG(debug, debug|release) {
-        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+    !CONFIG(release, debug|release) {
         OBJECTS_DIR = obj/debug
     } else { # Release
-        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
         OBJECTS_DIR = obj/release
     }
 
-    DESTDIR = $$OUTPUT_DIR/lib
 }
 
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
+CONFIG(QTDIR_build) {
+    include($$QT_SOURCE_TREE/src/qbase.pri)
+} else {
+    DESTDIR = $$OUTPUT_DIR/lib
+    !static: DEFINES += QT_MAKEDLL
+    symbian: TARGET =$$TARGET$${QT_LIBINFIX}
+}
+moduleFile=$$PWD/../WebKit/qt/qt_webkit_version.pri
+isEmpty(QT_BUILD_TREE):include($$moduleFile)
+VERSION = $${QT_WEBKIT_MAJOR_VERSION}.$${QT_WEBKIT_MINOR_VERSION}.$${QT_WEBKIT_PATCH_VERSION}
 
 unix {
     QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
 unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
+linux*-g++*:QMAKE_LFLAGS += $$QMAKE_LFLAGS_NOUNDEF
 
-CONFIG(release):!CONFIG(QTDIR_build) {
+CONFIG(release):!CONFIG(standalone_package) {
     contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
     unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
 }
@@ -79,151 +104,87 @@ freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
 DEFINES += BUILD_WEBKIT
 
 # Remove whole program optimizations due to miscompilations
-win32-msvc2005|win32-msvc2008:{
+win32-msvc2005|win32-msvc2008|wince*:{
     QMAKE_CFLAGS_RELEASE -= -GL
     QMAKE_CXXFLAGS_RELEASE -= -GL
 }
 
-win32-*: DEFINES += _HAS_TR1=0
-wince* {
-#    DEFINES += ENABLE_SVG=0 ENABLE_XPATH=0 ENABLE_XBL=0 \
-#               ENABLE_SVG_ANIMATION=0 ENABLE_SVG_USE=0  \
-#               ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_AS_IMAGE=0
-
-    INCLUDEPATH += $$PWD/../JavaScriptCore/os-wince
-    INCLUDEPATH += $$PWD/../JavaScriptCore/os-win32
-}
-
 # Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
-win32-g++ {
+win32-g++* {
     TMPPATH            = $$quote($$(INCLUDE))
     QMAKE_INCDIR_POST += $$split(TMPPATH,";")
     TMPPATH            = $$quote($$(LIB))
     QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
 }
 
-# Assume that symbian OS always comes with sqlite
-symbian:!CONFIG(QTDIR_build): CONFIG += system-sqlite
-
-# Try to locate sqlite3 source
-CONFIG(QTDIR_build) {
-    SQLITE3SRCDIR = $$QT_SOURCE_TREE/src/3rdparty/sqlite/
-} else {
-    SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
-    isEmpty(SQLITE3SRCDIR) {
-        SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
-    } 
+symbian {
+    !CONFIG(QTDIR_build) {
+        # Test if symbian OS comes with sqlite
+        exists($${EPOCROOT}epoc32/release/armv5/lib/sqlite3.dso):CONFIG *= system-sqlite
+    } else:!symbian-abld:!symbian-sbsv2 {
+        # When bundled with Qt, all Symbian build systems extract their own sqlite files if
+        # necessary, but on non-mmp based ones we need to specify this ourselves.
+        include($$QT_SOURCE_TREE/src/plugins/sqldrivers/sqlite_symbian/sqlite_symbian.pri)
+    }
 }
 
-# Optional components (look for defs in config.h and included files!)
 
-contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
-}
 
-# turn off SQLITE support if we do not have sqlite3 available
-!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
-
-!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
-!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
-!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
-!contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
-!contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
-!contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
-!contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
-!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
-
-# turn on SQLITE support if any of the dependent features are turned on
-!contains(DEFINES, ENABLE_SQLITE=.) {
-  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    DEFINES += ENABLE_SQLITE=1
-  } else {
-    DEFINES += ENABLE_SQLITE=0
-  }
-}
+RESOURCES += \
+    $$PWD/../WebCore/WebCore.qrc
 
-!contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
-!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
-!contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
-#!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
-!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
-!contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
-!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
-!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
-!contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
-
-# SVG support
-!contains(DEFINES, ENABLE_SVG=0) {
-    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
-    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
-    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
-    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
-    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
-    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
-} else {
-    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+!symbian:!maemo5 {
+    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
 }
 
-mameo5|symbian|embedded {
+maemo5|symbian|embedded {
     DEFINES += ENABLE_FAST_MOBILE_SCROLLING=1
 }
 
-# HTML5 ruby support
-!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
-
-# HTML5 media support
-!contains(DEFINES, ENABLE_VIDEO=.) {
-    contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
-    else:DEFINES += ENABLE_VIDEO=0
+maemo5|symbian {
+    DEFINES += WTF_USE_QT_MOBILE_THEME=1
 }
 
-# HTML5 datalist support
-!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
-
-# Nescape plugins support (NPAPI)
-!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    unix|win32-*:!embedded:!wince*: {
-        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
-    } else {
-        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
-    }
+contains(DEFINES, WTF_USE_QT_MOBILE_THEME=1) {
+    DEFINES += ENABLE_NO_LISTBOX_RENDERING=1
 }
 
-# Web Socket support.
-!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=0
+include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
+addJavaScriptCoreLib(../JavaScriptCore)
 
-# XSLT support with QtXmlPatterns
-!contains(DEFINES, ENABLE_XSLT=.) {
-    contains(QT_CONFIG, xmlpatterns):!lessThan(QT_MINOR_VERSION, 5):DEFINES += ENABLE_XSLT=1
-    else:DEFINES += ENABLE_XSLT=0
-}
 
-!CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_BEARER=.) {
-    symbian: {
-        exists($${EPOCROOT}epoc32/release/winscw/udeb/QtBearer.lib)| \
-        exists($${EPOCROOT}epoc32/release/armv5/lib/QtBearer.lib) {
-            DEFINES += ENABLE_QT_BEARER=1
-        }
+# HTML5 Media Support
+# We require phonon. QtMultimedia support is disabled currently.
+!contains(DEFINES, ENABLE_VIDEO=.) {
+    DEFINES -= ENABLE_VIDEO=1
+    DEFINES += ENABLE_VIDEO=0
+
+    contains(QT_CONFIG, phonon) {
+        DEFINES -= ENABLE_VIDEO=0
+        DEFINES += ENABLE_VIDEO=1
     }
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
+# Extract sources to build from the generator definitions
+defineTest(addExtraCompiler) {
+    isEqual($${1}.wkAddOutputToSources, false): return(true)
 
-# Used to compute defaults for the build-webkit script
-CONFIG(compute_defaults) {
-    message($$DEFINES)
-    error("Done computing defaults")
-}
+    outputRule = $$eval($${1}.output)
+    input = $$eval($${1}.input)
+    input = $$eval($$input)
 
-RESOURCES += \
-    $$PWD/../WebCore/WebCore.qrc
+    for(file,input) {
+        base = $$basename(file)
+        base ~= s/\\..+//
+        newfile=$$replace(outputRule,\\$\\{QMAKE_FILE_BASE\\},$$base)
+        SOURCES += $$newfile
+    }
+    SOURCES += $$eval($${1}.wkExtraSources)
+    export(SOURCES)
 
-!symbian {
-    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
+    return(true)
 }
-
-include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
+include(WebCore.pri)
 
 INCLUDEPATH = \
     $$PWD \
@@ -231,6 +192,7 @@ INCLUDEPATH = \
     $$PWD/bindings/js \
     $$PWD/bridge \
     $$PWD/bridge/c \
+    $$PWD/bridge/jsc \
     $$PWD/css \
     $$PWD/dom \
     $$PWD/dom/default \
@@ -268,7 +230,7 @@ INCLUDEPATH = \
     $$PWD/wml \
     $$PWD/workers \
     $$PWD/xml \
-    $$GENERATED_SOURCES_DIR \
+    $$WC_GENERATED_SOURCES_DIR \
     $$INCLUDEPATH
 
 INCLUDEPATH = \
@@ -277,33 +239,12 @@ INCLUDEPATH = \
     $$PWD/platform/graphics/qt \
     $$PWD/platform/network/qt \
     $$PWD/platform/qt \
+    $$PWD/../WebKit/qt/Api \
     $$PWD/../WebKit/qt/WebCoreSupport \
     $$INCLUDEPATH
 
 QT += network
-lessThan(QT_MINOR_VERSION, 4): QT += xml
-
-QMAKE_EXTRA_TARGETS += generated_files
-
-FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
-
-TOKENIZER = $$PWD/css/tokenizer.flex
-
-DOCTYPESTRINGS = $$PWD/html/DocTypeStrings.gperf
-
-CSSBISON = $$PWD/css/CSSGrammar.y
-
-HTML_NAMES = $$PWD/html/HTMLTagNames.in
-
-XML_NAMES = $$PWD/xml/xmlattrs.in
-
-ENTITIES_GPERF = $$PWD/html/HTMLEntityNames.gperf
-
-COLORDAT_GPERF = $$PWD/platform/ColorData.gperf
 
-WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
-
-WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
 DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
@@ -318,378 +259,18 @@ contains(DEFINES, ENABLE_WCSS=1) {
     EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
 }
 
-STYLESHEETS_EMBED = \
-    $$PWD/css/html.css \
-    $$PWD/css/quirks.css \
-    $$PWD/css/svg.css \
-    $$PWD/css/view-source.css \
-    $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css \
-    $$PWD/css/mediaControlsQt.css
-
-DOMLUT_FILES += \
-    bindings/js/JSDOMWindowBase.cpp \
-    bindings/js/JSWorkerContextBase.cpp
-
-IDL_BINDINGS += \
-    css/Counter.idl \
-    css/CSSCharsetRule.idl \
-    css/CSSFontFaceRule.idl \
-    css/CSSImportRule.idl \
-    css/CSSMediaRule.idl \
-    css/CSSPageRule.idl \
-    css/CSSPrimitiveValue.idl \
-    css/CSSRule.idl \
-    css/CSSRuleList.idl \
-    css/CSSStyleDeclaration.idl \
-    css/CSSStyleRule.idl \
-    css/CSSStyleSheet.idl \
-    css/CSSValue.idl \
-    css/CSSValueList.idl \
-    css/CSSVariablesDeclaration.idl \
-    css/CSSVariablesRule.idl \
-    css/Media.idl \
-    css/MediaList.idl \
-    css/RGBColor.idl \
-    css/Rect.idl \
-    css/StyleSheet.idl \
-    css/StyleSheetList.idl \
-    css/WebKitCSSKeyframeRule.idl \
-    css/WebKitCSSKeyframesRule.idl \
-    css/WebKitCSSMatrix.idl \
-    css/WebKitCSSTransformValue.idl \
-    dom/Attr.idl \
-    dom/BeforeLoadEvent.idl \
-    dom/CharacterData.idl \
-    dom/ClientRect.idl \
-    dom/ClientRectList.idl \
-    dom/Clipboard.idl \
-    dom/CDATASection.idl \
-    dom/Comment.idl \
-    dom/DocumentFragment.idl \
-    dom/Document.idl \
-    dom/DocumentType.idl \
-    dom/DOMCoreException.idl \
-    dom/DOMImplementation.idl \
-    dom/Element.idl \
-    dom/Entity.idl \
-    dom/EntityReference.idl \
-    dom/ErrorEvent.idl \
-    dom/Event.idl \
-    dom/EventException.idl \
-#    dom/EventListener.idl \
-#    dom/EventTarget.idl \
-    dom/KeyboardEvent.idl \
-    dom/MouseEvent.idl \
-    dom/MessageChannel.idl \
-    dom/MessageEvent.idl \
-    dom/MessagePort.idl \
-    dom/MutationEvent.idl \
-    dom/NamedNodeMap.idl \
-    dom/Node.idl \
-    dom/NodeFilter.idl \
-    dom/NodeIterator.idl \
-    dom/NodeList.idl \
-    dom/Notation.idl \
-    dom/OverflowEvent.idl \
-    dom/PageTransitionEvent.idl \
-    dom/ProcessingInstruction.idl \
-    dom/ProgressEvent.idl \
-    dom/RangeException.idl \
-    dom/Range.idl \
-    dom/Text.idl \
-    dom/TextEvent.idl \
-    dom/TreeWalker.idl \
-    dom/UIEvent.idl \
-    dom/WebKitAnimationEvent.idl \
-    dom/WebKitTransitionEvent.idl \
-    dom/WheelEvent.idl \
-    html/canvas/CanvasArray.idl \
-    html/canvas/CanvasArrayBuffer.idl \
-    html/canvas/CanvasByteArray.idl \
-    html/canvas/CanvasFloatArray.idl \
-    html/canvas/CanvasGradient.idl \
-    html/canvas/CanvasIntArray.idl \
-    html/canvas/CanvasPattern.idl \
-    html/canvas/CanvasRenderingContext.idl \
-    html/canvas/CanvasRenderingContext2D.idl \
-    html/canvas/CanvasRenderingContext3D.idl \
-    html/canvas/CanvasShortArray.idl \
-    html/canvas/CanvasUnsignedByteArray.idl \
-    html/canvas/CanvasUnsignedIntArray.idl \
-    html/canvas/CanvasUnsignedShortArray.idl \
-    html/DataGridColumn.idl \
-    html/DataGridColumnList.idl \
-    html/File.idl \
-    html/FileList.idl \
-    html/HTMLAllCollection.idl \
-    html/HTMLAudioElement.idl \
-    html/HTMLAnchorElement.idl \
-    html/HTMLAppletElement.idl \
-    html/HTMLAreaElement.idl \
-    html/HTMLBaseElement.idl \
-    html/HTMLBaseFontElement.idl \
-    html/HTMLBlockquoteElement.idl \
-    html/HTMLBodyElement.idl \
-    html/HTMLBRElement.idl \
-    html/HTMLButtonElement.idl \
-    html/HTMLCanvasElement.idl \
-    html/HTMLCollection.idl \
-    html/HTMLDataGridElement.idl \
-    html/HTMLDataGridCellElement.idl \
-    html/HTMLDataGridColElement.idl \
-    html/HTMLDataGridRowElement.idl \
-    html/HTMLDataListElement.idl \
-    html/HTMLDirectoryElement.idl \
-    html/HTMLDivElement.idl \
-    html/HTMLDListElement.idl \
-    html/HTMLDocument.idl \
-    html/HTMLElement.idl \
-    html/HTMLEmbedElement.idl \
-    html/HTMLFieldSetElement.idl \
-    html/HTMLFontElement.idl \
-    html/HTMLFormElement.idl \
-    html/HTMLFrameElement.idl \
-    html/HTMLFrameSetElement.idl \
-    html/HTMLHeadElement.idl \
-    html/HTMLHeadingElement.idl \
-    html/HTMLHRElement.idl \
-    html/HTMLHtmlElement.idl \
-    html/HTMLIFrameElement.idl \
-    html/HTMLImageElement.idl \
-    html/HTMLInputElement.idl \
-    html/HTMLIsIndexElement.idl \
-    html/HTMLLabelElement.idl \
-    html/HTMLLegendElement.idl \
-    html/HTMLLIElement.idl \
-    html/HTMLLinkElement.idl \
-    html/HTMLMapElement.idl \
-    html/HTMLMarqueeElement.idl \
-    html/HTMLMediaElement.idl \
-    html/HTMLMenuElement.idl \
-    html/HTMLMetaElement.idl \
-    html/HTMLModElement.idl \
-    html/HTMLObjectElement.idl \
-    html/HTMLOListElement.idl \
-    html/HTMLOptGroupElement.idl \
-    html/HTMLOptionElement.idl \
-    html/HTMLOptionsCollection.idl \
-    html/HTMLParagraphElement.idl \
-    html/HTMLParamElement.idl \
-    html/HTMLPreElement.idl \
-    html/HTMLQuoteElement.idl \
-    html/HTMLScriptElement.idl \
-    html/HTMLSelectElement.idl \
-    html/HTMLSourceElement.idl \
-    html/HTMLStyleElement.idl \
-    html/HTMLTableCaptionElement.idl \
-    html/HTMLTableCellElement.idl \
-    html/HTMLTableColElement.idl \
-    html/HTMLTableElement.idl \
-    html/HTMLTableRowElement.idl \
-    html/HTMLTableSectionElement.idl \
-    html/HTMLTextAreaElement.idl \
-    html/HTMLTitleElement.idl \
-    html/HTMLUListElement.idl \
-    html/HTMLVideoElement.idl \
-    html/ImageData.idl \
-    html/MediaError.idl \
-    html/TextMetrics.idl \
-    html/TimeRanges.idl \
-    html/ValidityState.idl \
-    html/VoidCallback.idl \
-    inspector/InspectorBackend.idl \
-    inspector/JavaScriptCallFrame.idl \
-    loader/appcache/DOMApplicationCache.idl \
-    page/BarInfo.idl \
-    page/Console.idl \
-    page/Coordinates.idl \
-    page/DOMSelection.idl \
-    page/DOMWindow.idl \
-    page/EventSource.idl \
-    page/Geolocation.idl \
-    page/Geoposition.idl \
-    page/History.idl \
-    page/Location.idl \
-    page/Navigator.idl \
-    page/PositionError.idl \
-    page/Screen.idl \
-    page/WebKitPoint.idl \
-    page/WorkerNavigator.idl \
-    plugins/Plugin.idl \
-    plugins/MimeType.idl \
-    plugins/PluginArray.idl \
-    plugins/MimeTypeArray.idl \
-    storage/Database.idl \
-    storage/Storage.idl \
-    storage/StorageEvent.idl \
-    storage/SQLError.idl \
-    storage/SQLResultSet.idl \
-    storage/SQLResultSetRowList.idl \
-    storage/SQLTransaction.idl \
-    svg/SVGZoomEvent.idl \
-    svg/SVGAElement.idl \
-    svg/SVGAltGlyphElement.idl \
-    svg/SVGAngle.idl \
-    svg/SVGAnimateColorElement.idl \
-    svg/SVGAnimatedAngle.idl \
-    svg/SVGAnimatedBoolean.idl \
-    svg/SVGAnimatedEnumeration.idl \
-    svg/SVGAnimatedInteger.idl \
-    svg/SVGAnimatedLength.idl \
-    svg/SVGAnimatedLengthList.idl \
-    svg/SVGAnimatedNumber.idl \
-    svg/SVGAnimatedNumberList.idl \
-    svg/SVGAnimatedPreserveAspectRatio.idl \
-    svg/SVGAnimatedRect.idl \
-    svg/SVGAnimatedString.idl \
-    svg/SVGAnimatedTransformList.idl \
-    svg/SVGAnimateElement.idl \
-    svg/SVGAnimateTransformElement.idl \
-    svg/SVGAnimationElement.idl \
-    svg/SVGCircleElement.idl \
-    svg/SVGClipPathElement.idl \
-    svg/SVGColor.idl \
-    svg/SVGComponentTransferFunctionElement.idl \
-    svg/SVGCursorElement.idl \
-    svg/SVGDefsElement.idl \
-    svg/SVGDescElement.idl \
-    svg/SVGDocument.idl \
-    svg/SVGElement.idl \
-    svg/SVGElementInstance.idl \
-    svg/SVGElementInstanceList.idl \
-    svg/SVGEllipseElement.idl \
-    svg/SVGException.idl \
-    svg/SVGFEBlendElement.idl \
-    svg/SVGFEColorMatrixElement.idl \
-    svg/SVGFEComponentTransferElement.idl \
-    svg/SVGFECompositeElement.idl \
-    svg/SVGFEDiffuseLightingElement.idl \
-    svg/SVGFEDisplacementMapElement.idl \
-    svg/SVGFEDistantLightElement.idl \
-    svg/SVGFEFloodElement.idl \
-    svg/SVGFEFuncAElement.idl \
-    svg/SVGFEFuncBElement.idl \
-    svg/SVGFEFuncGElement.idl \
-    svg/SVGFEFuncRElement.idl \
-    svg/SVGFEGaussianBlurElement.idl \
-    svg/SVGFEImageElement.idl \
-    svg/SVGFEMergeElement.idl \
-    svg/SVGFEMergeNodeElement.idl \
-    svg/SVGFEMorphologyElement.idl \
-    svg/SVGFEOffsetElement.idl \
-    svg/SVGFEPointLightElement.idl \
-    svg/SVGFESpecularLightingElement.idl \
-    svg/SVGFESpotLightElement.idl \
-    svg/SVGFETileElement.idl \
-    svg/SVGFETurbulenceElement.idl \
-    svg/SVGFilterElement.idl \
-    svg/SVGFontElement.idl \
-    svg/SVGFontFaceElement.idl \
-    svg/SVGFontFaceFormatElement.idl \
-    svg/SVGFontFaceNameElement.idl \
-    svg/SVGFontFaceSrcElement.idl \
-    svg/SVGFontFaceUriElement.idl \
-    svg/SVGForeignObjectElement.idl \
-    svg/SVGGElement.idl \
-    svg/SVGGlyphElement.idl \
-    svg/SVGGradientElement.idl \
-    svg/SVGHKernElement.idl \
-    svg/SVGImageElement.idl \
-    svg/SVGLength.idl \
-    svg/SVGLengthList.idl \
-    svg/SVGLinearGradientElement.idl \
-    svg/SVGLineElement.idl \
-    svg/SVGMarkerElement.idl \
-    svg/SVGMaskElement.idl \
-    svg/SVGMatrix.idl \
-    svg/SVGMetadataElement.idl \
-    svg/SVGMissingGlyphElement.idl \
-    svg/SVGNumber.idl \
-    svg/SVGNumberList.idl \
-    svg/SVGPaint.idl \
-    svg/SVGPathElement.idl \
-    svg/SVGPathSegArcAbs.idl \
-    svg/SVGPathSegArcRel.idl \
-    svg/SVGPathSegClosePath.idl \
-    svg/SVGPathSegCurvetoCubicAbs.idl \
-    svg/SVGPathSegCurvetoCubicRel.idl \
-    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
-    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
-    svg/SVGPathSegCurvetoQuadraticAbs.idl \
-    svg/SVGPathSegCurvetoQuadraticRel.idl \
-    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
-    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
-    svg/SVGPathSeg.idl \
-    svg/SVGPathSegLinetoAbs.idl \
-    svg/SVGPathSegLinetoHorizontalAbs.idl \
-    svg/SVGPathSegLinetoHorizontalRel.idl \
-    svg/SVGPathSegLinetoRel.idl \
-    svg/SVGPathSegLinetoVerticalAbs.idl \
-    svg/SVGPathSegLinetoVerticalRel.idl \
-    svg/SVGPathSegList.idl \
-    svg/SVGPathSegMovetoAbs.idl \
-    svg/SVGPathSegMovetoRel.idl \
-    svg/SVGPatternElement.idl \
-    svg/SVGPoint.idl \
-    svg/SVGPointList.idl \
-    svg/SVGPolygonElement.idl \
-    svg/SVGPolylineElement.idl \
-    svg/SVGPreserveAspectRatio.idl \
-    svg/SVGRadialGradientElement.idl \
-    svg/SVGRectElement.idl \
-    svg/SVGRect.idl \
-    svg/SVGRenderingIntent.idl \
-    svg/SVGScriptElement.idl \
-    svg/SVGSetElement.idl \
-    svg/SVGStopElement.idl \
-    svg/SVGStringList.idl \
-    svg/SVGStyleElement.idl \
-    svg/SVGSVGElement.idl \
-    svg/SVGSwitchElement.idl \
-    svg/SVGSymbolElement.idl \
-    svg/SVGTextContentElement.idl \
-    svg/SVGTextElement.idl \
-    svg/SVGTextPathElement.idl \
-    svg/SVGTextPositioningElement.idl \
-    svg/SVGTitleElement.idl \
-    svg/SVGTransform.idl \
-    svg/SVGTransformList.idl \
-    svg/SVGTRefElement.idl \
-    svg/SVGTSpanElement.idl \
-    svg/SVGUnitTypes.idl \
-    svg/SVGUseElement.idl \
-    svg/SVGViewElement.idl \
-    websockets/WebSocket.idl \
-    workers/AbstractWorker.idl \
-    workers/DedicatedWorkerContext.idl \
-    workers/SharedWorker.idl \
-    workers/SharedWorkerContext.idl \
-    workers/Worker.idl \
-    workers/WorkerContext.idl \
-    workers/WorkerLocation.idl \
-    xml/DOMParser.idl \
-    xml/XMLHttpRequest.idl \
-    xml/XMLHttpRequestException.idl \
-    xml/XMLHttpRequestProgressEvent.idl \
-    xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XPathNSResolver.idl \
-    xml/XPathException.idl \
-    xml/XPathExpression.idl \
-    xml/XPathResult.idl \
-    xml/XPathEvaluator.idl \
-    xml/XSLTProcessor.idl
-
-
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \    
+    accessibility/AccessibilityMenuList.cpp \
+    accessibility/AccessibilityMenuListOption.cpp \
+    accessibility/AccessibilityMenuListPopup.cpp \
     accessibility/AccessibilityObject.cpp \    
     accessibility/AccessibilityList.cpp \    
     accessibility/AccessibilityListBox.cpp \    
     accessibility/AccessibilityListBoxOption.cpp \    
     accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilityScrollbar.cpp \
     accessibility/AccessibilitySlider.cpp \    
     accessibility/AccessibilityARIAGrid.cpp \    
     accessibility/AccessibilityARIAGridCell.cpp \    
@@ -701,6 +282,8 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/DOMObjectHashTableMap.cpp \
+    bindings/js/DOMWrapperWorld.cpp \
     bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
@@ -719,12 +302,15 @@ SOURCES += \
     bindings/js/JSCustomXPathNSResolver.cpp \
     bindings/js/JSDataGridColumnListCustom.cpp \
     bindings/js/JSDataGridDataSource.cpp \
+    bindings/js/JSDebugWrapperSet.cpp \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDocumentFragmentCustom.cpp \
+    bindings/js/JSDOMFormDataCustom.cpp \
     bindings/js/JSDOMGlobalObject.cpp \
     bindings/js/JSDOMWindowBase.cpp \
     bindings/js/JSDOMWindowCustom.cpp \
     bindings/js/JSDOMWindowShell.cpp \
+    bindings/js/JSDOMWrapper.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
     bindings/js/JSEventSourceConstructor.cpp \
@@ -751,9 +337,8 @@ SOURCES += \
     bindings/js/JSHTMLSelectElementCustom.cpp \
     bindings/js/JSImageConstructor.cpp \
     bindings/js/JSImageDataCustom.cpp \
-    bindings/js/JSInspectedObjectWrapper.cpp \
-    bindings/js/JSInspectorBackendCustom.cpp \
-    bindings/js/JSInspectorCallbackWrapper.cpp \
+    bindings/js/JSInjectedScriptHostCustom.cpp \
+    bindings/js/JSInspectorFrontendHostCustom.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
     bindings/js/JSNavigatorCustom.cpp  \
@@ -763,7 +348,6 @@ SOURCES += \
     bindings/js/JSNodeIteratorCustom.cpp \
     bindings/js/JSNodeListCustom.cpp \
     bindings/js/JSOptionConstructor.cpp \
-    bindings/js/JSQuarantinedObjectWrapper.cpp \
     bindings/js/JSStyleSheetCustom.cpp \
     bindings/js/JSStyleSheetListCustom.cpp \
     bindings/js/JSTextCustom.cpp \
@@ -785,15 +369,21 @@ SOURCES += \
     bindings/js/JSEventListener.cpp \
     bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
+    bindings/js/JSPopStateEventCustom.cpp \
+    bindings/js/JavaScriptProfile.h \
+    bindings/js/JavaScriptProfileNode.h \
+    bindings/js/JavaScriptProfile.cpp \
+    bindings/js/JavaScriptProfileNode.cpp \
     bindings/js/ScriptArray.cpp \
     bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
     bindings/js/ScriptCallStack.cpp \
     bindings/js/ScriptController.cpp \
+    bindings/js/ScriptDebugServer.cpp \
     bindings/js/ScriptEventListener.cpp \
     bindings/js/ScriptFunctionCall.cpp \
     bindings/js/ScriptObject.cpp \
-    bindings/js/ScriptObjectQuarantine.cpp \
+    bindings/js/ScriptProfiler.cpp \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
@@ -803,14 +393,15 @@ SOURCES += \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
     bridge/runtime_array.cpp \
-    bridge/runtime.cpp \
     bridge/runtime_method.cpp \
     bridge/runtime_object.cpp \
     bridge/runtime_root.cpp \
+    bridge/c/CRuntimeObject.cpp \
     bridge/c/c_class.cpp \
     bridge/c/c_instance.cpp \
     bridge/c/c_runtime.cpp \
     bridge/c/c_utility.cpp \
+    bridge/jsc/BridgeJSC.cpp \
     css/CSSBorderImageValue.cpp \
     css/CSSCanvasValue.cpp \
     css/CSSCharsetRule.cpp \
@@ -856,7 +447,6 @@ SOURCES += \
     css/FontFamilyValue.cpp \
     css/FontValue.cpp \
     css/MediaFeatureNames.cpp \
-    css/Media.cpp \
     css/MediaList.cpp \
     css/MediaQuery.cpp \
     css/MediaQueryEvaluator.cpp \
@@ -865,6 +455,7 @@ SOURCES += \
     css/ShadowValue.cpp \
     css/StyleBase.cpp \
     css/StyleList.cpp \
+    css/StyleMedia.cpp \
     css/StyleSheet.cpp \
     css/StyleSheetList.cpp \
     css/WebKitCSSKeyframeRule.cpp \
@@ -877,18 +468,20 @@ SOURCES += \
     dom/BeforeTextInsertedEvent.cpp \
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
+    dom/CanvasSurface.cpp \
     dom/CharacterData.cpp \
     dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
-    dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
     dom/ClientRect.cpp \
     dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
+    dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
     dom/CSSMappedAttributeDeclaration.cpp \
+    dom/CustomEvent.cpp \
     dom/Document.cpp \
     dom/DocumentFragment.cpp \
     dom/DocumentType.cpp \
@@ -926,6 +519,7 @@ SOURCES += \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/PageTransitionEvent.cpp \
+    dom/PopStateEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -937,16 +531,21 @@ SOURCES += \
     dom/ScriptExecutionContext.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
+    dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
     dom/StyleElement.cpp \
     dom/TagNodeList.cpp \
     dom/Text.cpp \
     dom/TextEvent.cpp \
+    dom/Touch.cpp \
+    dom/TouchEvent.cpp \
+    dom/TouchList.cpp \
     dom/Traversal.cpp \
     dom/TreeWalker.cpp \
     dom/UIEvent.cpp \
     dom/UIEventWithKeyState.cpp \
+    dom/ViewportArguments.cpp \
     dom/WebKitAnimationEvent.cpp \
     dom/WebKitTransitionEvent.cpp \
     dom/WheelEvent.cpp \
@@ -1006,6 +605,7 @@ SOURCES += \
     history/HistoryItem.cpp \
     history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
+    html/Blob.cpp \
     html/canvas/CanvasGradient.cpp \
     html/canvas/CanvasPattern.cpp \
     html/canvas/CanvasPixelArray.cpp \
@@ -1015,7 +615,9 @@ SOURCES += \
     html/CollectionCache.cpp \
     html/DataGridColumn.cpp \
     html/DataGridColumnList.cpp \
+    html/DateComponents.cpp \
     html/DOMDataGridDataSource.cpp \
+    html/DOMFormData.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -1083,9 +685,9 @@ SOURCES += \
     html/HTMLPlugInElement.cpp \
     html/HTMLPlugInImageElement.cpp \
     html/HTMLPreElement.cpp \
+    html/HTMLProgressElement.cpp \
     html/HTMLQuoteElement.cpp \
     html/HTMLScriptElement.cpp \
-    html/HTMLNoScriptElement.cpp \
     html/HTMLSelectElement.cpp \
     html/HTMLStyleElement.cpp \
     html/HTMLTableCaptionElement.cpp \
@@ -1103,14 +705,19 @@ SOURCES += \
     html/HTMLViewSourceDocument.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
+    html/StepRange.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/InjectedScript.cpp \
+    inspector/InjectedScriptHost.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontend.cpp \
+    inspector/InspectorFrontendClientLocal.cpp \
+    inspector/InspectorFrontendHost.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/TimelineRecordFactory.cpp \
@@ -1179,6 +786,8 @@ SOURCES += \
     page/FrameTree.cpp \
     page/FrameView.cpp \
     page/Geolocation.cpp \
+    page/GeolocationController.cpp \
+    page/GeolocationPositionCache.cpp \
     page/History.cpp \
     page/Location.cpp \
     page/MouseEventWithHitTestResults.cpp \
@@ -1191,6 +800,7 @@ SOURCES += \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
     page/Settings.cpp \
+    page/SpatialNavigation.cpp \
     page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
     page/XSSAuditor.cpp \
@@ -1216,8 +826,8 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
-    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
+    platform/graphics/FontFallbackList.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
     platform/graphics/Color.cpp \
@@ -1228,6 +838,7 @@ SOURCES += \
     platform/graphics/FloatSize.cpp \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
+    platform/graphics/FontCache.cpp \
     platform/graphics/GeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1242,6 +853,8 @@ SOURCES += \
     platform/graphics/Pen.cpp \
     platform/graphics/SegmentedFontData.cpp \
     platform/graphics/SimpleFontData.cpp \
+    platform/graphics/TiledBackingStore.cpp \
+    platform/graphics/transforms/AffineTransform.cpp \
     platform/graphics/transforms/TransformationMatrix.cpp \
     platform/graphics/transforms/MatrixTransformOperation.cpp \
     platform/graphics/transforms/Matrix3DTransformOperation.cpp \
@@ -1299,6 +912,7 @@ SOURCES += \
     plugins/PluginView.cpp \
     rendering/AutoTableLayout.cpp \
     rendering/break_lines.cpp \
+    rendering/BidiRun.cpp \
     rendering/CounterNode.cpp \
     rendering/EllipsisBox.cpp \
     rendering/FixedTableLayout.cpp \
@@ -1317,6 +931,7 @@ SOURCES += \
     rendering/RenderButton.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderDataGrid.cpp \
+    rendering/RenderEmbeddedObject.cpp \
     rendering/RenderFieldset.cpp \
     rendering/RenderFileUploadControl.cpp \
     rendering/RenderFlexibleBox.cpp \
@@ -1337,8 +952,13 @@ SOURCES += \
     rendering/RenderObjectChildList.cpp \
     rendering/RenderPart.cpp \
     rendering/RenderPartObject.cpp \
+    rendering/RenderProgress.cpp \
     rendering/RenderReplaced.cpp \
     rendering/RenderReplica.cpp \
+    rendering/RenderRuby.cpp \
+    rendering/RenderRubyBase.cpp \
+    rendering/RenderRubyRun.cpp \
+    rendering/RenderRubyText.cpp \
     rendering/RenderScrollbar.cpp \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
@@ -1386,6 +1006,7 @@ SOURCES += \
     rendering/style/StyleVisualData.cpp \
     xml/DOMParser.cpp \
     xml/XMLHttpRequest.cpp \
+    xml/XMLHttpRequestProgressEventThrottle.cpp \
     xml/XMLHttpRequestUpload.cpp \
     xml/XMLSerializer.cpp 
 
@@ -1400,6 +1021,7 @@ HEADERS += \
     accessibility/AccessibilityMediaControls.h \
     accessibility/AccessibilityObject.h \
     accessibility/AccessibilityRenderObject.h \
+    accessibility/AccessibilityScrollbar.h \
     accessibility/AccessibilitySlider.h \
     accessibility/AccessibilityTableCell.h \
     accessibility/AccessibilityTableColumn.h \
@@ -1408,8 +1030,9 @@ HEADERS += \
     accessibility/AccessibilityTableRow.h \
     accessibility/AXObjectCache.h \
     bindings/js/CachedScriptSourceProvider.h \
-    bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/DOMObjectHashTableMap.h \
+    bindings/js/DOMWrapperWorld.h \
     bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
@@ -1421,13 +1044,16 @@ HEADERS += \
     bindings/js/JSCustomSQLTransactionErrorCallback.h \
     bindings/js/JSCustomVoidCallback.h \
     bindings/js/JSCustomXPathNSResolver.h \
+    bindings/js/JSDatabaseCallback.h \
     bindings/js/JSDataGridDataSource.h \
+    bindings/js/JSDebugWrapperSet.h \
     bindings/js/JSDOMBinding.h \
     bindings/js/JSDOMGlobalObject.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
+    bindings/js/JSDOMWrapper.h \
     bindings/js/JSEventListener.h \
     bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
@@ -1438,15 +1064,13 @@ HEADERS += \
     bindings/js/JSHTMLObjectElementCustom.h \
     bindings/js/JSHTMLSelectElementCustom.h \
     bindings/js/JSImageConstructor.h \
-    bindings/js/JSInspectedObjectWrapper.h \
-    bindings/js/JSInspectorCallbackWrapper.h \
     bindings/js/JSLazyEventListener.h \
     bindings/js/JSLocationCustom.h \
     bindings/js/JSMessageChannelConstructor.h \
+    bindings/js/JSNodeCustom.h \
     bindings/js/JSNodeFilterCondition.h \
     bindings/js/JSOptionConstructor.h \
     bindings/js/JSPluginElementFunctions.h \
-    bindings/js/JSQuarantinedObjectWrapper.h \
     bindings/js/JSSharedWorkerConstructor.h \
     bindings/js/JSStorageCustom.h \
     bindings/js/JSWebKitCSSMatrixConstructor.h \
@@ -1465,26 +1089,30 @@ HEADERS += \
     bindings/js/ScriptEventListener.h \
     bindings/js/ScriptFunctionCall.h \
     bindings/js/ScriptObject.h \
-    bindings/js/ScriptObjectQuarantine.h \
     bindings/js/ScriptSourceCode.h \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/ScriptWrappable.h \
     bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
+    bindings/js/WebCoreJSClientData.h \
     bindings/js/WorkerScriptController.h \
+    bridge/Bridge.h \
+    bridge/c/CRuntimeObject.h \
     bridge/c/c_class.h \
     bridge/c/c_instance.h \
     bridge/c/c_runtime.h \
     bridge/c/c_utility.h \
+    bridge/jsc/BridgeJSC.h \
     bridge/IdentifierRep.h \
     bridge/NP_jsobject.h \
     bridge/npruntime.h \
     bridge/qt/qt_class.h \
     bridge/qt/qt_instance.h \
     bridge/qt/qt_runtime.h \
+    bridge/qt/qt_pixmapruntime.h \
     bridge/runtime_array.h \
-    bridge/runtime.h \
     bridge/runtime_method.h \
     bridge/runtime_object.h \
     bridge/runtime_root.h \
@@ -1533,7 +1161,6 @@ HEADERS += \
     css/FontFamilyValue.h \
     css/FontValue.h \
     css/MediaFeatureNames.h \
-    css/Media.h \
     css/MediaList.h \
     css/MediaQueryEvaluator.h \
     css/MediaQueryExp.h \
@@ -1542,6 +1169,7 @@ HEADERS += \
     css/ShadowValue.h \
     css/StyleBase.h \
     css/StyleList.h \
+    css/StyleMedia.h \
     css/StyleSheet.h \
     css/StyleSheetList.h \
     css/WebKitCSSKeyframeRule.h \
@@ -1557,7 +1185,6 @@ HEADERS += \
     dom/CharacterData.h \
     dom/CheckedRadioButtons.h \
     dom/ChildNodeList.h \
-    dom/ClassNames.h \
     dom/ClassNodeList.h \
     dom/ClientRect.h \
     dom/ClientRectList.h \
@@ -1566,6 +1193,7 @@ HEADERS += \
     dom/Comment.h \
     dom/ContainerNode.h \
     dom/CSSMappedAttributeDeclaration.h \
+    dom/CustomEvent.h \
     dom/default/PlatformMessagePortChannel.h \
     dom/DocumentFragment.h \
     dom/Document.h \
@@ -1614,17 +1242,22 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectElement.h \
     dom/SelectorNodeList.h \
+    dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
     dom/StyleElement.h \
     dom/TagNodeList.h \
     dom/TextEvent.h \
     dom/Text.h \
+    dom/Touch.h \
+    dom/TouchEvent.h \
+    dom/TouchList.h \
     dom/TransformSource.h \
     dom/Traversal.h \
     dom/TreeWalker.h \
     dom/UIEvent.h \
     dom/UIEventWithKeyState.h \
+    dom/ViewportArguments.h \
     dom/WebKitAnimationEvent.h \
     dom/WebKitTransitionEvent.h \
     dom/WheelEvent.h \
@@ -1679,6 +1312,7 @@ HEADERS += \
     history/CachedPage.h \
     history/HistoryItem.h \
     history/PageCache.h \
+    html/Blob.h \
     html/canvas/CanvasGradient.h \
     html/canvas/CanvasPattern.h \
     html/canvas/CanvasPixelArray.h \
@@ -1688,7 +1322,9 @@ HEADERS += \
     html/CollectionCache.h \
     html/DataGridColumn.h \
     html/DataGridColumnList.h \
+    html/DateComponents.h \
     html/DOMDataGridDataSource.h \
+    html/DOMFormData.h \
     html/File.h \
     html/FileList.h \
     html/FormDataList.h \
@@ -1758,6 +1394,7 @@ HEADERS += \
     html/HTMLPlugInElement.h \
     html/HTMLPlugInImageElement.h \
     html/HTMLPreElement.h \
+    html/HTMLProgressElement.h \
     html/HTMLQuoteElement.h \
     html/HTMLScriptElement.h \
     html/HTMLSelectElement.h \
@@ -1779,20 +1416,23 @@ HEADERS += \
     html/HTMLViewSourceDocument.h \
     html/ImageData.h \
     html/PreloadScanner.h \
+    html/StepRange.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/InjectedScript.h \
+    inspector/InjectedScriptHost.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
+    inspector/InspectorFrontendClient.h \
+    inspector/InspectorFrontendClientLocal.h \
+    inspector/InspectorFrontendHost.h \
     inspector/InspectorResource.h \
     inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
-    inspector/JavaScriptDebugServer.h \
-    inspector/JavaScriptProfile.h \
-    inspector/JavaScriptProfileNode.h \
     inspector/TimelineRecordFactory.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
@@ -1852,6 +1492,7 @@ HEADERS += \
     page/Chrome.h \
     page/Console.h \
     page/ContextMenuController.h \
+    page/ContextMenuProvider.h \
     page/Coordinates.h \
     page/DOMSelection.h \
     page/DOMTimer.h \
@@ -1864,6 +1505,7 @@ HEADERS += \
     page/FrameTree.h \
     page/FrameView.h \
     page/Geolocation.h \
+    page/GeolocationPositionCache.h \
     page/Geoposition.h \
     page/HaltablePlugin.h \
     page/History.h \
@@ -1880,9 +1522,11 @@ HEADERS += \
     page/Screen.h \
     page/SecurityOrigin.h \
     page/Settings.h \
+    page/SpatialNavigation.h \
     page/WindowFeatures.h \
     page/WorkerNavigator.h \
     page/XSSAuditor.h \
+    page/ZoomMode.h \
     platform/animation/Animation.h \
     platform/animation/AnimationList.h \
     platform/Arena.h \
@@ -1921,6 +1565,8 @@ HEADERS += \
     platform/graphics/GraphicsTypes.h \
     platform/graphics/Image.h \
     platform/graphics/ImageSource.h \
+    platform/graphics/IntPoint.h \
+    platform/graphics/IntPointHash.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
     platform/graphics/Path.h \
@@ -1932,6 +1578,9 @@ HEADERS += \
     platform/graphics/qt/StillImageQt.h \
     platform/graphics/SegmentedFontData.h \
     platform/graphics/SimpleFontData.h \
+    platform/graphics/Tile.h \
+    platform/graphics/TiledBackingStore.h \    
+    platform/graphics/TiledBackingStoreClient.h \
     platform/graphics/transforms/Matrix3DTransformOperation.h \
     platform/graphics/transforms/MatrixTransformOperation.h \
     platform/graphics/transforms/PerspectiveTransformOperation.h \
@@ -1947,6 +1596,7 @@ HEADERS += \
     platform/Logging.h \
     platform/MIMETypeRegistry.h \
     platform/network/AuthenticationChallengeBase.h \
+    platform/network/AuthenticationClient.h \
     platform/network/Credential.h \
     platform/network/FormDataBuilder.h \
     platform/network/FormData.h \
@@ -1959,9 +1609,12 @@ HEADERS += \
     platform/network/ResourceHandle.h \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
+    platform/PlatformTouchEvent.h \
+    platform/PlatformTouchPoint.h \
     platform/qt/ClipboardQt.h \
     platform/qt/QWebPageClient.h \
-    platform/qt/QWebPopup.h \
+    platform/qt/QtAbstractWebPopup.h \
+    platform/qt/QtStyleOptionWebComboBox.h \
     platform/qt/RenderThemeQt.h \
     platform/qt/ScrollbarThemeQt.h \
     platform/Scrollbar.h \
@@ -2028,6 +1681,7 @@ HEADERS += \
     rendering/RenderButton.h \
     rendering/RenderCounter.h \
     rendering/RenderDataGrid.h \
+    rendering/RenderEmbeddedObject.h \
     rendering/RenderFieldset.h \
     rendering/RenderFileUploadControl.h \
     rendering/RenderFlexibleBox.h \
@@ -2051,8 +1705,13 @@ HEADERS += \
     rendering/RenderPart.h \
     rendering/RenderPartObject.h \
     rendering/RenderPath.h \
+    rendering/RenderProgress.h \
     rendering/RenderReplaced.h \
     rendering/RenderReplica.h \
+    rendering/RenderRuby.h \
+    rendering/RenderRubyBase.h \
+    rendering/RenderRubyRun.h \
+    rendering/RenderRubyText.h \
     rendering/RenderScrollbar.h \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
@@ -2065,7 +1724,11 @@ HEADERS += \
     rendering/RenderSVGInline.h \
     rendering/RenderSVGInlineText.h \
     rendering/RenderSVGModelObject.h \
+    rendering/RenderSVGResource.h \
+    rendering/RenderSVGResourceClipper.h \
+    rendering/RenderSVGResourceMasker.h \
     rendering/RenderSVGRoot.h \
+    rendering/RenderSVGShadowTreeRootContainer.h \
     rendering/RenderSVGText.h \
     rendering/RenderSVGTextPath.h \
     rendering/RenderSVGTransformableContainer.h \
@@ -2118,9 +1781,12 @@ HEADERS += \
     rendering/SVGCharacterLayoutInfo.h \
     rendering/SVGInlineFlowBox.h \
     rendering/SVGInlineTextBox.h \
+    rendering/SVGMarkerData.h \
+    rendering/SVGMarkerLayoutInfo.h \
     rendering/SVGRenderSupport.h \
     rendering/SVGRenderTreeAsText.h \
     rendering/SVGRootInlineBox.h \
+    rendering/SVGShadowTreeElements.h \
     rendering/TextControlInnerElements.h \
     rendering/TransformState.h \
     svg/animation/SMILTimeContainer.h \
@@ -2148,17 +1814,19 @@ HEADERS += \
     svg/graphics/SVGPaintServerPattern.h \
     svg/graphics/SVGPaintServerRadialGradient.h \
     svg/graphics/SVGPaintServerSolid.h \
-    svg/graphics/SVGResourceClipper.h \
     svg/graphics/SVGResourceFilter.h \
     svg/graphics/SVGResource.h \
     svg/graphics/SVGResourceMarker.h \
-    svg/graphics/SVGResourceMasker.h \
     svg/SVGAElement.h \
     svg/SVGAltGlyphElement.h \
     svg/SVGAngle.h \
     svg/SVGAnimateColorElement.h \
     svg/SVGAnimatedPathData.h \
     svg/SVGAnimatedPoints.h \
+    svg/SVGAnimatedProperty.h \
+    svg/SVGAnimatedPropertySynchronizer.h \
+    svg/SVGAnimatedPropertyTraits.h \
+    svg/SVGAnimatedTemplate.h \
     svg/SVGAnimateElement.h \
     svg/SVGAnimateMotionElement.h \
     svg/SVGAnimateTransformElement.h \
@@ -2175,6 +1843,7 @@ HEADERS += \
     svg/SVGElement.h \
     svg/SVGElementInstance.h \
     svg/SVGElementInstanceList.h \
+    svg/SVGElementRareData.h \
     svg/SVGEllipseElement.h \
     svg/SVGExternalResourcesRequired.h \
     svg/SVGFEBlendElement.h \
@@ -2282,7 +1951,6 @@ HEADERS += \
     svg/SVGViewSpec.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
-    svg/SynchronizablePropertyController.h \
     wml/WMLAccessElement.h \
     wml/WMLAElement.h \
     wml/WMLAnchorElement.h \
@@ -2356,6 +2024,7 @@ HEADERS += \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
     $$PWD/../WebKit/qt/Api/qwebplugindatabase_p.h \
+    $$PWD/../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
@@ -2364,6 +2033,7 @@ SOURCES += \
     bindings/js/ScriptControllerQt.cpp \
     bridge/qt/qt_class.cpp \
     bridge/qt/qt_instance.cpp \
+    bridge/qt/qt_pixmapruntime.cpp \
     bridge/qt/qt_runtime.cpp \
     page/qt/DragControllerQt.cpp \
     page/qt/EventHandlerQt.cpp \
@@ -2371,7 +2041,6 @@ SOURCES += \
     platform/graphics/qt/TransformationMatrixQt.cpp \
     platform/graphics/qt/ColorQt.cpp \
     platform/graphics/qt/FontQt.cpp \
-    platform/graphics/qt/FontQt43.cpp \
     platform/graphics/qt/FontPlatformDataQt.cpp \
     platform/graphics/qt/FloatPointQt.cpp \
     platform/graphics/qt/FloatRectQt.cpp \
@@ -2404,10 +2073,10 @@ SOURCES += \
     platform/qt/FileSystemQt.cpp \
     platform/qt/SharedBufferQt.cpp \
     platform/graphics/qt/FontCacheQt.cpp \
-    platform/graphics/qt/FontCustomPlatformData.cpp \
-    platform/graphics/qt/FontFallbackListQt.cpp \
+    platform/graphics/qt/FontCustomPlatformDataQt.cpp \
     platform/graphics/qt/GlyphPageTreeNodeQt.cpp \
     platform/graphics/qt/SimpleFontDataQt.cpp \
+    platform/graphics/qt/TileQt.cpp \
     platform/qt/KURLQt.cpp \
     platform/qt/Localizations.cpp \
     platform/qt/MIMETypeRegistryQt.cpp \
@@ -2415,8 +2084,10 @@ SOURCES += \
     platform/qt/PlatformKeyboardEventQt.cpp \
     platform/qt/PlatformMouseEventQt.cpp \
     platform/qt/PlatformScreenQt.cpp \
+    platform/qt/PlatformTouchEventQt.cpp \
+    platform/qt/PlatformTouchPointQt.cpp \
     platform/qt/PopupMenuQt.cpp \
-    platform/qt/QWebPopup.cpp \
+    platform/qt/QtAbstractWebPopup.cpp \
     platform/qt/RenderThemeQt.cpp \
     platform/qt/ScrollbarQt.cpp \
     platform/qt/ScrollbarThemeQt.cpp \
@@ -2426,13 +2097,14 @@ SOURCES += \
     platform/qt/SoundQt.cpp \
     platform/qt/LoggingQt.cpp \
     platform/text/qt/StringQt.cpp \
-    platform/qt/TemporaryLinkStubs.cpp \
-    platform/text/qt/TextBoundaries.cpp \
+    platform/qt/TemporaryLinkStubsQt.cpp \
+    platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
     platform/qt/WheelEventQt.cpp \
     platform/qt/WidgetQt.cpp \
     plugins/qt/PluginDataQt.cpp \
+    ../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp \
     ../WebKit/qt/WebCoreSupport/ChromeClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/DragClientQt.cpp \
@@ -2456,36 +2128,35 @@ SOURCES += \
     ../WebKit/qt/Api/qwebkitversion.cpp
 
 
-    win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp
+contains(DEFINES, WTF_USE_QT_MOBILE_THEME=1) {
+    HEADERS += platform/qt/Maemo5Webstyle.h
+    SOURCES += platform/qt/Maemo5Webstyle.cpp
+}
+
+maemo5 {
+    HEADERS += ../WebKit/qt/WebCoreSupport/QtMaemoWebPopup.h
+    SOURCES += ../WebKit/qt/WebCoreSupport/QtMaemoWebPopup.cpp
+}
+
+
+    win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp \
+                               platform/graphics/win/TransformationMatrixWin.cpp
 
     mac {
         SOURCES += \
             platform/text/cf/StringCF.cpp \
-            platform/text/cf/StringImplCF.cpp
+            platform/text/cf/StringImplCF.cpp \
+            platform/cf/SharedBufferCF.cpp \
+            editing/SmartReplaceCF.cpp
         LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
     win32-* {
         LIBS += -lgdi32
         LIBS += -luser32
-        LIBS += -lwinmm
     }
     wince*: LIBS += -lmmtimer
 
-    # Files belonging to the Qt 4.3 build
-    lessThan(QT_MINOR_VERSION, 4) {
-        HEADERS += \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface.h \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface_p.h \
-            $$PWD/../WebKit/qt/Api/qcookiejar.h
-
-        SOURCES += \
-            ../WebKit/qt/Api/qwebnetworkinterface.cpp \
-            ../WebKit/qt/Api/qcookiejar.cpp
-
-        DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-     }
-
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
@@ -2510,14 +2181,20 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             mac {
                 SOURCES += \
                     plugins/mac/PluginPackageMac.cpp \
-                    plugins/mac/PluginViewMac.cpp
+                    plugins/mac/PluginViewMac.mm
                 OBJECTIVE_SOURCES += \
                     platform/text/mac/StringImplMac.mm \
                     platform/mac/WebCoreNSStringExtras.mm
                 INCLUDEPATH += platform/mac
                 # Note: XP_MACOSX is defined in npapi.h
             } else {
-                !embedded: CONFIG += x11
+                !embedded {
+                    CONFIG += x11
+                    LIBS += -lXrender
+                }
+                maemo5 {
+                    DEFINES += MOZ_PLATFORM_MAEMO=5
+                }
                 SOURCES += \
                     plugins/qt/PluginContainerQt.cpp \
                     plugins/qt/PluginPackageQt.cpp \
@@ -2532,12 +2209,12 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             INCLUDEPATH += $$PWD/plugins/win \
                            $$PWD/platform/win
     
-            SOURCES += page/win/PageWin.cpp \
-                       plugins/win/PluginDatabaseWin.cpp \
+            SOURCES += plugins/win/PluginDatabaseWin.cpp \
                        plugins/win/PluginPackageWin.cpp \
                        plugins/win/PluginMessageThrottlerWin.cpp \
                        plugins/win/PluginViewWin.cpp \
-                       platform/win/BitmapInfo.cpp
+                       platform/win/BitmapInfo.cpp \
+                       platform/win/WebCoreInstanceHandle.cpp
     
             LIBS += \
                 -ladvapi32 \
@@ -2555,26 +2232,6 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         plugins/PluginViewNone.cpp
 }
 
-contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
-}
-
-contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
-}
-
-contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
-    DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
-}
-
-contains(DEFINES, ENABLE_DATAGRID=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
-}
-
-contains(DEFINES, ENABLE_EVENTSOURCE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
-}
-
 contains(DEFINES, ENABLE_SQLITE=1) {
     !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
             # Build sqlite3 into WebCore from source
@@ -2608,8 +2265,6 @@ contains(DEFINES, ENABLE_SQLITE=1) {
 
 
 contains(DEFINES, ENABLE_DATABASE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
-
     SOURCES += \
         storage/ChangeVersionWrapper.cpp \
         storage/DatabaseTask.cpp \
@@ -2627,18 +2282,18 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         bindings/js/JSCustomSQLStatementErrorCallback.cpp \
         bindings/js/JSCustomSQLTransactionCallback.cpp \
         bindings/js/JSCustomSQLTransactionErrorCallback.cpp \
+        bindings/js/JSDatabaseCallback.cpp \
         bindings/js/JSDatabaseCustom.cpp \
         bindings/js/JSSQLResultSetRowListCustom.cpp \
         bindings/js/JSSQLTransactionCustom.cpp
 }
 
 contains(DEFINES, ENABLE_DOM_STORAGE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
-
     HEADERS += \
         storage/ChangeVersionWrapper.h \
         storage/DatabaseAuthorizer.h \
         storage/Database.h \
+        storage/DatabaseCallback.h \
         storage/DatabaseTask.h \
         storage/DatabaseThread.h \
         storage/DatabaseTracker.h \
@@ -2689,8 +2344,6 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
 }
 
 contains(DEFINES, ENABLE_WORKERS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
-
     SOURCES += \
         bindings/js/JSAbstractWorkerCustom.cpp \
         bindings/js/JSDedicatedWorkerContextCustom.cpp \
@@ -2714,8 +2367,6 @@ contains(DEFINES, ENABLE_WORKERS=1) {
 }
 
 contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
-
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
@@ -2726,8 +2377,6 @@ contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
 }
 
 contains(DEFINES, ENABLE_VIDEO=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
-
     SOURCES += \
         html/HTMLAudioElement.cpp \
         html/HTMLMediaElement.cpp \
@@ -2740,30 +2389,34 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         rendering/RenderMedia.cpp \
         bindings/js/JSAudioConstructor.cpp
 
-        HEADERS += \
-            platform/graphics/qt/MediaPlayerPrivatePhonon.h
+        # QtMultimedia disabled currently
+        false:greaterThan(QT_MINOR_VERSION, 6) {
+            HEADERS += platform/graphics/qt/MediaPlayerPrivateQt.h
+            SOURCES += platform/graphics/qt/MediaPlayerPrivateQt.cpp
 
-        SOURCES += \
-            platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
-
-        # Add phonon manually to prevent it from coming first in
-        # the include paths, as Phonon's path.h conflicts with
-        # WebCore's Path.h on case-insensitive filesystems.
-        qtAddLibrary(phonon)
-        INCLUDEPATH -= $$QMAKE_INCDIR_QT/phonon
-        INCLUDEPATH += $$QMAKE_INCDIR_QT/phonon
-        mac {
-            INCLUDEPATH -= $$QMAKE_LIBDIR_QT/phonon.framework/Headers
-            INCLUDEPATH += $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+            tobe|!tobe: QT += mediaservices
+        } else {
+            HEADERS += \
+                platform/graphics/qt/MediaPlayerPrivatePhonon.h
+
+            SOURCES += \
+                platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+
+            # Add phonon manually to prevent it from coming first in
+            # the include paths, as Phonon's path.h conflicts with
+            # WebCore's Path.h on case-insensitive filesystems.
+            qtAddLibrary(phonon)
+            INCLUDEPATH -= $$QMAKE_INCDIR_QT/phonon
+            INCLUDEPATH += $$QMAKE_INCDIR_QT/phonon
+            mac {
+                INCLUDEPATH -= $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+                INCLUDEPATH += $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+            }
         }
 
 }
 
 contains(DEFINES, ENABLE_XPATH=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XPATH=1
-
-    XPATHBISON = $$PWD/xml/XPathGrammar.y
-
     SOURCES += \
         xml/NativeXPathNSResolver.cpp \
         xml/XPathEvaluator.cpp \
@@ -2786,8 +2439,6 @@ contains(DEFINES, ENABLE_XPATH=1) {
 unix:!mac:CONFIG += link_pkgconfig
 
 contains(DEFINES, ENABLE_XSLT=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
-
     tobe|!tobe: QT += xmlpatterns
 
     SOURCES += \
@@ -2799,10 +2450,6 @@ contains(DEFINES, ENABLE_XSLT=1) {
         xml/XSLTProcessorQt.cpp
 }
 
-contains(DEFINES, ENABLE_XBL=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
-}
-
 contains(DEFINES, ENABLE_FILTERS=1) {
     SOURCES += \
         platform/graphics/filters/FEBlend.cpp \
@@ -2813,16 +2460,6 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
-
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
-}
-
-contains(DEFINES, ENABLE_WCSS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
-    contains(DEFINES, ENABLE_XHTMLMP=0) {
-        DEFINES -= ENABLE_XHTMLMP=0
-        DEFINES += ENABLE_XHTMLMP=1
-    }
 }
 
 contains(DEFINES, ENABLE_WML=1) {
@@ -2863,29 +2500,11 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLTemplateElement.cpp \
         wml/WMLTimerElement.cpp \
         wml/WMLVariables.cpp
-
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
-
-    WML_NAMES = $$PWD/wml/WMLTagNames.in
-
-    wmlnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
-    wmlnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-    wmlnames_a.input = WML_NAMES
-    wmlnames_a.dependency_type = TYPE_C
-    wmlnames_a.CONFIG = target_predeps
-    wmlnames_a.variable_out = GENERATED_SOURCES
-    addExtraCompilerWithHeader(wmlnames_a)
-    wmlnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLElementFactory.cpp
-    wmlnames_b.commands = @echo -n ''
-    wmlnames_b.input = SVG_NAMES
-    wmlnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
-    wmlnames_b.CONFIG = target_predeps
-    wmlnames_b.variable_out = GENERATED_SOURCES
-    addExtraCompilerWithHeader(wmlnames_b)
 }
 
 contains(DEFINES, ENABLE_XHTMLMP=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+    SOURCES += \
+        html/HTMLNoScriptElement.cpp
 }
 
 contains(DEFINES, ENABLE_QT_BEARER=1) {
@@ -2895,17 +2514,15 @@ contains(DEFINES, ENABLE_QT_BEARER=1) {
     SOURCES += \
         platform/network/qt/NetworkStateNotifierQt.cpp
 
-    CONFIG += mobility
-    MOBILITY += bearer
+    # Bearer management is part of Qt 4.7, so don't accidentially
+    # pull in Qt Mobility when building against >= 4.7
+    !greaterThan(QT_MINOR_VERSION, 6) {
+        CONFIG += mobility
+        MOBILITY += bearer
+    }
 }
 
 contains(DEFINES, ENABLE_SVG=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
-
-    SVG_NAMES = $$PWD/svg/svgtags.in
-
-    XLINK_NAMES = $$PWD/svg/xlinkattrs.in
-
     SOURCES += \
 # TODO: this-one-is-not-auto-added! FIXME! tmp/SVGElementFactory.cpp \
         bindings/js/JSSVGElementInstanceCustom.cpp \
@@ -2913,8 +2530,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         bindings/js/JSSVGMatrixCustom.cpp \
         bindings/js/JSSVGPathSegCustom.cpp \
         bindings/js/JSSVGPathSegListCustom.cpp \
-        bindings/js/JSSVGPointListCustom.cpp \
-        bindings/js/JSSVGTransformListCustom.cpp \
         css/SVGCSSComputedStyleDeclaration.cpp \
         css/SVGCSSParser.cpp \
         css/SVGCSSStyleSelector.cpp \
@@ -3052,7 +2667,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGViewElement.cpp \
         svg/SVGViewSpec.cpp \
         svg/SVGZoomAndPan.cpp \
-        svg/SynchronizablePropertyController.cpp \
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
@@ -3077,11 +2691,9 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/SVGPaintServerPattern.cpp \
         svg/graphics/SVGPaintServerRadialGradient.cpp \
         svg/graphics/SVGPaintServerSolid.cpp \
-        svg/graphics/SVGResourceClipper.cpp \
         svg/graphics/SVGResource.cpp \
         svg/graphics/SVGResourceFilter.cpp \
         svg/graphics/SVGResourceMarker.cpp \
-        svg/graphics/SVGResourceMasker.cpp \
         rendering/RenderForeignObject.cpp \
         rendering/RenderPath.cpp \
         rendering/RenderSVGBlock.cpp \
@@ -3092,7 +2704,10 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/RenderSVGInline.cpp \
         rendering/RenderSVGInlineText.cpp \
         rendering/RenderSVGModelObject.cpp \
+        rendering/RenderSVGResourceClipper.cpp \
+        rendering/RenderSVGResourceMasker.cpp \
         rendering/RenderSVGRoot.cpp \
+        rendering/RenderSVGShadowTreeRootContainer.cpp \
         rendering/RenderSVGText.cpp \
         rendering/RenderSVGTextPath.cpp \
         rendering/RenderSVGTransformableContainer.cpp \
@@ -3101,83 +2716,19 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/SVGCharacterLayoutInfo.cpp \
         rendering/SVGInlineFlowBox.cpp \
         rendering/SVGInlineTextBox.cpp \
+        rendering/SVGMarkerLayoutInfo.cpp \
         rendering/SVGRenderSupport.cpp \
-        rendering/SVGRootInlineBox.cpp
-
-
-        # GENERATOR 5-C:
-        svgnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-        svgnames_a.input = SVG_NAMES
-        svgnames_a.dependency_type = TYPE_C
-        svgnames_a.CONFIG = target_predeps
-        svgnames_a.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(svgnames_a)
-        svgnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGElementFactory.cpp
-        svgnames_b.commands = @echo -n ''
-        svgnames_b.input = SVG_NAMES
-        svgnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgnames_b.CONFIG = target_predeps
-        svgnames_b.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(svgnames_b)
-        svgelementwrapper.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.cpp
-        svgelementwrapper.commands = @echo -n ''
-        svgelementwrapper.input = SVG_NAMES
-        svgelementwrapper.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgelementwrapper.CONFIG = target_predeps
-        svgelementwrapper.variable_out = GENERATED_SOURCES
-        addExtraCompiler(svgelementwrapper)
-        svgelementwrapper_header.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.h
-        svgelementwrapper_header.commands = @echo -n ''
-        svgelementwrapper_header.input = SVG_NAMES
-        svgelementwrapper_header.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgelementwrapper_header.CONFIG = target_predeps
-        svgelementwrapper_header.variable_out = GENERATED_FILES
-        addExtraCompiler(svgelementwrapper_header)
-
-        # GENERATOR 5-D:
-        xlinknames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XLinkNames.cpp
-        xlinknames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
-        xlinknames.input = XLINK_NAMES
-        xlinknames.dependency_type = TYPE_C
-        xlinknames.CONFIG = target_predeps
-        xlinknames.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(xlinknames)
-
-} 
-# GENERATOR 6-A:
-cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-cssprops.input = WALDOCSSPROPS
-cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$EXTRACSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-cssprops.CONFIG = target_predeps no_link
-cssprops.variable_out =
-cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES EXTRACSSPROPERTIES
-addExtraCompilerWithHeader(cssprops)
-
-# GENERATOR 6-B:
-cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-cssvalues.input = WALDOCSSVALUES
-cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-cssvalues.CONFIG = target_predeps no_link
-cssvalues.variable_out =
-cssvalues.depend = ${QMAKE_FILE_NAME} EXTRACSSVALUES
-cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
-addExtraCompiler(cssvalues)
+        rendering/SVGRootInlineBox.cpp \
+        rendering/SVGShadowTreeElements.cpp
+}
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
-
     SOURCES += \
         bindings/js/JSJavaScriptCallFrameCustom.cpp \
         inspector/JavaScriptCallFrame.cpp \
-        inspector/JavaScriptDebugServer.cpp \
-        inspector/JavaScriptProfile.cpp \
-        inspector/JavaScriptProfileNode.cpp
 }
 
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
-
 SOURCES += \
     loader/appcache/ApplicationCache.cpp \
     loader/appcache/ApplicationCacheGroup.cpp \
@@ -3190,185 +2741,190 @@ SOURCES += \
 }
 
 contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+    HEADERS += \
+        websockets/ThreadableWebSocketChannel.h \
+        websockets/ThreadableWebSocketChannelClientWrapper.h \
+        websockets/WebSocket.h \
+        websockets/WebSocketChannel.h \
+        websockets/WebSocketChannelClient.h \
+        websockets/WebSocketHandshake.h \
+        websockets/WebSocketHandshakeRequest.h \
+        platform/network/qt/SocketStreamHandlePrivate.h
+
+    SOURCES += \
+        websockets/WebSocket.cpp \
+        websockets/WebSocketChannel.cpp \
+        websockets/WebSocketHandshake.cpp \
+        websockets/WebSocketHandshakeRequest.cpp \
+        websockets/ThreadableWebSocketChannel.cpp \
+        platform/network/SocketStreamErrorBase.cpp \
+        platform/network/SocketStreamHandleBase.cpp \
+        platform/network/qt/SocketStreamHandleQt.cpp \
+        bindings/js/JSWebSocketCustom.cpp \
+        bindings/js/JSWebSocketConstructor.cpp
+
+    contains(DEFINES, ENABLE_WORKERS=1) {
+        HEADERS += \
+            websockets/WorkerThreadableWebSocketChannel.h
+
+        SOURCES += \
+            websockets/WorkerThreadableWebSocketChannel.cpp
+    }
+}
+
+contains(DEFINES, ENABLE_3D_CANVAS=1) {
+tobe|!tobe: QT += opengl
+HEADERS += \
+	bindings/js/JSWebGLArrayBufferConstructor.h \
+	bindings/js/JSWebGLArrayHelper.h \
+	bindings/js/JSWebGLByteArrayConstructor.h \
+	bindings/js/JSWebGLFloatArrayConstructor.h \
+	bindings/js/JSWebGLIntArrayConstructor.h \
+	bindings/js/JSWebGLShortArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedByteArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedIntArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedShortArrayConstructor.h \
+	html/canvas/CanvasContextAttributes.h \
+	html/canvas/CanvasObject.h \
+	html/canvas/WebGLActiveInfo.h \
+	html/canvas/WebGLArrayBuffer.h \
+	html/canvas/WebGLArray.h \
+	html/canvas/WebGLBuffer.h \
+	html/canvas/WebGLByteArray.h \
+	html/canvas/WebGLContextAttributes.h \
+	html/canvas/WebGLFloatArray.h \
+	html/canvas/WebGLFramebuffer.h \
+	html/canvas/WebGLGetInfo.h \
+	html/canvas/WebGLIntArray.h \
+	html/canvas/WebGLProgram.h \
+	html/canvas/WebGLRenderbuffer.h \
+	html/canvas/WebGLRenderingContext.h \
+	html/canvas/WebGLShader.h \
+	html/canvas/WebGLShortArray.h \
+	html/canvas/WebGLTexture.h \
+	html/canvas/WebGLUniformLocation.h \
+	html/canvas/WebGLUnsignedByteArray.h \
+	html/canvas/WebGLUnsignedIntArray.h \
+	html/canvas/WebGLUnsignedShortArray.h \
+    platform/graphics/GraphicsContext3D.h 
 
 SOURCES += \
-    websockets/WebSocket.cpp \
-    websockets/WebSocketChannel.cpp \
-    websockets/WebSocketHandshake.cpp \
-    platform/network/SocketStreamErrorBase.cpp \
-    platform/network/SocketStreamHandleBase.cpp \
-    platform/network/qt/SocketStreamHandleSoup.cpp \
-    bindings/js/JSWebSocketCustom.cpp \
-    bindings/js/JSWebSocketConstructor.cpp
+	bindings/js/JSWebGLArrayBufferConstructor.cpp \
+	bindings/js/JSWebGLArrayCustom.cpp \
+	bindings/js/JSWebGLByteArrayConstructor.cpp \
+	bindings/js/JSWebGLByteArrayCustom.cpp \
+	bindings/js/JSWebGLFloatArrayConstructor.cpp \
+	bindings/js/JSWebGLFloatArrayCustom.cpp \
+	bindings/js/JSWebGLIntArrayConstructor.cpp \
+	bindings/js/JSWebGLIntArrayCustom.cpp \
+	bindings/js/JSWebGLRenderingContextCustom.cpp \
+	bindings/js/JSWebGLShortArrayConstructor.cpp \
+	bindings/js/JSWebGLShortArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedByteArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedIntArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedShortArrayCustom.cpp \
+	html/canvas/CanvasContextAttributes.cpp \
+    html/canvas/CanvasObject.cpp \
+	html/canvas/WebGLArrayBuffer.cpp \
+	html/canvas/WebGLArray.cpp \
+	html/canvas/WebGLBuffer.cpp \
+	html/canvas/WebGLByteArray.cpp \
+	html/canvas/WebGLContextAttributes.cpp \
+	html/canvas/WebGLFloatArray.cpp \
+	html/canvas/WebGLFramebuffer.cpp \
+	html/canvas/WebGLGetInfo.cpp \
+	html/canvas/WebGLIntArray.cpp \
+	html/canvas/WebGLProgram.cpp \
+	html/canvas/WebGLRenderbuffer.cpp \
+	html/canvas/WebGLRenderingContext.cpp \
+	html/canvas/WebGLShader.cpp \
+	html/canvas/WebGLShortArray.cpp \
+	html/canvas/WebGLTexture.cpp \
+	html/canvas/WebGLUniformLocation.cpp \
+	html/canvas/WebGLUnsignedByteArray.cpp \
+	html/canvas/WebGLUnsignedIntArray.cpp \
+	html/canvas/WebGLUnsignedShortArray.cpp \
+    platform/graphics/GraphicsContext3D.cpp \
+    platform/graphics/qt/GraphicsContext3DQt.cpp \
+
 }
 
-# GENERATOR 1: IDL compiler
-idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
-idl.variable_out = GENERATED_SOURCES
-idl.input = IDL_BINDINGS
-idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
-idl.depends = $$PWD/bindings/scripts/generate-bindings.pl \
-              $$PWD/bindings/scripts/CodeGenerator.pm \
-              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
-              $$PWD/bindings/scripts/IDLParser.pm \
-              $$PWD/bindings/scripts/IDLStructure.pm \
-              $$PWD/bindings/scripts/InFilesParser.pm
-idl.CONFIG += target_predeps
-addExtraCompilerWithHeader(idl)
-
-# GENERATOR 2-A: LUT creator
-domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
-domlut.depend = ${QMAKE_FILE_NAME}
-domlut.input = DOMLUT_FILES
-domlut.CONFIG += no_link
-addExtraCompiler(domlut)
-
-# GENERATOR 3: tokenizer (flex)
-tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
-tokenizer.dependency_type = TYPE_C
-tokenizer.input = TOKENIZER
-tokenizer.CONFIG += target_predeps no_link
-tokenizer.variable_out =
-addExtraCompiler(tokenizer)
-
-# GENERATOR 4: CSS grammar
-cssbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}
-cssbison.depend = ${QMAKE_FILE_NAME}
-cssbison.input = CSSBISON
-cssbison.CONFIG = target_predeps
-cssbison.dependency_type = TYPE_C
-cssbison.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(cssbison)
-
-# GENERATOR 5-A:
-htmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-htmlnames.input = HTML_NAMES
-htmlnames.dependency_type = TYPE_C
-htmlnames.CONFIG = target_predeps
-htmlnames.variable_out = GENERATED_SOURCES
-htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
-addExtraCompilerWithHeader(htmlnames)
-
-htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
-htmlelementfactory.commands = @echo -n ''
-htmlelementfactory.input = HTML_NAMES
-htmlelementfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-htmlelementfactory.CONFIG = target_predeps
-htmlelementfactory.variable_out = GENERATED_SOURCES
-htmlelementfactory.clean += ${QMAKE_FILE_OUT}
-addExtraCompilerWithHeader(htmlelementfactory)
-
-elementwrapperfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSHTMLElementWrapperFactory.cpp
-elementwrapperfactory.commands = @echo -n ''
-elementwrapperfactory.input = HTML_NAMES
-elementwrapperfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-elementwrapperfactory.CONFIG = target_predeps
-elementwrapperfactory.variable_out = GENERATED_SOURCES
-elementwrapperfactory.clean += ${QMAKE_FILE_OUT}
-addExtraCompilerWithHeader(elementwrapperfactory)
-
-# GENERATOR 5-B:
-xmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XMLNames.cpp
-xmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
-xmlnames.input = XML_NAMES
-xmlnames.dependency_type = TYPE_C
-xmlnames.CONFIG = target_predeps
-xmlnames.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(xmlnames)
-
-# GENERATOR 8-A:
-entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.input = ENTITIES_GPERF
-entities.dependency_type = TYPE_C
-entities.CONFIG = target_predeps no_link
-entities.variable_out =
-entities.clean = ${QMAKE_FILE_OUT}
-addExtraCompiler(entities)
-
-# GENERATOR 8-B:
-doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-doctypestrings.input = DOCTYPESTRINGS
-doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
-doctypestrings.dependency_type = TYPE_C
-doctypestrings.CONFIG += target_predeps no_link
-doctypestrings.variable_out =
-doctypestrings.clean = ${QMAKE_FILE_OUT}
-addExtraCompiler(doctypestrings)
-
-# GENERATOR 8-C:
-colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
-colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
-colordata.input = COLORDAT_GPERF
-colordata.CONFIG = target_predeps no_link
-colordata.variable_out =
-addExtraCompiler(colordata)
-
-# GENERATOR 9:
-stylesheets.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheetsData.cpp
-stylesheets.commands = perl $$PWD/css/make-css-file-arrays.pl --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
-STYLESHEETS_EMBED_GENERATOR_SCRIPT = $$PWD/css/make-css-file-arrays.pl
-stylesheets.input = STYLESHEETS_EMBED_GENERATOR_SCRIPT
-stylesheets.depends = $$STYLESHEETS_EMBED
-stylesheets.CONFIG = target_predeps
-stylesheets.variable_out = GENERATED_SOURCES
-stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h
-addExtraCompilerWithHeader(stylesheets, $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheets.h)
-
-# GENERATOR 10: XPATH grammar
-xpathbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-xpathbison.depend = ${QMAKE_FILE_NAME}
-xpathbison.input = XPATHBISON
-xpathbison.CONFIG = target_predeps
-xpathbison.dependency_type = TYPE_C
-xpathbison.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(xpathbison)
-
-# GENERATOR 11: WebKit Version
-# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
-webkitversion.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WebKitVersion.h
-webkitversion.commands = perl $$PWD/../WebKit/scripts/generate-webkitversion.pl --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-WEBKITVERSION_SCRIPT = $$PWD/../WebKit/scripts/generate-webkitversion.pl
-webkitversion.input = WEBKITVERSION_SCRIPT
-webkitversion.CONFIG = target_predeps
-webkitversion.depend = $$PWD/../WebKit/scripts/generate-webkitversion.pl
-webkitversion.variable_out = GENERATED_SOURCES
-webkitversion.clean = ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}WebKitVersion.h
-addExtraCompiler(webkitversion)
+contains(DEFINES, ENABLE_SYMBIAN_DIALOG_PROVIDERS) {
+    # this feature requires the S60 platform private BrowserDialogsProvider.h header file
+    # and is therefore not enabled by default but only meant for platform builds.
+    symbian {
+        LIBS += -lbrowserdialogsprovider
+    }
+}
+
+!symbian-abld:!symbian-sbsv2 {
+    modfile.files = $$moduleFile
+    modfile.path = $$[QMAKE_MKSPECS]/modules
+
+    INSTALLS += modfile
+} else {
+    # INSTALLS is not implemented in qmake's mmp generators, copy headers manually
+
+    inst_modfile.commands = $$QMAKE_COPY ${QMAKE_FILE_NAME} ${QMAKE_FILE_OUT}
+    inst_modfile.input = moduleFile
+    inst_modfile.output = $$[QMAKE_MKSPECS]/modules
+    inst_modfile.CONFIG = no_clean
 
+    QMAKE_EXTRA_COMPILERS += inst_modfile
+
+    install.depends += compiler_inst_modfile_make_all
+    QMAKE_EXTRA_TARGETS += install
+}
 
 include($$PWD/../WebKit/qt/Api/headers.pri)
 HEADERS += $$WEBKIT_API_HEADERS
+
 !CONFIG(QTDIR_build) {
-    target.path = $$[QT_INSTALL_LIBS]
-    headers.files = $$WEBKIT_API_HEADERS
-    headers.path = $$[QT_INSTALL_HEADERS]/QtWebKit
+    exists($$OUTPUT_DIR/include/QtWebKit/classheaders.pri): include($$OUTPUT_DIR/include/QtWebKit/classheaders.pri)
+    WEBKIT_INSTALL_HEADERS = $$WEBKIT_API_HEADERS $$WEBKIT_CLASS_HEADERS
+
+    !symbian-abld:!symbian-sbsv2 {
+        headers.files = $$WEBKIT_INSTALL_HEADERS
+
+        !isEmpty(INSTALL_HEADERS): headers.path = $$INSTALL_HEADERS/QtWebKit
+        else: headers.path = $$[QT_INSTALL_HEADERS]/QtWebKit
+
+        !isEmpty(INSTALL_LIBS): target.path = $$INSTALL_LIBS
+        else: target.path = $$[QT_INSTALL_LIBS]
+
+        INSTALLS += target headers
+    } else {
+        # INSTALLS is not implemented in qmake's mmp generators, copy headers manually
+        inst_headers.commands = $$QMAKE_COPY ${QMAKE_FILE_NAME} ${QMAKE_FILE_OUT}
+        inst_headers.input = WEBKIT_INSTALL_HEADERS
+        inst_headers.CONFIG = no_clean
+
+        !isEmpty(INSTALL_HEADERS): inst_headers.output = $$INSTALL_HEADERS/QtWebKit/${QMAKE_FILE_BASE}${QMAKE_FILE_EXT}
+        else: inst_headers.output = $$[QT_INSTALL_HEADERS]/QtWebKit/${QMAKE_FILE_BASE}${QMAKE_FILE_EXT}
 
-    VERSION=$${QT_MAJOR_VERSION}.$${QT_MINOR_VERSION}.$${QT_PATCH_VERSION}
+        QMAKE_EXTRA_COMPILERS += inst_headers
+
+        install.depends += compiler_inst_headers_make_all
+    }
 
     win32-*|wince* {
         DLLDESTDIR = $$OUTPUT_DIR/bin
+        TARGET = $$qtLibraryTarget($$TARGET)
 
-        dlltarget.commands = $(COPY_FILE) $(DESTDIR)$(TARGET) $$[QT_INSTALL_BINS]
+        dlltarget.commands = $(COPY_FILE) $(DESTDIR_TARGET) $$[QT_INSTALL_BINS]
         dlltarget.CONFIG = no_path
         INSTALLS += dlltarget
     }
 
-
-    INSTALLS += target headers
-
     unix {
         CONFIG += create_pc create_prl
         QMAKE_PKGCONFIG_LIBDIR = $$target.path
         QMAKE_PKGCONFIG_INCDIR = $$headers.path
         QMAKE_PKGCONFIG_DESTDIR = pkgconfig
-        lib_replace.match = $$DESTDIR
+        lib_replace.match = $$re_escape($$DESTDIR)
         lib_replace.replace = $$[QT_INSTALL_LIBS]
         QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
     }
@@ -3386,7 +2942,7 @@ HEADERS += $$WEBKIT_API_HEADERS
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
             FRAMEWORK_HEADERS.version = Versions
-            FRAMEWORK_HEADERS.files = $$WEBKIT_API_HEADERS
+            FRAMEWORK_HEADERS.files = $${headers.files}
             FRAMEWORK_HEADERS.path = Headers
             QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
         }
@@ -3396,14 +2952,13 @@ HEADERS += $$WEBKIT_API_HEADERS
     }
 }
 
-CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4) {
-    # start with 4.5
+!CONFIG(webkit-debug):CONFIG(QTDIR_build) {
     # Remove the following 2 lines if you want debug information in WebCore
     CONFIG -= separate_debug_info
     CONFIG += no_debug_info
 }
 
-!win32-g++:win32:contains(QMAKE_HOST.arch, x86_64):{
+win32:!win32-g++*:contains(QMAKE_HOST.arch, x86_64):{
     asm_compiler.commands = ml64 /c
     asm_compiler.commands +=  /Fo ${QMAKE_FILE_OUT} ${QMAKE_FILE_IN}
     asm_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
@@ -3420,11 +2975,31 @@ CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4
             plugins/win/PaintHooks.asm
     }
 }
+contains(DEFINES, WTF_USE_ACCELERATED_COMPOSITING) {
+HEADERS += \
+    rendering/RenderLayerBacking.h \
+    rendering/RenderLayerCompositor.h \
+    platform/graphics/GraphicsLayer.h \
+    platform/graphics/GraphicsLayerClient.h \
+    platform/graphics/qt/GraphicsLayerQt.h
+SOURCES += \
+    platform/graphics/GraphicsLayer.cpp \
+    platform/graphics/qt/GraphicsLayerQt.cpp \
+    rendering/RenderLayerBacking.cpp \
+    rendering/RenderLayerCompositor.cpp
+}
 
 symbian {
     shared {
         contains(CONFIG, def_files) {
+            DEF_FILE=../WebKit/qt/symbian
+            # defFilePath is for Qt4.6 compatibility
             defFilePath=../WebKit/qt/symbian
+        } else {
+            MMP_RULES += EXPORTUNFROZEN
         }
     }
 }
+
+# Disable C++0x mode in WebCore for those who enabled it in their Qt's mkspec
+*-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
diff --git a/src/3rdparty/webkit/WebCore/WebCore.qrc b/src/3rdparty/webkit/WebCore/WebCore.qrc
index 69f860a..6da93c6 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.qrc
+++ b/src/3rdparty/webkit/WebCore/WebCore.qrc
@@ -12,5 +12,6 @@
     <file alias="copyCursor.png">Resources/copyCursor.png</file>
     <file alias="progressCursor.png">Resources/progressCursor.png</file>
     <file alias="aliasCursor.png">Resources/aliasCursor.png</file>
+    <file alias="deleteButton.png">Resources/deleteButton.png</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp b/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
index b522e1d..02a5643 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,4 +24,3 @@
  */
 
 #include "WebCorePrefix.h"
-
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.h b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
index 6c8e200..ac2014e 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.h
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
@@ -18,7 +18,7 @@
  *
  */
 
-/* This prefix file should contain only:
+/* This prefix file should contain only: 
  *    1) files to precompile for faster builds
  *    2) in one case at least: OS-X-specific performance bug workarounds
  *    3) the special trick to catch us using new or delete without including "config.h"
@@ -62,6 +62,19 @@
 #include <pthread.h>
 #endif // defined(WIN32) || defined(_WIN32)
 
+#if defined(ANDROID)
+#ifdef __cplusplus
+// Must come before include of algorithm.
+#define PREFIX_FOR_WEBCORE 1
+#define EXPORT __attribute__((visibility("default")))
+#endif
+// Android uses a single set of include directories when building WebKit and
+// JavaScriptCore. Since WebCore/ is included before JavaScriptCore/, Android
+// includes JavaScriptCore/config.h explicitly here to make sure it gets picked
+// up.
+#include <JavaScriptCore/config.h>
+#endif
+
 #include <sys/types.h>
 #include <fcntl.h>
 #if defined(__APPLE__)
@@ -105,7 +118,7 @@
 
 #include <time.h>
 
-#ifndef BUILDING_WX__
+#if !defined(BUILDING_WX__) && !defined(ANDROID)
 #include <CoreFoundation/CoreFoundation.h>
 #ifdef WIN_CAIRO
 #include <ConditionalMacros.h>
@@ -121,7 +134,7 @@
 #endif
 
 #endif
-#endif
+#endif  // !defined(BUILDING_WX__) && !defined(ANDROID)
 
 #ifdef __OBJC__
 #import <Cocoa/Cocoa.h>
@@ -140,3 +153,4 @@
 #undef try
 #undef catch
 #endif
+
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
index 55199a3..c347a81 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,14 +30,18 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityARIAGrid.h"
-#include "AccessibilityARIAGridRow.h"
 #include "AccessibilityARIAGridCell.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityImageMapLink.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
-#include "AccessibilityImageMapLink.h"
 #include "AccessibilityMediaControls.h"
+#include "AccessibilityMenuList.h"
+#include "AccessibilityMenuListPopup.h"
+#include "AccessibilityMenuListOption.h"
 #include "AccessibilityRenderObject.h"
+#include "AccessibilityScrollbar.h"
 #include "AccessibilitySlider.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
@@ -46,6 +50,8 @@
 #include "AccessibilityTableRow.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "HTMLAreaElement.h"
+#include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #if ENABLE(VIDEO)
 #include "MediaControlElements.h"
@@ -80,6 +86,35 @@ AXObjectCache::~AXObjectCache()
     }
 }
 
+AccessibilityObject* AXObjectCache::focusedImageMapUIElement(HTMLAreaElement* areaElement)
+{
+    // Find the corresponding accessibility object for the HTMLAreaElement. This should be
+    // in the list of children for its corresponding image.
+    if (!areaElement)
+        return 0;
+    
+    HTMLImageElement* imageElement = areaElement->imageElement();
+    if (!imageElement)
+        return 0;
+    
+    AccessibilityObject* axRenderImage = areaElement->document()->axObjectCache()->getOrCreate(imageElement->renderer());
+    if (!axRenderImage)
+        return 0;
+    
+    AccessibilityObject::AccessibilityChildrenVector imageChildren = axRenderImage->children();
+    unsigned count = imageChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* child = imageChildren[k].get();
+        if (!child->isImageMapLink())
+            continue;
+        
+        if (static_cast<AccessibilityImageMapLink*>(child)->areaElement() == areaElement)
+            return child;
+    }    
+    
+    return 0;
+}
+    
 AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
 {
     // get the focused node in the page
@@ -88,6 +123,9 @@ AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
     if (!focusedNode)
         focusedNode = focusedDocument;
 
+    if (focusedNode->hasTagName(areaTag))
+        return focusedImageMapUIElement(static_cast<HTMLAreaElement*>(focusedNode));
+    
     RenderObject* focusedNodeRenderer = focusedNode->renderer();
     if (!focusedNodeRenderer)
         return 0;
@@ -141,11 +179,16 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+        else if (renderer->isMenuList())
+            newObj = AccessibilityMenuList::create(renderer);
+
+        // If the node is aria role="list" or the aria role is empty and its a ul/ol/dl type (it shouldn't be a list if aria says otherwise). 
+        else if (node && ((nodeIsAriaType(node, "list") || nodeIsAriaType(node, "directory"))
+                          || (nodeIsAriaType(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
-        else if (nodeIsAriaType(node, "grid"))
+        else if (nodeIsAriaType(node, "grid") || nodeIsAriaType(node, "treegrid"))
             newObj = AccessibilityARIAGrid::create(renderer);
         else if (nodeIsAriaType(node, "row"))
             newObj = AccessibilityARIAGridRow::create(renderer);
@@ -191,23 +234,32 @@ AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
     
     // will be filled in...
     switch (role) {
-        case ListBoxOptionRole:
-            obj = AccessibilityListBoxOption::create();
-            break;
-        case ImageMapLinkRole:
-            obj = AccessibilityImageMapLink::create();
-            break;
-        case ColumnRole:
-            obj = AccessibilityTableColumn::create();
-            break;            
-        case TableHeaderContainerRole:
-            obj = AccessibilityTableHeaderContainer::create();
-            break;   
-        case SliderThumbRole:
-            obj = AccessibilitySliderThumb::create();
-            break;
-        default:
-            obj = 0;
+    case ListBoxOptionRole:
+        obj = AccessibilityListBoxOption::create();
+        break;
+    case ImageMapLinkRole:
+        obj = AccessibilityImageMapLink::create();
+        break;
+    case ColumnRole:
+        obj = AccessibilityTableColumn::create();
+        break;            
+    case TableHeaderContainerRole:
+        obj = AccessibilityTableHeaderContainer::create();
+        break;   
+    case SliderThumbRole:
+        obj = AccessibilitySliderThumb::create();
+        break;
+    case MenuListPopupRole:
+        obj = AccessibilityMenuListPopup::create();
+        break;
+    case MenuListOptionRole:
+        obj = AccessibilityMenuListOption::create();
+        break;
+    case ScrollBarRole:
+        obj = AccessibilityScrollbar::create();
+        break;
+    default:
+        obj = 0;
     }
     
     if (obj)
@@ -235,9 +287,8 @@ void AXObjectCache::remove(AXID axID)
     removeAXID(obj);
     
     // finally remove the object
-    if (!m_objects.take(axID)) {
+    if (!m_objects.take(axID))
         return;
-    }
     
     ASSERT(m_objects.size() >= m_idsInUse.size());    
 }
@@ -261,7 +312,7 @@ AXID AXObjectCache::platformGenerateAXID() const
     AXID objID = lastUsedID;
     do {
         ++objID;
-    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+    } while (!objID || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
 
     lastUsedID = objID;
 
@@ -286,20 +337,29 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
     return objID;
 }
 
-void AXObjectCache::removeAXID(AccessibilityObject* obj)
+void AXObjectCache::removeAXID(AccessibilityObject* object)
 {
-    if (!obj)
+    if (!object)
         return;
     
-    AXID objID = obj->axObjectID();
-    if (objID == 0)
+    AXID objID = object->axObjectID();
+    if (!objID)
         return;
     ASSERT(!HashTraits<AXID>::isDeletedValue(objID));
     ASSERT(m_idsInUse.contains(objID));
-    obj->setAXObjectID(0);
+    object->setAXObjectID(0);
     m_idsInUse.remove(objID);
 }
 
+#if HAVE(ACCESSIBILITY)
+void AXObjectCache::contentChanged(RenderObject* renderer)
+{
+    AccessibilityObject* object = getOrCreate(renderer);
+    if (object)
+        object->contentChanged(); 
+}
+#endif
+
 void AXObjectCache::childrenChanged(RenderObject* renderer)
 {
     if (!renderer)
@@ -339,7 +399,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 }
     
 #if HAVE(ACCESSIBILITY)
-void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement)
+void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement, PostType postType)
 {
     // Notifications for text input objects are sent to that object.
     // All others are sent to the top WebArea.
@@ -348,28 +408,35 @@ void AXObjectCache::postNotification(RenderObject* renderer, AXNotification noti
     
     // Get an accessibility object that already exists. One should not be created here
     // because a render update may be in progress and creating an AX object can re-trigger a layout
-    RefPtr<AccessibilityObject> obj = get(renderer);
-    while (!obj && renderer) {
+    RefPtr<AccessibilityObject> object = get(renderer);
+    while (!object && renderer) {
         renderer = renderer->parent();
-        obj = get(renderer); 
+        object = get(renderer); 
     }
     
     if (!renderer)
         return;
-
-    if (obj && !postToElement)
-        obj = obj->observableObject();
-    
-    Document* document = renderer->document();
-    if (!obj && document)
-        obj = get(document->renderer());
     
-    if (!obj)
+    postNotification(object.get(), renderer->document(), notification, postToElement, postType);
+}
+
+void AXObjectCache::postNotification(AccessibilityObject* object, Document* document, AXNotification notification, bool postToElement, PostType postType)
+{
+    if (object && !postToElement)
+        object = object->observableObject();
+
+    if (!object && document)
+        object = get(document->renderer());
+
+    if (!object)
         return;
 
-    m_notificationsToPost.append(make_pair(obj, notification));
-    if (!m_notificationPostTimer.isActive())
-        m_notificationPostTimer.startOneShot(0);
+    if (postType == PostAsynchronously) {
+        m_notificationsToPost.append(make_pair(object, notification));
+        if (!m_notificationPostTimer.isActive())
+            m_notificationPostTimer.startOneShot(0);
+    } else
+        postPlatformNotification(object, notification);
 }
 
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
index 5a75f84..dad73f2 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,104 +42,117 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
-    class Node;
-    class Page;
-    class RenderObject;
-    class String;
-    class VisiblePosition;
-
-    struct TextMarkerData  {
-        AXID axID;
-        Node* node;
-        int offset;
-        EAffinity affinity;
+class HTMLAreaElement;
+class Node;
+class Page;
+class RenderObject;
+class String;
+class VisiblePosition;
+
+struct TextMarkerData {
+    AXID axID;
+    Node* node;
+    int offset;
+    EAffinity affinity;
+};
+
+enum PostType { PostSynchronously, PostAsynchronously };
+
+class AXObjectCache : public Noncopyable {
+public:
+    AXObjectCache();
+    ~AXObjectCache();
+
+    static AccessibilityObject* focusedUIElementForPage(const Page*);
+
+    // to be used with render objects
+    AccessibilityObject* getOrCreate(RenderObject*);
+    
+    // used for objects without backing elements
+    AccessibilityObject* getOrCreate(AccessibilityRole);
+    
+    // will only return the AccessibilityObject if it already exists
+    AccessibilityObject* get(RenderObject*);
+    
+    void remove(RenderObject*);
+    void remove(AXID);
+
+    void detachWrapper(AccessibilityObject*);
+    void attachWrapper(AccessibilityObject*);
+    void childrenChanged(RenderObject*);
+    void selectedChildrenChanged(RenderObject*);
+    // Called by a node when text or a text equivalent (e.g. alt) attribute is changed.
+    void contentChanged(RenderObject*);
+    
+    void handleActiveDescendantChanged(RenderObject*);
+    void handleAriaRoleChanged(RenderObject*);
+    void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+    void handleScrolledToAnchor(const Node* anchorNode);
+
+    static void enableAccessibility() { gAccessibilityEnabled = true; }
+    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    
+    static bool accessibilityEnabled() { return gAccessibilityEnabled; }
+    static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
+
+    void removeAXID(AccessibilityObject*);
+    bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+    AXID platformGenerateAXID() const;
+    AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
+
+    // Text marker utilities.
+    static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
+    static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
+
+    enum AXNotification {
+        AXActiveDescendantChanged,
+        AXCheckedStateChanged,
+        AXFocusedUIElementChanged,
+        AXLayoutComplete,
+        AXLoadComplete,
+        AXSelectedChildrenChanged,
+        AXSelectedTextChanged,
+        AXValueChanged,
+        AXScrolledToAnchor,
+        AXLiveRegionChanged,
+        AXMenuListValueChanged,
     };
 
-    class AXObjectCache {
-    public:
-        AXObjectCache();
-        ~AXObjectCache();
-
-        static AccessibilityObject* focusedUIElementForPage(const Page*);
-
-        // to be used with render objects
-        AccessibilityObject* getOrCreate(RenderObject*);
-        
-        // used for objects without backing elements
-        AccessibilityObject* getOrCreate(AccessibilityRole);
-        
-        // will only return the AccessibilityObject if it already exists
-        AccessibilityObject* get(RenderObject*);
-        
-        void remove(RenderObject*);
-        void remove(AXID);
-
-        void detachWrapper(AccessibilityObject*);
-        void attachWrapper(AccessibilityObject*);
-        void childrenChanged(RenderObject*);
-        void selectedChildrenChanged(RenderObject*);
-        void handleActiveDescendantChanged(RenderObject*);
-        void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
-        void handleScrolledToAnchor(const Node* anchorNode);
-
-        static void enableAccessibility() { gAccessibilityEnabled = true; }
-        static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
-        
-        static bool accessibilityEnabled() { return gAccessibilityEnabled; }
-        static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
-
-        void removeAXID(AccessibilityObject*);
-        bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
-        AXID platformGenerateAXID() const;
-        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
-
-        // Text marker utilities.
-        static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
-        static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-
-        enum AXNotification {
-            AXCheckedStateChanged,
-            AXFocusedUIElementChanged,
-            AXLayoutComplete,
-            AXLoadComplete,
-            AXSelectedChildrenChanged,
-            AXSelectedTextChanged,
-            AXValueChanged,
-            AXScrolledToAnchor,
-        };
-        
-        void postNotification(RenderObject*, AXNotification, bool postToElement);
-
-    protected:
-        void postPlatformNotification(AccessibilityObject*, AXNotification);
-
-    private:
-        HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
-        HashMap<RenderObject*, AXID> m_renderObjectMapping;
-        static bool gAccessibilityEnabled;
-        static bool gAccessibilityEnhancedUserInterfaceEnabled;
-        
-        HashSet<AXID> m_idsInUse;
-        
-        Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
-        void notificationPostTimerFired(Timer<AXObjectCache>*);
-        
-        AXID getAXID(AccessibilityObject*);
-        bool nodeIsAriaType(Node* node, String role);
-    };
+    void postNotification(RenderObject*, AXNotification, bool postToElement, PostType = PostAsynchronously);
+    void postNotification(AccessibilityObject*, Document*, AXNotification, bool postToElement, PostType = PostAsynchronously);
+
+protected:
+    void postPlatformNotification(AccessibilityObject*, AXNotification);
+
+private:
+    HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
+    HashMap<RenderObject*, AXID> m_renderObjectMapping;
+    static bool gAccessibilityEnabled;
+    static bool gAccessibilityEnhancedUserInterfaceEnabled;
+    
+    HashSet<AXID> m_idsInUse;
+    
+    Timer<AXObjectCache> m_notificationPostTimer;
+    Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
+    void notificationPostTimerFired(Timer<AXObjectCache>*);
+    
+    static AccessibilityObject* focusedImageMapUIElement(HTMLAreaElement*);
+    
+    AXID getAXID(AccessibilityObject*);
+    bool nodeIsAriaType(Node*, String role);
+};
 
 #if !HAVE(ACCESSIBILITY)
-    inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
-    inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
-    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
+inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
+inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
+inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement, PostType) { }
+inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::contentChanged(RenderObject*) { }
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 69c4512..58b3fa1 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -29,11 +29,11 @@
 #include "config.h"
 #include "AccessibilityARIAGrid.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -131,13 +131,12 @@ AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned colu
     if (!m_renderer)
         return 0;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     if (column >= columnCount() || row >= rowCount())
         return 0;
     
-    AccessibilityObject *tableRow = m_rows[row].get();
+    AccessibilityObject* tableRow = m_rows[row].get();
     if (!tableRow)
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
index 32c8ce9..3511f0f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -52,6 +52,9 @@ public:
     virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
 
 private:
+    // ARIA treegrids and grids support selected rows.
+    virtual bool supportsSelectedRows() { return true; }    
+
     void addChild(AccessibilityObject* object, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount);
 };
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
index 6e1f1c8..7d562d9 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -30,6 +30,7 @@
 #include "AccessibilityARIAGridRow.h"
 
 #include "AccessibilityObject.h"
+#include "AccessibilityTable.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -50,6 +51,71 @@ PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObje
     return adoptRef(new AccessibilityARIAGridRow(renderer));
 }
 
+bool AccessibilityARIAGridRow::isARIATreeGridRow() const
+{
+    AccessibilityObject* parent = parentTable();
+    if (!parent)
+        return false;
+    
+    return parent->ariaRoleAttribute() == TreeGridRole;
+}
+    
+void AccessibilityARIAGridRow::disclosedRows(AccessibilityChildrenVector& disclosedRows)
+{
+    // The contiguous disclosed rows will be the rows in the table that 
+    // have an aria-level of plus 1 from this row.
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return;
+    
+    // Search for rows that match the correct level. 
+    // Only take the subsequent rows from this one that are +1 from this row's level.
+    int index = rowIndex();
+    if (index < 0)
+        return;
+    
+    unsigned level = hierarchicalLevel();
+    AccessibilityChildrenVector& allRows = static_cast<AccessibilityTable*>(parent)->rows();
+    int rowCount = allRows.size();
+    for (int k = index + 1; k < rowCount; ++k) {
+        AccessibilityObject* row = allRows[k].get();
+        // Stop at the first row that doesn't match the correct level.
+        if (row->hierarchicalLevel() != level + 1)
+            break;
+
+        disclosedRows.append(row);
+    }
+}
+    
+AccessibilityObject* AccessibilityARIAGridRow::disclosedByRow() const
+{
+    // The row that discloses this one is the row in the table
+    // that is aria-level subtract 1 from this row.
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return 0;
+    
+    // If the level is 1 or less, than nothing discloses this row.
+    unsigned level = hierarchicalLevel();
+    if (level <= 1)
+        return 0;
+    
+    // Search for the previous row that matches the correct level.
+    int index = rowIndex();
+    AccessibilityChildrenVector& allRows = static_cast<AccessibilityTable*>(parent)->rows();
+    int rowCount = allRows.size();
+    if (index >= rowCount)
+        return 0;
+    
+    for (int k = index - 1; k >= 0; --k) {
+        AccessibilityObject* row = allRows[k].get();
+        if (row->hierarchicalLevel() == level - 1)
+            return row;
+    }
+    
+    return 0;
+}
+    
 AccessibilityObject* AccessibilityARIAGridRow::parentTable() const
 {
     AccessibilityObject* parent = parentObjectUnignored();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
index c2ca8b8..f89ea92 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -41,8 +41,14 @@ public:
     static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
     virtual ~AccessibilityARIAGridRow();
     
+    void disclosedRows(AccessibilityChildrenVector&);
+    AccessibilityObject* disclosedByRow() const;
+    
     virtual AccessibilityObject* headerObject();
     virtual AccessibilityObject* parentTable() const;    
+    
+private:
+    virtual bool isARIATreeGridRow() const;
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
index 83cf5d0..9cf2068 100755
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -25,6 +25,7 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include <AXObjectCache.cpp>
 #include <AccessibilityARIAGrid.cpp>
 #include <AccessibilityARIAGridCell.cpp>
 #include <AccessibilityARIAGridRow.cpp>
@@ -35,10 +36,10 @@
 #include <AccessibilityMediaControls.cpp>
 #include <AccessibilityObject.cpp>
 #include <AccessibilityRenderObject.cpp>
+#include <AccessibilityScrollbar.cpp>
 #include <AccessibilitySlider.cpp>
 #include <AccessibilityTable.cpp>
 #include <AccessibilityTableCell.cpp>
 #include <AccessibilityTableColumn.cpp>
 #include <AccessibilityTableHeaderContainer.cpp>
 #include <AccessibilityTableRow.cpp>
-#include <AXObjectCache.cpp>
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 943122e..06150b9 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityImageMapLink.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "IntRect.h"
@@ -68,6 +68,18 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
+AccessibilityRole AccessibilityImageMapLink::roleValue() const
+{
+    if (!m_areaElement)
+        return WebCoreLinkRole;
+    
+    const AtomicString& ariaRole = m_areaElement->getAttribute(roleAttr);
+    if (!ariaRole.isEmpty())
+        return AccessibilityObject::ariaRoleToWebCoreRole(ariaRole);
+
+    return WebCoreLinkRole;
+}
+    
 Element* AccessibilityImageMapLink::actionElement() const
 {
     return anchorElement();
@@ -134,5 +146,15 @@ IntSize AccessibilityImageMapLink::size() const
 {
     return elementRect().size();
 }
-    
+
+String AccessibilityImageMapLink::stringValueForMSAA() const
+{
+    return url();
+}
+
+String AccessibilityImageMapLink::nameForMSAA() const
+{
+    return accessibilityDescription();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
index 2c27e46..ca4c62c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -44,21 +44,29 @@ public:
     virtual ~AccessibilityImageMapLink();
     
     void setHTMLAreaElement(HTMLAreaElement* element) { m_areaElement = element; }
+    HTMLAreaElement* areaElement() const { return m_areaElement; }
+    
     void setHTMLMapElement(HTMLMapElement* element) { m_mapElement = element; }    
+    HTMLMapElement* mapElement() const { return m_mapElement; }
+    
     void setParent(AccessibilityObject* parent) { m_parent = parent; }
         
-    virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
+    virtual AccessibilityRole roleValue() const;
     virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isEnabled() const { return true; }
-
+    
     virtual AccessibilityObject* parentObject() const;
     virtual Element* anchorElement() const;
     virtual Element* actionElement() const;
     virtual KURL url() const;
     virtual bool isLink() const { return true; } 
+    virtual bool isLinked() const { return true; }
     virtual String title() const;
     virtual String accessibilityDescription() const;
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String nameForMSAA() const;
+
     virtual IntSize size() const;
     virtual IntRect elementRect() const;
 
@@ -66,6 +74,8 @@ private:
     HTMLAreaElement* m_areaElement;
     HTMLMapElement* m_mapElement;
     AccessibilityObject* m_parent;
+    
+    virtual bool isImageMapLink() const { return true; }
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
index 95239b0..073b0fc 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
@@ -55,6 +55,12 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 
 bool AccessibilityList::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     // lists don't appear on tiger/leopard on the mac
 #if ACCESSIBILITY_LISTS
     return false;
@@ -83,7 +89,11 @@ bool AccessibilityList::isOrderedList() const
 {
     if (!m_renderer)
         return false;
-    
+
+    // ARIA says a directory is like a static table of contents, which sounds like an ordered list.
+    if (ariaRoleAttribute() == DirectoryRole)
+        return true;
+
     Node* node = m_renderer->node();
     return node && node->hasTagName(olTag);    
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
index 89befb2..b7265b2 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
@@ -47,7 +47,7 @@ public:
     static PassRefPtr<AccessibilityList> create(RenderObject*);
     virtual ~AccessibilityList();
     
-    virtual bool isList() const { return true; };
+    virtual bool isList() const { return true; }
     bool isUnorderedList() const;
     bool isOrderedList() const;
     bool isDefinitionList() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
index 1f37481..8a9e062 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
@@ -31,9 +31,9 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBoxOption.h"
-#include "HitTestResult.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "HitTestResult.h"
 #include "RenderListBox.h"
 #include "RenderObject.h"
 
@@ -78,9 +78,9 @@ void AccessibilityListBox::addChildren()
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
         // The cast to HTMLElement below is safe because the only other possible listItem type
-        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        // would be a WMLElement, but WML builds don't use accessibility features at all.
         AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
-        if (listOption)
+        if (listOption && !listOption->accessibilityIsIgnored())
             m_children.append(listOption);
     }
 }
@@ -151,6 +151,17 @@ AccessibilityObject* AccessibilityListBox::listBoxOptionAccessibilityObject(HTML
     
     return listBoxObject;
 }
+    
+bool AccessibilityListBox::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    return false;
+}
 
 AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint& point) const
 {
@@ -165,16 +176,21 @@ AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint
     
     IntRect parentRect = boundingBoxRect();
     
-    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
-    unsigned length = listItems.size();
+    AccessibilityObject* listBoxOption = 0;
+    unsigned length = m_children.size();
     for (unsigned i = 0; i < length; i++) {
         IntRect rect = toRenderListBox(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
         // The cast to HTMLElement below is safe because the only other possible listItem type
-        // would be a WMLElement, but WML builds don't use accessbility features at all.
-        if (rect.contains(point))
-            return listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        // would be a WMLElement, but WML builds don't use accessibility features at all.
+        if (rect.contains(point)) {
+            listBoxOption = m_children[i].get();
+            break;
+        }
     }
     
+    if (listBoxOption && !listBoxOption->accessibilityIsIgnored())
+        return listBoxOption;
+    
     return axObjectCache()->getOrCreate(m_renderer);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d..72ce82f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
@@ -43,15 +43,13 @@ public:
     virtual ~AccessibilityListBox();
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
-    virtual bool isListBox() const { return true; };
+    virtual bool isListBox() const { return true; }
     
     virtual bool canSetFocusAttribute() const { return true; }
     virtual bool canSetSelectedChildrenAttribute() const;
     void setSelectedChildren(AccessibilityChildrenVector&);
     virtual AccessibilityRole roleValue() const { return ListBoxRole; }
-    
-    virtual bool accessibilityIsIgnored() const { return false; }
-    
+        
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
     
@@ -59,6 +57,7 @@ public:
 
 private:    
     AccessibilityObject* listBoxOptionAccessibilityObject(HTMLElement*) const;
+    virtual bool accessibilityIsIgnored() const;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
index 6e3bf98..57519e3 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -34,12 +34,12 @@
 #include "Element.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "HTMLOptionElement.h"
 #include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
 #include "HTMLSelectElement.h"
 #include "IntRect.h"
-#include "RenderObject.h"
 #include "RenderListBox.h"
+#include "RenderObject.h"
 
 using namespace std;
 
@@ -105,6 +105,22 @@ IntRect AccessibilityListBoxOption::elementRect() const
     return rect;
 }
 
+bool AccessibilityListBoxOption::accessibilityIsIgnored() const
+{
+    if (!m_optionElement)
+        return true;
+    
+    if (equalIgnoringCase(getAttribute(m_optionElement, aria_hiddenAttr), "true"))
+        return true;
+    
+    return parentObject()->accessibilityIsIgnored();
+}
+    
+String AccessibilityListBoxOption::language() const
+{
+    return AccessibilityObject::language(m_optionElement);
+}
+
 bool AccessibilityListBoxOption::canSetSelectedAttribute() const
 {
     if (!m_optionElement)
@@ -128,6 +144,10 @@ String AccessibilityListBoxOption::stringValue() const
     if (!m_optionElement)
         return String();
     
+    const AtomicString& ariaLabel = getAttribute(m_optionElement, aria_labelAttr);
+    if (!ariaLabel.isNull())
+        return ariaLabel;
+    
     if (m_optionElement->hasTagName(optionTag))
         return static_cast<HTMLOptionElement*>(m_optionElement)->text();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
index 933cdeb..1da77e7 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -51,7 +51,7 @@ public:
     void setHTMLElement(HTMLElement* element) { m_optionElement = element; }
     
     virtual AccessibilityRole roleValue() const { return ListBoxOptionRole; }
-    virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool accessibilityIsIgnored() const;
     virtual bool isSelected() const;
     virtual bool isEnabled() const;
     virtual String stringValue() const;
@@ -63,11 +63,12 @@ public:
     virtual IntRect elementRect() const;
     virtual IntSize size() const;
     virtual AccessibilityObject* parentObject() const;
-    bool isListBoxOption() const { return true; };
+    bool isListBoxOption() const { return true; }
     
 private:
     HTMLElement* m_optionElement;
     
+    virtual String language() const;
     virtual bool canHaveChildren() const { return false; }
     HTMLSelectElement* listBoxOptionParentNode() const;
     int listBoxOptionIndex() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
index 7200de9..6151840 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -113,6 +113,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaShowClosedCaptionsButtonName, ("ShowClosedCaptionsButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaHideClosedCaptionsButtonName, ("HideClosedCaptionsButton"));
 
     switch (controlType()) {
     case MediaFullscreenButton:
@@ -139,6 +141,10 @@ String AccessibilityMediaControl::controlTypeName() const
         return mediaCurrentTimeDisplay;
     case MediaTimeRemainingDisplay:
         return mediaTimeRemainingDisplay;
+    case MediaShowClosedCaptionsButton:
+        return mediaShowClosedCaptionsButtonName;
+    case MediaHideClosedCaptionsButton:
+        return mediaHideClosedCaptionsButtonName;
 
     default:
         break;
@@ -187,6 +193,8 @@ AccessibilityRole AccessibilityMediaControl::roleValue() const
     case MediaReturnToRealtimeButton:
     case MediaUnMuteButton:
     case MediaPauseButton:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         return ButtonRole;
 
     case MediaStatusDisplay:
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
index 9b306fd..6f51b2c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
@@ -37,77 +37,77 @@
 
 namespace WebCore {
 
-    class AccessibilityMediaControl : public AccessibilityRenderObject {
+class AccessibilityMediaControl : public AccessibilityRenderObject {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControl() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControl() { }
 
-        virtual AccessibilityRole roleValue() const;
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String title() const;
-        virtual String accessibilityDescription() const;
-        virtual String helpText() const;
+    virtual String title() const;
+    virtual String accessibilityDescription() const;
+    virtual String helpText() const;
 
-    protected:
-        AccessibilityMediaControl(RenderObject*);
-        MediaControlElementType controlType() const;
-        String controlTypeName() const;
-    };
+protected:
+    AccessibilityMediaControl(RenderObject*);
+    MediaControlElementType controlType() const;
+    String controlTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeline : public AccessibilitySlider {
+class AccessibilityMediaTimeline : public AccessibilitySlider {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeline() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeline() { }
 
-        virtual bool isMediaTimeline() const { return true; }
+    virtual bool isMediaTimeline() const { return true; }
 
-        virtual String helpText() const;
-        virtual String valueDescription() const;
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual String helpText() const;
+    virtual String valueDescription() const;
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-    private:
-        AccessibilityMediaTimeline(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeline(RenderObject*);
+};
 
 
-    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControlsContainer() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControlsContainer() { }
 
-        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual String helpText() const;
-        virtual String accessibilityDescription() const;
+    virtual String helpText() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaControlsContainer(RenderObject*);
-        bool controllingVideoElement() const;
-        const String elementTypeName() const;
-    };
+private:
+    AccessibilityMediaControlsContainer(RenderObject*);
+    bool controllingVideoElement() const;
+    const String elementTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeDisplay() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeDisplay() { }
 
-        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String stringValue() const;
-        virtual String accessibilityDescription() const;
+    virtual String stringValue() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaTimeDisplay(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeDisplay(RenderObject*);
+};
 
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp
new file mode 100644
index 0000000..05cdf97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuList.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuListPopup.h"
+#include "RenderMenuList.h"
+
+namespace WebCore {
+
+AccessibilityMenuList::AccessibilityMenuList(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+    ASSERT_ARG(renderer, renderer->isMenuList());
+}
+
+bool AccessibilityMenuList::press() const
+{
+    RenderMenuList* menuList = static_cast<RenderMenuList*>(m_renderer);
+    if (menuList->popupIsVisible())
+        menuList->hidePopup();
+    else
+        menuList->showPopup();
+    return true;
+}
+
+void AccessibilityMenuList::addChildren()
+{
+    m_haveChildren = true;
+
+    AXObjectCache* cache = m_renderer->document()->axObjectCache();
+
+    AccessibilityObject* list = cache->getOrCreate(MenuListPopupRole);
+    if (!list)
+        return;
+
+    if (list->accessibilityPlatformIncludesObject() == IgnoreObject) {
+        cache->remove(list->axObjectID());
+        return;
+    }
+
+    static_cast<AccessibilityMenuListPopup*>(list)->setMenuList(this);
+    m_children.append(list);
+
+    list->addChildren();
+}
+
+void AccessibilityMenuList::childrenChanged()
+{
+    if (m_children.isEmpty())
+        return;
+
+    ASSERT(m_children.size() == 1);
+    m_children[0]->childrenChanged();
+}
+
+bool AccessibilityMenuList::isCollapsed() const
+{
+    return !static_cast<RenderMenuList*>(m_renderer)->popupIsVisible();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h
new file mode 100644
index 0000000..d00c8b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuList_h
+#define AccessibilityMenuList_h
+
+#include "AccessibilityObject.h"
+#include "AccessibilityRenderObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuList;
+class AccessibilityMenuListPopup;
+class HTMLOptionElement;
+
+class AccessibilityMenuList : public AccessibilityRenderObject {
+public:
+    static PassRefPtr<AccessibilityMenuList> create(RenderObject* renderer) { return adoptRef(new AccessibilityMenuList(renderer)); }
+
+    virtual bool isCollapsed() const;
+    virtual bool press() const;
+
+private:
+    AccessibilityMenuList(RenderObject*);
+
+    virtual bool isMenuList() const { return true; }
+    virtual AccessibilityRole roleValue() const { return PopUpButtonRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool canSetFocusAttribute() const { return true; }
+
+    virtual void addChildren();
+    virtual void childrenChanged();
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuList_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp
new file mode 100644
index 0000000..d7473de
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuListOption.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuListPopup.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityMenuListOption::AccessibilityMenuListOption()
+    : m_popup(0)
+{
+}
+
+void AccessibilityMenuListOption::setElement(HTMLElement* element)
+{
+    ASSERT_ARG(element, element->hasTagName(optionTag));
+    m_element = element;
+}
+
+Element* AccessibilityMenuListOption::actionElement() const
+{
+    return m_element.get();
+}
+
+AccessibilityObject* AccessibilityMenuListOption::parentObject() const
+{
+    return m_popup;
+}
+
+bool AccessibilityMenuListOption::isEnabled() const
+{
+    // disabled() returns true if the parent <select> element is disabled,
+    // which we don't want.
+    return !static_cast<HTMLOptionElement*>(m_element.get())->ownElementDisabled();
+}
+
+bool AccessibilityMenuListOption::isVisible() const
+{
+    // In a single-option select with the popup collapsed, only the selected
+    // item is considered visible.
+    return !m_popup->isOffScreen() || isSelected();
+}
+
+bool AccessibilityMenuListOption::isOffScreen() const
+{
+    // Invisible list options are considered to be offscreen.
+    return !isVisible();
+}
+
+bool AccessibilityMenuListOption::isSelected() const
+{
+    return static_cast<HTMLOptionElement*>(m_element.get())->selected();
+}
+
+void AccessibilityMenuListOption::setSelected(bool b)
+{
+    if (!canSetSelectedAttribute())
+        return;
+
+    static_cast<HTMLOptionElement*>(m_element.get())->setSelected(b);
+}
+
+String AccessibilityMenuListOption::nameForMSAA() const
+{
+    return static_cast<HTMLOptionElement*>(m_element.get())->text();
+}
+
+bool AccessibilityMenuListOption::canSetSelectedAttribute() const
+{
+    return isEnabled();
+}
+
+IntRect AccessibilityMenuListOption::elementRect() const
+{
+    AccessibilityObject* parent = parentObject();
+    ASSERT(parent->isMenuListPopup());
+
+    AccessibilityObject* grandparent = parent->parentObject();
+    ASSERT(grandparent->isMenuList());
+
+    return grandparent->elementRect();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h
new file mode 100644
index 0000000..7e27888
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuListOption_h
+#define AccessibilityMenuListOption_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuListPopup;
+class HTMLElement;
+
+class AccessibilityMenuListOption : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityMenuListOption> create() { return adoptRef(new AccessibilityMenuListOption); }
+
+    void setElement(HTMLElement*);
+    void setParent(AccessibilityMenuListPopup* popup) { m_popup = popup; }
+
+private:
+    AccessibilityMenuListOption();
+
+    virtual bool isMenuListOption() const { return true; }
+
+    virtual AccessibilityRole roleValue() const { return MenuListOptionRole; }
+    virtual bool canHaveChildren() const { return false; }
+    virtual IntSize size() const { return elementRect().size(); }
+
+    virtual Element* actionElement() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool isEnabled() const;
+    virtual bool isVisible() const;
+    virtual bool isOffScreen() const;
+    virtual bool isSelected() const;
+    virtual String nameForMSAA() const;
+    virtual void setSelected(bool);
+    virtual bool canSetSelectedAttribute() const;
+    virtual IntRect elementRect() const;
+
+    RefPtr<HTMLElement> m_element;
+    AccessibilityMenuListPopup* m_popup;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuListOption_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp
new file mode 100644
index 0000000..48c2fab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuListPopup.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuList.h"
+#include "AccessibilityMenuListOption.h"
+#include "HTMLNames.h"
+#include "HTMLSelectElement.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityMenuListPopup::AccessibilityMenuListPopup()
+    : m_menuList(0)
+{
+}
+
+bool AccessibilityMenuListPopup::isVisible() const
+{
+    return false;
+}
+
+bool AccessibilityMenuListPopup::isOffScreen() const
+{
+    return m_menuList->isCollapsed();
+}
+
+AccessibilityObject* AccessibilityMenuListPopup::parentObject() const
+{
+    return m_menuList;
+}
+
+bool AccessibilityMenuListPopup::isEnabled() const
+{
+    return m_menuList->isEnabled();
+}
+
+AccessibilityMenuListOption* AccessibilityMenuListPopup::menuListOptionAccessibilityObject(HTMLElement* element) const
+{
+    if (!element || !element->hasTagName(optionTag))
+        return 0;
+
+    AccessibilityObject* object = m_menuList->renderer()->document()->axObjectCache()->getOrCreate(MenuListOptionRole);
+    ASSERT(object->isMenuListOption());
+
+    AccessibilityMenuListOption* option = static_cast<AccessibilityMenuListOption*>(object);
+    option->setElement(element);
+
+    return option;
+}
+
+bool AccessibilityMenuListPopup::press() const
+{
+    m_menuList->press();
+    return true;
+}
+
+void AccessibilityMenuListPopup::addChildren()
+{
+    Node* selectNode = m_menuList->renderer()->node();
+    if (!selectNode)
+        return;
+
+    m_haveChildren = true;
+
+    ASSERT(selectNode->hasTagName(selectTag));
+
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
+    unsigned length = listItems.size();
+    for (unsigned i = 0; i < length; i++) {
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        AccessibilityMenuListOption* option = menuListOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        if (option) {
+            option->setParent(this);
+            m_children.append(option);
+        }
+    }
+}
+
+void AccessibilityMenuListPopup::childrenChanged()
+{
+    for (size_t i = m_children.size(); i > 0 ; --i) {
+        AccessibilityObject* child = m_children[i - 1].get();
+        if (child->actionElement() && !child->actionElement()->attached()) {
+            m_menuList->renderer()->document()->axObjectCache()->remove(child->axObjectID());
+            m_children.remove(i - 1);
+        }
+    }
+}
+
+void AccessibilityMenuListPopup::setMenuList(AccessibilityMenuList* menuList)
+{
+    ASSERT_ARG(menuList, menuList);
+    ASSERT(!m_menuList);
+    m_menuList = menuList;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h
new file mode 100644
index 0000000..88fbf7c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuListPopup_h
+#define AccessibilityMenuListPopup_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuList;
+class AccessibilityMenuListOption;
+class HTMLElement;
+
+class AccessibilityMenuListPopup : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityMenuListPopup> create() { return adoptRef(new AccessibilityMenuListPopup); }
+
+    void setMenuList(AccessibilityMenuList*);
+
+    virtual bool isEnabled() const;
+    virtual bool isOffScreen() const;
+
+private:
+    AccessibilityMenuListPopup();
+
+    virtual bool isMenuListPopup() const { return true; }
+
+    virtual IntRect elementRect() const { return IntRect(); }
+    virtual IntSize size() const { return IntSize(); }
+    virtual AccessibilityRole roleValue() const { return MenuListPopupRole; }
+
+    virtual bool isVisible() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool press() const;
+    virtual void addChildren();
+    virtual void childrenChanged();
+
+    AccessibilityMenuListOption* menuListOptionAccessibilityObject(HTMLElement*) const;
+
+    AccessibilityMenuList* m_menuList;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuListPopup_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index d7093e4..8dedc36 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FocusController.h"
@@ -85,8 +85,9 @@ void AccessibilityObject::detach()
 AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
 {
     AccessibilityObject* parent;
-    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject())
-        ;
+    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
+    }
+    
     return parent;
 }
 
@@ -147,6 +148,15 @@ bool AccessibilityObject::press() const
     return true;
 }
     
+String AccessibilityObject::language(Node* node) const
+{
+    const AtomicString& lang = getAttribute(node, langAttr);
+    if (lang.isEmpty())
+        return AccessibilityObject::language();
+    
+    return lang;
+}
+    
 String AccessibilityObject::language() const
 {
     AccessibilityObject* parent = parentObject();
@@ -275,7 +285,7 @@ VisiblePositionRange AccessibilityObject::rightLineVisiblePositionRange(const Vi
     VisiblePosition startPosition = startOfLine(nextVisiblePos);
 
     // fetch for a valid line start position
-    if (startPosition.isNull() ) {
+    if (startPosition.isNull()) {
         startPosition = visiblePos;
         nextVisiblePos = nextVisiblePos.next();
     } else
@@ -381,9 +391,8 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
 {
     // we should always be given a rendered node and a replaced node, but be safe
     // replaced nodes are either attachments (widgets) or images
-    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode()) {
+    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode())
         return false;
-    }
 
     // create an AX object, but skip it if it is not supposed to be seen
     AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
@@ -445,7 +454,7 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length()) {
             // Add a textual representation for list marker text
             String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
             if (!listMarkerText.isEmpty())
@@ -459,9 +468,8 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             ASSERT(node == it.range()->endContainer(exception));
             int offset = it.range()->startOffset(exception);
 
-            if (replacedNodeNeedsCharacter(node->childNode(offset))) {
+            if (replacedNodeNeedsCharacter(node->childNode(offset)))
                 resultVector.append(objectReplacementCharacter);
-            }
         }
     }
 
@@ -478,9 +486,9 @@ int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRang
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length())
             length += it.length();
-        } else {
+        else {
             // locate the node and starting offset for this replaced range
             int exception = 0;
             Node* node = it.range()->startContainer(exception);
@@ -732,8 +740,8 @@ FrameView* AccessibilityObject::documentFrameView() const
 
 void AccessibilityObject::clearChildren()
 {
-    m_haveChildren = false;
     m_children.clear();
+    m_haveChildren = false;
 }
 
 AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
@@ -754,6 +762,53 @@ AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
     return anchorRenderer->document()->axObjectCache()->getOrCreate(anchorRenderer);
 }
     
+void AccessibilityObject::ariaTreeRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole) 
+            result.append(obj);
+
+        // Now see if this item also has rows hiding inside of it.
+        obj->ariaTreeRows(result);
+    }
+}
+    
+void AccessibilityObject::ariaTreeItemContent(AccessibilityChildrenVector& result)
+{
+    // The ARIA tree item content are the item that are not other tree items or their containing groups.
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        AccessibilityRole role = obj->roleValue();
+        if (role == TreeItemRole || role == GroupRole)
+            continue;
+        
+        result.append(obj);
+    }
+}
+
+void AccessibilityObject::ariaTreeItemDisclosedRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole)
+            result.append(obj);
+        // If it's not a tree item, then descend into the group to find more tree items.
+        else 
+            obj->ariaTreeRows(result);
+    }    
+}
+    
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -763,26 +818,44 @@ const String& AccessibilityObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, checkedCheckBoxAction, (AXCheckedCheckBoxActionVerb()));
     DEFINE_STATIC_LOCAL(const String, uncheckedCheckBoxAction, (AXUncheckedCheckBoxActionVerb()));
     DEFINE_STATIC_LOCAL(const String, linkAction, (AXLinkActionVerb()));
+    DEFINE_STATIC_LOCAL(const String, menuListAction, (AXMenuListActionVerb()));
+    DEFINE_STATIC_LOCAL(const String, menuListPopupAction, (AXMenuListPopupActionVerb()));
     DEFINE_STATIC_LOCAL(const String, noAction, ());
 
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    case PopUpButtonRole:
+        return menuListAction;
+    case MenuListPopupRole:
+        return menuListPopupAction;
+    default:
+        return noAction;
     }
 }
  
+const AtomicString& AccessibilityObject::getAttribute(Node* node, const QualifiedName& attribute)
+{
+    if (!node)
+        return nullAtom;
+    
+    if (!node->isElementNode())
+        return nullAtom;
+    
+    Element* element = static_cast<Element*>(node);
+    return element->getAttribute(attribute);
+}
+    
 // Lacking concrete evidence of orientation, horizontal means width > height. vertical is height > width;
 AccessibilityOrientation AccessibilityObject::orientation() const
 {
@@ -794,6 +867,119 @@ AccessibilityOrientation AccessibilityObject::orientation() const
 
     // A tie goes to horizontal.
     return AccessibilityOrientationHorizontal;
+}    
+
+typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
+
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
+static ARIARoleMap* createARIARoleMap()
+{
+    const RoleEntry roles[] = {
+        { "alert", ApplicationAlertRole },
+        { "alertdialog", ApplicationAlertDialogRole },
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
+        { "button", ButtonRole },
+        { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
+        { "dialog", ApplicationDialogRole },
+        { "directory", DirectoryRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "combobox", ComboBoxRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
+        { "rowheader", RowHeaderRole },
+        { "group", GroupRole },
+        { "heading", HeadingRole },
+        { "img", ImageRole },
+        { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
+        { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
+        // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
+        { "math", DocumentMathRole },
+        { "menu", MenuRole },
+        { "menubar", GroupRole },
+        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
+        { "menuitemcheckbox", MenuItemRole },
+        { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
+        { "progressbar", ProgressIndicatorRole },
+        { "radio", RadioButtonRole },
+        { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
+        { "row", RowRole },
+        { "range", SliderRole },
+        { "scrollbar", ScrollBarRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
+        { "slider", SliderRole },
+        { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
+        { "tab", TabRole },
+        { "tablist", TabListRole },
+        { "tabpanel", TabPanelRole },
+        { "text", StaticTextRole },
+        { "textbox", TextAreaRole },
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole },
+        { "tree", TreeRole },
+        { "treegrid", TreeGridRole },
+        { "treeitem", TreeItemRole }
+    };
+    ARIARoleMap* roleMap = new ARIARoleMap;
+    
+    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
+    for (unsigned i = 0; i < numRoles; ++i)
+        roleMap->set(roles[i].ariaRole, roles[i].webcoreRole);
+    return roleMap;
+}
+
+AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value)
+{
+    ASSERT(!value.isEmpty());
+    static const ARIARoleMap* roleMap = createARIARoleMap();
+    return roleMap->get(value);
 }
+
+bool AccessibilityObject::isInsideARIALiveRegion() const
+{
+    if (supportsARIALiveRegion())
+        return true;
+    
+    for (AccessibilityObject* axParent = parentObject(); axParent; axParent = axParent->parentObject()) {
+        if (axParent->supportsARIALiveRegion())
+            return true;
+    }
+    
+    return false;
+}
+
+bool AccessibilityObject::supportsARIAAttributes() const
+{
+    return supportsARIALiveRegion() || supportsARIADragging() || supportsARIADropping() || supportsARIAFlowTo() || supportsARIAOwns();
+}
+    
+bool AccessibilityObject::supportsARIALiveRegion() const
+{
+    const AtomicString& liveRegion = ariaLiveRegionStatus();
+    return equalIgnoringCase(liveRegion, "polite") || equalIgnoringCase(liveRegion, "assertive");
+}
+
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index 8fc40e8..7c52cd5 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -34,13 +34,12 @@
 #include "Range.h"
 #include "VisiblePosition.h"
 #include "VisibleSelection.h"
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#elif PLATFORM(WIN) && !PLATFORM(WINCE)
+#elif PLATFORM(WIN) && !OS(WINCE)
 #include "AccessibilityObjectWrapperWin.h"
 #include "COMPtr.h"
 #elif PLATFORM(CHROMIUM)
@@ -161,7 +160,18 @@ enum AccessibilityRole {
     AnnotationRole,
     SliderThumbRole,
     IgnoredRole,
-    
+    TabRole,
+    TabListRole,
+    TabPanelRole,
+    TreeRole,
+    TreeGridRole,
+    TreeItemRole,
+    DirectoryRole,
+    EditableTextRole,
+    ListItemRole,
+    MenuListPopupRole,
+    MenuListOptionRole,
+
     // ARIA Grouping roles
     LandmarkApplicationRole,
     LandmarkBannerRole,
@@ -171,6 +181,9 @@ enum AccessibilityRole {
     LandmarkNavigationRole,
     LandmarkSearchRole,
     
+    ApplicationAlertRole,
+    ApplicationAlertDialogRole,
+    ApplicationDialogRole,
     ApplicationLogRole,
     ApplicationMarqueeRole,
     ApplicationStatusRole,
@@ -178,6 +191,7 @@ enum AccessibilityRole {
     
     DocumentRole,
     DocumentArticleRole,
+    DocumentMathRole,
     DocumentNoteRole,
     DocumentRegionRole,
     
@@ -189,7 +203,7 @@ enum AccessibilityOrientation {
     AccessibilityOrientationHorizontal,
 };
     
-enum AccessibilityObjectPlatformInclusion {
+enum AccessibilityObjectInclusion {
     IncludeObject,
     IgnoreObject,
     DefaultBehavior,
@@ -225,7 +239,7 @@ struct PlainTextRange {
         , length(l)
     { }
     
-    bool isNull() const { return start == 0 && length == 0; }
+    bool isNull() const { return !start && !length; }
 };
 
 class AccessibilityObject : public RefCounted<AccessibilityObject> {
@@ -237,64 +251,82 @@ public:
         
     typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
     
-    virtual bool isAccessibilityRenderObject() const { return false; };
-    virtual bool isAnchor() const { return false; };
-    virtual bool isAttachment() const { return false; };
-    virtual bool isHeading() const { return false; };
-    virtual bool isLink() const { return false; };
-    virtual bool isImage() const { return false; };
-    virtual bool isNativeImage() const { return false; };
-    virtual bool isImageButton() const { return false; };
-    virtual bool isPasswordField() const { return false; };
-    virtual bool isTextControl() const { return false; };
-    virtual bool isNativeTextControl() const { return false; };
-    virtual bool isWebArea() const { return false; };
-    virtual bool isCheckboxOrRadio() const { return false; };
-    virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isAccessibilityRenderObject() const { return false; }
+    virtual bool isAnchor() const { return false; }
+    virtual bool isAttachment() const { return false; }
+    virtual bool isHeading() const { return false; }
+    virtual bool isLink() const { return false; }
+    virtual bool isImage() const { return false; }
+    virtual bool isNativeImage() const { return false; }
+    virtual bool isImageButton() const { return false; }
+    virtual bool isPasswordField() const { return false; }
+    virtual bool isTextControl() const { return false; }
+    virtual bool isNativeTextControl() const { return false; }
+    virtual bool isWebArea() const { return false; }
+    virtual bool isCheckboxOrRadio() const { return false; }
+    virtual bool isListBox() const { return roleValue() == ListBoxRole; }
     virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
-    virtual bool isFileUploadButton() const { return false; };
+    virtual bool isFileUploadButton() const { return false; }
     virtual bool isInputImage() const { return false; }
-    virtual bool isProgressIndicator() const { return false; };
-    virtual bool isSlider() const { return false; };
-    virtual bool isControl() const { return false; };
-    virtual bool isList() const { return false; };
-    virtual bool isDataTable() const { return false; };
-    virtual bool isTableRow() const { return false; };
-    virtual bool isTableColumn() const { return false; };
-    virtual bool isTableCell() const { return false; };
-    virtual bool isFieldset() const { return false; };
-    virtual bool isGroup() const { return false; };
+    virtual bool isProgressIndicator() const { return false; }
+    virtual bool isSlider() const { return false; }
+    virtual bool isControl() const { return false; }
+    virtual bool isList() const { return false; }
+    virtual bool isDataTable() const { return false; }
+    virtual bool isTableRow() const { return false; }
+    virtual bool isTableColumn() const { return false; }
+    virtual bool isTableCell() const { return false; }
+    virtual bool isFieldset() const { return false; }
+    virtual bool isGroup() const { return false; }
+    virtual bool isARIATreeGridRow() const { return false; }
+    virtual bool isImageMapLink() const { return false; }
+    virtual bool isMenuList() const { return false; }
+    virtual bool isMenuListPopup() const { return false; }
+    virtual bool isMenuListOption() const { return false; }
+    bool isTabList() const { return roleValue() == TabListRole; }
+    bool isTabItem() const { return roleValue() == TabRole; }
     bool isRadioGroup() const { return roleValue() == RadioGroupRole; }
+    bool isComboBox() const { return roleValue() == ComboBoxRole; }
+    bool isTree() const { return roleValue() == TreeRole; }
+    bool isTreeItem() const { return roleValue() == TreeItemRole; }
+    bool isScrollbar() const { return roleValue() == ScrollBarRole; }
+    bool isButton() const { return roleValue() == ButtonRole; }
     
-    virtual bool isChecked() const { return false; };
-    virtual bool isEnabled() const { return false; };
-    virtual bool isSelected() const { return false; };
-    virtual bool isFocused() const { return false; };
-    virtual bool isHovered() const { return false; };
-    virtual bool isIndeterminate() const { return false; };
-    virtual bool isLoaded() const { return false; };
-    virtual bool isMultiSelect() const { return false; };
-    virtual bool isOffScreen() const { return false; };
-    virtual bool isPressed() const { return false; };
-    virtual bool isReadOnly() const { return false; };
-    virtual bool isVisited() const { return false; };
-    virtual bool isRequired() const { return false; };
-
-    virtual bool canSetFocusAttribute() const { return false; };
-    virtual bool canSetTextRangeAttributes() const { return false; };
-    virtual bool canSetValueAttribute() const { return false; };
+    virtual bool isChecked() const { return false; }
+    virtual bool isEnabled() const { return false; }
+    virtual bool isSelected() const { return false; }
+    virtual bool isFocused() const { return false; }
+    virtual bool isHovered() const { return false; }
+    virtual bool isIndeterminate() const { return false; }
+    virtual bool isLoaded() const { return false; }
+    virtual bool isMultiSelectable() const { return false; }
+    virtual bool isOffScreen() const { return false; }
+    virtual bool isPressed() const { return false; }
+    virtual bool isReadOnly() const { return false; }
+    virtual bool isVisited() const { return false; }
+    virtual bool isRequired() const { return false; }
+    virtual bool isLinked() const { return false; }
+    virtual bool isExpanded() const { return false; }
+    virtual bool isVisible() const { return true; }
+    virtual bool isCollapsed() const { return false; }
+    virtual void setIsExpanded(bool) { }
+
+    virtual bool canSetFocusAttribute() const { return false; }
+    virtual bool canSetTextRangeAttributes() const { return false; }
+    virtual bool canSetValueAttribute() const { return false; }
     virtual bool canSetSelectedAttribute() const { return false; }
     virtual bool canSetSelectedChildrenAttribute() const { return false; }
+    virtual bool canSetExpandedAttribute() const { return false; }
     
-    virtual bool hasIntValue() const { return false; };
+    virtual bool hasIntValue() const { return false; }
 
-    bool accessibilityShouldUseUniqueId() const { return true; };
-    virtual bool accessibilityIsIgnored() const  { return true; };
+    bool accessibilityShouldUseUniqueId() const { return true; }
+    virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
     virtual int intValue() const { return 0; }
@@ -303,9 +335,22 @@ public:
     virtual float maxValueForRange() const { return 0.0f; }
     virtual float minValueForRange() const { return 0.0f; }
     virtual AccessibilityObject* selectedRadioButton() { return 0; }
+    virtual AccessibilityObject* selectedTabItem() { return 0; }    
     virtual int layoutCount() const { return 0; }
+    virtual double estimatedLoadingProgress() const { return 0; }
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
+    virtual bool supportsARIAOwns() const { return false; }
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const { }
+    virtual bool supportsARIAFlowTo() const { return false; }
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const { }
+    
+    // ARIA drag and drop
+    virtual bool supportsARIADropping() const { return false; }
+    virtual bool supportsARIADragging() const { return false; }
+    virtual bool isARIAGrabbed() { return false; }
+    virtual void setARIAGrabbed(bool) { }
+    virtual void determineARIADropEffects(Vector<String>&) { }
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const { return 0; }
     virtual AccessibilityObject* focusedUIElement() const { return 0; }
@@ -331,7 +376,6 @@ public:
 
     void setRoleValue(AccessibilityRole role) { m_role = role; }
     virtual AccessibilityRole roleValue() const { return m_role; }
-    virtual String ariaAccessibilityName(const String&) const { return String(); }
     virtual String ariaLabeledByAttribute() const { return String(); }
     virtual String ariaDescribedByAttribute() const { return String(); }
     virtual String accessibilityDescription() const { return String(); }
@@ -370,32 +414,40 @@ public:
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-
+    String language(Node*) const;
+    virtual unsigned hierarchicalLevel() const { return 0; }
+    
     virtual void setFocused(bool) { }
     virtual void setSelectedText(const String&) { }
     virtual void setSelectedTextRange(const PlainTextRange&) { }
     virtual void setValue(const String&) { }
     virtual void setSelected(bool) { }
-
+    virtual void setSelectedRows(AccessibilityChildrenVector&) { }
+    
     virtual void makeRangeVisible(const PlainTextRange&) { }
     virtual bool press() const;
     bool performDefaultAction() const { return press(); }
-
+    
     virtual AccessibilityOrientation orientation() const;
-    virtual void increment() { };
-    virtual void decrement() { };
+    virtual void increment() { }
+    virtual void decrement() { }
 
     virtual void childrenChanged() { }
+    virtual void contentChanged() { }
     virtual const AccessibilityChildrenVector& children() { return m_children; }
     virtual void addChildren() { }
     virtual bool canHaveChildren() const { return true; }
     virtual bool hasChildren() const { return m_haveChildren; }
     virtual void selectedChildren(AccessibilityChildrenVector&) { }
     virtual void visibleChildren(AccessibilityChildrenVector&) { }
+    virtual void tabChildren(AccessibilityChildrenVector&) { }
     virtual bool shouldFocusActiveDescendant() const { return false; }
     virtual AccessibilityObject* activeDescendant() const { return 0; }    
     virtual void handleActiveDescendantChanged() { }
 
+    static AccessibilityRole ariaRoleToWebCoreRole(const String&);
+    static const AtomicString& getAttribute(Node*, const QualifiedName&);
+
     virtual VisiblePositionRange visiblePositionRange() const { return VisiblePositionRange(); }
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const { return VisiblePositionRange(); }
     
@@ -446,6 +498,29 @@ public:
 
     unsigned doAXLineForIndex(unsigned);
 
+    virtual String stringValueForMSAA() const { return String(); }
+    virtual String stringRoleForMSAA() const { return String(); }
+    virtual String nameForMSAA() const { return String(); }
+    virtual String descriptionForMSAA() const { return String(); }
+    virtual AccessibilityRole roleValueForMSAA() const { return roleValue(); }
+
+    // Used by an ARIA tree to get all its rows.
+    void ariaTreeRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get all of its direct rows that it can disclose.
+    void ariaTreeItemDisclosedRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get only its content, and not its child tree items and groups. 
+    void ariaTreeItemContent(AccessibilityChildrenVector&);
+    
+    // ARIA live-region features.
+    bool supportsARIALiveRegion() const;
+    bool isInsideARIALiveRegion() const;
+    virtual const AtomicString& ariaLiveRegionStatus() const { return nullAtom; }
+    virtual const AtomicString& ariaLiveRegionRelevant() const { return nullAtom; }
+    virtual bool ariaLiveRegionAtomic() const { return false; }
+    virtual bool ariaLiveRegionBusy() const { return false; }
+    
+    bool supportsARIAAttributes() const;
+    
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
@@ -459,18 +534,14 @@ public:
 #endif
 #endif
 
-    // a platform-specific method for determining if an attachment is ignored
 #if HAVE(ACCESSIBILITY)
+    // a platform-specific method for determining if an attachment is ignored
     bool accessibilityIgnoreAttachment() const;
-#else
-    bool accessibilityIgnoreAttachment() const { return true; }
-#endif
-
     // gives platforms the opportunity to indicate if and how an object should be included
-#if HAVE(ACCESSIBILITY)
-    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const;
+    AccessibilityObjectInclusion accessibilityPlatformIncludesObject() const;
 #else
-    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
+    bool accessibilityIgnoreAttachment() const { return true; }
+    AccessibilityObjectInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
 #endif
 
     // allows for an AccessibilityObject to update its render tree or perform
@@ -489,7 +560,7 @@ protected:
     
 #if PLATFORM(MAC)
     RetainPtr<AccessibilityObjectWrapper> m_wrapper;
-#elif PLATFORM(WIN) && !PLATFORM(WINCE)
+#elif PLATFORM(WIN) && !OS(WINCE)
     COMPtr<AccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(GTK)
     AtkObject* m_wrapper;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 4c50b9a..8de8e5b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -30,8 +30,8 @@
 #include "AccessibilityRenderObject.h"
 
 #include "AXObjectCache.h"
-#include "AccessibilityListBox.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityListBox.h"
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
@@ -53,6 +53,7 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
+#include "ProgressTracker.h"
 #include "RenderButton.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
@@ -64,9 +65,11 @@
 #include "RenderMenuList.h"
 #include "RenderText.h"
 #include "RenderTextControl.h"
+#include "RenderTextFragment.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "SelectElement.h"
 #include "SelectionController.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -84,6 +87,8 @@ AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
     : AccessibilityObject()
     , m_renderer(renderer)
     , m_ariaRole(UnknownRole)
+    , m_childrenDirty(false)
+    , m_roleForMSAA(UnknownRole)
 {
     updateAccessibilityRole();
 #ifndef NDEBUG
@@ -166,7 +171,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
 
@@ -178,7 +183,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
     
@@ -296,10 +301,10 @@ bool AccessibilityRenderObject::isSlider() const
 bool AccessibilityRenderObject::isMenuRelated() const
 {
     AccessibilityRole role = roleValue();
-    return  role == MenuRole ||
-            role == MenuBarRole ||
-            role == MenuButtonRole ||
-            role == MenuItemRole;
+    return role == MenuRole 
+        || role == MenuBarRole
+        || role == MenuButtonRole
+        || role == MenuItemRole;
 }    
 
 bool AccessibilityRenderObject::isMenu() const
@@ -361,11 +366,21 @@ bool AccessibilityRenderObject::isChecked() const
     if (!m_renderer->node() || !m_renderer->node()->isElementNode())
         return false;
 
+    // First test for native checkedness semantics
     InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
-    if (!inputElement)
+    if (inputElement)
+        return inputElement->isChecked();
+
+    // Else, if this is an ARIA checkbox or radio, respect the aria-checked attribute
+    AccessibilityRole ariaRole = ariaRoleAttribute();
+    if (ariaRole == RadioButtonRole || ariaRole == CheckBoxRole) {
+        if (equalIgnoringCase(getAttribute(aria_checkedAttr), "true"))
+            return true;
         return false;
+    }
 
-    return inputElement->isChecked();
+    // Otherwise it's not checked
+    return false;
 }
 
 bool AccessibilityRenderObject::isHovered() const
@@ -374,9 +389,16 @@ bool AccessibilityRenderObject::isHovered() const
     return m_renderer->node() && m_renderer->node()->hovered();
 }
 
-bool AccessibilityRenderObject::isMultiSelect() const
+bool AccessibilityRenderObject::isMultiSelectable() const
 {
     ASSERT(m_renderer);
+    
+    const AtomicString& ariaMultiSelectable = getAttribute(aria_multiselectableAttr);
+    if (equalIgnoringCase(ariaMultiSelectable, "true"))
+        return true;
+    if (equalIgnoringCase(ariaMultiSelectable, "false"))
+        return false;
+    
     if (!m_renderer->isListBox())
         return false;
     return m_renderer->node() && static_cast<HTMLSelectElement*>(m_renderer->node())->multiple();
@@ -505,18 +527,28 @@ AccessibilityObject* AccessibilityRenderObject::selectedRadioButton()
     }
     return 0;
 }
+
+AccessibilityObject* AccessibilityRenderObject::selectedTabItem()
+{
+    if (!isTabList())
+        return 0;
+    
+    // Find the child tab item that is selected (ie. the intValue == 1).
+    AccessibilityObject::AccessibilityChildrenVector tabs;
+    tabChildren(tabs);
+    
+    int count = tabs.size();
+    for (int i = 0; i < count; ++i) {
+        AccessibilityObject* object = m_children[i].get();
+        if (object->isTabItem() && object->intValue() == 1)
+            return object;
+    }
+    return 0;
+}
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return nullAtom;
-
-    if (!node->isElementNode())
-        return nullAtom;
-
-    Element* element = static_cast<Element*>(node);
-    return element->getAttribute(attribute);
+    return AccessibilityObject::getAttribute(m_renderer->node(), attribute);
 }
 
 Element* AccessibilityRenderObject::anchorElement() const
@@ -578,6 +610,10 @@ Element* AccessibilityRenderObject::actionElement() const
     if (m_renderer->isMenuList())
         return static_cast<Element*>(m_renderer->node());
 
+    AccessibilityRole role = roleValue();
+    if (role == ButtonRole || role == PopUpButtonRole)
+        return static_cast<Element*>(m_renderer->node()); 
+    
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -693,23 +729,46 @@ String AccessibilityRenderObject::helpText() const
     return String();
 }
     
-String AccessibilityRenderObject::language() const
+unsigned AccessibilityRenderObject::hierarchicalLevel() const
 {
     if (!m_renderer)
-        return String();
-    
-    // Defer to parent if this element doesn't have a language set
+        return 0;
+
     Node* node = m_renderer->node();
-    if (!node)
-        return AccessibilityObject::language();
+    if (!node || !node->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(node);
+    String ariaLevel = element->getAttribute(aria_levelAttr);
+    if (!ariaLevel.isEmpty())
+        return ariaLevel.toInt();
     
-    if (!node->isElementNode())
-        return AccessibilityObject::language();
+    // Only tree item will calculate its level through the DOM currently.
+    if (roleValue() != TreeItemRole)
+        return 0;
+    
+    // Hierarchy leveling starts at 0.
+    // We measure tree hierarchy by the number of groups that the item is within.
+    unsigned level = 0;
+    AccessibilityObject* parent = parentObject();
+    while (parent) {
+        AccessibilityRole parentRole = parent->roleValue();
+        if (parentRole == GroupRole)
+            level++;
+        else if (parentRole == TreeRole)
+            break;
+        
+        parent = parent->parentObject();
+    }
     
-    String language = static_cast<Element*>(node)->getAttribute(langAttr);
-    if (language.isEmpty())
-        return AccessibilityObject::language();
-    return language;
+    return level;
+}
+    
+String AccessibilityRenderObject::language() const
+{
+    if (!m_renderer)
+        return String();
+    
+    return AccessibilityObject::language(m_renderer->node());
 }
 
 String AccessibilityRenderObject::textUnderElement() const
@@ -730,6 +789,14 @@ String AccessibilityRenderObject::textUnderElement() const
         }
     }
     
+    // Sometimes text fragments don't have Node's associated with them (like when
+    // CSS content is used to insert text).
+    if (m_renderer->isText()) {
+        RenderText* renderTextObject = toRenderText(m_renderer);
+        if (renderTextObject->isTextFragment())
+            return String(static_cast<RenderTextFragment*>(m_renderer)->contentString());
+    }
+    
     // return the null string for anonymous text because it is non-trivial to get
     // the actual text and, so far, that is not needed
     return String();
@@ -780,7 +847,7 @@ String AccessibilityRenderObject::valueDescription() const
     
 float AccessibilityRenderObject::valueForRange() const
 {
-    if (!isProgressIndicator() && !isSlider())
+    if (!isProgressIndicator() && !isSlider() && !isScrollbar())
         return 0.0f;
 
     return getAttribute(aria_valuenowAttr).toFloat();
@@ -807,11 +874,23 @@ String AccessibilityRenderObject::stringValue() const
     if (!m_renderer || isPasswordField())
         return String();
     
+    if (ariaRoleAttribute() == StaticTextRole)
+        return text();
+        
     if (m_renderer->isText())
         return textUnderElement();
     
-    if (m_renderer->isMenuList())
+    if (m_renderer->isMenuList()) {
+        // RenderMenuList will go straight to the text() of its selected item.
+        // This has to be overriden in the case where the selected item has an aria label
+        SelectElement* selectNode = toSelectElement(static_cast<Element*>(m_renderer->node()));
+        Element* selectedOption = selectNode->listItems()[selectNode->selectedIndex()];
+        String overridenDescription = AccessibilityObject::getAttribute(selectedOption, aria_labelAttr);
+        if (!overridenDescription.isNull())
+            return overridenDescription;
+        
         return toRenderMenuList(m_renderer)->text();
+    }
     
     if (m_renderer->isListMarker())
         return toRenderListMarker(m_renderer)->text();
@@ -864,56 +943,67 @@ static String accessibleNameForNode(Node* node)
     return String();
 }
 
-String AccessibilityRenderObject::ariaAccessibilityName(const String& s) const
+String AccessibilityRenderObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
+{
+    Vector<UChar> ariaLabel;
+    unsigned size = elements.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Element* idElement = elements[i];
+        
+        String nameFragment = accessibleNameForNode(idElement);
+        ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
+            nameFragment = accessibleNameForNode(n);
+            ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        }
+            
+        if (i != size - 1)
+            ariaLabel.append(' ');
+    }
+    return String::adopt(ariaLabel);
+}
+
+    
+void AccessibilityRenderObject::elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& attribute) const
 {
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+
     Document* document = m_renderer->document();
     if (!document)
-        return String();
-
-    String idList = s;
+        return;
+    
+    String idList = getAttribute(attribute).string();
+    if (idList.isEmpty())
+        return;
+    
     idList.replace('\n', ' ');
     Vector<String> idVector;
     idList.split(' ', idVector);
-
-    Vector<UChar> ariaLabel;
+    
     unsigned size = idVector.size();
     for (unsigned i = 0; i < size; ++i) {
         String idName = idVector[i];
         Element* idElement = document->getElementById(idName);
-        if (idElement) {
-            String nameFragment = accessibleNameForNode(idElement);
-            ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
-                nameFragment = accessibleNameForNode(n);
-                ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            }
-            
-            if (i != size - 1)
-                ariaLabel.append(' ');
-        }
+        if (idElement)
+            elements.append(idElement);
     }
-    return String::adopt(ariaLabel);
 }
-
+    
+void AccessibilityRenderObject::ariaLabeledByElements(Vector<Element*>& elements) const
+{
+    elementsFromAttribute(elements, aria_labeledbyAttr);
+    if (!elements.size())
+        elementsFromAttribute(elements, aria_labelledbyAttr);
+}
+   
 String AccessibilityRenderObject::ariaLabeledByAttribute() const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return String();
-
-    if (!node->isElementNode())
-        return String();
-
-    // The ARIA spec uses the British spelling: "labelled." It seems prudent to support the American
-    // spelling ("labeled") as well.
-    String idList = getAttribute(aria_labeledbyAttr).string();
-    if (idList.isEmpty()) {
-        idList = getAttribute(aria_labelledbyAttr).string();
-        if (idList.isEmpty())
-            return String();
-    }
-
-    return ariaAccessibilityName(idList);
+    Vector<Element*> elements;
+    ariaLabeledByElements(elements);
+    
+    return accessibilityDescriptionForElements(elements);
 }
 
 static HTMLLabelElement* labelForElement(Element* element)
@@ -990,6 +1080,8 @@ String AccessibilityRenderObject::title() const
         || ariaRole == MenuItemRole
         || ariaRole == MenuButtonRole
         || ariaRole == RadioButtonRole
+        || ariaRole == CheckBoxRole
+        || ariaRole == TabRole
         || isHeading())
         return textUnderElement();
     
@@ -1001,11 +1093,10 @@ String AccessibilityRenderObject::title() const
 
 String AccessibilityRenderObject::ariaDescribedByAttribute() const
 {
-    String idList = getAttribute(aria_describedbyAttr).string();
-    if (idList.isEmpty())
-        return String();
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_describedbyAttr);
     
-    return ariaAccessibilityName(idList);
+    return accessibilityDescriptionForElements(elements);
 }
 
 String AccessibilityRenderObject::accessibilityDescription() const
@@ -1032,7 +1123,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
     }
     
     if (isWebArea()) {
-        Document *document = m_renderer->document();
+        Document* document = m_renderer->document();
         Node* owner = document->ownerElement();
         if (owner) {
             if (owner->hasTagName(frameTag) || owner->hasTagName(iframeTag)) {
@@ -1048,12 +1139,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
         if (owner && owner->isHTMLElement())
             return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
     }
-    
-    if (roleValue() == DefinitionListTermRole)
-        return AXDefinitionListTermText();
-    if (roleValue() == DefinitionListDefinitionRole)
-        return AXDefinitionListDefinitionText();
-    
+
     return String();
 }
 
@@ -1068,7 +1154,10 @@ IntRect AccessibilityRenderObject::boundingBoxRect() const
         obj = obj->node()->renderer();
     
     Vector<FloatQuad> quads;
-    obj->absoluteQuads(quads);
+    if (obj->isText())
+        obj->absoluteQuads(quads);
+    else
+        obj->absoluteFocusRingQuads(quads);
     const size_t n = quads.size();
     if (!n)
         return IntRect();
@@ -1198,6 +1287,8 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
 // or an internal anchor connection
 void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& linkedUIElements) const
 {
+    ariaFlowToElements(linkedUIElements);
+
     if (isAnchor()) {
         AccessibilityObject* linkedAXElement = internalLinkElement();
         if (linkedAXElement)
@@ -1208,6 +1299,71 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::hasTextAlternative() const
+{
+    // ARIA: section 2A, bullet #3 says if aria-labeledby or aria-label appears, it should
+    // override the "label" element association.
+    if (!ariaLabeledByAttribute().isEmpty() || !getAttribute(aria_labelAttr).string().isEmpty())
+        return true;
+        
+    return false;   
+}
+    
+bool AccessibilityRenderObject::supportsARIAFlowTo() const
+{
+    return !getAttribute(aria_flowtoAttr).string().isEmpty();
+}
+    
+void AccessibilityRenderObject::ariaFlowToElements(AccessibilityChildrenVector& flowTo) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_flowtoAttr);
+    
+    AXObjectCache* cache = axObjectCache();
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* flowToElement = cache->getOrCreate(element->renderer());
+        if (flowToElement)
+            flowTo.append(flowToElement);
+    }
+        
+}
+    
+bool AccessibilityRenderObject::supportsARIADropping() const 
+{
+    const AtomicString& dropEffect = getAttribute(aria_dropeffectAttr).string();
+    return !dropEffect.isEmpty();
+}
+
+bool AccessibilityRenderObject::supportsARIADragging() const
+{
+    const AtomicString& grabbed = getAttribute(aria_grabbedAttr).string();
+    return equalIgnoringCase(grabbed, "true") || equalIgnoringCase(grabbed, "false");   
+}
+
+bool AccessibilityRenderObject::isARIAGrabbed()
+{
+    return elementAttributeValue(aria_grabbedAttr);
+}
+
+void AccessibilityRenderObject::setARIAGrabbed(bool grabbed)
+{
+    setElementAttributeValue(aria_grabbedAttr, grabbed);
+}
+
+void AccessibilityRenderObject::determineARIADropEffects(Vector<String>& effects)
+{
+    String dropEffects = getAttribute(aria_dropeffectAttr).string();
+    if (dropEffects.isEmpty()) {
+        effects.clear();
+        return;
+    }
+    
+    dropEffects.replace('\n', ' ');
+    dropEffects.split(' ', effects);
+}
+    
 bool AccessibilityRenderObject::exposesTitleUIElement() const
 {
     if (!isControl())
@@ -1217,6 +1373,9 @@ bool AccessibilityRenderObject::exposesTitleUIElement() const
     if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
         return false;
     
+    if (hasTextAlternative())
+        return false;
+    
     return true;
 }
     
@@ -1242,13 +1401,13 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     
 bool AccessibilityRenderObject::ariaIsHidden() const
 {
-    if (equalIgnoringCase(getAttribute(aria_hiddenAttr).string(), "true"))
+    if (equalIgnoringCase(getAttribute(aria_hiddenAttr), "true"))
         return true;
     
     // aria-hidden hides this object and any children
     AccessibilityObject* object = parentObject();
     while (object) {
-        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr).string(), "true"))
+        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr), "true"))
             return true;
         object = object->parentObject();
     }
@@ -1256,29 +1415,86 @@ bool AccessibilityRenderObject::ariaIsHidden() const
     return false;
 }
 
-bool AccessibilityRenderObject::accessibilityIsIgnored() const
+bool AccessibilityRenderObject::isDescendantOfBarrenParent() const
 {
-    // is the platform is interested in this object?
-    AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
-    if (decision == IncludeObject)
-        return false;
-    if (decision == IgnoreObject)
-        return true;
-    // the decision must, therefore, be DefaultBehavior.
-
-    // ignore invisible element
+    for (AccessibilityObject* object = parentObject(); object; object = object->parentObject()) {
+        if (!object->canHaveChildren())
+            return true;
+    }
+    
+    return false;
+}
+    
+bool AccessibilityRenderObject::isAllowedChildOfTree() const
+{
+    // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
+    AccessibilityObject* axObj = parentObject();
+    bool isInTree = false;
+    while (axObj) {
+        if (axObj->isTree()) {
+            isInTree = true;
+            break;
+        }
+        axObj = axObj->parentObject();
+    }
+    
+    // If the object is in a tree, only tree items should be exposed (and the children of tree items).
+    if (isInTree) {
+        AccessibilityRole role = roleValue();
+        if (role != TreeItemRole && role != StaticTextRole)
+            return false;
+    }
+    return true;
+}
+    
+AccessibilityObjectInclusion AccessibilityRenderObject::accessibilityIsIgnoredBase() const
+{
+    // The following cases can apply to any element that's a subclass of AccessibilityRenderObject.
+    
+    // Ignore invisible elements.
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
-        return true;
+        return IgnoreObject;
 
+    // Anything marked as aria-hidden or a child of something aria-hidden must be hidden.
     if (ariaIsHidden())
-        return true;
+        return IgnoreObject;
     
+    // Anything that is a presentational role must be hidden.
     if (isPresentationalChildOfAriaRole())
-        return true;
+        return IgnoreObject;
+
+    // Allow the platform to make a decision.
+    AccessibilityObjectInclusion decision = accessibilityPlatformIncludesObject();
+    if (decision == IncludeObject)
+        return IncludeObject;
+    if (decision == IgnoreObject)
+        return IgnoreObject;
         
+    return DefaultBehavior;
+}  
+ 
+bool AccessibilityRenderObject::accessibilityIsIgnored() const
+{
+    // Check first if any of the common reasons cause this element to be ignored.
+    // Then process other use cases that need to be applied to all the various roles
+    // that AccessibilityRenderObjects take on.
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    // If this element is within a parent that cannot have children, it should not be exposed.
+    if (isDescendantOfBarrenParent())
+        return true;    
+    
     if (roleValue() == IgnoredRole)
         return true;
     
+    // An ARIA tree can only have tree items and static text as children.
+    if (!isAllowedChildOfTree())
+        return true;
+    
     // ignore popup menu items because AppKit does
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
         if (parent->isMenuList())
@@ -1288,7 +1504,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AccessibilityObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->exposesTitleUIElement())
+    if (controlObject && !controlObject->exposesTitleUIElement() && controlObject->isCheckboxOrRadio())
         return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
@@ -1300,8 +1516,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // NOTE: BRs always have text boxes now, so the text box check here can be removed
     if (m_renderer->isText()) {
         // static text beneath MenuItems and MenuButtons are just reported along with the menu item, so it's ignored on an individual level
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
-            parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
+        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole
+            || parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
         RenderText* renderText = toRenderText(m_renderer);
         if (m_renderer->isBR() || !renderText->firstTextBox())
@@ -1321,11 +1537,28 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isControl())
         return false;
     
+    if (ariaRole != UnknownRole)
+        return false;
+    
     // don't ignore labels, because they serve as TitleUIElements
     Node* node = m_renderer->node();
     if (node && node->hasTagName(labelTag))
         return false;
     
+    // Anything that is content editable should not be ignored.
+    // However, one cannot just call node->isContentEditable() since that will ask if its parents
+    // are also editable. Only the top level content editable region should be exposed.
+    if (node && node->isElementNode()) {
+        Element* element = static_cast<Element*>(node);
+        const AtomicString& contentEditable = element->getAttribute(contenteditableAttr);
+        if (equalIgnoringCase(contentEditable, "true"))
+            return false;
+    }
+    
+    // if this element has aria attributes on it, it should not be ignored.
+    if (supportsARIAAttributes())
+        return false;
+    
     if (m_renderer->isBlockFlow() && m_renderer->childrenInline())
         return !toRenderBlock(m_renderer)->firstLineBox() && !mouseButtonListener();
     
@@ -1364,9 +1597,6 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     }
     
-    if (ariaRole != UnknownRole)
-        return false;
-    
     // make a platform-specific decision
     if (isAttachment())
         return accessibilityIgnoreAttachment();
@@ -1379,6 +1609,21 @@ bool AccessibilityRenderObject::isLoaded() const
     return !m_renderer->document()->tokenizer();
 }
 
+double AccessibilityRenderObject::estimatedLoadingProgress() const
+{
+    if (!m_renderer)
+        return 0;
+    
+    if (isLoaded())
+        return 1.0;
+    
+    Page* page = m_renderer->document()->page();
+    if (!page)
+        return 0;
+    
+    return page->progress()->estimatedProgress();
+}
+    
 int AccessibilityRenderObject::layoutCount() const
 {
     if (!m_renderer->isRenderView())
@@ -1388,6 +1633,10 @@ int AccessibilityRenderObject::layoutCount() const
 
 String AccessibilityRenderObject::text() const
 {
+    // If this is a user defined static text, use the accessible name computation.
+    if (ariaRoleAttribute() == StaticTextRole)
+        return accessibilityDescription();
+    
     if (!isTextControl() || isPasswordField())
         return String();
     
@@ -1545,6 +1794,51 @@ bool AccessibilityRenderObject::isVisited() const
     return m_renderer->style()->pseudoState() == PseudoVisited;
 }
     
+bool AccessibilityRenderObject::isExpanded() const
+{
+    if (equalIgnoringCase(getAttribute(aria_expandedAttr).string(), "true"))
+        return true;
+    
+    return false;  
+}
+
+void AccessibilityRenderObject::setElementAttributeValue(const QualifiedName& attributeName, bool value)
+{
+    if (!m_renderer)
+        return;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+    
+    Element* element = static_cast<Element*>(node);
+    element->setAttribute(attributeName, (value) ? "true" : "false");        
+}
+    
+bool AccessibilityRenderObject::elementAttributeValue(const QualifiedName& attributeName) const
+{
+    if (!m_renderer)
+        return false;
+    
+    return equalIgnoringCase(getAttribute(attributeName), "true");
+}
+    
+void AccessibilityRenderObject::setIsExpanded(bool isExpanded)
+{
+    // Combo boxes, tree items and rows can be expanded (in different ways on different platforms).
+    // That action translates into setting the aria-expanded attribute to true.
+    AccessibilityRole role = roleValue();
+    switch (role) {
+    case ComboBoxRole:
+    case TreeItemRole:
+    case RowRole:
+        setElementAttributeValue(aria_expandedAttr, isExpanded);
+        break;
+    default:
+        break;
+    }
+}
+    
 bool AccessibilityRenderObject::isRequired() const
 {
     if (equalIgnoringCase(getAttribute(aria_requiredAttr).string(), "true"))
@@ -1562,9 +1856,56 @@ bool AccessibilityRenderObject::isSelected() const
     if (!node)
         return false;
     
+    String ariaSelected = getAttribute(aria_selectedAttr).string();
+    if (equalIgnoringCase(ariaSelected, "true"))
+        return true;    
+    
+    if (isTabItem() && isTabItemSelected())
+        return true;
+
     return false;
 }
 
+bool AccessibilityRenderObject::isTabItemSelected() const
+{
+    if (!isTabItem() || !m_renderer)
+        return false;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return false;
+    
+    // The ARIA spec says a tab item can also be selected if it is aria-labeled by a tabpanel
+    // that has keyboard focus inside of it, or if a tabpanel in its aria-controls list has KB
+    // focus inside of it.
+    AccessibilityObject* focusedElement = focusedUIElement();
+    if (!focusedElement)
+        return false;
+    
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_controlsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element->renderer());
+
+        // A tab item should only control tab panels.
+        if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
+            continue;
+        
+        AccessibilityObject* checkFocusElement = focusedElement;
+        // Check if the focused element is a descendant of the element controlled by the tab item.
+        while (checkFocusElement) {
+            if (tabPanel == checkFocusElement)
+                return true;
+            checkFocusElement = checkFocusElement->parentObject();
+        }
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::isFocused() const
 {
     if (!m_renderer)
@@ -1580,8 +1921,8 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->node() || 
-        (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
+    if (focusedNode == m_renderer->node()
+        || (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
     return false;
@@ -1613,6 +1954,27 @@ void AccessibilityRenderObject::changeValueByPercent(float percentChange)
     axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
 }
     
+void AccessibilityRenderObject::setSelected(bool enabled)
+{
+    setElementAttributeValue(aria_selectedAttr, enabled);
+}
+
+void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& selectedRows)
+{
+    // Setting selected only makes sense in trees and tables (and tree-tables).
+    AccessibilityRole role = roleValue();
+    if (role != TreeRole && role != TreeGridRole && role != TableRole)
+        return;
+    
+    bool isMulti = isMultiSelectable();
+    unsigned count = selectedRows.size();
+    if (count > 1 && !isMulti)
+        count = 1;
+    
+    for (unsigned k = 0; k < count; ++k)
+        selectedRows[k]->setSelected(true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
     if (!m_renderer)
@@ -1632,6 +1994,29 @@ void AccessibilityRenderObject::setValue(const String& string)
     }
 }
 
+void AccessibilityRenderObject::ariaOwnsElements(AccessibilityChildrenVector& axObjects) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_ownsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        RenderObject* render = elements[k]->renderer();
+        AccessibilityObject* obj = axObjectCache()->getOrCreate(render);
+        if (obj)
+            axObjects.append(obj);
+    }
+}
+
+bool AccessibilityRenderObject::supportsARIAOwns() const
+{
+    if (!m_renderer)
+        return false;
+    const AtomicString& ariaOwns = getAttribute(aria_ownsAttr).string();
+
+    return !ariaOwns.isEmpty();
+}
+    
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
@@ -1653,6 +2038,8 @@ RenderView* AccessibilityRenderObject::topRenderer() const
 
 Document* AccessibilityRenderObject::document() const
 {
+    if (!m_renderer)
+        return 0;
     return m_renderer->document();
 }
 
@@ -1676,24 +2063,14 @@ AXObjectCache* AccessibilityRenderObject::axObjectCache() const
 AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(HTMLMapElement* map) const
 {
     // find an image that is using this map
-    if (!m_renderer || !map)
+    if (!map)
         return 0;
 
-    String mapName = map->getName().string().lower();
-    RefPtr<HTMLCollection> coll = m_renderer->document()->images();
-    for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
-        RenderObject* obj = curr->renderer();
-        if (!obj || !curr->hasTagName(imgTag))
-            continue;
-        
-        // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
-        // which has to be stripped off
-        String useMapName = static_cast<HTMLImageElement*>(curr)->getAttribute(usemapAttr).string().substring(1).lower();
-        if (useMapName == mapName)
-            return axObjectCache()->getOrCreate(obj);
-    }
+    HTMLImageElement* imageElement = map->imageElement();
+    if (!imageElement)
+        return 0;
     
-    return 0;
+    return axObjectCache()->getOrCreate(imageElement->renderer());
 }
     
 void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& result)
@@ -1777,7 +2154,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
 
 VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsigned lineCount) const
 {
-    if (lineCount == 0 || !m_renderer)
+    if (!lineCount || !m_renderer)
         return VisiblePositionRange();
     
     // iterate over the lines
@@ -1785,7 +2162,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // last offset of the last line
     VisiblePosition visiblePos = m_renderer->document()->renderer()->positionForCoordinates(0, 0);
     VisiblePosition savedVisiblePos;
-    while (--lineCount != 0) {
+    while (--lineCount) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -1900,9 +2277,8 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         return;
     
     // make selection and tell the document to use it. if it's zero length, then move to that position
-    if (range.start == range.end) {
+    if (range.start == range.end)
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
-    }
     else {
         VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
@@ -1998,7 +2374,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // iterate to the specified line
     VisiblePosition visiblePos = visiblePositionForIndex(0);
     VisiblePosition savedVisiblePos;
-    for (unsigned lineCount = lineNumber; lineCount != 0; lineCount -= 1) {
+    for (unsigned lineCount = lineNumber; lineCount; lineCount -= 1) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -2053,8 +2429,8 @@ String AccessibilityRenderObject::doAXStringForRange(const PlainTextRange& range
     if (isPasswordField())
         return String();
     
-    if (range.length == 0)
-        return "";
+    if (!range.length)
+        return String();
     
     if (!isTextControl())
         return String();
@@ -2081,7 +2457,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     if (!area)
         return 0;
     
-    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parent());
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;
@@ -2115,14 +2491,21 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     if (node->hasTagName(areaTag)) 
         return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
     
+    if (node->hasTagName(optionTag))
+        node = static_cast<HTMLOptionElement*>(node)->ownerSelectElement();
+    
     RenderObject* obj = node->renderer();
     if (!obj)
         return 0;
     
     AccessibilityObject* result = obj->document()->axObjectCache()->getOrCreate(obj);
 
-    if (obj->isListBox())
-        return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
+    if (obj->isListBox()) {
+        // Make sure the children are initialized so that hit testing finds the right element.
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(result);
+        listBox->updateChildrenIfNecessary();
+        return listBox->doAccessibilityHitTest(point);
+    }
         
     if (result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
@@ -2159,14 +2542,14 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
     case ProgressIndicatorRole:
     case ToolbarRole:
     case OutlineRole:
+    case TreeRole:
+    case GridRole:
     /* FIXME: replace these with actual roles when they are added to AccessibilityRole
     composite
     alert
     alertdialog
-    grid
     status
     timer
-    tree
     */
         return true;
     default:
@@ -2176,19 +2559,22 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->node() && !renderer()->node()->isElementNode())
+    if (!m_renderer)
         return 0;
-    Element* element = static_cast<Element*>(renderer()->node());
+    
+    if (m_renderer->node() && !m_renderer->node()->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(m_renderer->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
         return 0;
     
-    Element* target = renderer()->document()->getElementById(activeDescendantAttrStr);
+    Element* target = document()->getElementById(activeDescendantAttrStr);
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
+    AccessibilityObject* obj = axObjectCache()->getOrCreate(target->renderer());
     if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -2207,7 +2593,7 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
+        doc->axObjectCache()->postNotification(m_renderer, AXObjectCache::AXActiveDescendantChanged, true);
 }
 
 AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
@@ -2247,80 +2633,6 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
     return 0;
 }
-    
-typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
-
-struct RoleEntry {
-    String ariaRole;
-    AccessibilityRole webcoreRole;
-};
-
-static const ARIARoleMap& createARIARoleMap()
-{
-    const RoleEntry roles[] = {
-        { "application", LandmarkApplicationRole },
-        { "article", DocumentArticleRole },
-        { "banner", LandmarkBannerRole },
-        { "button", ButtonRole },
-        { "checkbox", CheckBoxRole },
-        { "complementary", LandmarkComplementaryRole },
-        { "contentinfo", LandmarkContentInfoRole },
-        { "grid", TableRole },
-        { "gridcell", CellRole },
-        { "columnheader", ColumnHeaderRole },
-        { "definition", DefinitionListDefinitionRole },
-        { "document", DocumentRole },
-        { "rowheader", RowHeaderRole },
-        { "group", GroupRole },
-        { "heading", HeadingRole },
-        { "img", ImageRole },
-        { "link", WebCoreLinkRole },
-        { "list", ListRole },        
-        { "listitem", GroupRole },        
-        { "listbox", ListBoxRole },
-        { "log", ApplicationLogRole },
-        // "option" isn't here because it may map to different roles depending on the parent element's role
-        { "main", LandmarkMainRole },
-        { "marquee", ApplicationMarqueeRole },
-        { "menu", MenuRole },
-        { "menubar", GroupRole },
-        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
-        { "menuitemcheckbox", MenuItemRole },
-        { "menuitemradio", MenuItemRole },
-        { "note", DocumentNoteRole },
-        { "navigation", LandmarkNavigationRole },
-        { "option", ListBoxOptionRole },
-        { "presentation", IgnoredRole },
-        { "progressbar", ProgressIndicatorRole },
-        { "radio", RadioButtonRole },
-        { "radiogroup", RadioGroupRole },
-        { "region", DocumentRegionRole },
-        { "row", RowRole },
-        { "range", SliderRole },
-        { "search", LandmarkSearchRole },
-        { "separator", SplitterRole },
-        { "slider", SliderRole },
-        { "spinbutton", ProgressIndicatorRole },
-        { "status", ApplicationStatusRole },
-        { "textbox", TextAreaRole },
-        { "timer", ApplicationTimerRole },
-        { "toolbar", ToolbarRole },
-        { "tooltip", UserInterfaceTooltipRole }
-    };
-    ARIARoleMap& roleMap = *new ARIARoleMap;
-        
-    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
-    for (unsigned i = 0; i < numRoles; ++i)
-        roleMap.set(roles[i].ariaRole, roles[i].webcoreRole);
-    return roleMap;
-}
-
-static AccessibilityRole ariaRoleToWebCoreRole(String value)
-{
-    ASSERT(!value.isEmpty() && !value.isNull());
-    static const ARIARoleMap& roleMap = createARIARoleMap();
-    return roleMap.get(value);
-}
 
 AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
 {
@@ -2329,17 +2641,21 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
         return UnknownRole;
     
     AccessibilityRole role = ariaRoleToWebCoreRole(ariaRole);
+
+    if (role == ButtonRole && elementAttributeValue(aria_haspopupAttr))
+        role = PopUpButtonRole;
+    
     if (role)
         return role;
     // selects and listboxes both have options as child roles, but they map to different roles within WebCore
-    if (equalIgnoringCase(ariaRole,"option")) {
+    if (equalIgnoringCase(ariaRole, "option")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
             return MenuItemRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == ListBoxRole)
             return ListBoxOptionRole;
     }
     // an aria "menuitem" may map to MenuButton or MenuItem depending on its parent
-    if (equalIgnoringCase(ariaRole,"menuitem")) {
+    if (equalIgnoringCase(ariaRole, "menuitem")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == GroupRole)
             return MenuButtonRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
@@ -2418,7 +2734,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel() != 0)
+    if (headingLevel())
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2429,19 +2745,43 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 
     if (node && (node->hasTagName(rpTag) || node->hasTagName(rtTag)))
         return AnnotationRole;
-    
+
+#if PLATFORM(GTK)
+    // Gtk ATs expect all tables, data and layout, to be exposed as tables.
+    if (node && (node->hasTagName(tdTag) || node->hasTagName(thTag)))
+        return CellRole;
+
+    if (node && node->hasTagName(trTag))
+        return RowRole;
+
+    if (node && node->hasTagName(tableTag))
+        return TableRole;
+#endif   
+
     if (m_renderer->isBlockFlow() || (node && node->hasTagName(labelTag)))
         return GroupRole;
     
     return UnknownRole;
 }
 
+AccessibilityOrientation AccessibilityRenderObject::orientation() const
+{
+    const AtomicString& ariaOrientation = getAttribute(aria_orientationAttr).string();
+    if (equalIgnoringCase(ariaOrientation, "horizontal"))
+        return AccessibilityOrientationHorizontal;
+    if (equalIgnoringCase(ariaOrientation, "vertical"))
+        return AccessibilityOrientationVertical;
+    
+    return AccessibilityObject::orientation();
+}
+    
 bool AccessibilityRenderObject::isPresentationalChildOfAriaRole() const
 {
     // Walk the parent chain looking for a parent that has presentational children
     AccessibilityObject* parent;
     for (parent = parentObject(); parent && !parent->ariaRoleHasPresentationalChildren(); parent = parent->parentObject())
-        ;
+    { }
+    
     return parent;
 }
     
@@ -2474,30 +2814,36 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         return false;
 
     switch (roleValue()) {
-        case WebCoreLinkRole:
-        case ImageMapLinkRole:
-        case TextFieldRole:
-        case TextAreaRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case SliderRole:
-            return true;
-        default:
-            return false;
+    case WebCoreLinkRole:
+    case ImageMapLinkRole:
+    case TextFieldRole:
+    case TextAreaRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case SliderRole:
+        return true;
+    default:
+        return node->supportsFocus();
     }
 }
+    
+bool AccessibilityRenderObject::canSetExpandedAttribute() const
+{
+    // An object can be expanded if it aria-expanded is true or false.
+    String ariaExpanded = getAttribute(aria_expandedAttr).string();
+    return equalIgnoringCase(ariaExpanded, "true") || equalIgnoringCase(ariaExpanded, "false");
+}
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
     if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
         return false;
 
-    if (isWebArea() || isTextControl()) 
-        return !isReadOnly();
-
-    return isProgressIndicator() || isSlider();
+    // Any node could be contenteditable, so isReadOnly should be relied upon
+    // for this information for all elements.
+    return isProgressIndicator() || isSlider() || !isReadOnly();
 }
 
 bool AccessibilityRenderObject::canSetTextRangeAttributes() const
@@ -2505,22 +2851,50 @@ bool AccessibilityRenderObject::canSetTextRangeAttributes() const
     return isTextControl();
 }
 
+void AccessibilityRenderObject::contentChanged()
+{
+    // If this element supports ARIA live regions, then notify the AT of changes.
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (!parent)
+            continue;
+        
+        // If we find a parent that has ARIA live region on, send the notification and stop processing.
+        // The spec does not talk about nested live regions.
+        if (parent->supportsARIALiveRegion()) {
+            axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
+            break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::childrenChanged()
 {
     // this method is meant as a quick way of marking dirty
     // a portion of the accessibility tree
     
-    markChildrenDirty();
-    
     if (!m_renderer)
         return;
     
     // Go up the render parent chain, marking children as dirty.
     // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
-    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+    // At the same time, process ARIA live region changes.
+    for (RenderObject* renderParent = m_renderer; renderParent; renderParent = renderParent->parent()) {
         AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
-        if (parent && parent->isAccessibilityRenderObject())
-            static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
+        if (!parent || !parent->isAccessibilityRenderObject())
+            continue;
+        
+        AccessibilityRenderObject* axParent = static_cast<AccessibilityRenderObject*>(parent);
+        // Only do work if the children haven't been marked dirty. This has the effect of blocking
+        // future live region change notifications until the AX tree has been accessed again. This
+        // is a good performance win for all parties.
+        if (!axParent->needsToUpdateChildren()) {
+            axParent->setNeedsToUpdateChildren();
+            
+            // If this element supports ARIA live regions, then notify the AT of changes.
+            if (axParent->supportsARIALiveRegion())
+                axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
+        }
     }
 }
     
@@ -2531,28 +2905,40 @@ bool AccessibilityRenderObject::canHaveChildren() const
     
     // Elements that should not have children
     switch (roleValue()) {
-        case ImageRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case StaticTextRole:
-        case ListBoxOptionRole:
-            return false;
-        default:
-            return true;
+    case ImageRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case TabRole:
+    case StaticTextRole:
+    case ListBoxOptionRole:
+    case ScrollBarRole:
+        return false;
+    default:
+        return true;
     }
 }
 
-const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
+void AccessibilityRenderObject::clearChildren()
+{
+    AccessibilityObject::clearChildren();
+    m_childrenDirty = false;
+}
+    
+void AccessibilityRenderObject::updateChildrenIfNecessary()
 {
-    if (m_childrenDirty) {
+    if (needsToUpdateChildren())
         clearChildren();        
-        m_childrenDirty = false;
-    }
     
-    if (!m_haveChildren)
-        addChildren();
+    if (!hasChildren())
+        addChildren();    
+}
+    
+const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
+{
+    updateChildrenIfNecessary();
+    
     return m_children;
 }
 
@@ -2603,18 +2989,91 @@ void AccessibilityRenderObject::addChildren()
         }
     }
 }
+        
+const AtomicString& AccessibilityRenderObject::ariaLiveRegionStatus() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusAssertive, ("assertive"));
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusPolite, ("polite"));
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusOff, ("off"));
+    
+    const AtomicString& liveRegionStatus = getAttribute(aria_liveAttr);
+    // These roles have implicit live region status.
+    if (liveRegionStatus.isEmpty()) {
+        switch (roleValue()) {
+        case ApplicationAlertDialogRole:
+        case ApplicationAlertRole:
+            return liveRegionStatusAssertive;
+        case ApplicationLogRole:
+        case ApplicationStatusRole:
+            return liveRegionStatusPolite;
+        case ApplicationTimerRole:
+            return liveRegionStatusOff;
+        default:
+            break;
+        }
+    }
+
+    return liveRegionStatus;
+}
+
+const AtomicString& AccessibilityRenderObject::ariaLiveRegionRelevant() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, defaultLiveRegionRelevant, ("additions text"));
+    const AtomicString& relevant = getAttribute(aria_relevantAttr);
 
+    // Default aria-relevant = "additions text".
+    if (relevant.isEmpty())
+        return defaultLiveRegionRelevant;
+    
+    return relevant;
+}
+
+bool AccessibilityRenderObject::ariaLiveRegionAtomic() const
+{
+    return elementAttributeValue(aria_atomicAttr);    
+}
+
+bool AccessibilityRenderObject::ariaLiveRegionBusy() const
+{
+    return elementAttributeValue(aria_busyAttr);    
+}
+    
+void AccessibilityRenderObject::ariaSelectedRows(AccessibilityChildrenVector& result)
+{
+    // Get all the rows. 
+    AccessibilityChildrenVector allRows;
+    ariaTreeRows(allRows);
+
+    // Determine which rows are selected.
+    bool isMulti = isMultiSelectable();
+
+    // Prefer active descendant over aria-selected.
+    AccessibilityObject* activeDesc = activeDescendant();
+    if (activeDesc && (activeDesc->isTreeItem() || activeDesc->isTableRow())) {
+        result.append(activeDesc);    
+        if (!isMulti)
+            return;
+    }
+
+    unsigned count = allRows.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (allRows[k]->isSelected()) {
+            result.append(allRows[k]);
+            if (!isMulti)
+                break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildrenVector& result)
 {
     AccessibilityObject* child = firstChild();
-    bool isMultiselectable = false;
     
     Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
-    String multiselectablePropertyStr = element->getAttribute("aria-multiselectable").string();
-    isMultiselectable = equalIgnoringCase(multiselectablePropertyStr, "true");
+    bool isMulti = isMultiSelectable();
     
     while (child) {
         // every child should have aria-role option, and if so, check for selected attribute/state
@@ -2625,10 +3084,10 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (childRenderer && ariaRole == ListBoxOptionRole) {
             Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
-                String selectedAttrString = childElement->getAttribute("aria-selected").string();
+                String selectedAttrString = childElement->getAttribute(aria_selectedAttr).string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
                     result.append(child);
-                    if (isMultiselectable)
+                    if (isMulti)
                         return;
                 }
             }
@@ -2642,11 +3101,11 @@ void AccessibilityRenderObject::selectedChildren(AccessibilityChildrenVector& re
     ASSERT(result.isEmpty());
 
     // only listboxes should be asked for their selected children. 
-    if (ariaRoleAttribute() != ListBoxRole) { // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
-        ASSERT_NOT_REACHED(); 
-        return;
-    }
-    return ariaListboxSelectedChildren(result);
+    AccessibilityRole role = roleValue();
+    if (role == ListBoxRole) // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
+        ariaListboxSelectedChildren(result);
+    else if (role == TreeRole || role == TreeGridRole || role == TableRole)
+        ariaSelectedRows(result);
 }
 
 void AccessibilityRenderObject::ariaListboxVisibleChildren(AccessibilityChildrenVector& result)      
@@ -2673,6 +3132,17 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
+void AccessibilityRenderObject::tabChildren(AccessibilityChildrenVector& result)
+{
+    ASSERT(roleValue() == TabListRole);
+    
+    unsigned length = m_children.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_children[i]->isTabItem())
+            result.append(m_children[i]);
+    }
+}
+    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2685,20 +3155,20 @@ const String& AccessibilityRenderObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
     
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
      
@@ -2711,4 +3181,128 @@ void AccessibilityRenderObject::updateBackingStore()
     m_renderer->document()->updateLayoutIgnorePendingStylesheets();
 }
 
+static bool isLinkable(const AccessibilityRenderObject& object)
+{
+    if (!object.renderer())
+        return false;
+
+    // See https://wiki.mozilla.org/Accessibility/AT-Windows-API for the elements
+    // Mozilla considers linkable.
+    return object.isLink() || object.isImage() || object.renderer()->isText();
+}
+
+String AccessibilityRenderObject::stringValueForMSAA() const
+{
+    if (isLinkable(*this)) {
+        Element* anchor = anchorElement();
+        if (anchor && anchor->hasTagName(aTag))
+            return static_cast<HTMLAnchorElement*>(anchor)->href();
+    }
+
+    return stringValue();
+}
+
+bool AccessibilityRenderObject::isLinked() const
+{
+    if (!isLinkable(*this))
+        return false;
+
+    Element* anchor = anchorElement();
+    if (!anchor || !anchor->hasTagName(aTag))
+        return false;
+
+    return !static_cast<HTMLAnchorElement*>(anchor)->href().isEmpty();
+}
+
+String AccessibilityRenderObject::nameForMSAA() const
+{
+    if (m_renderer && m_renderer->isText())
+        return textUnderElement();
+
+    return title();
+}
+
+static bool shouldReturnTagNameAsRoleForMSAA(const Element& element)
+{
+    // See "document structure",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    // FIXME: Add the other tag names that should be returned as the role.
+    return element.hasTagName(h1Tag) || element.hasTagName(h2Tag) 
+        || element.hasTagName(h3Tag) || element.hasTagName(h4Tag)
+        || element.hasTagName(h5Tag) || element.hasTagName(h6Tag);
+}
+
+String AccessibilityRenderObject::stringRoleForMSAA() const
+{
+    if (!m_renderer)
+        return String();
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return String();
+
+    Element* element = static_cast<Element*>(node);
+    if (!shouldReturnTagNameAsRoleForMSAA(*element))
+        return String();
+
+    return element->tagName();
+}
+
+String AccessibilityRenderObject::positionalDescriptionForMSAA() const
+{
+    // See "positional descriptions",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    if (isHeading())
+        return "L" + String::number(headingLevel());
+
+    // FIXME: Add positional descriptions for other elements.
+    return String();
+}
+
+String AccessibilityRenderObject::descriptionForMSAA() const
+{
+    String description = positionalDescriptionForMSAA();
+    if (!description.isEmpty())
+        return description;
+
+    description = accessibilityDescription();
+    if (!description.isEmpty()) {
+        // From the Mozilla MSAA implementation:
+        // "Signal to screen readers that this description is speakable and is not
+        // a formatted positional information description. Don't localize the
+        // 'Description: ' part of this string, it will be parsed out by assistive
+        // technologies."
+        return "Description: " + description;
+    }
+
+    return String();
+}
+
+static AccessibilityRole msaaRoleForRenderer(const RenderObject* renderer)
+{
+    if (!renderer)
+        return UnknownRole;
+
+    if (renderer->isText())
+        return EditableTextRole;
+
+    if (renderer->isListItem())
+        return ListItemRole;
+
+    return UnknownRole;
+}
+
+AccessibilityRole AccessibilityRenderObject::roleValueForMSAA() const
+{
+    if (m_roleForMSAA != UnknownRole)
+        return m_roleForMSAA;
+
+    m_roleForMSAA = msaaRoleForRenderer(m_renderer);
+
+    if (m_roleForMSAA == UnknownRole)
+        m_roleForMSAA = roleValue();
+
+    return m_roleForMSAA;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index c6fd748..244eb60 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -62,7 +62,7 @@ public:
     static PassRefPtr<AccessibilityRenderObject> create(RenderObject*);
     virtual ~AccessibilityRenderObject();
     
-    bool isAccessibilityRenderObject() const { return true; };
+    bool isAccessibilityRenderObject() const { return true; }
     
     virtual bool isAnchor() const;
     virtual bool isAttachment() const;
@@ -96,20 +96,26 @@ public:
     virtual bool isHovered() const;
     virtual bool isIndeterminate() const;
     virtual bool isLoaded() const;
-    virtual bool isMultiSelect() const;
+    virtual bool isMultiSelectable() const;
     virtual bool isOffScreen() const;
     virtual bool isPressed() const;
     virtual bool isReadOnly() const;
     virtual bool isVisited() const;        
     virtual bool isRequired() const;
+    virtual bool isLinked() const;
+    virtual bool isExpanded() const;
+    virtual void setIsExpanded(bool);
 
     const AtomicString& getAttribute(const QualifiedName&) const;
     virtual bool canSetFocusAttribute() const;
     virtual bool canSetTextRangeAttributes() const;
     virtual bool canSetValueAttribute() const;
-    
+    virtual bool canSetExpandedAttribute() const;
+
     virtual bool hasIntValue() const;
     
+    // Provides common logic used by all elements when determining isIgnored.
+    AccessibilityObjectInclusion accessibilityIsIgnoredBase() const;
     virtual bool accessibilityIsIgnored() const;
     
     virtual int headingLevel() const;
@@ -119,7 +125,9 @@ public:
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
     virtual AccessibilityObject* selectedRadioButton();
+    virtual AccessibilityObject* selectedTabItem();
     virtual int layoutCount() const;
+    virtual double estimatedLoadingProgress() const;
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
     virtual AccessibilityObject* focusedUIElement() const;
@@ -136,6 +144,8 @@ public:
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
     virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const;
+    virtual bool supportsARIAOwns() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -167,7 +177,6 @@ public:
     virtual PlainTextRange selectedTextRange() const;
     virtual VisibleSelection selection() const;
     virtual String stringValue() const;
-    virtual String ariaAccessibilityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
     virtual String title() const;
     virtual String ariaDescribedByAttribute() const;
@@ -184,23 +193,30 @@ public:
     virtual Widget* widgetForAttachmentView() const;
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
-    virtual String language() const;
-    
+    virtual unsigned hierarchicalLevel() const;
+
     virtual const AccessibilityChildrenVector& children();
+    virtual void clearChildren();
+    void updateChildrenIfNecessary();
     
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void setSelected(bool);
+    virtual void setSelectedRows(AccessibilityChildrenVector&);
     virtual void changeValueByPercent(float percentChange);
+    virtual AccessibilityOrientation orientation() const;
     virtual void increment();
     virtual void decrement();
     
     virtual void detach();
     virtual void childrenChanged();
+    virtual void contentChanged();
     virtual void addChildren();
     virtual bool canHaveChildren() const;
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
+    virtual void tabChildren(AccessibilityChildrenVector&);
     virtual bool shouldFocusActiveDescendant() const;
     virtual AccessibilityObject* activeDescendant() const;
     virtual void handleActiveDescendantChanged();
@@ -209,6 +225,14 @@ public:
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const;
     virtual IntRect boundsForVisiblePositionRange(const VisiblePositionRange&) const;
     virtual void setSelectedVisiblePositionRange(const VisiblePositionRange&) const;
+    virtual bool supportsARIAFlowTo() const;
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const;
+
+    virtual bool supportsARIADropping() const;
+    virtual bool supportsARIADragging() const;
+    virtual bool isARIAGrabbed();
+    virtual void setARIAGrabbed(bool);
+    virtual void determineARIADropEffects(Vector<String>&);
     
     virtual VisiblePosition visiblePositionForPoint(const IntPoint&) const;
     virtual VisiblePosition visiblePositionForIndex(unsigned indexValue, bool lastIndexOK) const;    
@@ -224,13 +248,21 @@ public:
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
     virtual void updateBackingStore();
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String stringRoleForMSAA() const;
+    virtual String nameForMSAA() const;
+    virtual String descriptionForMSAA() const;
+    virtual AccessibilityRole roleValueForMSAA() const;
+
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
     mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
+    void ariaLabeledByElements(Vector<Element*>& elements) const;
+    bool needsToUpdateChildren() const { return m_childrenDirty; }
     
     virtual bool isDetached() const { return !m_renderer; }
 
@@ -238,19 +270,40 @@ private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
     bool ariaIsHidden() const;
+    bool isDescendantOfBarrenParent() const;
+    bool isAllowedChildOfTree() const;
+    bool hasTextAlternative() const;
+    String positionalDescriptionForMSAA() const;
+    virtual String language() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const;
     AccessibilityRole determineAccessibilityRole();
     AccessibilityRole determineAriaRoleAttribute() const;
 
+    bool isTabItemSelected() const;
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
     AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
-    void markChildrenDirty() const { m_childrenDirty = true; }
+    void ariaSelectedRows(AccessibilityChildrenVector&);
+    
+    bool elementAttributeValue(const QualifiedName&) const;
+    void setElementAttributeValue(const QualifiedName&, bool);
+    
+    String accessibilityDescriptionForElements(Vector<Element*> &elements) const;
+    void elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& name) const;
+    
+    virtual const AtomicString& ariaLiveRegionStatus() const;
+    virtual const AtomicString& ariaLiveRegionRelevant() const;
+    virtual bool ariaLiveRegionAtomic() const;
+    virtual bool ariaLiveRegionBusy() const;    
+    
+    void setNeedsToUpdateChildren() const { m_childrenDirty = true; }
+    
+    mutable AccessibilityRole m_roleForMSAA;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp
new file mode 100644
index 0000000..717d0da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityScrollbar.h"
+
+#include "Scrollbar.h"
+
+namespace WebCore {
+
+AccessibilityScrollbar::AccessibilityScrollbar()
+    : m_scrollbar(0)
+{
+}
+
+PassRefPtr<AccessibilityScrollbar> AccessibilityScrollbar::create()
+{
+    return adoptRef(new AccessibilityScrollbar);
+}
+
+float AccessibilityScrollbar::valueForRange() const
+{
+    if (!m_scrollbar)
+        return 0;
+    return m_scrollbar->currentPos();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h
new file mode 100644
index 0000000..d75e60c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef AccessibilityScrollbar_h
+#define AccessibilityScrollbar_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class Scrollbar;
+
+class AccessibilityScrollbar : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityScrollbar> create();
+
+    void setScrollbar(Scrollbar* scrollbar) { m_scrollbar = scrollbar; }
+
+    virtual AccessibilityRole roleValue() const { return ScrollBarRole; }
+
+    virtual float valueForRange() const;
+
+private:
+    AccessibilityScrollbar();
+
+    virtual bool accessibilityIsIgnored() const { return false; }
+
+    // These should never be reached since the AccessibilityScrollbar is not part of
+    // the accessibility tree.
+    virtual IntSize size() const { ASSERT_NOT_REACHED(); return IntSize(); }
+    virtual IntRect elementRect() const { ASSERT_NOT_REACHED(); return IntRect(); }
+    virtual AccessibilityObject* parentObject() const { ASSERT_NOT_REACHED(); return 0; }
+
+    Scrollbar* m_scrollbar;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityScrollbar_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
index 5aca672..e8d1f41 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
@@ -68,18 +68,18 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     
     ControlPart styleAppearance = style->appearance();
     switch (styleAppearance) {
-        case SliderThumbHorizontalPart:
-        case SliderHorizontalPart:
-        case MediaSliderPart:
-            return AccessibilityOrientationHorizontal;
+    case SliderThumbHorizontalPart:
+    case SliderHorizontalPart:
+    case MediaSliderPart:
+        return AccessibilityOrientationHorizontal;
+    
+    case SliderThumbVerticalPart: 
+    case SliderVerticalPart:
+    case MediaVolumeSliderPart:
+        return AccessibilityOrientationVertical;
         
-        case SliderThumbVerticalPart: 
-        case SliderVerticalPart:
-        case MediaVolumeSliderPart:
-            return AccessibilityOrientationVertical;
-            
-        default:
-            return AccessibilityOrientationHorizontal;
+    default:
+        return AccessibilityOrientationHorizontal;
     }
 }
     
@@ -99,6 +99,17 @@ const AtomicString& AccessibilitySlider::getAttribute(const QualifiedName& attri
     return element()->getAttribute(attribute);
 }
 
+bool AccessibilitySlider::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    return false;
+}
+    
 float AccessibilitySlider::valueForRange() const
 {
     return element()->value().toFloat();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
index 254ebdd..461f62b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
@@ -33,58 +33,58 @@
 
 namespace WebCore {
 
-    class HTMLInputElement;
+class HTMLInputElement;
 
-    class AccessibilitySlider : public AccessibilityRenderObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySlider> create(RenderObject*);
-        virtual ~AccessibilitySlider() { }
+class AccessibilitySlider : public AccessibilityRenderObject {
+    
+public:
+    static PassRefPtr<AccessibilitySlider> create(RenderObject*);
+    virtual ~AccessibilitySlider() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderRole; }
 
-        virtual bool isSlider() const { return true; }
+    virtual bool isSlider() const { return true; }
 
-        virtual const AccessibilityChildrenVector& children();
-        virtual void addChildren();
+    virtual const AccessibilityChildrenVector& children();
+    virtual void addChildren();
 
-        virtual bool canSetValueAttribute() const { return true; };
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual bool canSetValueAttribute() const { return true; }
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-        virtual void setValue(const String&);
-        virtual float valueForRange() const;
-        virtual float maxValueForRange() const;
-        virtual float minValueForRange() const;
-        virtual AccessibilityOrientation orientation() const;
+    virtual void setValue(const String&);
+    virtual float valueForRange() const;
+    virtual float maxValueForRange() const;
+    virtual float minValueForRange() const;
+    virtual AccessibilityOrientation orientation() const;
 
-    protected:
-        AccessibilitySlider(RenderObject*);
+protected:
+    AccessibilitySlider(RenderObject*);
 
-    private:
-        HTMLInputElement* element() const;
-    };
+private:
+    HTMLInputElement* element() const;
+    virtual bool accessibilityIsIgnored() const;
+};
 
-    class AccessibilitySliderThumb : public AccessibilityObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySliderThumb> create();
-        virtual ~AccessibilitySliderThumb() { }
+class AccessibilitySliderThumb : public AccessibilityObject {
+    
+public:
+    static PassRefPtr<AccessibilitySliderThumb> create();
+    virtual ~AccessibilitySliderThumb() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
 
-        void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
-        virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
+    void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
+    virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
 
-        virtual IntSize size() const;
-        virtual IntRect elementRect() const;
+    virtual IntSize size() const;
+    virtual IntRect elementRect() const;
 
-    private:
-        AccessibilitySliderThumb();
+private:
+    AccessibilitySliderThumb();
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        AccessibilitySlider* m_parentSlider;
-    };
+    AccessibilitySlider* m_parentSlider;
+};
 
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
index 928ef2c..aed8867 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
@@ -29,15 +29,15 @@
 #include "config.h"
 #include "AccessibilityTable.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "HTMLNames.h"
-#include "HTMLTableElement.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "RenderObject.h"
 #include "RenderTable.h"
 #include "RenderTableCell.h"
@@ -94,6 +94,11 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     Node* tableNode = table->node();
     if (!tableNode || !tableNode->hasTagName(tableTag))
         return false;
+
+    // Gtk+ ATs expect all tables to be exposed as tables.
+#if PLATFORM(GTK)
+    return true;
+#endif
     
     // if there is a caption element, summary, THEAD, or TFOOT section, it's most certainly a data table
     HTMLTableElement* tableElement = static_cast<HTMLTableElement*>(tableNode);
@@ -149,8 +154,8 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             HTMLTableCellElement* cellElement = static_cast<HTMLTableCellElement*>(cellNode);
             
             // in this case, the developer explicitly assigned a "data" table attribute
-            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty() || 
-                !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
+            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty()
+                || !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
                 return true;
             
             RenderStyle* renderStyle = cell->style();
@@ -158,15 +163,15 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
                 continue;
 
             // a cell needs to have matching bordered sides, before it can be considered a bordered cell.
-            if ((cell->borderTop() > 0 && cell->borderBottom() > 0) ||
-                (cell->borderLeft() > 0 && cell->borderRight() > 0))
+            if ((cell->borderTop() > 0 && cell->borderBottom() > 0)
+                || (cell->borderLeft() > 0 && cell->borderRight() > 0))
                 borderedCellCount++;
             
             // if the cell has a different color from the table and there is cell spacing,
             // then it is probably a data table cell (spacing and colors take the place of borders)
             Color cellColor = renderStyle->backgroundColor();
-            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0 && 
-                tableBGColor != cellColor && cellColor.alpha() != 1)
+            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0
+                && tableBGColor != cellColor && cellColor.alpha() != 1)
                 backgroundDifferenceCellCount++;
             
             // if we've found 10 "good" cells, we don't need to keep searching
@@ -193,10 +198,9 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     
 void AccessibilityTable::clearChildren()
 {
-    m_children.clear();
+    AccessibilityRenderObject::clearChildren();
     m_rows.clear();
     m_columns.clear();
-    m_haveChildren = false;
 }
 
 void AccessibilityTable::addChildren()
@@ -251,7 +255,12 @@ void AccessibilityTable::addChildren()
                 
                 row->setRowIndex((int)m_rows.size());        
                 m_rows.append(row);
-                m_children.append(row);
+                if (!row->accessibilityIsIgnored())
+                    m_children.append(row);
+#if PLATFORM(GTK)
+                else
+                    m_children.append(row->children());
+#endif
                 appendedRows.add(row);
             }
         }
@@ -266,11 +275,12 @@ void AccessibilityTable::addChildren()
         column->setColumnIndex((int)i);
         column->setParentTable(this);
         m_columns.append(column);
-        m_children.append(column);
+        if (!column->accessibilityIsIgnored())
+            m_children.append(column);
     }
     
     AccessibilityObject* headerContainerObject = headerContainer();
-    if (headerContainerObject)
+    if (headerContainerObject && !headerContainerObject->accessibilityIsIgnored())
         m_children.append(headerContainerObject);
 }
     
@@ -287,17 +297,15 @@ AccessibilityObject* AccessibilityTable::headerContainer()
 
 AccessibilityObject::AccessibilityChildrenVector& AccessibilityTable::columns()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
         
     return m_columns;
 }
 
 AccessibilityObject::AccessibilityChildrenVector& AccessibilityTable::rows()
 {
-    if (!hasChildren())
-        addChildren();
-
+    updateChildrenIfNecessary();
+    
     return m_rows;
 }
     
@@ -306,8 +314,7 @@ void AccessibilityTable::rowHeaders(AccessibilityChildrenVector& headers)
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     unsigned rowCount = m_rows.size();
     for (unsigned k = 0; k < rowCount; ++k) {
@@ -323,8 +330,7 @@ void AccessibilityTable::columnHeaders(AccessibilityChildrenVector& headers)
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     unsigned colCount = m_columns.size();
     for (unsigned k = 0; k < colCount; ++k) {
@@ -340,8 +346,7 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     int numRows = m_rows.size();
     for (int row = 0; row < numRows; ++row) {
@@ -352,16 +357,14 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     
 unsigned AccessibilityTable::columnCount()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     return m_columns.size();    
 }
     
 unsigned AccessibilityTable::rowCount()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     return m_rows.size();
 }
@@ -371,8 +374,7 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     if (!m_renderer || !m_renderer->isTable())
         return 0;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     RenderTable* table = toRenderTable(m_renderer);
     RenderTableSection* tableSection = table->header();
@@ -448,9 +450,15 @@ AccessibilityRole AccessibilityTable::roleValue() const
     
 bool AccessibilityTable::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isDataTable())
         return AccessibilityRenderObject::accessibilityIsIgnored();
-    
+        
     return false;
 }
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
index b6aa3ca..42edf2a 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
@@ -63,6 +63,7 @@ public:
     AccessibilityChildrenVector& columns();
     AccessibilityChildrenVector& rows();
     
+    virtual bool supportsSelectedRows() { return false; }
     unsigned columnCount();
     unsigned rowCount();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
index 7674cb8..318c619 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -56,6 +56,12 @@ PassRefPtr<AccessibilityTableCell> AccessibilityTableCell::create(RenderObject*
 
 bool AccessibilityTableCell::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isTableCell())
         return AccessibilityRenderObject::accessibilityIsIgnored();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
index e09d65e..5872706 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "AccessibilityTableColumn.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "RenderTable.h"
-#include "RenderTableSection.h"
 #include "RenderTableCell.h"
+#include "RenderTableSection.h"
 
 using namespace std;
 
@@ -158,6 +158,18 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
     return m_parentTable->axObjectCache()->getOrCreate(cell);
 }
     
+bool AccessibilityTableColumn::accessibilityIsIgnored() const
+{
+    if (!m_parentTable)
+        return true;
+    
+#if PLATFORM(GTK)
+    return true;
+#endif
+    
+    return m_parentTable->accessibilityIsIgnored();
+}
+    
 void AccessibilityTableColumn::addChildren()
 {
     ASSERT(!m_haveChildren); 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
index 6270398..15d300c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
@@ -49,8 +49,8 @@ public:
     virtual AccessibilityObject* parentObject() const { return m_parentTable; }
     AccessibilityObject* headerObject();
         
+    virtual bool accessibilityIsIgnored() const;
     virtual AccessibilityRole roleValue() const { return ColumnRole; }
-    virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isTableColumn() const { return true; }
     
     void setColumnIndex(int columnIndex) { m_columnIndex = columnIndex; }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39..e2da83c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableHeaderContainer.h"
 
-#include "AccessibilityTable.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTable.h"
 
 using namespace std;
 
@@ -68,6 +68,18 @@ IntSize AccessibilityTableHeaderContainer::size() const
     return elementRect().size();
 }
     
+bool AccessibilityTableHeaderContainer::accessibilityIsIgnored() const
+{
+    if (!m_parentTable)
+        return true;
+    
+#if PLATFORM(GTK)
+    return true;
+#endif
+
+    return m_parentTable->accessibilityIsIgnored();
+}
+
 void AccessibilityTableHeaderContainer::addChildren()
 {
     ASSERT(!m_haveChildren); 
@@ -79,9 +91,8 @@ void AccessibilityTableHeaderContainer::addChildren()
     static_cast<AccessibilityTable*>(m_parentTable)->columnHeaders(m_children);
     
     unsigned length = m_children.size();
-    for (unsigned k = 0; k < length; ++k) {
+    for (unsigned k = 0; k < length; ++k)
         m_headerRect.unite(m_children[k]->elementRect());
-    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
index 8a9448a..79521c0 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
@@ -48,8 +48,6 @@ public:
     void setParentTable(AccessibilityTable* table) { m_parentTable = table; }
     virtual AccessibilityObject* parentObject() const { return m_parentTable; }
     
-    virtual bool accessibilityIsIgnored() const { return false; }
-    
     virtual const AccessibilityChildrenVector& children();
     virtual void addChildren();
     
@@ -60,6 +58,7 @@ private:
     AccessibilityTable* m_parentTable;
     IntRect m_headerRect;
     
+    virtual bool accessibilityIsIgnored() const;
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
index 53b479e..e2a1157 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableRow.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "HTMLTableRowElement.h"
 #include "RenderObject.h"
@@ -76,6 +76,12 @@ bool AccessibilityTableRow::isTableRow() const
     
 bool AccessibilityTableRow::accessibilityIsIgnored() const
 {    
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isTableRow())
         return AccessibilityRenderObject::accessibilityIsIgnored();
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 07f13d4..7232642 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
@@ -29,8 +29,11 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
-AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
 {
+    if (isMenuListPopup() || isMenuListOption())
+        return IgnoreObject;
+
     return DefaultBehavior;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
index 7dc68ef..0467f2d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
@@ -22,6 +22,7 @@
 #include "ScriptController.h"
 
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "Page.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
@@ -30,6 +31,19 @@
 
 namespace WebCore {
 
+bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reason)
+{
+    // FIXME: We should get this information from the document instead of the frame.
+    if (m_frame->loader()->isSandboxed(SandboxScripts))
+        return false;
+
+    Settings* settings = m_frame->settings();
+    const bool allowed = m_frame->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled());
+    if (!allowed && reason == AboutToExecuteScript)
+        m_frame->loader()->client()->didNotAllowScript();
+    return allowed;
+}
+
 ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
 {
     return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()));
@@ -37,7 +51,7 @@ ScriptValue ScriptController::executeScript(const String& script, bool forceUser
 
 ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
 {
-    if (!isEnabled() || isPaused())
+    if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
@@ -73,8 +87,15 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
         result = executeScript(script, userGesture);
 
     String scriptResult;
+#if USE(JSC)
+    JSDOMWindowShell* shell = windowShell(mainThreadNormalWorld());
+    JSC::ExecState* exec = shell->window()->globalExec();
+    if (!result.getString(exec, scriptResult))
+        return true;
+#else
     if (!result.getString(scriptResult))
         return true;
+#endif
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h
new file mode 100644
index 0000000..d6d3087
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingDOMWindow_h
+#define BindingDOMWindow_h
+
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "GenericBinding.h"
+#include "Page.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+template <class Binding>
+class BindingDOMWindow {
+public:
+    typedef typename Binding::Value BindingValue;
+
+    static Frame* createWindow(State<Binding>*,
+                               Frame* callingFrame,
+                               Frame* enteredFrame,
+                               Frame* openerFrame,
+                               const String& url,
+                               const String& frameName,
+                               const WindowFeatures& windowFeatures,
+                               BindingValue dialogArgs);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+Frame* BindingDOMWindow<Binding>::createWindow(State<Binding>* state,
+                                               Frame* callingFrame,
+                                               Frame* enteredFrame,
+                                               Frame* openerFrame,
+                                               const String& url,
+                                               const String& frameName,
+                                               const WindowFeatures& windowFeatures,
+                                               BindingValue dialogArgs)
+{
+    ASSERT(callingFrame);
+    ASSERT(enteredFrame);
+
+    if (Document* callingDocument = callingFrame->document()) {
+        // Sandboxed iframes cannot open new auxiliary browsing contexts.
+        if (callingDocument->securityOrigin()->isSandboxed(SandboxNavigation))
+            return 0;
+    }
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the entered frame to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = enteredFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, enteredFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL,
+    // here where we know what URL we are going to open. Unfortunately, this
+    // code passes the empty string for the URL, but there's a reason for that.
+    // Before loading we have to set up the opener, openedByDOM,
+    // and dialogArguments values. Also, to decide whether to use the URL
+    // we currently do an allowsAccessFrom call using the window we create,
+    // which can't be done before creating it. We'd have to resolve all those
+    // issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the
+    // frame name, in case the active frame is different from the opener frame,
+    // and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = callingFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->page()->setOpenedByDOM();
+
+    Binding::DOMWindow::storeDialogArgs(state, newFrame, dialogArgs);
+
+    if (!protocolIsJavaScript(url) || BindingSecurity<Binding>::canAccessFrame(state, newFrame, true)) {
+        KURL completedUrl =
+            url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(url);
+        bool userGesture = processingUserGesture();
+
+        if (created)
+            newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->redirectScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
+    }
+
+    return newFrame;
+}
+
+} // namespace WebCore
+
+#endif // BindingDOMWindow_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h
new file mode 100644
index 0000000..ba7856a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingElement_h
+#define BindingElement_h
+
+#include "Attr.h"
+#include "BindingSecurity.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+template <class Binding>
+class BindingElement {
+public:
+    static void setAttribute(State<Binding>*, Element*, const AtomicString&, const AtomicString&, ExceptionCode&);
+    static RefPtr<Attr> setAttributeNode(State<Binding>*, Element*, Attr*, ExceptionCode&);
+    static void setAttributeNS(State<Binding>*, Element*, const AtomicString&, const AtomicString&, const AtomicString&, ExceptionCode&);
+    static RefPtr<Attr> setAttributeNodeNS(State<Binding>*, Element*, Attr*, ExceptionCode&);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+void BindingElement<Binding>::setAttribute(State<Binding>* state, Element* element, const AtomicString& name, const AtomicString& value, ExceptionCode& ec)
+{
+    ASSERT(element);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, name, value))
+        return;
+
+    element->setAttribute(name, value, ec);
+}
+
+template <class Binding>
+RefPtr<Attr> BindingElement<Binding>::setAttributeNode(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
+{
+    ASSERT(element);
+    ASSERT(newAttr);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
+        return 0;
+
+    return element->setAttributeNode(newAttr, ec);
+}
+
+template <class Binding>
+void BindingElement<Binding>::setAttributeNS(State<Binding>* state, Element* element, const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec)
+{
+    ASSERT(element);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, qualifiedName, value))
+        return;
+
+    element->setAttributeNS(namespaceURI, qualifiedName, value, ec);
+}
+
+template <class Binding>
+RefPtr<Attr> BindingElement<Binding>::setAttributeNodeNS(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
+{
+    ASSERT(element);
+    ASSERT(newAttr);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
+        return 0;
+
+    return element->setAttributeNodeNS(newAttr, ec);
+}
+
+} // namespace WebCore
+
+#endif // BindingElement_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h
new file mode 100644
index 0000000..929b8f4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingSecurity_h
+#define BindingSecurity_h
+
+#include "BindingSecurityBase.h"
+#include "CSSHelper.h"
+#include "Element.h"
+#include "GenericBinding.h"
+#include "HTMLFrameElementBase.h"
+
+namespace WebCore {
+
+class DOMWindow;
+class Frame;
+class Node;
+
+// Security functions shared by various language bindings.
+template <class Binding>
+class BindingSecurity : public BindingSecurityBase {
+public:
+    // Check if the active execution context can access the target frame.
+    static bool canAccessFrame(State<Binding>*, Frame*, bool reportError);
+
+    // Check if it is safe to access the given node from the
+    // current security context.
+    static bool checkNodeSecurity(State<Binding>*, Node* target);
+
+    static bool allowSettingFrameSrcToJavascriptUrl(State<Binding>*, HTMLFrameElementBase*, String value);
+    static bool allowSettingSrcToJavascriptURL(State<Binding>*, Element*, String name, String value);
+
+private:
+    explicit BindingSecurity() {}
+    ~BindingSecurity();
+
+    // Check if the current DOMWindow's security context can access the target
+    // DOMWindow.  This function does not report errors, so most callers should
+    // use canAccessFrame instead.
+    static bool canAccessWindow(State<Binding>*, DOMWindow* target);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+bool BindingSecurity<Binding>::canAccessWindow(State<Binding>* state,
+                                               DOMWindow* targetWindow)
+{
+    DOMWindow* activeWindow = state->getActiveWindow();
+    return canAccess(activeWindow, targetWindow);
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::canAccessFrame(State<Binding>* state,
+                                              Frame* target,
+                                              bool reportError)
+{
+    // The subject is detached from a frame, deny accesses.
+    if (!target)
+        return false;
+
+    if (!canAccessWindow(state, getDOMWindow(target))) {
+        if (reportError)
+            state->immediatelyReportUnsafeAccessTo(target);
+        return false;
+    }
+    return true;
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::checkNodeSecurity(State<Binding>* state, Node* node)
+{
+    if (!node)
+        return false;
+
+    Frame* target = getFrame(node);
+
+    if (!target)
+        return false;
+
+    return canAccessFrame(state, target, true);
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::allowSettingFrameSrcToJavascriptUrl(State<Binding>* state, HTMLFrameElementBase* frame, String value)
+{
+    if (protocolIsJavaScript(deprecatedParseURL(value))) {
+        Node* contentDoc = frame->contentDocument();
+        if (contentDoc && !checkNodeSecurity(state, contentDoc))
+            return false;
+    }
+    return true;
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(State<Binding>* state, Element* element, String name, String value)
+{
+    if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)) && equalIgnoringCase(name, "src"))
+        return allowSettingFrameSrcToJavascriptUrl(state, static_cast<HTMLFrameElementBase*>(element), value);
+    return true;
+}
+
+}
+
+#endif // BindingSecurity_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp
new file mode 100644
index 0000000..1598781
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BindingSecurityBase.h"
+
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+DOMWindow* BindingSecurityBase::getDOMWindow(Frame* frame)
+{
+    return frame->domWindow();
+}
+
+Frame* BindingSecurityBase::getFrame(Node* node)
+{
+    return node->document()->frame();
+}
+
+// Same origin policy implementation:
+//
+// Same origin policy prevents JS code from domain A from accessing JS & DOM
+// objects in a different domain B. There are exceptions and several objects
+// are accessible by cross-domain code. For example, the window.frames object
+// is accessible by code from a different domain, but window.document is not.
+//
+// The JS binding code sets security check callbacks on a function template,
+// and accessing instances of the template calls the callback function.
+// The callback function enforces the same origin policy.
+//
+// Callback functions are expensive. Binding code should use a security token
+// string to do fast access checks for the common case where source and target
+// are in the same domain. A security token is a string object that represents
+// the protocol/url/port of a domain.
+//
+// There are special cases where security token matching is not enough.
+// For example, JS can set its domain to a super domain by calling
+// document.setDomain(...). In these cases, the binding code can reset
+// a context's security token to its global object so that the fast access
+// check will always fail.
+
+// Helper to check if the current execution context can access a target frame.
+// First it checks same domain policy using the lexical context.
+//
+// This is equivalent to KJS::Window::allowsAccessFrom(ExecState*).
+bool BindingSecurityBase::canAccess(DOMWindow* activeWindow,
+                                    DOMWindow* targetWindow)
+{
+    ASSERT(targetWindow);
+
+    String message;
+
+    if (activeWindow == targetWindow)
+        return true;
+
+    if (!activeWindow)
+        return false;
+
+    const SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
+    const SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
+
+    // We have seen crashes were the security origin of the target has not been
+    // initialized. Defend against that.
+    if (!targetSecurityOrigin)
+        return false;
+
+    if (activeSecurityOrigin->canAccess(targetSecurityOrigin))
+        return true;
+
+    // Allow access to a "about:blank" page if the dynamic context is a
+    // detached context of the same frame as the blank page.
+    if (targetSecurityOrigin->isEmpty() && activeWindow->frame() == targetWindow->frame())
+        return true;
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h
new file mode 100644
index 0000000..cfa2e99
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingSecurityBase_h
+#define BindingSecurityBase_h
+
+namespace WebCore {
+
+class DOMWindow;
+class Frame;
+class Node;
+
+// Helper functions for BindingSecurity that depend on WebCore classes, and
+// thus should not be implemented in BindingSecurity.h, which contains template
+// method definitions.
+class BindingSecurityBase {
+protected:
+    static DOMWindow* getDOMWindow(Frame*);
+    static Frame* getFrame(Node*);
+    static bool canAccess(DOMWindow* active, DOMWindow* target);
+};
+
+}
+
+#endif // BindingSecurityBase_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h b/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h
new file mode 100644
index 0000000..d030b45
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GenericBinding_h
+#define GenericBinding_h
+
+namespace WebCore {
+
+// Used to instantiate binding templates for any methods shared among all
+// language bindings.
+class GenericBinding {};
+
+// Class to represent execution state for each language binding.
+template <class T>
+class State {};
+
+// Common notion of execution state for language bindings.
+template <>
+class State<GenericBinding> {
+    // Any methods shared across bindings can go here.
+};
+
+}
+
+#endif // GenericBinding_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
new file mode 100644
index 0000000..6ba85da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RuntimeEnabledFeatures.h"
+
+#include "Database.h"
+#include "MediaPlayer.h"
+#include "SharedWorkerRepository.h"
+#include "WebSocket.h"
+
+namespace WebCore {
+
+bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
+bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
+bool RuntimeEnabledFeatures::isWebkitNotificationsEnabled = false;
+bool RuntimeEnabledFeatures::isApplicationCacheEnabled = true;
+bool RuntimeEnabledFeatures::isGeolocationEnabled = true;
+bool RuntimeEnabledFeatures::isIndexedDBEnabled = false;
+bool RuntimeEnabledFeatures::isWebGLEnabled = false;
+bool RuntimeEnabledFeatures::isPushStateEnabled = false;
+
+#if ENABLE(VIDEO)
+
+bool RuntimeEnabledFeatures::audioEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlMediaElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlAudioElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlVideoElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::mediaErrorEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+#endif
+
+#if ENABLE(SHARED_WORKERS)
+bool RuntimeEnabledFeatures::sharedWorkerEnabled()
+{
+    return SharedWorkerRepository::isAvailable();
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+bool RuntimeEnabledFeatures::webSocketEnabled()
+{
+    return WebSocket::isAvailable();
+}
+#endif
+
+#if ENABLE(DATABASE)
+bool RuntimeEnabledFeatures::openDatabaseEnabled()
+{
+    return Database::isAvailable();
+}
+#endif
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h
new file mode 100644
index 0000000..37dceff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RuntimeEnabledFeatures_h
+#define RuntimeEnabledFeatures_h
+
+namespace WebCore {
+
+// A class that stores static enablers for all experimental features. Note that
+// the method names must line up with the JavaScript method they enable for code
+// generation to work properly.
+
+class RuntimeEnabledFeatures {
+public:
+    static void setLocalStorageEnabled(bool isEnabled) { isLocalStorageEnabled = isEnabled; }
+    static bool localStorageEnabled() { return isLocalStorageEnabled; }
+
+    static void setSessionStorageEnabled(bool isEnabled) { isSessionStorageEnabled = isEnabled; }
+    static bool sessionStorageEnabled() { return isSessionStorageEnabled; }
+
+    static void setWebkitNotificationsEnabled(bool isEnabled) { isWebkitNotificationsEnabled = isEnabled; }
+    static bool webkitNotificationsEnabled() { return isWebkitNotificationsEnabled; }
+
+    static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
+    static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
+
+    static void setGeolocationEnabled(bool isEnabled) { isGeolocationEnabled = isEnabled; }
+    static bool geolocationEnabled() { return isGeolocationEnabled; }
+
+    static void setIndexedDBEnabled(bool isEnabled) { isIndexedDBEnabled = isEnabled; }
+    static bool indexedDBEnabled() { return isIndexedDBEnabled; }
+
+#if ENABLE(VIDEO)
+    static bool audioEnabled();
+    static bool htmlMediaElementEnabled();
+    static bool htmlAudioElementEnabled();
+    static bool htmlVideoElementEnabled();
+    static bool mediaErrorEnabled();
+#endif
+
+#if ENABLE(SHARED_WORKERS)
+    static bool sharedWorkerEnabled();
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    static bool webSocketEnabled();
+#endif
+
+#if ENABLE(DATABASE)
+    static bool openDatabaseEnabled();
+#endif
+
+#if ENABLE(3D_CANVAS)
+    static void setWebGLEnabled(bool isEnabled) { isWebGLEnabled = isEnabled; }
+    static bool webGLRenderingContextEnabled() { return isWebGLEnabled; }
+    static bool webGLArrayBufferEnabled() { return isWebGLEnabled; }
+    static bool webGLByteArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedByteArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLShortArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedShortArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLIntArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedIntArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLFloatArrayEnabled() { return isWebGLEnabled; }
+#endif
+
+    static void setPushStateEnabled(bool isEnabled) { isPushStateEnabled = isEnabled; }
+    static bool pushStateEnabled() { return isPushStateEnabled; }
+    static bool replaceStateEnabled() { return isPushStateEnabled; }
+
+private:
+    // Never instantiate.
+    RuntimeEnabledFeatures() { }
+
+    static bool isLocalStorageEnabled;
+    static bool isSessionStorageEnabled;
+    static bool isWebkitNotificationsEnabled;
+    static bool isApplicationCacheEnabled;
+    static bool isGeolocationEnabled;
+    static bool isIndexedDBEnabled;
+    static bool isWebGLEnabled;
+    static bool isPushStateEnabled;
+};
+
+} // namespace WebCore
+
+#endif // RuntimeEnabledFeatures_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
new file mode 100644
index 0000000..bfcab0b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
@@ -0,0 +1,37 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMObjectHashTableMap.h"
+
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore{
+
+DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
new file mode 100644
index 0000000..4ddacb8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMObjectHashTableMap_h
+#define DOMObjectHashTableMap_h
+
+#include <runtime/Lookup.h>
+#include <wtf/HashMap.h>
+
+namespace JSC {
+    class JSGlobalData;
+}
+
+namespace WebCore {
+
+// Map from static HashTable instances to per-GlobalData ones.
+class DOMObjectHashTableMap {
+public:
+    static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
+
+    ~DOMObjectHashTableMap()
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+            iter->second.deleteTable();
+    }
+
+    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+        if (iter != m_map.end())
+            return &iter->second;
+        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+    }
+
+private:
+    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+};
+
+} // namespace WebCore
+
+#endif // DOMObjectHashTableMap_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
deleted file mode 100644
index 3d435cb..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Google, Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMObjectWithSVGContext_h
-#define DOMObjectWithSVGContext_h
-
-#if ENABLE(SVG)
-
-#include "JSDOMBinding.h"
-#include "SVGElement.h"
-
-namespace WebCore {
-
-    // FIXME: This class (and file) should be removed once all SVG bindings
-    // have moved context() onto the various impl() pointers.
-    class DOMObjectWithSVGContext : public DOMObject {
-    public:
-        SVGElement* context() const { return m_context.get(); }
-
-    protected:
-        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
-            : DOMObject(structure)
-            , m_context(context)
-        {
-            // No space to store the JSDOMGlobalObject w/o hitting the CELL_SIZE limit.
-        }
-
-    protected: // FIXME: Many custom bindings use m_context directly.  Making this protected to temporariliy reduce code churn.
-        RefPtr<SVGElement> m_context;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // DOMObjectWithSVGContext_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
new file mode 100644
index 0000000..c696315
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
@@ -0,0 +1,68 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMWrapperWorld.h"
+
+#include "JSDOMWindow.h"
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData, bool isNormal)
+    : m_globalData(globalData)
+    , m_isNormal(isNormal)
+{
+}
+
+static void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
+{
+    Document::JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
+    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
+    delete wrappers;
+}
+
+DOMWrapperWorld::~DOMWrapperWorld()
+{
+    JSGlobalData::ClientData* clientData = m_globalData->clientData;
+    ASSERT(clientData);
+    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
+
+    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
+        forgetWorldOfDOMNodesForDocument(*iter, this);
+}
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
+}
+
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    ASSERT(isMainThread());
+    static DOMWrapperWorld* cachedNormalWorld = normalWorld(*JSDOMWindow::commonJSGlobalData());
+    return cachedNormalWorld;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
new file mode 100644
index 0000000..65cf6a6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
@@ -0,0 +1,88 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMWrapperWorld_h
+#define DOMWrapperWorld_h
+
+#include "Document.h"
+#include "JSDOMGlobalObject.h"
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCMap.h>
+
+namespace WebCore {
+
+class StringImpl;
+
+typedef JSC::WeakGCMap<void*, DOMObject*> DOMObjectWrapperMap;
+typedef JSC::WeakGCMap<StringImpl*, JSC::JSString*> JSStringCache; 
+
+class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+public:
+    static PassRefPtr<DOMWrapperWorld> create(JSC::JSGlobalData* globalData, bool isNormal)
+    {
+        return adoptRef(new DOMWrapperWorld(globalData, isNormal));
+    }
+    ~DOMWrapperWorld();
+
+    void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
+    void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
+
+    // FIXME: can we make this private?
+    DOMObjectWrapperMap m_wrappers;
+    JSStringCache m_stringCache;
+
+    bool isNormal() const { return m_isNormal; }
+
+protected:
+    DOMWrapperWorld(JSC::JSGlobalData*, bool isNormal);
+
+private:
+    JSC::JSGlobalData* m_globalData;
+    HashSet<Document*> documentsWithWrappers;
+    bool m_isNormal;
+};
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
+DOMWrapperWorld* mainThreadNormalWorld();
+inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
+inline DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
+{
+    return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
+}
+
+// From Document.h
+
+inline Document::JSWrapperCache* Document::getWrapperCache(DOMWrapperWorld* world)
+{
+    if (world->isNormal()) {
+        if (Document::JSWrapperCache* wrapperCache = m_normalWorldWrapperCache)
+            return wrapperCache;
+        ASSERT(!m_wrapperCacheMap.contains(world));
+    } else if (Document::JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
+        return wrapperCache;
+    return createWrapperCache(world);
+}
+
+} // namespace WebCore
+
+#endif // DOMWrapperWorld_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index 59bcfa3..d5a1789 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -40,17 +40,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-#if USE(PTHREADS)
-
 static void* collect(void*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
     return 0;
 }
 
-#endif
-
 GCController& gcController()
 {
     DEFINE_STATIC_LOCAL(GCController, staticGCController, ());
@@ -70,14 +66,14 @@ void GCController::garbageCollectSoon()
 
 void GCController::gcTimerFired(Timer<GCController>*)
 {
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    collect(0);
 }
 
 void GCController::garbageCollectNow()
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    if (!JSDOMWindow::commonJSGlobalData()->heap.isBusy())
+        collect(0);
 }
 
 void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 6eca7bd..61fcf98 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -50,7 +50,7 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -60,7 +60,7 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index 14457c4..4cd40ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -33,6 +33,7 @@
 #include "Document.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -46,13 +47,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     String attrValue = valueToStringWithNullCheck(exec, value);
 
     Element* ownerElement = imp->ownerElement();
-    if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
-        if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
-            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
-                return;
-        }
-    }
+    if (ownerElement && !allowSettingSrcToJavascriptURL(exec, ownerElement, imp->name(), attrValue))
+        return;
 
     ExceptionCode ec = 0;
     imp->setValue(attrValue, ec);
@@ -65,10 +61,8 @@ void JSAttr::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->ownerElement()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->ownerElement())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index 174cc11..77bb120 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -30,10 +30,7 @@
 #include "JSAudioConstructor.h"
 
 #include "HTMLAudioElement.h"
-#include "HTMLNames.h"
 #include "JSHTMLAudioElement.h"
-#include "ScriptExecutionContext.h"
-#include "Text.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -46,24 +43,30 @@ JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globa
     : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
     putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
 }
 
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSAudioConstructor* jsAudio = static_cast<JSAudioConstructor*>(constructor);
-    // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
-    Document* document = jsAudio->document();
+    JSAudioConstructor* jsConstructor = static_cast<JSAudioConstructor*>(constructor);
+
+    Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
-    audio->setAutobuffer(true);
-    if (args.size() > 0) {
-        audio->setSrc(args.at(0).toString(exec));
-        audio->scheduleLoad();
-    }
-    return asObject(toJS(exec, jsAudio->globalObject(), audio.release()));
+    // Calling toJS on the document causes the JS document wrapper to be
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the audio element to be marked if necessary.
+    toJS(exec, jsConstructor->globalObject(), document);
+
+    // FIXME: This converts an undefined argument to the string "undefined", but possibly we
+    // should treat it as if no argument was passed instead, by checking the value of args.at
+    // rather than looking at args.size.
+    String src;
+    if (args.size() > 0)
+        src = args.at(0).toString(exec);
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLAudioElement::createForJSConstructor(document, src)));
 }
 
 ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
index f08303a..5a0820b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -85,8 +85,8 @@
 #include "JSHistoryCustom.cpp"
 #include "JSImageConstructor.cpp"
 #include "JSImageDataCustom.cpp"
-#include "JSInspectedObjectWrapper.cpp"
-#include "JSInspectorBackendCustom.cpp"
+#include "JSInjectedScriptHostCustom.cpp"
+#include "JSInspectorFrontendHostCustom.cpp"
 #include "JSJavaScriptCallFrameCustom.cpp"
 #include "JSLazyEventListener.cpp"
 #include "JSLocationCustom.cpp"
@@ -106,7 +106,6 @@
 #include "JSPluginArrayCustom.cpp"
 #include "JSPluginCustom.cpp"
 #include "JSPluginElementFunctions.cpp"
-#include "JSQuarantinedObjectWrapper.cpp"
 #include "JSSQLResultSetRowListCustom.cpp"
 #include "JSSQLTransactionCustom.cpp"
 #include "JSSVGElementInstanceCustom.cpp"
@@ -114,7 +113,6 @@
 #include "JSSVGMatrixCustom.cpp"
 #include "JSSVGPathSegCustom.cpp"
 #include "JSSVGPathSegListCustom.cpp"
-#include "JSSVGPointListCustom.cpp"
 #include "JSSharedWorkerConstructor.cpp"
 #include "JSSharedWorkerCustom.cpp"
 #include "JSStorageCustom.cpp"
@@ -142,9 +140,10 @@
 #include "ScriptCallStack.cpp"
 #include "ScriptController.cpp"
 #include "ScriptControllerWin.cpp"
+#include "ScriptDebugServer.cpp"
 #include "ScriptEventListener.cpp"
 #include "ScriptFunctionCall.cpp"
-#include "ScriptObjectQuarantine.cpp"
+#include "ScriptProfiler.cpp"
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
 #include "WorkerScriptController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 1b96c06..b0adf15 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -54,7 +54,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
     if (wrapper)
         return wrapper;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 4a137d3..fad7aba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -142,9 +142,9 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
 
 // FIXME: You can get these properties, and set them (see putDelegate below),
 // but you should also be able to enumerate them.
-JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
 
     // Set up pixelOrPos boolean to handle the fact that
     // pixelTop returns "CSS Top" as number value in unit pixels
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 87a5760..83c1d3a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
index 38292c7..e128f27 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -47,13 +47,8 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     ASSERT(globalObject());
 
     ExecState* exec = globalObject()->globalExec();
-    
-    JSValue function;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        function = callback()->get(exec, Identifier(exec, "handleEvent"));
-    }
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -64,7 +59,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
+    JSValue result = JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
index 5c86701..b939c01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -48,7 +48,6 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
-        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -65,7 +64,6 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
deleted file mode 100644
index 93d53ca..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasArrayBufferConstructor.h"
-
-#include "Document.h"
-#include "CanvasArrayBuffer.h"
-#include "JSCanvasArrayBuffer.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
-
-JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
-
-    unsigned int size = 0;
-    if (args.size() == 1) {
-        size = (unsigned int)args.at(0).toInt32(exec);
-        if (isnan(size))
-            size = 0;
-    }
-    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
-}
-
-JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasArrayBuffer;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
deleted file mode 100644
index 5f1254e..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasArrayBufferConstructor_h
-#define JSCanvasArrayBufferConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-#include "JSCanvasArrayBuffer.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-    class CanvasArray;
-
-    // Template function used by CanvasXXXArrayConstructors
-    template<class C, typename T>
-    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
-    {
-        // There are 3 constructors:
-        //
-        //  1) (in int size)
-        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
-        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
-        //
-        RefPtr<C> arrayObject;
-        
-        // For the 0 args case, just create an object without a buffer 
-        if (args.size() < 1)
-            return C::create(0, 0, 0);
-        
-        if (args.at(0).isObject()) {
-            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
-            if (buffer) {
-                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
-                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
-                return C::create(buffer, offset, length);
-            }
-            
-            JSC::JSObject* array = asObject(args.at(0));
-            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-            void* tempValues;
-            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
-                throwError(exec, JSC::GeneralError);
-                return 0;
-            }
-            
-            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
-            for (int i = 0; i < length; ++i) {
-                JSC::JSValue v = array->get(exec, i);
-                if (exec->hadException())
-                    return 0;
-                values.get()[i] = static_cast<T>(v.toNumber(exec));
-            }
-            
-            return C::create(values.get(), length);
-        }
-        
-        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
-        return C::create(size);
-    }
-
-    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
deleted file mode 100644
index 14548d7..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "config.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasByteArray.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "JSCanvasShortArray.h"
-#include "JSCanvasUnsignedShortArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
-{
-    if (object->isFloatArray())
-        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
-    if (object->isUnsignedByteArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
-    if (object->isByteArray())
-        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
-    if (object->isIntArray())
-        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
-    if (object->isUnsignedIntArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
-    if (object->isShortArray())
-        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
-    if (object->isUnsignedShortArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
-    return jsUndefined();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
deleted file mode 100644
index ec1d66d..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
-    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasByteArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
deleted file mode 100644
index 4d5dc11..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasByteArrayConstructor_h
-#define JSCanvasByteArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
deleted file mode 100644
index 04697ce..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
deleted file mode 100644
index 15e39c2..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasFloatArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasFloatArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
-    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasFloatArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
deleted file mode 100644
index efea250..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasFloatArrayConstructor_h
-#define JSCanvasFloatArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
deleted file mode 100644
index 20cd805c0..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasFloatArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<float>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
deleted file mode 100644
index 6d57912..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasIntArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasIntArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
-    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasIntArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
deleted file mode 100644

path: root/Tests/RunCMake/CompilerChange/CMakeLists.txt

cmake_minimum_required(VERSION 3.3)
if(NOT RunCMake_TEST)
  set(RunCMake_TEST "$ENV{RunCMake_TEST}") # needed when cache is deleted
endif()
project(${RunCMake_TEST} NONE)
include(${RunCMake_TEST}.cmake)